Posts

There Are Almost Certainly Other DAG Rosenstein Memos

/15 Comments/in , , , /by

As I noted in this post, Robert Mueller’s team of “Attorneys for the United States of America” responded to Paul Manafort’s claim that Rod Rosenstein’s grant of authority to the Special Counsel did not extend to the money laundering he is currently being prosecuted for by revealing an August 2, 2017 memo from Rosenstein authorizing Mueller to investigate, along with a bunch of redacted stuff,

Allegations that Paul Manafort:

  • Committed a crime or crimes by colluding with Russian government officials with respect to the Russian government’s efforts to interfere with the 2016 election for President of the United States, in violation of United States law;
  • Committed a crime or crimes arising out of payments he received from the Ukrainian government before and during the tenure of President Viktor Yanukovych.

As the filing notes, this memo has not been revealed before, neither to us nor to Manafort.

That’s all very interesting (and has the DC press corps running around claiming this is a big scoop, when it is instead predictable). More interesting, however, is the date, which strongly suggests that there are more of these memos out there.

Mueller is unlikely to have waited two and a half months to memorialize his scope

I say that, first of all, because Rosenstein wrote the August 2 memo two and a half months after he appointed Mueller. Given Trump’s raging attacks on the investigation, it’d be imprudent not to get memorialization of the scope of the investigation at each step. Indeed, as I’ve noted, in the filing Mueller points to the Libby precedent, arguing that this memo “has the same legal significance” as the two memos Jim Comey used to (publicly) memorialize the scope of Patrick Fitzgerald’s investigation.

The August 2 Scope Memorandum is precisely the type of material that has previously been considered in evaluating a Special Counsel’s jurisdiction. United States v. Libby, 429 F. Supp. 2d 27 (D.D.C. 2006), involved a statutory and constitutional challenge to the authority of a Special Counsel who was appointed outside the framework of 28 C.F.R. Part 600. In rejecting that challenge, Judge Walton considered similar materials that defined the scope of the Special Counsel’s authority. See id. at 28-29, 31-32, 39 (considering the Acting Attorney General’s letter of appointment and clarification of jurisdiction as “concrete evidence * * * that delineates the Special Counsel’s authority,” and “conclud[ing] that the Special Counsel’s delegated authority is described within the four corners of the December 30, 2003 and February 6, 2004 letters”). The August 2 Scope Memorandum has the same legal significance as the original Appointment Order on the question of scope.

The first of those Comey letters, dated December 30, 2003, authorized Fitz to investigate the leak of Valerie Plame’s identity. The second of those, dated February 6, 2004, memorialized that Fitz could also investigate,

federal crimes committed in the course of, and with intent to interfere with, your investigation, such as perjury, obstruction of justice, destruction of evidence, and intimidation of witnesses; to conduct appeals arising out of the matter being investigated and/or prosecuted; and to pursue administrative remedies and civil sanctions (such as civil contempt) that are within the Attorney General’s authority to impose or pursue.

It’s the second memo that memorialized Fitz’ authority to prosecute Scooter Libby for protecting Dick Cheney’s role in outing Valerie Plame.

Mueller, then the acting FBI Director, would presumably have been in the loop of the Fitz investigation (as Christopher Wray is in Mueller’s) and would have known how these two letters proceeded. So it would stand to reason he’d ask for a memo from the start, particularly given that the investigation already included multiple known targets and that Trump is even more hostile to this investigation than George Bush and Dick Cheney were to Fitz’s.

Admittedly, unlike the Comey memo, which was designed for public release, there’s no obvious, unredacted reference to a prior memo. Though something that might imply a prior memo is redacted at the top of the released memo (though this is probably a classification marking).

And, given that this memo was designed to be secret, Rosenstein may have written the memo to obscure whether there are prior ones and if so how many.

The memo closely follows two key dates

That said, the date of the memo, August 2, is mighty curious. It is six days after the July 27 Papadopoulos arrest at Dulles airport. And seven days after the July 26 no knock search of Paul Manafort’s Alexandria home.

That timing might suggest any of several things. It’s certainly possible (though unlikely) the timing is unrelated.

It’s possible that Rosenstein wrote the memo to ensure those two recent steps were covered by his grant. That wouldn’t mean that the search and arrest wouldn’t have been authorized. The memo itself notes that Mueller would be obliged to inform Rosenstein before each major investigative step.

The Special Counsel has an explicit notification obligation to the Attorney General: he “shall notify the Attorney General of events in the course of his or her investigation in conformity with the Departmental guidelines with respect to Urgent Reports.” 28 C.F.R. § 600.8(b). Those reports cover “[m]ajor developments in significant investigations and litigation,” which may include commencing an investigation; filing criminal charges; executing a search warrant; interviewing an important witness; and arresting a defendant.

Both Papadopoulos’ arrest and that dramatic search would fit this criteria. So it’s virtually certain Rosenstein reviewed Urgent Memos on both these events before they happened. Plus, his memo makes it clear that the allegations included in his memo “were within the scope of the Investigation at the time of your appointment and are within the scope of the Order,” meaning that the inclusion of them in the memo would retroactively authorize any activities that had already taken place, such as the collection of evidence at Manafort’s home outside the scope of the election inquiry.

As I noted, the memo also asserts that Special Counsels’ investigative authority, generally, extends to investigating obstruction and crimes the prosecutor might use to flip witnesses.

The filing is perhaps most interesting for the other authorities casually asserted, which are not necessarily directly relevant in this prosecution, but are for others. First, Mueller includes this footnote, making it clear his authority includes obstruction, including witness tampering.

The Special Counsel also has “the authority to investigate and prosecute federal crimes committed in the course of, and with intent to interfere with, the Special Counsel’s investigation, such as perjury, obstruction of justice, destruction of evidence, and intimidation of witnesses” and has the authority “to conduct appeals arising out of the matter being investigated and/or prosecuted.” 28 C.F.R. § 600.4(a). Those authorities are not at issue here.

Those authorities are not at issue here, but they are for the Flynn, Papadopoulos, Gates, and Van der Zwaan prosecutions, and for any obstruction the White House has been engaging in. But because it is relevant for the Gates and Van der Zwaan prosecutions, that mention should preempt any Manafort attempt to discredit their pleas for the way they expose him.

The filing includes a quotation from DOJ’s discussion of special counsels making it clear that it’s normal to investigate crimes that might lead someone to flip.

[I]n deciding when additional jurisdiction is needed, the Special Counsel can draw guidance from the Department’s discussion accompanying the issuance of the Special Counsel regulations. That discussion illustrated the type of “adjustments to jurisdiction” that fall within Section 600.4(b). “For example,” the discussion stated, “a Special Counsel assigned responsibility for an alleged false statement about a government program may request additional jurisdiction to investigate allegations of misconduct with respect to the administration of that program; [or] a Special Counsel may conclude that investigating otherwise unrelated allegations against a central witness in the matter is necessary to obtain cooperation.”

That one is technically relevant here — one thing Mueller is doing with the Manafort prosecution (and successfully did with the Gates one) is to flip witnesses against Trump. But it also makes it clear that Mueller could do so more generally.

Mueller used the false statements charges against Papadopoulos to flip him. He surely hopes to use the money laundering charges against Manafort to flip him, too. Both issues may have been at issue in any memo written to newly cover the events of late July.

Mueller may not have revealed the scope of the Manafort investigation at that time

Now consider this detail: the second bullet describing the extent of the investigation into Manafort has a semi-colon, not a period.

It’s possible Mueller used semi-colons after all these bullets (of which Manafort’s is the second or third entry). But that, plus the resumption of the redaction without a double space suggests there may be another bulleted allegation in the Manafort allegation.

There are two other (known) things that might merit a special bullet. First, while it would seem to fall under the general election collusion bullet, Rosenstein may have included a bullet describing collusion with Aras Agalarov and friends in the wake of learning about the June 9 Trump Tower meeting with his employees. More likely, Rosenstein may have included a bullet specifically authorizing an investigation of Manafort’s ties with Oleg Deripaska and Konstantin Kilimnik.

The Mueller memo actually includes a specific reference to that, which as I’ve noted I will return to.

Open-source reporting also has described business arrangements between Manafort and “a Russian oligarch, Oleg Deripaska, a close ally of President Vladimir V. Putin.”

The latter might be of particular import, given that we know a bunch of fall 2017 interviews focused on Manafort’s ties to Deripaska and the ongoing cover-up with Kilimnik regarding the Skadden Arps report on the Yulia Tymoshenko prosecution.

All of which is to say that this memo may reflect a new expansion of the Manafort investigation, perhaps pursuant to whatever the FBI discovered in that raid on Manafort’s home. If so, that should be apparent to him, as he and his lawyers know what was seized.

Still, I wouldn’t be surprised if he inquired about what authorized that July 26 raid, if for no other reason than to sustain his effort to make more information on Mueller’s investigation public.

The redactions almost certainly hide two expansions to the investigation as it existed in October 2016

Now let’s turn to what else (besides another possible Manafort bullet) the redactions might show, and what may have been added since.

The unredacted description of the Manafort investigation takes up very roughly about one fifth of the section describing allegations Mueller was pursuing.

The Schiff Memo revealed that DOJ had sub-investigations into four individuals in October 2016.

Endnote 7 made it clear that, in addition to Page, this included Flynn and Papadopoulos, probably not Rick Gates, and one other person, possibly Roger Stone.

In August 2017, all four of those would have been included in a Rosenstein memo, possibly with a bullet dedicated to Gates alone added. That said, not all of these would require two or more bullets (and therefore as much space as the Manafort description). Papadopoulos’ description might include two, one dedicated to the collusion and one to the lying about collusion, or just one encompassing both the collusion and the lying. Flynn’s might include three, one dedicated to the collusion, one to the lying about it, and one to the unregistered foreign agent work, including with Turkey, that we know Mueller to have been investigating; or, as with Papadopoulos, the lying about the collusion might be incorporated into that bullet. Stone’s bullet would likely have only reflected the collusion, an investigation that is currently very active. Carter Page’s suspected role as a foreign agent might be one bullet or two.

That suggests, though doesn’t confirm, that there are a few other things included in those redacted bullets, things not included in the investigation in October 2016 as reflected in the Schiff memo.

Indeed, we should expect two more things to be included in the bullet points: First, the name of any suspect, including the President, associated with the obstruction of justice. Rosenstein himself had already been interviewed with respect to that aspect of the investigation by August 2, so surely Rosenstein had already authorized that aspect of the investigation.

The redactions most likely also include the names of Don Jr and Jared Kushner (and Paul Manafort), for their suspected collusion with Russia as reflected in the June 9 meeting. At least according to public reporting, Mueller may have first learned of this in June when Manafort and Kushner confirmed it in turning over evidence to Congress and Mueller. The first revelations that Mueller was obtaining subpoenas from a dedicated grand jury were on August 3, just one day after this memo. That same day, reports described Mueller issuing subpoenas related to the June 9 meeting.

Indeed, it’s quite possible Rosenstein issued this memo to memorialize the inclusion of the President’s spawn among the suspects of the investigation.

Rosenstein has almost certainly updated this memo since August 2

All that said, there’s not enough redacted space to include the known expanded current scope of the investigation, and given that the newly expanded scope gets closer to the President, Rosenstein has surely issued an update to this memo since then. These things are all definitively included in the current scope of the investigation and might warrant special mention in any update to Rosenstein’s authorizing memo:

Many of these — particularly the ones that affect only Russians — might be included under a generic “collusion with Russia” bullet. The closer scrutiny on Jared, however, surely would get an update, as would any special focus on the Attorney General.

More importantly, to the extent Mueller really is investigating Trump’s business interests (whether that investigation is limited just to Russian business, or more broadly) — the red line the NYT helpfully set for the President — that would necessarily be included in the most up-to-date memo authorizing Mueller’s activities. There is no way Mueller would take actions involving the President personally without having the authorization to do so in writing.

Which is why we can be virtually certain the August 2 memo is not the last memo Rosenstein has written to authorize Mueller’s actions.

Mind you, Mueller probably wouldn’t want to release a memo with several pages of redacted allegations. Which may be why we’re looking at the redacted version of an almost certainly superseded memo.

Updated: Later today Mueller’s team asked to file a copy of an exhibit–which given Judge Berman Jackson’s description of it as released in redacted form, has to be the Rosenstein memo–under seal. Which suggests they’re going to show Manafort what else they’re investigating (which I bet is the Deripaska stuff).

Did Ecuador Gag Julian Assange for Interference in Spain AND the US?

/101 Comments/in , /by

On Wednesday, Ecuador shut off Julian Assange’s access to the Internet and (far more interestingly) prohibited any visitors to the Embassy. It has been assumed the gag was a response to this tweet likening the German arrest of the Catalan leader Carlos Puigdemont on Spanish rebellion charges to the historical Nazi arrest of Catalan’s leader.

That’s definitely one of the two things that has gotten Assange in trouble with his hosts before. But I wonder if that’s the only thing that precipitated this gag.

In its statement about the gag, the government of Ecuador said Assange’s social media messages “put at risk the good relations the country has with the UK, the rest of the states of the EU, and other countries.”  It’s not just Spain and the UK that Ecuador is trying not to piss off.

And yesterday, in response to the campaign to lift the gag on Assange, Ecuador released another statement insisting that it had acted within the constitution and international law. As part of the statement, it reminded Assange of his duty not to interfere in the political activities of other countries prohibited to foreigners.

The Foreign Ministry also emphasizes that, beyond this commitment, all persons, regardless of their status, including those under international protection, are obliged to respect the norms of international law that govern peaceful coexistence and friendly relations. cooperation among the nations, citizens and civilized peoples of the world, among them the duty to abstain from political activities in a foreign country, provided for in Article 38 of the American Declaration of Rights and Duties of Man. The legal text states that every person has the duty not to intervene in political activities that, in accordance with the law, are exclusive of the citizens of the State in which he is a foreigner.

This sounds like more than a tweet suggesting the Germans are acting like Nazis. It sounds like the ConFraudUs language we’ve seen Mueller’s team to use.

And while the gag closely followed Assange’s tweet, it also followed the detention and questioning of Trump advisor Ted Malloch when he arrived in Logan airport Tuesday. Among the questions the FBI asked Malloch, they asked about his contacts with Roger Stone and Wikileaks.

“The questions got more detailed about my involvement in the Trump campaign (which was informal and unpaid); whom I communicated with; whom I knew and how well — they had a long list of names,” Malloch said. “They seemed to then focus more attention on Roger Stone (whom I have met a grand total of three times and with groups of people); Jerome Corsi, a journalist who edited a memoir I had written some years ago; and about WikiLeaks, which I knew nothing.”

He said was asked specifically if he had visited the Ecuadorian Embassy in London, where WikiLeaks founder Julian Assange has been holed up for nearly six years. He had not, he said.

The FBI let Malloch go, but not before seizing his phone and subpoenaing him to appear before Mueller’s grand jury on April 13.

That’s why I’m so interested that Ecuador has prohibited Assange visitors. The one time, in the past, they cut off his Internet access seemed to be a response to his release of emails designed to influence US politics, not Spanish politics. And his well-known use of mules to carry data to him would necessitate cutting off human visitors as well if Ecuador wanted to prevent his participation in foreign affairs.

In any case, if Mueller’s team ever provides solid evidence of more malign Assange involvement in the election, this is the kind of response I’d expect Ecuador to take.

The GOP PAC-thetic Effort to Disclaim Cambridge Analytica

/52 Comments/in , /by

In the wake of Friday’s news that Cambridge Analytica had not deleted psychographic data based off Facebook data, Republicans have claimed they didn’t rely on CA in 2016’s election. Major Garrett, for example, reported that, for most but not all uses, the Trump campaign replaced CA with RNC data after proving the latter more accurate.

In late September 2016, Cambridge and other data vendors were submitting bids to the Trump campaign. Then-candidate Trump’s campaign used Cambridge Analytica during the primaries and in the summer because it was never certain the Republican National Committee would be a willing, cooperative partner. Cambridge Analytica instead was a hedge against the RNC, in case it wouldn’t share its data.

The crucial decision was made in late September or early October when Mr. Trump’s son-in-law Jared Kushner and Brad Parscale, Mr. Trump’s digital guru on the 2016 campaign, decided to utilize just the RNC data for the general election and used nothing from that point from Cambridge Analytica or any other data vendor. The Trump campaign had tested the RNC data, and it proved to be vastly more accurate than Cambridge Analytica’s, and when it was clear the RNC would be a willing partner, Mr. Trump’s campaign was able to rely solely on the RNC.

Cambridge Analytica data was used for some targeted digital advertising and a large TV buy, but the main source of “get out the vote” and matching digital outreach data came from the RNC.

This story is not much different from one that got told last fall, in the wake of Brad Parscale’s testimony before the House Intelligence Committee. After using CA data for the first month of the general, the campaign transitioned to using RNC data (for whatever reason).

But according to both Parscale and [CA Chief Product Officer] Oczkowski, the campaign didn’t use Cambridge’s trove of data, opting instead for the RNC’s data file.

“The RNC was the voter file of record for the campaign, but we were the intelligence on top of the voter file,” Oczkowski says. “Sometimes the sales pitch can be a bit inflated, and I think people can misconstrue that.”

Parscale describes the firm’s work this way: “As I’ve said multiple times over prior statements, Matt Oczkowski and his team created a daily tracker of polling, so that I could see how Trump was doing in key swing states. They provided that to me daily.” Parscale says Cambridge also helped the campaign with what he calls “persuasion online media buying. They also helped us identify potential donors. And they created a visualization tool that showed in each state which areas were most persuadable and what those voters care about.”

As I noted at the time, however, Oczkowski claimed to be unaware of what CA was doing because the PAC activities were firewalled from campaign activities.

“I had absolutely no understanding any of this was going on, and I was surprised as everybody else when I saw the story” about Nix’s approach to Assange, Oczkowski says. During the campaign, he says his team was walled off from the rest of Cambridge, because the company was also working with a Trump Super PAC. Federal regulations prevent campaigns from coordinating with Super PACs. Of the 13 Cambridge staffers who worked in Trump’s San Antonio office, only four remain at the company.

Which, of course, suggests that the interesting stuff with CA was happening at the Super PAC, which just happens to have been run by the Mercers.

Today, Daily Beast reported that a Cambridge Analytica employee, Emily Cornell, gleefully pounced on the opportunity presented by the release of more stolen Hillary emails.

Cambridge Analytica hoped to capitalize on Russian hacking of Hillary Clinton and her ally, an email written by one of its employees indicates.

Emily Cornell, the employee, sent the email on July 29, 2016. It went out to people working with Make America Number One, the pro-Trump super PAC funded by Republican super-donors Robert and Rebekah Mercer.

After noting some of the firm’s work for the super PAC, Cornell wrote: “With her campaign getting hacked, I can only imagine what a new swatch [sic] of emails will do to her already fractured base!”

This seems to confirm two things. First, the Mercer directed efforts remained happy to exploit Russia’s theft even later in the process (remember the Alexander Nix email to Julian Assange kept Mercer in the loop). And also, the Trump campaign claim to have ditched Cambridge Analytica are only meaningful insofar as they really maintained that firewall between campaign and PAC.

How the DNC Hack Skeptics’ Dominant Theory Sinks Stone

/11 Comments/in , , , /by

I’ve been thinking about something since I wrote this piece on Roger Stone’s Swiss cheese denials of conspiring with Guccifer 2.0 or Wikileaks on the hack-and-leak. As I laid out, Stone’s denial consists of two tactics: he admits he spoke with Guccifer 2.0 at a time he believed him to have done the hack but notes that that happened after (he claims six weeks, but it was really three) the documents already started coming out. And he denies knowing anything in advance about Wikileaks, which wouldn’t be a problem anyway, he says, because there’s no evidence Wikileaks is a Russian asset.

Effectively, that puts Stone’s involvement after the undeniably criminal act — the hack of the DNC and puts the rest into simple general foreknowledge of Wikileaks’ plan.

As I noted in my first post on Stone’s non-denials, that doesn’t address the possibility he was involved in the Peter Smith led rat-fuck negotiations with Russian hackers to find Hillary’s deleted emails.

But there’s one other problem with it.

According to the public record, Guccifer 2.0 first spoke with Stone on August 12 (though in his statement to Congress, he fudged that date interestingly and claimed the first contact — perhaps meaning DM — was August 14). While that post-dates all known hacking, it pre-dates at least one and possibly several key dates on the leak part of the operation. As Raffi Khatchadourian lays out, Wikileaks may have obtained the John Podesta emails around this time.

A pattern that was set in June appeared to recur: just before DCLeaks became active with election publications, WikiLeaks began to prepare another tranche of e-mails, this time culled from John Podesta’s Gmail account. “We are working around the clock,” Assange told Fox News in late August. “We have received quite a lot of material.” It is unclear how long Assange had been in possession of the e-mails, but a staffer assigned to the project suggested that he had received them in the late summer: “As soon as we got them, we started working on them, and then we started publishing them. From when we received them to when we published them, it was a real crunch. My only wish is that we had the equivalent from the Republicans.”

All of the raw e-mail files that WikiLeaks published from Podesta’s account are dated September 19th, which appears to indicate the day that they were copied or modified for some purpose.

Indeed, Stone’s “Podesta time in the barrel” comment, which Chuck Todd noted addressed Tony but not John Podesta, may even have preceded Wikileaks’ receipt of the emails.

But Stone’s discussions with Guccifer 2.0 undeniably precede an event that, at least according to the skeptics’ theory, necessarily precedes the publication of Podesta’s emails. That’s Craig Murray obtaining … something from someone while he was in the US for the Sam Adams Award on September 25. He has said he didn’t obtain the documents, but it might be a key or something.

That still doesn’t, by itself, make Stone’s conduct criminal. But it does mean his timeline is not exonerating.

The Timing of Mark Warner’s PseudoScandal Texts

/12 Comments/in , , /by

By now, you’ve heard about Fox News’ scoop that Mark Warner made efforts last year to obtain testimony from two key figures in the Senate Intelligence Committee investigation into Russia’s involvement in the 2016 election via DC fixer Adam Waldman: Christopher Steele and Oleg Deripaska. (In my opinion, the news buried at the bottom of the story that Deripaska agreed to provide testimony if he could get immunity, but did not get it, is far more interesting than the rest of this, but I’m not a Fox News editor.)

“We have so much to discuss u need to be careful but we can help our country,” Warner texted the lobbyist, Adam Waldman, on March 22, 2017.

“I’m in,” Waldman, whose firm has ties to Hillary Clinton, texted back to Warner.

The story also includes this paragraph, which also has gotten less attention.

Warner began texting with Waldman in February 2017 about the possibility of helping to broker a deal with the Justice Department to get the WikiLeaks founder Julian Assange to the United States to potentially face criminal charges. That went nowhere, though a Warner aide told Fox News that the senator shared his previously undisclosed private conversations about WikiLeaks with the FBI.

Interestingly, the Fox story relies on texts that Warner and Richard Burr jointly requested in June (targeting Waldman’s phone, not Warner’s, apparently), and then turned over to the committee in October. I look forward to seeing how the notoriously anti-leak Burr deals with the apparent leak of committee sensitive materials to the right wing press.

Even while the story links to texts from SSCI, it comes a week after a woman duped the famously paranoid Julian Assange into exchanging texts with her fake Sean Hannity account promising news on Mark Warner.

[Dell] Gilliam, a technical writer from Texas, was bored with the flu when she created @SeanHannity__ early Saturday morning. The Fox News host’s real account was temporarily deleted after cryptically tweeting the phrase “Form Submission 1649 | #Hannity” on Friday night. Twitter said the account had been “briefly compromised,” according to a statement provided to The Daily Beast, and was back up on Sunday morning.

[snip]

Just minutes after @SeanHannity disappeared, several accounts quickly sprung up posing as the real Hannity, shouting from Twitter exile. None were as successful as Gilliam’s @SeanHannity__ account, which has since amassed over 24,000 followers.

Gilliam then used her newfound prominence to direct message Assange as Hannity within hours.

“I can’t believe this is happening. I mean… I can. It’s crazy. Nothing can be put past people,” Gilliam, posing as Hannity, wrote to Assange. “I’m exhausted from the whole night. What about you, though? You doing ok?”

“I’m happy as long as there is a fight!” Assange responded.

Gilliam reassured Assange that she, or Hannity, was also “definitely up for a fight” and set up a call for 9:30 a.m. Eastern, about six hours later.

“You can send me messages on other channels,” said Assange, the second reference to “other channels” he made since their conversation began.

“Have some news about Warner.”

With that in mind, I want to look at the timing of some security issues last year.

While the texts turned over to Congress date to February 14, the conversation pertaining to Steele started around March 22. That puts it not long after news of a massive hack involving T-Mobile, first reported March 16.

An unusual amount of highly suspicious cellphone activity in the Washington, D.C., region is fueling concerns that a rogue entity is surveying the communications of numerous individuals, likely including U.S. government officials and foreign diplomats, according to documents viewed by the Washington Free Beacon and conversations with security insiders.

A large spike in suspicious activity on a major U.S. cellular carrier has raised red flags in the Department of Homeland Security and prompted concerns that cellphones in the region are being tracked. Such activity could allow pernicious actors to clone devices and other mobile equipment used by civilians and government insiders, according to information obtained by the Free Beacon.

It remains unclear who is behind the attacks, but the sophistication and amount of time indicates it could be a foreign nation, sources said.

I would hope to hell that former cell company mogul and current Ranking Member on the Senate Intelligence Committee running an important counterintelligence investigation Mark Warner would be aware of the security problems with mobile phones. But what do I know? [Update: Not much. Looking more closely it looks like he was using Signal.] In the last several months we’ve learned that FBI’s investigators discuss the even more sensitive aspects of the more important side of counterintelligence investigation on SMS texts on their Samsung cell phones.

¯\_(ツ)_/¯

But who knows what Waldman (who apparently chats a lot with spies, mobbed up Russian oligarchs, and — as Mike Pompeo deemed Wikileaks — non-state hostile intelligence services) knows about cell phone security?

In any case, the day before that was reported publicly, Ron Wyden and Ted Lieu sent a letter to John Kelly (who, as a reminder, in spite of or because he ran DHS for a while, had his own cell phone compromised), stating in part,

We are also concerned that the government has not adequately considered the counterintelligence threat posed by SS7-enabled surveillance.

[snip]

What resources has DHS allocated to identifying and addressing SS7-related threats? Are these resources sufficient to protect U.S. government officials and the private sector.

If the government started considering such issues in March, they might have gotten around to discovering what kinds of problems were created by the T-Mobile hack in June, when Warner and Burr moved to get the texts for SSCI.

In any case, at around that point in time, APT 28 (one of the entities blamed for hacking the DNC the previous year) started a phishing campaign targeting the Senate’s email server.

Beginning in June 2017, phishing sites were set up mimicking the ADFS (Active Directory Federation Services) of the U.S. Senate. By looking at the digital fingerprints of these phishing sites and comparing them with a large data set that spans almost five years, we can uniquely relate them to a couple of Pawn Storm incidents in 2016 and 2017. The real ADFS server of the U.S. Senate is not reachable on the open internet, however phishing of users’ credentials on an ADFS server that is behind a firewall still makes sense. In case an actor already has a foothold in an organization after compromising one user account, credential phishing could help him get closer to high profile users of interest.

Reporting at the time suggested this was an effort in advance of the 2018 election (which aside from minimizing the damage Russia might do in the interim, ignores the fact that staffers are ostensibly prohibited from using Senate resources for election related activities). But it always seemed to me it would more profitably target policy.

Or, maybe the only reasonable work Congress is doing to investigate the Russians?

Whether there’s a connection between these two compromises last year or not, and Julian Assange, and this Mark Warner story, it’s clear that DC remains ill-prepared to address the counterintelligence problems they’re faced with.

Chuck Johnson’s Narrowed Scope of What a Russian Is Excludes Known Conspirators in Operation

/52 Comments/in , /by

Michael Tracey has a story that purports to show that the Senate Intelligence Committee, in negotiating voluntary cooperation with Chuck Johnson, is criminalizing being Russian.

The Senate committee probing alleged Russian interference in the U.S. political system has deemed anyone “of Russian nationality or Russian descent” relevant to its investigation, according to a document obtained by TYT.

[snip]

On July 27, 2017, Charles C. Johnson, a controversial right-wing media figure, received a letter from Sens. Burr and Warner requesting that he voluntarily provide materials in his possession that are “relevant” to the committee’s investigation. Relevant materials, the letter went on, would include any records of interactions Johnson had with “Russian persons” who were involved in some capacity in the 2016 U.S. elections.

The committee further requested materials related to “Russian persons” who were involved in some capacity in “activities that related in any way to the political election process in the U.S.” Materials may include “documents, emails, text messages, direct messages, calendar appointments, memoranda, [and] notes,” the letter outlined.

Doss’s statement was in response to a request made by Robert Barnes, an attorney for Johnson, for clarification as to the SSCI’s definition of a “Russian person.”

How the committee expects subjects to go about ascertaining whether a person is of “Russian descent” is unclear. “It does indicate that the committee is throwing a rather broad net,” Jonathan Turley, a professor of law at George Washington University, said. “It is exceptionally broad.” In terms of constitutionality, Turley speculated that “most courts would view that as potentially too broad, but not unlawful.”

Johnson played a key role in several known parts of the election operation. In addition to brokering Dana Rohrabacher’s meeting with Julian Assange, all designed to provide some alternative explanation for the DNC hack, Johnson worked with Peter Smith and Weev to try to find the deleted emails from Hillary’s server.

Johnson said he and Smith stayed in touch, discussing “tactics and research” regularly throughout the presidential campaign, and that Smith sought his help tracking down Clinton’s emails. “He wanted me to introduce to him to Bannon, to a few others, and I sort of demurred on some of that,” Johnson said. “I didn’t think his operation was as sophisticated as it needed to be, and I thought it was good to keep the campaign as insulated as possible.”

Instead, Johnson said, he put the word out to a “hidden oppo network” of right-leaning opposition researchers to notify them of the effort. Johnson declined to provide the names of any of the members of this “network,” but he praised Smith’s ambition.

“The magnitude of what he was trying to do was kind of impressive,” Johnson said. “He had people running around Europe, had people talking to Guccifer.” (U.S. intelligence agencies have linked the materials provided by “Guccifer 2.0”—an alias that has taken credit for hacking the Democratic National Committee and communicated with Republican operatives, including Trump confidant Roger Stone—to Russian government hackers.)

Johnson said he also suggested that Smith get in touch with Andrew Auernheimer, a hacker who goes by the alias “Weev” and has collaborated with Johnson in the past. Auernheimer—who was released from federal prison in 2014 after having a conviction for fraud and hacking offenses vacated and subsequently moved to Ukraine—declined to say whether Smith contacted him, citing conditions of his employment that bar him from speaking to the press.

Tracey’s claims are based on this email (and, clearly, cooperation with Johnson).

Except Tracey (and so presumably Johnson) appear to be misrepresenting what is going on.

When SSCI originally asked for Johnson’s cooperation in July, they asked him to provide communications “with Russian persons, or representatives of Russian government, business, or media interest” relating to the 2016 election and any hack related to it.

And while Tracey calls the December follow-up a “clarification,” Doss clearly considers it a “narrowing” of that July description. So the description Tracey finds so outrageous — people of Russian nationality or descent — appears to be a subset of what might be included in the original request.

Moreover, the narrowing might be really detrimental to SSCI’s ability to learn what Johnson was up to when he was seeking out Russian hackers who might have Hillary’s server. Consider just the examples of Karim Baratov or Ike Kaveladze. Both are likely suspects for involvement in the events of 2016. Baratov — the hacker who recently pled guilty to compromising selected Google and Yandex accounts for FSB — is a Canadian citizen born in Kazakhstan. Kaveladze — who works for Aras Agalarov, has past ties to money laundering, and attended the June 9, 2016 meeting — is an American citizen born in Georgia. Neither is ethnically Russian. So if Johnson had any hypothetical interactions with them, he could cabin off those interactions based on this narrowed definition of what counts as a Russian.

To say nothing of Johnson’s interactions with Assange, who is Australian, yet whose ties to Russia are unclear. Effectively, even if Johnson knew that Assange had coordinated with Russia last year, he wouldn’t have to turn over his communications with him, because he’s not himself Russian.

According to Tracey’s piece, Johnson says he won’t cooperate regardless, in spite of his lawyer’s efforts to narrow the scope of any cooperation.

But I find it interesting that his lawyer attempted to narrow any testimony in a fashion that might hide important parts of Johnson’s actions.

The Implicit Threat in Julian Assange’s Ambassador Tweet

/37 Comments/in , , /by

The other day, I suggested the Twitter Direct Messages between Wikileaks and Don Jr were underwhelming, in that some of the more damning things we might have expected did not show up in those DMs. Since then, several things have become clear. First, there were some time zone inaccuracies behind the timestamps on one of the most inflammatory claims (that Trump immediately tweeted in response to an October 12 DM from Assange; it probably was 75 minutes). And the password Wikileaks shared with Don Jr had been made available to journalists and may have been passed on by Chuck Johnson, who was currying favor with Assange at the time; that minimizes the possibility that such sharing could be deemed a CFAA or other kind of technical violation though puts Johnson more centrally in this picture.

I didn’t say explicitly enough in that post and I should have, though, that I was speaking about Don Jr, not about Wikileaks.

Wikileaks’ contributions do show the organization (and Assange in particular, in those DMs we know involved him) to be self-interested and rabidly anti-Clinton If you haven’t known the latter fact to be true since Hillary did some pretty crazy things in 2010, then you’re new to this rodeo. That said, the tweets did elicit some righteous betrayal from Barrett Brown, which I totally respect given the price he has paid for the claimed idealism of Wikileaks (see also this story).

It’s worth remembering, as Emma Best notes, because they’ve been under unrelenting surveillance since 2010, “WikiLeaks *knew* the DMs were being monitored in real time. It was inevitable that this would leak. Simply calling this dumb misses the point and ignores the tradecraft at play.” Assange, from the refusal of inside information to the demand for an Ambassadorship, was staging a show, and we should remember that.

That said, I’m far more interested in Assange’s subsequent response to the disclosure of the emails, specifically this tweet. In the full DMs released by Don Jr (I think Wikileaks can fairly claim Atlantic took out some context — Atlantic came close to and I think should have just replicated the content of all the DMs, though Brown disagrees), this was the comment Assange made on December 16 asking to be Ambassador.

Hi Don. Hope you’re doing well! In relation to Mr. Assange: Obama/Clinton placed pressure on Sweden, UK and Australia (his home country) to illicitly go after Mr. Assange. It would be real easy and helpful for your dad to suggest that Australia appoint Assange ambassador to DC “That’s a really smart tough guy and the most famous australian you have! ” or something similar. They won’t do it, but it will send the right signals to Australia, UK + Sweden to start following the law and stop bending it to ingratiate themselves with the Clintons. 12/16/16 12:38PM

On Tuesday, Assange posted an ostensible follow-up to that one, renewing his offer to serve as Ambassador.

Note, Assange had originally misspelled Don Jr’s twitter handle, so deleted and reposted it.

This has been taking as trolling, with Assange’s notion that he’d open a hotel in DC, as the Trumps have, with “luxury immunity suites” for whistleblowers.

But even that’s not trolling. It’s a public renewal, more explicit this time, of Assange’s request for a pardon from Trump Sr, though here he drops the “offer” of the claims laundered through Dana Rohrabacher that the emails Assange published to help Trump get elected came from an insider and not Russia. Assange wants the fuck out of his embassy closet, and he’s willing to say that explicitly, now, in a public tweet (as Best noted, making this request visible for all).

Remember, Rohrabacher was always clear that someone (or someones, but Chuck Johnson is clearly one of those people) had made clear that Trump wanted this information. Was Don Jr in on that loop?

It’s the rest of the tweet that got less attention. First, Assange’s promise of “a turbo-charged flow of intel about the latest CIA plots to undermine democracy,” a remarkable reference coming as it does in the wake of Mike Pompeo’s consideration of an alternative narrative for how Wikileaks got emails (as I noted, scheduled even as John Kelly thwarted Rohrabacher’s attempts to meet with Trump directly), not to mention Trump’s screed at John Brennan and others over the weekend.

Assange is agreeing with Trump, even if no one else is, even as the two of them both seek to push an alternative narrative that doesn’t have the Russians orchestrating Assange’s actions for Trump’s benefit, that the CIA is undermining Trump’s presidency.

It’s the hashtag, though, that most observers missed: Vault 8.

Vault 8 is the name Wikileaks has given for its release — started just Friday — of actual source code for CIA’s hacking tools, after long releasing “just” the development notes and manuals for the same tools. I noted then both the way Wikileaks was picking up Shadow Brokers’ narrative about Kaspersky, but also the multiple references to Wikileaks having the same set of NSA files as Shadow Brokers had.

I noted last December that with the December 14 Shadow Brokers release of new NSA tools (just days before Assange joked about being ambassador), the persona seemed to be engaging in extortion: “Nice little NSA here, it’d be shame if anything would happen to it.” Since that time, Shadow Brokers made good on the threat, leading to global cyberattacks. What Assange seems to be doing is similar: no longer a quid pro quo for safety in DC, but now a threat, using CIA, and tools released in CIA’s name, as hostage.

Assange is not offering to release secrets about CIA, but instead weapons leaked or stolen from them. Sure, to the extent the Vault 7 releases haven’t already, that’ll allow others to attribute CIA attacks. But it’ll also devastate the agency and badly undermine US power.

That appears to be where Assange’s request for immunity has gotten.

The Don Jr – WikiLeaks Emails Are Underwhelming

/68 Comments/in , , /by

Julia Ioffe has a big scoop on the content of DMs between Don Jr and WikiLeaks turned over to Congress (unless it came indirectly from Don Jr, as it may have, it’s another inappropriate leak that will discredit whatever source turned them over).

And I have to say, the DMs are more telling for what they don’t include than what they do. Most notably, Ioffe cites no DM showing Julian Assange explaining to Don Jr that his source wasn’t Russia, which given more recent efforts to pitch that story, you might have expected.

Just as notable, when Don Jr asks Assange what emails will be coming out the week of October 7 — one of the moments when, Democrats have speculated, some coordination between WikiLeaks and the Trump campaign may have occurred — Assange doesn’t answer.

On October 3, 2016, Wikileaks wrote again. “Hiya, it’d be great if you guys could comment on/push this story,” Wikileaks suggested, attaching a quote from then-Democratic nominee Hillary Clinton about wanting to “just drone” Wikileaks founder, Julian Assange.

“Already did that earlier today,” Trump Jr. responded an hour-and-a-half later. “It’s amazing what she can get away with.”

Two minutes later, Trump Jr. wrote again, asking, “What’s behind this Wednesday leak I keep reading about?” The day before, Roger Stone, an informal advisor to Donald Trump, had tweeted, “Wednesday@HillaryClinton is done. #Wikileaks.”

Wikileaks didn’t respond to that message, but on October 12, 2016, the account again messaged Trump Jr. “Hey Donald, great to see you and your dad talking about our publications,” Wikileaks wrote. (At a rally on October 10, Donald Trump had proclaimed, “I love Wikileaks!”)

The exchange is interesting for a number of reasons: given my questions about uncertainty over whether these would be Clinton Foundation emails or something else, there’s no discussion from either side about content. Don Jr seems to have gone to Assange rather than Roger Stone to find out about the impending dump. And there’s no talk about other impending dumps — not the Access Hollywood tape, not the Intelligence Community report blaming Russian for the hack.

All in all more exonerating than inculpating, particularly given the expectations around that week.

The other thing that doesn’t appear in these DMs is any hint that Don Jr knew of Peter Smith’s efforts to find and send to Wikileaks hacked copies of emails from Hillary’s server.

It is definitely the case that Assange was trying to gain some value from Trump, but Don Jr, at least, didn’t comply (indeed, as Ioffe notes, with just a few exceptions Don Jr didn’t respond). But (unless Don Jr withheld DMs that Twitter would have already turned over to Mueller) this in no way backs the narrative that Democrats suggested might have happened.

Here are the DMs Ioffe describes:

September 20: Wikileaks warns about PutinTrump (Don Jr promises to ask around, and emailed four people on the campaign telling them WikiLeaks had made contact)

October 3: Wikileaks asks for pushback on Hillary’s threat to drone Wikileaks (Don Jr says he had already done so)

October 3: Don Jr asks about the impending dump (Wikileaks doesn’t respond)

October 7: IC statement tying Wikileaks to the Russian operation

October 12: Wikileaks thanks Don Jr for his dad talking up Wikileaks, provides a preferred link (Don Jr tweets out the link two days later); Shortly after the original tweet, Don Sr tweeted out praise for Wikileaks, but didn’t use the link Assange wanted him to use. [Update: Some caution is due on this last point. While it indeed looks like Don Sr’s tweet closely follows the exchange, the DMs we have are printouts, meaning we can’t check the actual timestamps of the exchanges to verify what time zone they were set to.]

October 21: Wikileaks asks for a tax return to publish, trying to establish impartiality

November 8: Wikileaks suggests Trump not concede and challenge media corruption

November 9: Wikileaks tweets “wow”

December 16: Assange asks to be appointed Australian Ambassador to DC

July 11: Wikileaks offers to publish Don Jr’s Veselnitskaya email (Don Jr posts them himself)

Trump’s Campaign Didn’t Use Cambridge Analytica’s Pyschographics; Did His SuperPAC?

/25 Comments/in /by

In the wake of news that the head of Cambridge Analytica, Alexander Nix, offered to help Julian Assange with the stolen Hillary emails, Wired has a good story on what Trump’s campaign did with CA. In general, it says that the campaign did not rely on CA’s data, nor did it use CA’s famed psychographics based in part of Facebook data.

Cambridge worked both for the Trump campaign and a Trump-aligned Super PAC. In June 2016, Cambridge sent three staffers, led by chief product officer Matt Oczkowski, to the campaign’s San Antonio office. Oczkowski’s team eventually grew to 13 people, working under Trump digital director Brad Parscale and alongside his staff and outside consultants. According to Parscale, the Cambridge staff provided useful analysis of data about the American electorate. They did not, however, provide the raw data—things like demographic information, contact information, and data about how voters feel about different issues—on which that analysis was done.

That may sound like a small distinction, but it’s a crucial one. Ever since it burst onto the scene of American politics in 2015, Cambridge has trumpeted its massive data trove, boasting 5,000 data points on every American. Cambridge claims to have built extensive personality profiles on every American, which it uses for so-called “psychographic targeting,” based on people’s personality types. It is feared by some, including Hillary Clinton, for conducting a kind of psychological warfare against the American people and dismissed by others as snake oil. Both Parscale and Oczkowski have said repeatedly that the Trump campaign did not use psychographic targeting.

In fact, however, the story suggests Trump’s campaign did use CA data for a month, in July, because the RNC wasn’t yet sharing its data with Trump.

The Cambridge staff helped the campaign identify which voters in the RNC’s data file were most likely to be persuadable, meaning they were undecided but looked likely to swing toward Trump. They also created lists of voters who were most likely to become donors. In August 2016, a Trump aide told me Cambridge was critical to helping the campaign raise $80 million in the prior month, after a primary race that had been largely self-funded by Trump. This was the only period during which Oczkowski’s staff relied on Cambridge’s data, because the RNC was just beginning to share its data with the Trump team.

According to the WSJ, July is when Nix reached out to Assange.

But there’s another implicit revelation in the story: in explaining why he didn’t know about Nix’s outreach to Assange, CA chief product officer Matt Oczkowski, who led CA’s efforts with the campaign, said that they were walled off from CA because of rules prohibiting cooperation between campaigns and SuperPACs.

“I had absolutely no understanding any of this was going on, and I was surprised as everybody else when I saw the story” about Nix’s approach to Assange, Oczkowski says. During the campaign, he says his team was walled off from the rest of Cambridge, because the company was also working with a Trump Super PAC.

Which of course suggests that CA was embedded even more with the SuperPAC.

And that, in turn, raises a slew of other questions. For example, did people who left the Trump campaign — most notably Roger Stone — have any ties with the SuperPAC? After all, Stone had a role in efforts to find Hillary’s emails and surely a bunch of other rat-fuckery (because that’s what rat-fuckers do). So did the wing that was openly asking Russians for help also have closer ties to the more sordid aspects of what CA does?

Cambridge Analytica and the Hillary Emails

/22 Comments/in , , /by

Update: I made an error in this post: WSJ has made it clear the emails in question were the DNC emails, not the Hillary ones. I’ve deleted the parts that are inaccurate accordingly.

For some time, I have been interested in the many pieces of evidence that, partly as a result of late GOP ratfucker Peter Smith’s efforts, Julian Assange ended up with something approximating Hillary Clinton’s deleted emails. We know Smith alleged Mike Flynn was involved in the effort. Weev and Chuck Johnson were involved. There are reasons to believe Roger Stone was involved in the effort. And there are reasons to believe Guccifer 2.0 was involved in the effort.

Plus, everyone from Stone to Attorney General Sessions (who “did not recall” whether he had spoken to Russians about email in his SJC testimony) seems to be ignoring that part of the scandal in their denials of colluding with Russians.

And now, Cambridge Analytica — the data firm paid for by far right wing oligarch Bob Mercer that played a big role in getting Trump elected — is involved in it.

The DailyBeast reports that Congressional investigators have found an email from CA head Alexander Nix to some unnamed person (Trump’s digital director Brad Parscale was interviewed by HPSCI yesterday) saying he offered to help Assange with the project.

Nix, who heads Cambridge Analytica, told a third party that he reached out to Assange about his firm somehow helping the WikiLeaks editor release Clinton’s missing emails, according to two sources familiar with a congressional investigation into interactions between Trump associates and the Kremlin. Those sources also relayed that, according to Nix’s email, Assange told the Cambridge Analytica CEO that he didn’t want his help, and preferred to do the work on his own.

Assange, who insists he never says anything to compromise sources, released his own statement saying he rejected the help.

After publication, Assange provided this statement to The Daily Beast: ”We can confirm an approach by Cambridge Analytica and can confirm that it was rejected by WikiLeaks.”

Remember, Stone told the Russian hackers he was soliciting that, allegedly because he couldn’t verify the authenticity of any emails obtained from hackers, they should turn them over to Assange. And both the Nix email and the Assange denial seem to admit that WikiLeaks did, indeed, receive at least one set of those emails. Which would explain why Roger Stone was so certain WikiLeaks was going to drop Clinton Foundation emails — not the Podesta ones that Stone showed no interest in — in October of last year. And it would seem to explain why Guccifer 2.0 had the same belief.

That is, there are a whole bunch of dots suggesting WikiLeaks got something approximating Clinton’s emails, and either because they couldn’t be verified, or because his source was too obviously Russian, or some other unknown reason, he decided not to publish.

If that’s right, all these non-denial denials about the operation seem to point to a confluence of interest around this effort that touched pretty much everyone. And involved Russians, their agents, and GOP ratfuckers willfully working together.

Update: The Trump campaign just did some amazing bus under-throwing of CA. Compare that to this November 10 piece attributing their win to CA.