Posts

Three Days in December 2016: Sanctions, Nukes, Syria, and Russia

In this post, I described how badly much of the press had misrepresented the unmasking report released by Ric Grenell yesterday. The transcripts of the calls Mike Flynn had with Sergey Kislyak were identified by the FBI, FBI never put them into a finalized intelligence product, and Jim Comey told James Clapper about them.

The unmaskings described on the list released yesterday, by contrast, were finalized NSA products, not unfinished FBI ones, and none of the dates correlate with the discovery of Flynn’s calls.

In other words, the masking report released yesterday does not include the calls in question. These aren’t the droids you’re looking for.

Indeed, there is no evidence in the public record that any of these calls reflected any suspicion of wrong-doing.

That said, there were a flurry of requests to unmask Flynn’s name around mid-December 2016 that experts have highlighted both publicly and privately. While we can’t speak to the content of the intercepts in question, it is certain that Flynn was involved or mentioned in some communications in the days before December 14, 2016 that attracted an interesting set of people around the US government.

I’d like to look at what that flurry looks like. Before I start, let me lay out some assumptions. First, there may be a delay between the time NSA obtained communications themselves and the time it finalized a report on them, so the December 14 start date for this flurry may have happened days or more later after the communications were collected (though given how some of the most senior people in government reviewed these, that’s not necessarily true). Second, while there’s reason to believe this flurry is all related, we can’t be certain. Finally, remember that Flynn may not be the only American on this list; there could be any number of others, and their names might have gotten unmasked as well. To reiterate: Flynn wouldn’t necessarily have been a party to these communications; rather, he could have been discussed in them.

On the first day of this flurry, a significant group of people at Treasury — up to and including Treasury Secretary Jacob Lew — asked to unmask Flynn’s identity. This would suggest sanctions might be involved. Note, by that time Adam Szubin had moved to head Terrorism and Financial Crimes, so the issue might have more directly concerned money laundering than sanctions (though he appears to have still been in charge of OFAC as well).

In addition, John Brennan unmasked his identity, which suggests the intelligence immediately got briefed to the top of CIA.

Also that day, UN Ambassador Samatha Power unmasked Flynn’s identity twice that day, which (if this is part of the flurry) suggests someone in New York may have been involved.

The next day, December 15, Jim Comey got this intelligence and unmasked Flynn’s identity. Importantly, given the draft EC closing the Flynn investigation on January 4, 2017, nothing about this seems to have triggered notice to the Crossfire Hurricane team, which either suggests it involved an entirely different topic or proves that the FBI didn’t have it in for Flynn and treated some communications involving Flynn and Russia as routine.

John Brennan got something — either the same or a follow-on report, or something else entirely different — on December 15. That seems to have filtered down to CIA officials working on the Middle East, including Syria. But there’s not evidence that counterterrorism experts got it or were very interested, which is interesting given that Flynn always pitched cooperation with Russia in terms of cooperating against ISIS.

The same day, a whole bunch of people at NATO got it, including the Policy Advisor for Russia (Scott Parrish, too, seems to focus on Russia or Eastern Europe).

In addition, a senior person at Department of Energy and someone on the intelligence side there got it. This suggests nuclear power or proliferation is involved.

Finally, on December 16, four people at CIA whose location and portfolio are unknown got it, as well as the Ambassador to Russia (it would be unsurprising if those CIA people were also in Russia).

December 14, 2016

CIA Director John Brennan

UN Ambassador Samantha Power (twice)

Treasury

Secretary of Treasury Jacob Lew

Deputy Secretary of Treasury Sarah Raskin

Under Secretary of Treasury Nathan Sheets

Acting Under Secretary of Treasury Adam Szubin

Acting Assistant Secretary of Treasury, Office of Intelligence & Analysis Danny McGlynn

Acting Assistant Secretary of Treasury, Office of Intelligence & Analysis Mike Neufeld

Office of Intelligence & Analysis Patrick Conlan

December 15, 2016

FBI Director Jim Comey

CIA

CIA Director John Brennan

Deputy Assistant Director of Near East Mission Center [redacted]

Chief Syria Group [Redacted]

NATO

US Ambassador to NATO Douglas Lute

US Deputy Chief of US Mission to NATO Lee Litzenberger

US NATO [CIA?] Advisor to Ambassador Douglas Lute

US NATO Defense Advisor (DEFAD) Robert Bell

US NATO Deputy DEFAD James Hursh

US Representative to NATO Military Vice Admiral John Christenson

US NATO Office of the Defense Advisor (ODA) Policy Advisor for Russia Lieutenant Colonel Paul Geehreng

US NATO Political Officer [redacted] Scott Parrish

US NATO Political Advisor [POLAD] Tamir Waser

Department of Energy

US Department of Energy Deputy Secretary Elizabeth Sherwood-Randall

US Department of Energy Intelligence and Analysis, Executive Briefer

December 16

State

US Ambassador to Russia John Tefft

CIA

Chief of Station [Redacted]

Deputy Chief of Station [Redacted]

Collection Management Officer [Redacted]

Collection Management Officer [Redacted]

The most credible explanation I’ve seen for this flurry is that it relates to Flynn’s scheme to sell nuclear energy to Saudi Arabia (because it would involve sanctions, so Treasury, and proliferation, so Energy, and partnership with Russia), but that explanation doesn’t account for some of these readers, most notably someone with a Syria portfolio (the entire nuclear plan was a scheme to lure Russia away from Iran). Plus, unless those CIA people are tied to Saudi Arabia, these readers don’t include the key target of this scheme.

Moreover, it’s unclear why so many people at NATO would focus on this so quickly.

Whatever this flurry (or flurries), what Ric Grenell has done by releasing the list is given whatever adversary is involved, along with Mike Flynn, a picture of how this information flowed within the federal government.

Maybe that — and not any disclosure about who unmasked Flynn’s call with Sergey Kislyak — was the point.

Update: Here’s the first story on Jared Kushner’s request for a back channel, which Kislyak reported back to Moscow. It would have triggered Power (the meeting was in NY), Russia, Syria (Kushner said he wanted to cooperate on Syria). But it’s not clear why Treasury got this first, unless the message included set-up to the meeting with Sergei Gorkov, which took place on December 13. This being a report on Gorkov would explain the response at Treasury, but not other elements, such as the involvement of Energy (unless the Gorkov meeting was significantly different than has been reported).

SSCI Has Already Dismissed One of the Key Issues John Durham Is Investigating

The other day, the NYT had an update on another area included in John Durham’s 9-month investigation of the Russian investigation. Durham appears to be chasing a theory (based on what predication, aside from Bill Barr’s fevered imagination, it’s unclear) that John Brennan tricked the FBI into investigating Trump by fooling them into believing Russia wanted Trump elected.

Questions asked by Mr. Durham, who was assigned by Attorney General William P. Barr to scrutinize the early actions of law enforcement and intelligence officials struggling to understand the scope of Russia’s scheme, suggest that Mr. Durham may have come to view with suspicion several clashes between analysts at different intelligence agencies over who could see each other’s highly sensitive secrets, the people said.

Mr. Durham appears to be pursuing a theory that the C.I.A., under its former director John O. Brennan, had a preconceived notion about Russia or was trying to get to a particular result — and was nefariously trying to keep other agencies from seeing the full picture lest they interfere with that goal, the people said.

[snip]

The Justice Department has declined to talk about Mr. Durham’s work in meaningful detail, but he has been said to be interested in how the intelligence community came up with its analytical judgments — including its assessment that Russia was not merely sowing discord, but specifically sought to help Mr. Trump defeat Hillary Clinton in the 2016 election.

A key part of this involves the credibility assigned to a Russian source and the CIA’s initial unwillingness to share his identity.

One fight, they said, concerned the identity and placement of a C.I.A. source inside the Kremlin. Analysts at the National Security Agency wanted to know more about him to weigh the credibility of his information. The C.I.A. was initially reluctant to share details about the Russian’s identity but eventually relented.

But officials disagreed about how much weight to give the source’s information, and the intelligence community’s eventual assessment apparently reflected that division. While the F.B.I. and the C.I.A. concluded with “high confidence” that Mr. Putin was specifically trying to help Mr. Trump win the election, the National Security Agency agreed but said it had only “moderate confidence.”

As with much of the Durham investigation, this likely came from a partisan investigation — specifically the HPSCI Report on Russian interference that the GOP released with little Democratic involvement. It found that

(U) Finding #16: The lntelllgence Communi· tv Assessment judgments on Putin’s strategic intentions did not employ proper ana· lytic tradecraft. (U) While the Committee found that most ICA analysis held-up to scrutiny, the investigation also identified significant intelligence tradecraft failings that undermine confidence in the JCA judgments regarding Russian President Vladimir Putin’s strategic objectives for disrupting the U.S. election. Those judgments failed to meet longstanding standards set forth in the primary guiding document for IC analysis, ICD 203, Analytic Standards including:

(U) ”Properly describe quality and credibilit:y of underlying sources.”

(U) “Properly express and explain uncertainties associated with major analytic judgments.”

(U) “Incorporate analysis of alternatives ·- [particularly] when major judgments must contend with significant uncertainties or … high-impact results.”

(U) Base confidence assessments on “the quantity and quality of source material.”

(U) “Be informed by all relevant information available.”

(U) “Be independent of political considerations.”

[snip]

The Committee’s findings on ICA tradecraft focused on the use of sensitive, [redacted] intelligence [redacted] cited by the ICA. This presented a significant challenge for classification downgrade. The Committee worked with intelligence officers from the agencies who own the raw reporting cited in the ICA to downgrade the classification of compartmented findings [redacted]

In short, in the same way that the HJC/OGR echo chamber of shoddy propaganda injected George Papadopoulos’ claims into Durham’s investigation, the HPSCI report likely gave Barr a way to demand this prong of the investigation.

The thing is, however, the Senate Intelligence Committee has also reviewed this intelligence — notably, at a time after the CIA source behind it had been exfiltrated (and after abundant other evidence proving that Putin really did prefer Trump came in). And SSCI had no problem with the conclusion.

The ICA states that:

We assess Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the U.S. presidential election. Russia’s goals were to undermine public faith in the U.S. democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency. We further assess Putin and the Russian Government developed a clear preference for President-elect Trump.[2]

  • The Committee found that the ICA provided a range of all-source reporting to support these assessments.
  • The Committee concurs with intelligence and open-source assessments that this influence campaign was approved by President Putin.
  • Further, a body of reporting, to include different intelligence disciplines, open source reporting on Russian leadership policy preferences, and Russian media content, showed that Moscow sought to denigrate Secretary Clinton.
  • The ICA relies on public Russian leadership commentary, Russian state media reports, public examples of where Russian interests would have aligned with candidates’ policy statements, and a body of intelligence reporting to support the assessment that Putin and the Russian Government developed a clear preference for Trump.

The ICA also states that:

We also assess Putin and the Russian Government aspired to help President-elect Trump’s election chances when possible by discrediting Secretary Clinton and publicly contrasting her unfavorably to him.[3]

  • The Committee found that the ICA provided intelligence and open source reporting to support this assessment, and information obtained subsequent to publication of the ICA provides further support.
  • This is the only assessment in the ICA that had different confidence levels between the participating agencies—the CIA and FBI assessed with “high confidence” and the NSA assessed with “moderate confidence”—so the Committee gave this section additional attention.

The Committee found that the analytical disagreement was reasonable, transparent, and openly debated among the agencies and analysts, with analysts, managers, and agency heads on both sides of the confidence level articulately justifying their positions. [my emphasis]

Significantly, over time that conclusion has held up.

In fact, an even more recent SSCI Report — released in recent weeks — makes it clear that what is obviously this same reporting stream provided the “wake up” call that led the IC to take the Russian attack as seriously as they should have. The intelligence is introduced (but entirely redacted) on page 11, but the description of Brennan’s action — and the degree to which this intelligence was closely held thereafter — makes it clear that this is the CIA HUMINT.

According to Director Brennan, he recommended that the intelligence be briefed to the Gang of Eight, stating, “I think it’s important that this be a personal briefing.”

[snip]

According to multiple administration officials, the receipt of the sensitive intelligence prompted the NSC to being a series of restricted PC meetings to craft the administration’s response to the Russians’ active measures campaign. These restricted “small group” PC meetings, and the corresponding Deputies Committee (DC) meetings, were atypically restricted, and excluded regular PC and DC attendees such as the relevant Senior Directors within the NSC and subject matter experts that normally accompanied the principals and deputies from the U.S. Government departments and agencies.

According to former NSC Senior Director for Intelligence Programs, Brett Holmgren, no one other than the principals participated in the initial PC meetings, due to the sensitivity of the intelligence reporting. Mr. Holmgren further stated that the “reports were briefed verbally, often times by Director Brennan. So I didn’t get access to a lot of these reports until the November or December time frame.”

To be clear, ultimately this more recent SSCI Report comes down on the same side that the Durham inquiry seems to be — that CIA ended up holding this too close, making it difficult for other agencies to properly vet it. This SSCI Report argues that the close hold led to a less robust response than the US should have mounted.

So all four reviews — HPSCI’s, SSCI’s ICA assessment and 3rd volume, along with Durham’s current review — agree that the CIA held this information really closely. But the bipartisan reports that assess whether the conclusion held up over time — just the SSCI ones — not only find that CIA was right, but that that view marked the belated moment when the US IC started taking the attack seriously enough.

In other words, John Durham is investigating something that the proper oversight authorities already have deemed the correct result that actually came too late and not broadly enough, and trying to find fault with it. Bill Barr is trying to get Durham to criminalize an intelligence conclusion that is the one thing that didn’t lead us to get more badly damaged by the attack.

The Size of Bill Barr’s Cover-Up Hints at the Magnitude of What He’s Covering Up

After the Tuesday Afternoon Massacre — where four prosecutors withdrew from the Roger Stone case rather than be party to Bill Barr interfering in the prosecution of Trump’s rat-fucker — we learned on Friday that Bill Barr had deployed a third US Attorney — Saint Louis’ Jeffrey Jensen — to the DC US Attorney’s office as part of an elaborate cover-up for Trump’s crimes. I’m going to attempt to lay out the full scope of Barr’s attempted cover-up. This post will serve as an overview and I will update it with links to the known or suspected evidence and crimes that Barr is covering up. I’m not including efforts to launch or sustain investigations into those Trump perceives to be his enemies.

The cover-up has the following aspects:

Interim US Attorneys oversee investigations implicating Trump’s actions

Geoffrey Berman, Southern District of New York: For the most part, Berman seems to have operated independently after his appointment as US Attorney for SDNY, but there are recent concerns that investigations implicating Trump have been stymied:

  • Hush payments: After getting Michael Cohen to plead guilty to covering up Trump’s past sex partners during the election and obtaining testimony from National Enquirer, the investigation closed with no further charges on or before July 17, 2019.
  • Ukrainian grifters: There are conflicting stories about the scope of the investigation into Ukrainian grifters Lev Parnas and Igor Fruman, particularly with regards to how seriously SDNY is considering charges against Rudy Giuliani. WaPo reported steps taken implicating Rudy’s activities on February 14, 2020. But Parnas has insinuated that his sudden arrest on October 9 was an attempt to keep him silent; Barr visited SDNY that day and subsequently visited Rupert Murdoch at his home. SDNY showed unusual concern for the privacy of third parties as Parnas tried to share more information with the House Intelligence Committee. And Bill Barr has not recused in spite of a clear conflict and a request from Parnas.
  • Halkbank: Barr tried to pre-empt an indictment of Turkey’s Halkbank with a settlement.

Timothy Shea, District of Columbia: While Berman worked for several years without any show of corruption, that’s not true of Timothy Shea, a trusted Barr aide. The very first day he started work — having been installed by Barr with just a day’s notice — he started questioning the guidelines sentence of Roger Stone, who has promised to remain silent about details of Trump’s involvement in his efforts to optimize the release of emails stolen by Russian. Then, Shea worked with Bill Barr to reverse the guidelines sentence recommended by career prosecutors. In addition, Shea’s appointment coincided with the start of a “review” of other prosecutions and investigations of Trump associates in DC including, but not limited to, Mike Flynn and Erik Prince.

Confirmed US Attorneys “review” investigations into Trump and his associates

John Durham, Connecticut: In May 2019, Barr ordered John Durham to conduct an investigation into the origins of the Crossfire Hurricane investigation of Trump associates’ ties to Russia. He predicated the investigation, explicitly, on the absence of evidence. In clear contrast to the Mueller investigation, DOJ has produced no documentation regarding the scope of the investigation (including whether Durham could pursue crimes by Trump’s associates or even Barr himself if he found evidence of a crime), and Barr has remained personally involved, completely negating the entire point of appointing a US Attorney to conduct the investigation. Republicans have described the point of this investigation as an effort to discredit the Mueller investigation. It has included the following:

  • Bill Barr’s worldwide tour chasing the hoaxes rolled out through George Papadopoulos via the right wing echo chamber
  • Some disinformation likely fed via Rudy
  • The legitimate criminal investigation of FBI Attorney Kevin Clinesmith, the actual venue for which should be Washington DC
  • CIA’s 2016 determination — confirmed by more recent intelligence collection and reviewed approvingly by the Senate Intelligence Committee — that Russia not only wanted to hurt Hillary, but help Trump in the 2016 election
  • Communications between John Brennan and Jim Comey and Andrew McCabe

Jeffrey Jensen, Eastern District of Missouri: The “review” Jeffrey Jensen is conducting of DC US Attorney cases seems to couple with Durham’s investigation. It reportedly is second-guessing decisions made by prosecutors on the Mike Flynn and Erik Prince investigation, as well as other non-public investigations. The review is almost certainly assessing rumors started by known propagandists that have already been investigated three times, including by FBI’s Inspection Division, rumors already reviewed and dismissed in a meticulous 92-page opinion from Emmet Sullivan. This “review” seems to have been part of the installment of Shea at DC and may amount to an attempt to thwart investigations that Jessie Liu let proceed without political interference.

DOJ diverts disinformation from Rudy Giuliani to another confirmed US Attorneys

In recent weeks, Barr has appointed Scott Brady, US Attorney for Western District of Pennsylvania, to vet incoming information from Rudy’s foreign influence peddling in Ukraine. It’s unclear whether Barr did this to try to make something out of that disinformation, or to prevent evidence that might support foreign influence peddling charges against Rudy from getting to prosecutors in SDNY.

Richard Donoghue, Eastern District of New York: Donoghue is apparently “handling certain Ukraine-related matters.” In connection to that, Jeffrey Rosen put Donoghue in charge of coordinating all investigations that pertain to Ukraine,

to avoid duplication of efforts across Offices and components, to obviate the need for deconfliction at a later stage of potentially overlapping investigations, and to efficiently marshal the resources of the Department to address the appropriate handling of potentially relevant new information.

That in and of itself is not problematic. But by putting Jensen in charge of intake, presumably before it gets to Donoghue, Rosen has ensured that information that — because it is disinformation — would be incriminating to Rudy, not Joe Biden (or anyone else).

DOJ prevents full investigation of Ukraine complaint

Barr and his DOJ engaged in multiple acts of obstruction of the Ukraine complaint. First, Barr did not recuse from a complaint mentioning him by name. Then (knowing that Barr was personally implicated), DOJ did not conduct a full assessment of the whistleblower complaint, which would have identified a tie to the SDNY investigation of Lev Parnas and Igor Fruman. Then OLC invented an excuse not to share whistleblower complaint with Congress, which resulted in a significant delay and almost led Ukraine to make concessions to obtain aid. Then, DOJ did not share whistleblower complaint with FEC as required by Memorandum of Notification. Finally, DOJ made a comment claiming Trump was exonerated, precisely the abuse — speaking about ongoing investigations — that Jim Comey got fired for.

The Black Hole Where SSCI’s Current Understanding of WikiLeaks Is

Four years after it started, the Senate Intelligence Committee continues its investigation into Russia’s 2016 election interference, this week releasing the report on what the Obama Administration could have done better. For a variety of reasons, these reports have been as interesting for their redactions or silences as for what the unredacted bits say.

This latest report is no different.

Putin responded to Obama’s warnings by waggling his nukes

The most interested unredacted bit pertains to Susan Rice’s efforts, scheduled to occur just before ODNI and DHS released their report attributing the hack to Russia, to warn Russia against continuing to tamper in the election. That would place the meeting at just about precisely the moment the Access Hollywood video and Podesta email release happened, a big fuck you even as Obama was trying to do something about the tampering. The meeting also would have occurred during the period when Sergei Kislyak was bitching about FBI efforts to prevent Russia from sending election observers to voting sites.

The description of the meeting between Rice and Kislyak is redacted. But the report does reveal, for the first that I heard, that Russia responded to being warned by raising its nukes.

Approximately a week after the October 7. 2016. meeting, Ambassador Kislyak asked to meet with Ambassador Rice to deliver Putin’s response. The response, as characterized by Ambassador Rice, was “denial and obfuscation,” and “[t]he only thing notable about it is that Putin somehow deemed it necessary to mention the obvious fact that Russia remains a nuclear power.”

This exchange is all the more interesting given that there’s an entirely redacted bullet (on page 37) describing actions that “Russian cyber actors” took after Obama warned Putin. Given that the state and county scanning and the alleged hack of VR Systems shows up, there’s something we either still don’t know about or SSCI continues to hide more details of the VR Systems hack.

The page long post-election response to the election year attack

The longest subsection in a section devoted to describing Obama’s response is redacted (pages 39-41).

Here’s what the timing of the unredacted parts of that section is:

  • A: Expulsion of Russian diplomats (December 29, 2016)
  • B: Modifying the EO and sanctions (December 29, 2016)
  • C: redacted
  • D: Cybersecurity action in the form of the issuance of two technical reports (December 29, 2016 and February 10, 2017)
  • E: Tasking the ICA Report (initiated December 6, 2016; completed December 30, 2016; published January 5 and 6, 2017)
  • F: Protecting election infrastructure (January 5, 2017)

That might suggest that whatever secret action the Obama Administration took happened right in December, with everything else.

John Brennan was proved fucking right

There’s a redacted passage that may undermine the entire premise of the John Durham investigation, which purports to review what agencies, other than FBI, did to lead to an investigation focused on Trump’s campaign. Some reporting suggests Durham is investigating whether CIA tricked FBI into investigating Trump’s flunkies.

But this report describes how, in spite of knowing about related Russian hacks in 2015 and Russia’s habit of leaking information they stole, the IC really wasn’t aware of what was going on until John Brennan got an intelligence tip during the summer of 2016. That intelligence tip was described at length in a WaPo story that resembles this section of the report.

Early last August, an envelope with extraordinary handling restrictions arrived at the White House. Sent by courier from the CIA, it carried “eyes only” instructions that its contents be shown to just four people: President Barack Obama and three senior aides.

Inside was an intelligence bombshell, a report drawn from sourcing deep inside the Russian government that detailed Russian President Vladi­mir Putin’s direct involvement in a cyber campaign to disrupt and discredit the U.S. presidential race.

But it went further. The intelligence captured Putin’s specific instructions on the operation’s audacious objectives — defeat or at least damage the Democratic nominee, Hillary Clinton, and help elect her opponent, Donald Trump.

At that point, the outlines of the Russian assault on the U.S. election were increasingly apparent. Hackers with ties to Russian intelligence services had been rummaging through Democratic Party computer networks, as well as some Republican systems, for more than a year. In July, the FBI had opened an investigation of contacts between Russian officials and Trump associates. And on July 22, nearly 20,000 emails stolen from the Democratic National Committee were dumped online by WikiLeaks.

But at the highest levels of government, among those responsible for managing the crisis, the first moment of true foreboding about Russia’s intentions arrived with that CIA intelligence.

The section in this report is redacted.

Effectively, this report seems to confirm the WaPo reporting (which may have been based off sources close to those who testified to SSCI). It also emphasizes the import of this intelligence. But for this intelligence, the IC may have continued to remain ignorant of Putin’s plans for the operation.

The IC won’t let SSCI share its current understanding of WikiLeaks

But the most interesting redactions pertain to WikiLeaks.

There are four redacted paragraphs describing how hard it was for the IC to come up with a consensus attribution for the hack and leak operation.

Senior administration officials told the Committee that they hesitated to publicly attribute the cyber efforts to Russia m1til they had sufficient information on the penetration of the DNC network and the subsequent disclosure of stolen information via WikiLeaks, DCLeaks, and Guccifer 2.0.

More interesting still, almost the entirety of the page-plus discussion (relying on testimony from Ben Rhodes, Michael Daniel, Paul Selva, Mike Rogers, and others) of why it took so long to understand WikiLeaks remains redacted.

One reference that is unredacted, however, describes WikiLeaks as “coopted.”

This information would be of particular interest as the prosecution of Julian Assange goes forward. That — and the fact that some of this determination, relying as it does on former NSA Director Mike Rogers, appears to rely on NSA information — may be why it remains redacted.

Update: I’ve deleted the remainder of this post. It came from Wyden’s views, not the report itself.

Roger Stone’s Latest: When Legal Categories of Innocent or Guilty become Disinformation and Pardon [Updated]

Update, June 27: This post describes why Stone’s defense strategy — not to mount a legal defense, but to engage in disinformation — may pose a problem for Amy Berman Jackson’s enforcement  of her gag against Roger Stone. That’s because his magnification of other outlets’ coverage of his lawyers’ own bullshit filings questioning whether Russia hacked the DNC do amount to a magnification of his own defense strategy. ABJ ordered Stone to explain why his release conditions shouldn’t be changed. Stone’s response is here. As expected, his response largely claims he was within the terms of her order when commenting on his lawyers’ own filings.

The government’s disproportionate reaction is an effort to deprive Stone of the narrow latitude the Court left him; a latitude that was not violated by the posts, and a latitude which, if curtailed, based on the posts, would violate Stone’s First Amendment rights. The notion that “an appeal to major media outlets to publish information that is not relevant to, but may prejudice, this case” (Dkt. 136, p. 4, n.1), is oxymoronic, outré, and out of First Amendment bounds

Stone’s response is weakest in the explanation for calling for John Brennan to be hanged.

June 2, 2019 (Gov’t Ex. 8): “This psycho must be charged, tried, convicted . . . . [John Brennan] and hung for treason.” Dkt. 136-9. Stone: No comment was made by Stone about the “case” or about the “investigation.” Analysis: As background, Mr. Brennan, in a July 16, 2018 Tweet (about which 133,000 people were “talking”) wrote: “Donald Trump’s press conference performance in Helsinki rises to and exceeds the threshold of ‘high crimes and misdemeanors. It was nothing short of treasonous’.” The First Amendment protected Brennan’s remarks. Likewise, Stone’s remarks are also protected. This posting has nothing whatsoever to do with Stone’s case and therefore posed no fair trial threat, nor did it violate the Order.

This is clearly an attempt to explain away what Stone’s deletion of the post seems to recognize did violate the gag.

Anyway, I may be alone in thinking this, but I suspect ABJ won’t do anything more than restrict Stone’s use of the Internet, if even she does that.

I will add, however, that the government would do well to formally notice what I pointed out here: that in the DNC lawsuit, his attorneys are arguing the opposite of what they’re arguing here, that Russia definitely did the DNC hack.


Yesterday, the government asked Judge Amy Berman Jackson to hold a hearing to determine whether Roger Stone didn’t violate his gag order earlier this week by trying to get mainstream press outlets to pick up marginal outlets’ reports of his attorneys’ effort to undermine the attribution of the DNC hack to Russia. They point to several Instagram posts Stone made that referred to conspiratorial interpretations of his lawyers’ own frivolous arguments and ask why other outlets aren’t picking up the story. [I’ve added links to the posts.]

On June 18, 2019, Stone posted a screenshot of an article about one of his recent filings in this case. The screenshot read: “US Govt’s Entire Russia-DNC Hacking Narrative Based on Redacted Draft of CrowdStrike Report.” Ex. 1. He tagged the post, “But where is the @NYTimes? @washingtonpost? @WSJ? @CNN?” Id. Later that day, Stone posted a screenshot of another piece about his filing with the title, “FBI Never Saw CrowdStrike Unredacted Final Report on Alleged Russian Hacking Because None was Produced.” Ex. 2. Next, Stone posted an article titled, “Stone defense team exposes the ‘intelligence community’s’ [sic] betrayal of their responsibilities.” Ex. 3. The text further stated, “As the Russia Hoax is being unwound, we are learning some deeply disturbing lessons about the level of corruption at the top levels of the agencies charged with protecting us from external threats. One Jaw-dropping example has just been exposed by the legal team defending Roger Stone.” Id. Stone tagged the article, “Funny , No @nytimes or @washingtonpost coverage of this development.”

On June 19, 2019, Stone posted a screenshot of an article with the title, “FBI Never Saw CrowdStrike Unredacted or Final Report on Alleged Russian Hacking Because None Was Produced.” Ex. 4. He tagged the post, “The truth is slowly emerging. #NoCollusion.” Id.2

They argue this violates ABJ’s ban on,

making statements to the media or in public settings about the Special Counsel’s investigation or this case or any of the participants in the investigation or the case. The prohibition includes, but is not limited to, statements made about the case through the following means: radio broadcasts; interviews on television, on the radio, with print reporters, or on internet based media; press releases or press conferences; blogs or letters to the editor; and posts on Facebook, Twitter, Instagram, or any other form of social media.

Thus far, ABJ has not responded to this request, though in that same time she assented to another of the government’s requests, to submit a sur-reply to Stone’s claim that the FBI never had any direct evidence Russia hacked the DNC.

I want Roger Stone to go to jail as much as the next opponent of rat-fucking. But I think the government’s claim, on this point, is problematic. Back when ABJ set Stone’s gag, she said,

You may send out as many emails, Tweets, posts as you choose that say, Please donate to the Roger Stone defense fund to help me defend myself against these charges. And you may add that you deny or are innocent of the charges, but that’s the extent of it. You apparently need clear boundaries, so there they are.

But in the same hearing, prosecutor Jonathan Kravis — the guy who signed yesterday’s filing — laid out that defensible public statements would include articulating a defense.

And because the conduct we’re talking about now, because the message we’re talking about now are not just messages about proclaiming innocence or articulating a defense, but are messages that could be construed as threatening, the government believes that the restriction on extrajudicial statements would be appropriate under the Bail Reform Act.

And the posts from this week that prosecutors lay out do nothing more than point to poor analysis of Stone’s own lawyers’ filings, and as such probably count as an effort to articulate a defense.

The problem is precisely what prosecutors explicitly explain is their real concern, that these posts are designed to generate more attention for conspiracy theories that totally undermine the public record of the Mueller investigation.

Stone’s posts appear calculated to generate media coverage of information that is not relevant to this case but that could prejudice potential jurors. They relate to Stone’s claims—made in both filings before the Court and in public settings—that Russia did not hack the DNC servers, that the FBI and intelligence community were negligent in investigating Russian interference in the 2016 presidential election, that the government improperly “targeted” Stone and others, and that the entire investigation was somehow invalid and any crimes flowing from it (including Stone’s witness tampering and lies to Congress) were justified.3 If those theories were relevant to this case (which they are not), public statements aimed at the media and meant to bolster the claims would risk prejudicing the jury pool. But these posts are arguably even worse, because they risk tainting the jury pool with information that is not relevant but that may appear, to some, to be relevant. At best, Stone’s efforts could create the misimpression that this case is about issues that are not charged in the Indictment, and risk the trial “devolv[ing] into a circus” (Tr. 49:19-20). But worse, it could confuse prospective jurors or color how they later view the actually-relevant evidence and understand the Court’s instructions about that evidence.

Prosecutors are absolutely right: the reporting on Stone’s lawyers filings misrepresent what his case is about. But that’s because Stone’s own lawyers are engaging in a legal strategy of disinformation, not legal defense.

I’ve repeatedly said that I think Stone will be pardoned before his November trial. Currently, there are no charges against him which could be refiled in NY or FL (the latter of which wouldn’t do it anyway). DOJ has already ruled that Stone’s known underlying activity — optimizing the release of documents stolen by Russians — does not reach the level of illegal conspiracy. So if Trump pardoned Stone before November, the fact that Stone would lose his Fifth Amendment rights over his charges would pose no legal risk to Trump (unlike, say, Manafort). Yet November’s trial, if it goes forward, will be unbelievably damning for the President.

And that means that Stone’s lawyers have an even bigger incentive than Manafort’s lawyers did to mount a defense that undermines the credibility of the Russian investigation, even if it does nothing to increase Stone’s chances for acquittal (which, if this goes to trial, are slim).

Which leaves ABJ and the prosecutors attempting to litigate a trial that will find innocence or guilt, while Stone’s lawyers are litigating to push disinformation in support of a pardon.

All that said, Stone may still be in trouble. Prosecutors note that this is not the first time Stone has violated the letter (if not spirit) of ABJ’s gag. They include several more examples.

1 These posts are not the first statements that appear to have run afoul of the Court’s order. See, e.g., Ex. 5 (Instagram Posting of April 4, 2019, stating “FBI Refuses Records Request for Emails to CNN on Day of Roger Stone Raid,” with the tag, “How curious? What could they possibly be hiding?”); Ex. 6 (Instagram Posting of May 8, 2019, with the headline “Judge demands unredacted Mueller report in Roger Stone case,” with the comment, “The Judge has ruled but @Politico gets most of the story wrong because they are biased elitist snot-nosed fake news [expletive] who’s [sic] specialty is distortion by omitting key facts to create a false narrative.”); Ex. 7 (Instagram Posting of May 16, 2019, with headline, “Roger Stone Swings For the Fences; Court Filing Challenges Russiagate’s Original Premise,” with the comment, “My attorneys challenged the entire “Russia hacked the DNC/CrowdStrike” claim by the Special Counsel in public court filings[.]”); Ex. 8 (Instagram Posting of June 2, 2019, picturing a former CIA Director and writing, “This psycho must be charged, tried, convicted . . . . and hung for treason.”) (ellipses in original) (subsequently deleted). The government is bringing this matter to the Court’s attention now because Stone’s most recent posts represent a direct attempt to appeal to major media outlets to publish information that is not relevant to, but may prejudice, this case.

Three of these, like the other four, might be viewed as articulating a defense, with the defense being, engaging in disinformation.

The fourth, however, solidly violates the spirit and letter of ABJ’s gag, because it would be likely to incite violence directed at John Brennan, because it calls for his hanging (Click through to see the post; I don’t want to magnify Stone’s violent language).

I’m not sure what the remedy is for lawyers whose defense strategy is to sow disinformation inside and outside the court room (in both filings this week, the government has said they’re going to move to prevent any such discussion from the trial). But I think these Instagram posts were probably designed, with advice of counsel, to be defensible as part of a defense strategy.

It’s Stone’s defense strategy that’s the problem.

Update: ABJ has given Stone until Thursday to convince her he didn’t violate her gag.

As I disclosed last July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

We Will Not Get Peace from the People Who Dismember Dissidents Alive

In the wake of Trump’s announcement that the US will withdraw from Syria and James Mattis’ subsequent resignation, Jeremy Scahill captured the ambivalence of the moment this way:

I agree with much of what Scahill says: I welcome withdrawing troops from overseas. We should never forget that Mattis earned his name, Mad Dog, nor that he got fired by Obama for being too belligerent. The panicked response of a bunch of warmongers is telling. Trump cannot be trusted.

But I think Scahill is too pat in saying “the chaos presents opportunity,” in part because (as he suggests) there doesn’t yet exist “an alternative vision for US foreign policy.”

And while I appreciate that Scahill really does capture this ambivalence, far too many others welcoming a potential troop withdrawal are not recognizing the complexity of the moment.

While we don’t yet fully understand the complex dynamics that led to it, Trump decided to withdraw from Syria during a phone call with a man who has spent two months embarrassing Trump, Trump’s son-in-law, and the corrupt Saudi prince whose crackdown Trump has enthusiastically backed by releasing details of how that prince lulled an American resident dissident to a third country so he could be chopped up with a bone saw while still breathing. And even while Erdogan was embarrassing Trump with those details about Khashoggi’s assassination, he was pressuring Trump to extend the same favor to him by extraditing Fethullah Gulen so he could be chopped up in some grisly fashion.

It is a mistake to think we will get peace from men who dismember dissidents alive.

All that said, Trump will do what he wants and unless the simmering revolt at DOD changes his mind, he will withdraw from Syria and drawdown in Afghanistan.

And if that happens those who would like peace had damn well be better prepared  for that “opportunity” than by simply hoping a future alternative US foreign policy arises. It will take immediate tactical actions to prevent any withdrawal from creating more chaos and misery both in the US and overseas. After all, Trump says he wants to bring troops home, but he has already come perilously close to violating posse comitatus by deploying troops domestically, and that was even with Mattis pushing back against that campaign stunt.

At a minimum, those who want peace need to answer some of the following questions immediately:

What person would both be willing to work for Trump and pursue a policy of peace?

I could not think of any person who could be confirmed by the Senate — even one where nutjobs like Marsha Blackburn have replaced people like Bob Corker — that would be willing to work for Donald Trump and might pursue some kind of alternative foreign policy.

In fact, the only person I could think of for the job (ruling out Erik Prince for a variety of reasons) would be Tom Cotton.

So job number one, for people who hope to use this as an opportunity, is to start coming up with names of people who could replace Mattis and anyone else who quits along with him.

How to prevent the refugee crisis from getting worse?

Multiple accounts of the events leading up to Trump’s decision make it clear that Erdogan would like to use US withdrawal to massacre the Kurds. It’s possible we’ll see similar massacres in Assad-held Syria and Afghanistan as those left try to consolidate their victory.

For all the years the refugee crisis has been mostly a political prop here in the US, it has posed a real threat to the European Union (indeed, I went to several meetings with EUP members in the weeks before Trump’s election where they said it was the greatest threat to the EU). So we need to start thinking seriously about how to prevent genocide and other massacres and the inevitable refugee crises that would result.

How to counter Trump’s fondness for fossil fuels and arms sales?

No withdrawal is going to lead to “peace” or even a retreat of the US empire so long as Trump exacerbates an already unforgivable US addiction to fossil fuels and reliance on arms sales. Particularly with Saudi Arabia but also with Turkey, Trump has excused his fondness for authoritarianism by pointing to arms sales.

And on these issues, Trump actually agrees with the “war party in DC,” which will make it far harder to counter them. Yes, many of the new Democrats entering Congress — most of all Alexandria Ocasio-Cortez — don’t have these horrible habits. So what can you do to make sure her Green New Deal not only isn’t squelched by party leadership, but is seen as the alternative to Trump by centrists?

Nukes. How to prevent Trump from using them?

It’s not that Trump is opposed to violence. He’s opposed to engagement and complexity and long term engagement.

Which means, particularly as more and more so-called adults leave, the chance he’ll turn a tantrum into a nuclear strike skyrocket. Mattis won’t be there to stop him.

How to balance accountability for the mistakes that got us here with accountability for Trump?

The movement that brands itself as “The Resistance” has long made a grave mistake of embracing whatever warmed over anti-Trump centrist wanted to loudly denounce the President.

As a result, the mistakes of many of those people — people like John Brennan and Jim Comey and David Frum and David Brooks — were ignored, even when those mistakes created the vacuum that Trump (and Vladimir Putin) have filled.

Trump would not be President if George Bush had not invaded Iraq, abetted by Frum’s nifty tagline, Axis of Evil. Trump would not be President if the banks that crashed the economy in 2008 had been accountable by people like former Bridgewater Associates executive and HSBC board member then FBI Director Jim Comey.

Again, this is about complexity. But so long as those who would keep Trump accountable ignore what made Trump possible, we will make no progress.

How to preserve democracy long enough to pursue a new foreign policy?

Finally, an increasingly real challenge. Trump sides with Putin and Erdogan and Mohammed bin Salman and Abdel Fattah el-Sisi not because it serves US interests (which is the excuse American politicians usually offer for tolerating Saudi and Egyptian authoritarianism). He does so because he genuinely loves their authoritarianism.

And as Republicans in the Senate begin to push back against Trump, Democrats in the House try to hold him accountable, and the so-called adults leave his Administration, it raises the chances that Trump will embrace increasingly desperate measures to implement his policies. We can’t just assume that Mueller and SDNY and NY State will prevent a Trump authoritarian power grab, particularly not as he continues to pack the courts.

While numerous State Attorneys General and NGOs are having reasonable success at constraining Trump, thus far, in the courts, eventually we’re going to need a bipartisan commitment in DC to constraining Trump. Eventually we’re going to need to convince a bunch of Republican Senators that Trump is doing permanent damage to this country. That’s going to take building, not severing, relationships with some Republicans, even while finding some means to persuade them that Trump can no longer benefit them.

To some degree, we have no choice but to find answers to these questions, one way or another. It is especially incumbent on those celebrating a withdrawal to acknowledge, and try to answer, them.

The DNC-Centric Focus of the HPSCI Investigation

Through the duration of the various Russia investigations, skeptics always harp on two questions pertaining to the Russian election year hacks — why the Democrats never turned over the DNC “server,” singular, to the FBI, allegedly leaving the FBI to rely on Crowdstrike’s work, and whether several sets of files released via Guccifer 2.0 showed signs of non-Russian origin. That is, skeptics look exclusively at the DNC, not the totality of the known Russian targeting.

Looking at the list of witnesses the House Intelligence Committee called (which the committee will release in the coming weeks) shows one reason why: that the most public and propagandist of all the Russia investigations focused on the DNC to the detriment of other known Democratic targets.

Here’s what the list of the HPSCI interviews looks like arranged by date (HPSCI will not be releasing the bolded interviews).

  1. [Comey, Jim (May 2 and 4, 2017): Intel]
  2. [Rogers, Mike (May 4, 2017): Intel]
  3. [Brennan, John (May 23, 2017): Intel]
  4. Coats, Dan (June 22, 2017): Intel
  5. Farkas, Evelyn (June 26, 2017): Ukraine/RU DOD
  6. Podesta, John (June 27, 2017): Clinton Chair
  7. Caputo, Michael (July 14, 2017): RU tied Trump
  8. Clapper, James (July 17, 2017): Intel
  9. Kushner, Jared (July 25, 2017): June 9 etc
  10. Carlin, John (July 27, 2017): Early investigation
  11. Gordon, JD (July 26, 2017): Trump NatSec
  12. Brown, Andrew (August 30, 2017): DNC CTO
  13. Tamene, Yared (August 30, 2017): DNC tech contractor
  14. Rice, Susan (September 6, 2017): Obama response to hack/unmasking
  15. Stone, Roger (September 26, 2017): Trump associate
  16. Epshteyn, Boris (September 28, 2017): RU-tied Trump
  17. Tait, Matthew (October 6, 2017): Solicit hack
  18. Safron, Jonathan (October 12, 2017): Peter Smith
  19. Power, Samantha (October 13, 2017): Obama response to hack/unmasking
  20. Catan, Thomas (October 18, 2017): Fusion
  21. Fritsch, Peter (October 18, 2017): Fusion
  22. Lynch, Loretta (October 20, 2017): Investigation
  23. Parscale, Brad (October 24, 2017): Trump’s data
  24. Cohen, Michael (October 24, 2017): Trump lawyer
  25. Rhodes, Benjamin (October 25, 2017): Obama response to hack/unmasking
  26. McCord, Mary (November 1, 2017): Early investigation
  27. Kaveladze, Ike (November 2, 2017): June 9 meeting
  28. Yates, Sally (November 3, 2017): Early investigation
  29. Schiller, Keith (November 7, 2017): Trump bodyguard
  30. Akhmetshin, Rinat (November 13, 2017): June 9
  31. Samachornov, Anatoli (November 28, 2017): June 9
  32. Sessions, Jeff (November 30, 2017): Trump transition
  33. Podesta, John (December 4, 2017): Dossier
  34. Denman, Diana (December 5, 2017): RNC platform
  35. Henry, Shawn (December 5, 2017): Crowdstrike
  36. Trump, Jr. Donald (December 6, 2017): June 9
  37. Phares, Walid (December 8, 2017): Trump NatSec
  38. Clovis, Sam (December 12, 2017): Trump NatSec
  39. Goldfarb, Michael (December 12, 2017): Dossier
  40. Elias, Marc (December 13, 2017): Dossier
  41. Nix, Alexander (December 14, 2017): Cambridge Analytica
  42. Goldstone, Rob (December 18, 2017): June 9
  43. Sussmann, Michael (December 18, 2017): Hack and dossier
  44. McCabe, Andrew (December 19, 2017): Early investigation
  45. Kramer, David (December 19, 2017): Dossier
  46. Sater, Felix (December 20, 2017): RU connected Trump
  47. Gaeta, Mike (December 20, 2017): Dossier go-between
  48. Sullivan, Jake (December 21, 2017): Dossier
  49. [Rohrabacher, Dana (December 21, 2017): Russian compromise]
  50. [Wasserman Schultz, Debbie (December 21, 2017): dossier]
  51. Graff, Rhona (December 22, 2017): June 9
  52. Kramer, David (January 10, 2018): Dossier
  53. Bannon, Stephen (January 16, 2018): Trump official
  54. Lewandowski, Corey (January 17, 2018): Trump official
  55. Dearborn, Rick (January 17, 2018): Trump official
  56. Bannon, Stephen (February 15, 2018): Trump official
  57. Hicks, Hope (February 27, 2018): Trump official
  58. Lewandowski, Corey (March 8, 2018): Trump official

While John Podesta, one of the earliest spearphishing victims, was one of  the earliest witnesses (and, as HPSCI shifted focus to the dossier, one of the last as well), the other hack witnesses, DNC CTO Andrew Brown and DNC IT contractor Yared Tamene, represent the DNC. Perhaps that’s because of the NYT’s big story on the hack, which was obviously misleading in real time and eight months old by the time of those interviews. While Perkins Coie lawyer and former DOJ cyber prosecutor Michael Sussmann would surely have real insight into the scope of all the Democratic targets, he was interviewed during HPSCI’s dossier obsession, not alongside Brown and Tamene.

All of which is to say that the HPSCI investigation of the hack was an investigation of the hack of the DNC, not of the full election year attack.

To get a sense of some of what that missed, consider the victims described in the GRU indictment (which leaves out some of the earlier Republican targets, such as Colin Powell). I’ve included relevant paragraph numbers to ID these victims.

  1. Spearphish victim 3, March 21, 2016 (Podesta)
  2. Spearphish victim 1 Clinton aide, March 25, 2016 (released via dcleaks)
  3. Spearphish victim 4 (DCCC Employee 1), April 12, 2016 ¶24
  4. Spearphish victim 5 (DCCC Employee), April 15, 2016
  5. Spearphish victim 6 (possibly DCCC Employee 2), April 18, 2016 ¶26
  6. Spearphish victim 7 (DNC target), May 10, 2016
  7. Spearphish victim 2 Clinton aide, June 2, 2016 (released via dcleaks)
  8. Spearphish victim 8 (not described), July 6, 2016
  9. Ten DCCC computers ¶24
  10. 33 DNC computers ¶26
  11. DNC Microsoft Exchange Server ¶29
  12. Act Blue ¶33
  13. Third party email provider used by Clinton’s office ¶22 (in response to July 27 Trump request)
  14. 76 email addresses at Clinton campaign ¶22 (in response to July 27 Trump request)
  15. DNC’s Amazon server ¶34
  16. Republican party websites ¶71
  17. Illinois State Board of Elections ¶72
  18. VR Systems ¶73
  19. County websites in GA, IA, and FL ¶75
  20. VR Systems clients in FL ¶76

Effectively, HPSCI (and most hack skeptics) focused exclusively on item 11, the DNC Microsoft Exchange server from which the emails sent to WikiLeaks were stolen.

Yet, at least as laid out by Mueller’s team, the election year hack started elsewhere — with Podesta, then the DCCC, and only after that the DNC. It continued to target Hillary through the year (though with less success than they had with the DNC). And some key things happened after that — such as the seeming response to Trump’s call for Russia to find more Hillary emails, the Info-Ops led targeting of election infrastructure in the summer and fall, and voter registration software. Not to mention some really intriguing research on Republican party websites. And this barely scratches on the social media campaign, largely though not entirely carried out by a Putin-linked corporation.

HPSCI would get no insight on the overwhelming majority of the election year operation, then, by interviewing the witnesses they did. Of particular note, HPSCI would not review how the targeting and release of DCCC opposition research gave Republican congressmen a leg up over their Democratic opponents.

And while HPSCI did interview the available June 9 meeting witnesses, they refused to subpoena the information needed to really understand it. Nor did they interview all the witnesses or subpoena available information to understand the Stone operation and the Peter Smith outreach.

Without examining the other multiple threads via which Russia recruited Republicans, most notably via the NRA, HPSCI wouldn’t even get a sense of all the ways Russia was trying to make Republicans and their party infrastructure into the tools of a hostile foreign country. And there are other parts of the 2016 attack that not only don’t appear in these interviews, but which at least one key member on the committee was utterly clueless about well past the time the investigation finished.

The exception to the rule that HPSCI didn’t seek out information that might damn Republicans, of course, is the interview of Dana Rohrabacher, who (along with President Trump) proved reliably willing to entertain Russian outreach via all known channnels. But that’s one of the interviews Republicans intend to keep buried because — according to an anonymous Daily Beast source — they don’t want Rohrabacher’s constituents to know how badly Russia has pwned him before November 6.

“The Republicans are trying to conceal from the voters their colleague Dana Rohrabacher’s Russia investigation testimony,” said a committee source familiar with the issue. “There were highly concerning contacts between Rohrabacher and Russians during the campaign that the public should hear about.”

By burying the Comey, Rogers, and Brennan transcripts, Republicans suppress further evidence of the degree to which Russia specifically targeted Hillary, and did so to help not just Trump, but the Republican party.

I’m sure there will be some fascinating material in these transcripts when they’re released. But even before the selective release, designed to hide any evidence gathered of how lopsided the targeting was, the scope of these interviews makes clear that the HPSCI investigation was designed to minimize, as much as possible, evidence showing how aggressively Russia worked to help Republicans.

As I laid out in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The Epistemology of Security Clearance Dick-Waving

As I disclosed last month, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

I really couldn’t be bothered to get hot and bothered about President Trump stripping John Brennan of his security clearance. Brennan himself has been involved in the politicization of security clearances (perhaps most directly in Jeffrey Sterling’s case), and to have David Petraeus, of all people, complain about politicized security clearances, discredits the pushback. I’m far more concerned about the loyalty policing at EPA, Interior, Department of Education, and on the DOJ team attacking ObamaCare than I am about Brennan, because the bullying of those more obscure people will have a tangible effect on Americans’ lives. Indeed, the fact that Trump issued a declaration stripping Brennan of his clearance on July 26 but we only learned about it on August 15 is a testament to how little impact this has, other than the posturing around it.

But it has led to dangerous politicization elsewhere.

After being stripped of his clearance, Brennan wrote this op-ed.

In it, Brennan spends six paragraphs setting up how deceitful are Russians generally and his former counterpart Alexander Bortnikov specifically, and how successfully they recruit targets, including Americans, leading from a description of Russian “perfidy” directly to deeming election tampering denials “hogwash.”

Brennan then turns to Trump. He leads his accusation that Trump “colluded” with Russia by describing how asking for Russian to find Hillary’s missing emails “openly authorized his followers to work” with Russians.

The already challenging work of the American intelligence and law enforcement communities was made more difficult in late July 2016, however, when Mr. Trump, then a presidential candidate, publicly called upon Russia to find the missing emails of Mrs. Clinton. By issuing such a statement, Mr. Trump was not only encouraging a foreign nation to collect intelligence against a United States citizen, but also openly authorizing his followers to work with our primary global adversary against his political opponent.

Brennan then points to what he has read in “the reporting of an open and free press” to declare Trump’s claims of no collusion — as he had just claimed Russia’s denials of election interference — to be “hogwash.”

Such a public clarion call certainly makes one wonder what Mr. Trump privately encouraged his advisers to do — and what they actually did — to win the election. While I had deep insight into Russian activities during the 2016 election, I now am aware — thanks to the reporting of an open and free press — of many more of the highly suspicious dalliances of some American citizens with people affiliated with the Russian intelligence services.

Mr. Trump’s claims of no collusion are, in a word, hogwash.

The only questions that remain are whether the collusion that took place constituted criminally liable conspiracy, whether obstruction of justice occurred to cover up any collusion or conspiracy, and how many members of “Trump Incorporated” attempted to defraud the government by laundering and concealing the movement of money into their pockets.

In response, Richard Burr issued this testy statement, defending Trump’s action of stripping the clearance of a former CIA Director with whom Burr got along splendidly when he was spying on Burr’s own separate branch of government oversight committee.

Director Brennan’s recent statements purport to know as fact that the Trump campaign colluded with a foreign power. If Director Brennan’s statement is based on intelligence he received while still leading the CIA, why didn’t he include it in the Intelligence Community Assessment released in 2017? If his statement is based on intelligence he has seen since leaving office, it constitutes an intelligence breach. If he has some other personal knowledge of or evidence of collusion, it should be disclosed to the Special Counsel, not The New York Times.

If, however, Director Brennan’s statement is purely political and based on conjecture, the president has full authority to revoke his security clearance as head of the Executive Branch.

I’m offended by Burr’s statement not just because it ignores the plain language of Brennan’s op-ed, which it links, but for the epistemology of the Russian investigation suggested by the Senate Intelligence Committee Chair. Here’s the logic of the statement:

1. Brennan “purports” to know Trump colluded with a foreign power

Here, Burr ignores how Brennan defines it — first “authorizing his followers to work” with Russia by calling on them to find Hillary’s missing emails, and then “highly suspicious dalliances of some American citizens with people affiliated with the Russian intelligence services” — stuff that’s public. He also ignores that Brennan himself says he doesn’t know whether the “collusion” involved constitutes a criminally liable conspiracy. That is, Brennan is defining collusion as something less than a criminal conspiracy to cooperate to cheat on the election, but Burr doesn’t care.

2. Why doesn’t Brennan’s claim show up in the Brennan-led Intelligence Community Assessment?

Again, Burr ignores Brennan’s description of becoming aware of this in the time period after he “had deep insight into Russian activities during the 2016 election” — so after he left the CIA — and taunts him that the ICA Brennan oversaw showed no evidence of collusion. The implication is Brennan’s ability to know if there were collusion ended on January 20, 2017. (Burr is also ignoring that there were two different investigations even while Brennan was in government — the intelligence investigation led by Brennan, which by law should not be targeting Americans, and the several parallel counterintelligence investigations at FBI, which could investigate Americans.)

Burr then presents three and only three possibilities for how Brennan might have knowledge of collusion, once again ignoring the free press that Brennan clearly attributes it to. First, either intelligence, or personal knowledge:

3. If Brennan has something called “intelligence” proving Trump’s collusion, then it must have come from an intelligence breach.

4. If he has something called “personal knowledge” of collusion, then it must only be shared with Mueller’s team, not with the NYT.

That’s it, according to the Senate Intelligence Chair, for real information about collusion. Either it’s intelligence to which Brennan is no longer entitled (assuming, of course, that Gina Haspel would have no reason to share intelligence about Russia with Brennan in some kind of consultation, which — if Brennan did then pass that on publicly, would be the only proper reason to strip his clearance). Or it’s “personal information,” usually called “evidence,” which may only be shared with Mueller and not with the press. “Intelligence,” which is the purview of the Intelligence Committee and the agencies it oversees. Or “evidence,” which is the purview of a DOJ investigation. Either/or.

That’s, of course, illogical, and not just because Burr’s own committee is investigating some of the same “evidence” that the FBI is, notably what happened on social media and what some witnesses have testified about, in secret, to the committee, and witnesses to both (like Rob Goldstone) have also commented publicly.

It’s illogical, too, because there are other ways to get real evidence of collusion. I believe I have evidence of collusion. I shared it with the FBI, sure. But after I revealed that I had provided information to the FBI in July, I also shared limited parts of it with some Republican Congressmen, in hopes of explaining to them how serious the investigation is and showing that entire parts of it don’t derive from Peter Strzok’s decisions. I’ve also discussed, prospectively, sharing it with some former top intelligence officials (unsurprisingly, not Brennan), in the interests of elucidating parts of the Russian attack they missed.

Yet even though his either/or proposition is false, Burr then uses it to proclaim Trump’s treatment of Brennan proper based on this remarkable statement:

5. “If, however, Director Brennan’s statement is purely political and based on conjecture, the president has full authority to revoke his security clearance as head of the Executive Branch.”

Having set up this false either/or proposition, Burr then suggests anything else must be “purely political” and “based on conjecture,” and — without showing the logical relation between the two clauses in this sentence — states that the President has the authority to revoke Brennan’s security clearance.

(If NOT (intelligence or evidence,) THEN political conjecture) THEN strip the damn clearance.

It is true that thus far the case law suggests that a President does have the authority to strip Brennan’s clearance (though a Brennan challenge, or even more easily, a Bruce Ohr challenge, might establish new limits to that authority). But that authority has no relationship to the claimed political or conjectural nature of Brennan’s comments. Not only does Burr suggest it does — suggest that stripping security clearances because of speech perceived to be political is not just proper but justified — but by yoking these two clauses together in one sentence, Burr suggests punishing political speech is in some way intimately tied to the authority therein.

Plus, as Brad Heath noted, Burr’s statement argues that Trump was right to strip Brennan’s clearance on July 26 because of statements Brennan made on August 16.

The Chairman of the Intelligence Committee, mind you, made this statement.

But here’s the reason why I really care about this.

Back when he was CIA Director, I openly criticized Brennan for the way he worked the press to get the most hawkish read of the Russian attack into the press. But I didn’t think his efforts arose from partisanship. Rather, it was an effort to raise alarm bells about the attack in the last weeks of the Administration. Such use of the press happens all the time when Administration officials are trying to advance their favored policy decisions.

Burr, however, is using his position of authority to affirmatively tie security clearances to speech he (or the President) deems excessively political. He’s doing it even as he argues there are just two appropriate categories of weighing whether collusion happened or not, intelligence (his purview) or evidence (Mueller’s). And he’s doing it as his committee is leading what has, up to this point, been the only Congressional investigation not utterly discredited by partisan bickering.

That pisses me off for several reasons. First, Burr is in the same breath being a raging partisan and asserting that his committee is one of the only entities that can appropriately weigh whether Trump conspired with Russia to win the election. He’s putting a thumb on the scale at precisely the moment that he claims only he (and Mueller) get to decide whether collusion happened. This raises real questions in my mind about what would happen if and when SSCI came upon information that shows Trump conspired with Russia. It raises real doubts in my mind about whether SSCI is able to conduct their investigation.

More importantly, he’s wrong. He’s wrong for the obvious reason that journalists are discovering important threads of the Russia investigation. Indeed, the part of SSCI’s work they’re most proud about — Russia’s use of social media — came out of a lot of really good reporting on the topic.

He’s wrong because we’re a democracy and whether Trump conspired with Russia will one day be most critically decided in a political sphere. As we get closer to that day, the American public has every right to read these two data points together and consider whether they show Trump and the Russians conspiring.

“Russia, if you’re listening, I hope you’re able to find the 30,000 emails that are missing. I think you will probably be rewarded mightily by our press.”

For example, on or about July 27, 2016, the Conspirators attempted after hours to spearphish for the first time email accounts at a domain hosted by a third-party provider and used by Clinton’s personal office. At or around the same time, they also targeted seventy-six email addresses at the domain for the Clinton Campaign.

And he’s wrong because none of the certified experts are getting the Russia story entirely right. As I said, I’ve had conversations in the last several months with Republican congressmen, former top intelligence officials, and a whole lot of experts on the Russian attack, including (but not limited to) top InfoSec people, other journalists, and some key witnesses. Even aside from the stuff I went to the FBI about (which might give me special insight to what happened, but also has made me admittedly blindered about other issues) all of those people, including me, have missed key things or gotten key details wrong. Just as one example, in conversations I’ve had with that ilk of people, every single person save one has either misread key parts of the GRU indictment or read in their prior assumptions (the one exception had the advantage of being a key witness behind at least two paragraphs of the indictment). That’s just one example, but it’s an example that suggests we need more honest discussion and less of Burr and Trump’s attempt to decertify democratic speech about what the President did.

The Chair of the Intelligence Committee, Richard Burr, effectively asserted that he is one of the few authorities with the right to say, based off what his committee does in private, whether Trump conspired with Russia or not, and that any citizen deigning to weigh in based off the public evidence may be properly disciplined by the President. The statement goes a long way to discredit the investigation his committee is doing, a real blow to his staffers’ success at bridging any partisan divide. Most importantly, because it so badly gets the epistemology of an attack that targeted all Americans wrong, it raises real questions about Burr’s understanding of the Russian attack at issue.

GRU’s Alice Donovan Persona Warned of a WannaCry-Like Event a Year before It Happened

As I disclosed last month, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

In this post, I suggested that The Shadow Brokers persona served as a stick to the carrots Vladimir Putin dangled in front of Donald Trump. When Donald Trump took an action — bombing Syria to punish Bashar al-Assad — that violated what I believe to be one of the key payoffs in the election quid pro quo, Shadow Brokers first bitched mightily, then released a bunch of powerful NSA tools that would soon lead to the WannaCry global malware attack.

It turns out GRU warned of that kind of attack a year before it happened.

One of the tidbits dropped into a very tidbit-filled GRU indictment is that GRU ran the Alice Donovan propaganda persona.

On or about June 8, 2016, and at approximately the same time that the dcleaks.com website was launched, the Conspirators created a DCLeaks Facebook page using a preexisting social media account under the fictitious name “Alice Donovan.”

That tidbit has led to some follow-up on the Donovan figure, including this typically great DFRLab piece arguing that Russia had two parallel streams of troll campaigns, the Internet Research Agency one focused on the election, and the GRU one focused on foreign policy.

Donovan was first exposed in December of last year after WaPo reported on and CounterPunch did a review of “her” work after then WaPo reporter Adam Entous contacted CP after learning the FBI believed “she” had some tie to Russia.

We received a call on Thursday morning, November 30, from Adam Entous, a national security reporter at the Washington Post. Entous said that he had a weird question to ask about one of our contributors. What did we know about Alice Donovan? It was indeed an odd question. The name was only faintly familiar. Entous said that he was asking because he’d been leaked an FBI document alleging that “Alice Donovan” was a fictitious identity with some relationship to Russia. He described the FBI document as stating that “Donovan” began pitching stories to websites in early 2016. The document cites an article titled “Cyberwarfare: Challenge of Tomorrow.”

As both pieces emphasize, the first article that Donovan pitched — and “she” pitched it to multiple outlets — pertained to cyberattacks, specifically to ransomware attacks on hospitals.

The article was first published in Veterans Today on April 26, 2016. That’s the same day that Joseph Mifsud first told George Papadopoulos Russia had emails — emails hacked by Donovan’s operators — they planned to leak to help defeat Hillary Clinton.

CounterPunch published the cybersecurity article on April 29. That’s the day the DNC first figured out that GRU (and FSB’s APT 29) had hacked them.

Those dates may well be coincidences (though they make it clear the Donovan persona paralleled the hack-and-leak campaign). I’m less sure about the third publication of the article, in Mint Press, on August 17, 2016, just four days after Shadow Brokers went live. So just days after Shadow Brokers had called out, “!!! Attention government sponsors of cyber warfare and those who profit from it !!!” an article was republished with the penultimate paragraph accusing the US of planning to shut down Iran’s power grid.

Moreover, the U.S. has been designing crippling cyber attack plans targeting the civilian sector. In case its nuclear negotiations with Iran failed, the U.S. was prepared to shut down the country’s power grid and communications networks.

The basis for that accusation was actually this article, but “Donovan” took out the reference (bolded below) to GRU’s attack on Ukraine’s power grid in the original.

Today such ransomware attacks are largely the work of criminal actors looking for a quick payoff, but the underlying techniques are already part of military planning for state-sponsored cyberwarfare. Russia showcased the civilian targeting of modern hybrid operations in its attack on Ukraine’s power grid, which included software designed to physically destroy computer equipment. Even the US has been designing crippling cyberattack plans targeting the civilian sector. In case its nuclear negotiations with Iran failed, the US was prepared to shut down the country’s power grid and communications networks.

Imagine a future “first strike” cyberattack in which a nation burrowed its way deeply into the industrial and commercial networks of another state and deployed ransomware across its entire private sector, flipping a single switch to hold the entire country for ransom. Such a nightmare scenario is unfortunately far closer than anyone might think. [my emphasis]

And “Donovan” adds in this sentence (from elsewhere in the Forbes article).

Government itself, including its most senior intelligence and national security officials are no better off when a single phishing email can redirect their home phone service and personal email accounts.

When this article was first published, the memory was still fresh of the Crackas with Attitude hack, where self-described teenagers managed to hack John Brennan and James Clapper and forward the latter’s communications (among the men serving prison sentences for this attack are two adult Americans, Andrew Otto Boggs and Justin Liverman).

Most of the rest of the article uses the threat of malware attacks on hospitals to illustrate the vulnerability of civilian infrastructure to cyberattack. It cites a Kaspersky proof of concept (recall that Shadow Brokers included a long play with Kaspersky). It cites an FBI agent attributing much of this hacking to Eastern Europe.

Stangl said the hackers, most of them from Eastern Europe, have increasingly targeted businesses, which are often able to pay more than individuals to unlock data. The hackers “scan the Internet for companies that post their contact information,” then send them email phishing attacks. Unsuspecting employees, Stangl said, are asked to click on what seem to be innocuous links or attachments — perhaps something as simple as a .PDF purporting to be a customer complaint — and before they know it, their computers are infected.

And the “Donovan” article explains at length — stealing from this article — why hospitals are especially vulnerable to malware attacks.

Such attacks may all sound like nightmare scenarios, but the experts say they’re becoming almost routine. And hospitals have not made cybersecurity a priority in their budgets. On average hospitals spent about 2 percent on IT, and security might be 10 percent of that. Compare that percentage to the security spending by financial institutions: for example, Fidelity spends 35 percent of its budget on IT.

Moreover, medical facilities are vulnerable to these attacks in part because they don’t properly train their employees on how to avoid being hacked, according to Sinan Eren, who has worked in cybersecurity for government and health-care organizations for two decades.

“It’s not like the financial-services industry, where they train employees how to spot suspicious emails,” said Eren, general manager at Avast Mobile Enterprise. Also, many hospital computer systems are outdated, bulky and in dire need of upgrades or newer software, he said. But such institutions often don’t have — or don’t want to spend — the money to make sweeping changes.

While it’s still unclear which computer WannaCry first infected in May 2017, Britain’s National Health Service was easily the most famous victim, with about a third of the system being shut down. Not long after WannaCry, NotPetya similarly spanned the globe in wiperware designed to appear as ransomware (though the latter’s use of NSA tools was mostly just show). While the US and UK have publicly attributed WannaCry to North Korea (I’m not convinced), NotPetya was pretty clearly done by entities close to GRU.

And a year before those global pseudo-ransomware worms were launched, repeated just days after Shadow Brokers started releasing NSA’s own tools, GRU stole language to warn of “a nation burrow[ing] its way deeply into the industrial and commercial networks of another state and deploy[ing] ransomware across its entire private sector, flipping a single switch to hold the entire country for ransom. Such a nightmare scenario is unfortunately far closer than anyone might think.”

(h/t TC for the heads up on this file and a number of the insights in this piece)

Update: MB noted that the “added” sentence actually also comes from the original Forbes article (it links to an earlier column that notes the Crackas tie explicitly).

[Photo: National Security Agency, Ft. Meade, MD via Wikimedia]

The Preferred Anti-Obama Russian Hack Story Remains Silent on Shadow Brokers

Michael Isikoff and David Corn are fluffing their upcoming book on the Russian tampering with the 2016 election. This installment covers the same ground, and the same arguments, and has the same weaknesses that this WaPo article did: It describes how urgent but closely held the CIA tips were (without considering whether the close hold on the intelligence led the IC to make incorrect conclusions about the attack). It describes efforts to make a public statement that got drowned out by the Pussy Grabber and Podesta releases. It airs the disappointment of those who thought Obama should have launched a more aggressive response.

Perhaps the biggest addition to the WaPo version is that this one includes more discussion of Obama’s thoughts on cyber proliferation, with the acknowledgement that the US would be more vulnerable than Russia in an escalating cyber confrontation.

Michael Daniel and Celeste Wallander, the National Security Council’s top Russia analyst, were convinced the United States needed to strike back hard against the Russians and make it clear that Moscow had crossed a red line. Words alone wouldn’t do the trick; there had to be consequences. “I wanted to send a signal that we would not tolerate disruptions to our electoral process,” Daniel recalled. His basic argument: “The Russians are going to push as hard as they can until we start pushing back.”

Daniel and Wallander began drafting options for more aggressive responses beyond anything the Obama administration or the US government had ever before contemplated in response to a cyberattack. One proposal was to unleash the NSA to mount a series of far-reaching cyberattacks: to dismantle the Guccifer 2.0 and DCLeaks websites that had been leaking the emails and memos stolen from Democratic targets, to bombard Russian news sites with a wave of automated traffic in a denial-of-service attack that would shut the news sites down, and to launch an attack on the Russian intelligence agencies themselves, seeking to disrupt their command and control modes.

[snip]

One idea Daniel proposed was unusual: The United States and NATO should publicly announce a giant “cyber exercise” against a mythical Eurasian country, demonstrating that Western nations had it within their power to shut down Russia’s entire civil infrastructure and cripple its economy.

[snip]

The principals did discuss cyber responses. The prospect of hitting back with cyber caused trepidation within the deputies and principals meetings. The United States was telling Russia this sort of meddling was unacceptable. If Washington engaged in the same type of covert combat, some of the principals believed, Washington’s demand would mean nothing, and there could be an escalation in cyber warfare. There were concerns that the United States would have more to lose in all-out cyberwar.

“If we got into a tit-for-tat on cyber with the Russians, it would not be to our advantage,” a participant later remarked. “They could do more to damage us in a cyber war or have a greater impact.” In one of the meetings, Clapper said he was worried that Russia might respond with cyberattacks against America’s critical infrastructure—and possibly shut down the electrical grid.

[snip]

Asked at a post-summit news conference about Russia’s hacking of the election, the president spoke in generalities—and insisted the United States did not want a blowup over the issue. “We’ve had problems with cyber intrusions from Russia in the past, from other counties in the past,” he said. “Our goal is not to suddenly in the cyber arena duplicate a cycle escalation that we saw when it comes to other arms races in the past, but rather to start instituting some norms so that everybody’s acting responsibly.”

The most dramatic part of the piece quotes an angry Susan Rice telling her top Russian expert to stand down some time after August 21.

One day in late August, national security adviser Susan Rice called Daniel into her office and demanded he cease and desist from working on the cyber options he was developing. “Don’t get ahead of us,” she warned him. The White House was not prepared to endorse any of these ideas. Daniel and his team in the White House cyber response group were given strict orders: “Stand down.” She told Daniel to “knock it off,” he recalled.

Daniel walked back to his office. “That was one pissed-off national security adviser,” he told one of his aides.

But like the WaPo article before it, and in spite of the greater attentiveness to the specific dates involved, the Isikoff/Corn piece makes not one mention of the Shadow Brokers part of the operation, which first launched just as NSC’s Russian experts were dreaming up huge cyber-assaults on Russia.

On August 13, Shadow Brokers released its first post, releasing files that had compromised US firewall providers and including a message that — while appearing to be an attack on American Elites and tacitly invoking Hillary — emphasizes how vulnerable the US would be if its own cybertools were deployed against it.

We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control. Let us spell out for Elites. Your wealth and control depends on electronic data. You see what “Equation Group” can do. You see what cryptolockers and stuxnet can do. You see free files we give for free. You see attacks on banks and SWIFT in news. Maybe there is Equation Group version of cryptolocker+stuxnet for banks and financial systems? If Equation Group lose control of cyber weapons, who else lose or find cyber weapons? If electronic data go bye bye where leave Wealthy Elites?

Sure, it’s possible the IC didn’t know right away that this was a Russian op (though Isikoff and Corn claim, dubiously and in contradiction to James Clapper’s November 17, 2016 testimony, that the IC had already IDed all the cut-outs Russia was using on the Guccifer 2.0 and DC Leaks operations). Though certainly the possibility was publicly discussed right away. By December, I was able to map out how it seemed the perpetrators were holding the NSA hostage to any retaliation attempts. Nice little NSA you’ve got here; it’d be a shame if anything happened to it. After the inauguration, Shadow Brokers took a break, until responding to Trump’s Syria strike by complaining that he was abandoning those who had gotten him elected.

Respectfully, what the fuck are you doing? TheShadowBrokers voted for you. TheShadowBrokers supports you. TheShadowBrokers is losing faith in you. Mr. Trump helping theshadowbrokers, helping you. Is appearing you are abandoning “your base”, “the movement”, and the peoples who getting you elected.

That was followed by a release of tools that would soon lead to billion dollar attacks using repurposed NSA tools.

As recently as February, the NSA and CIA were still trying to figure out what Russia (and the stories do appear to confirm the IC believed this was Russia) had obtained.

I mean, it’s all well and good to complain that Obama asked the NSC to stand down from its plans to launch massive cyberattacks as a warning to Putin. But you might, first, consider whether that decision happened at a time when the US was facing far greater uncertainty about our own vulnerabilities on that front.