Posts

Dan Scavino, Alone with Trump, Had Access to the Attempted Murder Weapon

/96 Comments/in , /by

Since DC District unsealed Jack Smith’s warrant to obtain Trump’s Twitter account, I have described that one of the most important things prosecutors were seeking was attribution: to learn, before conducting an Executive Privilege-waived interview with Dan Scavino, whether Trump or Scavino wielded the murder weapon, Trump’s Twitter account, that almost got Mike Pence killed three years ago.

Donald Trump nearly killed his Vice President by tweet — the tweet he sent at 2:24PM on January 6, 2021.

111. At 2:24 p.m., after advisors had left the Defendant alone in his dining room, the Defendant issued a Tweet intended to further delay and obstruct the certification: “Mike Pence didn’t have the courage to do what should have been done to protect our Country and our Constitution, giving States a chance to certify a corrected set of facts, not the fraudulent or inaccurate ones which they were asked to previously certify. USA demands the truth!”

112. One minute later, at 2:25 p.m., the United States Secret Service was forced to evacuate the Vice President to a secure location.

113. At the Capitol, throughout the afternoon, members of the crowd chanted, “Hang Mike Pence!”; “Where is Pence? Bring him out!”; and “Traitor Pence!”

114. The Defendant repeatedly refused to approve a message directing rioters to leave the Capitol, as urged by his most senior advisors-including the White House Counsel, a Deputy White House Counsel, the Chief of Staff, a Deputy Chief of Staff, and a Senior Advisor.

As the indictment tells it, at the time Trump sent his potentially lethal tweet, inciting the mob bearing down on Mike Pence, Pence’s spouse, and daughter, Donald Trump was alone in his dining room with the murder weapon: an unknown phone, and his Twitter account.

But when DOJ served a warrant on Twitter for Trump’s Twitter account on January 17, they couldn’t be sure who was holding the murder weapon. They also wouldn’t know whether triggering the murder weapon was coordinated with other events.

That explains why, as Thomas Windom described in a February 9 hearing, metadata from Trump’s Twitter account showing any other account associated with his own may have been just as important for the investigation as any DMs obtained with the warrant.

MR. HOLTZBLATT: Well, Your Honor, we don’t — the issue, Your Honor — there isn’t a category of “associated account information”; that’s not information that Twitter stores.

What we are doing right now is manually attempting to ascertain links between accounts. But the ascertainment of links between accounts on the basis of machine, cookie, IP address, email address, or other account or device identifier is not information that Twitter possesses, it would be information that Twitter needs to create. So that’s the reason why we had not previously produced it because it’s not a category of information that we actually possess.

[snip]

MR. WINDOM: It is, as explained more fully in the warrant — but for these purposes, it is a useful tool in identifying what other accounts are being used by the same user or by the same device that has access to the account is oftentimes in any number of cases, user attribution is important. And if there are other accounts that a user is using, that is very important to the government’s investigation.

[snip]

MR. HOLTZBLATT: That’s right. If the records — if the linkage between accounts, which is what we understand this category to be referring to, is not itself a piece of information that we keep, then it’s not a business record that we would ordinarily produce.

What I understand the government to be asking is for us to analyze our data, as opposed to produce existing data. And we are trying to work with the government in that respect, but that is the reason that it is not something that — that is a different category of information. [my emphasis]

By that point, DOJ would have had Cassidy Hutchinson’s testimony describing what she saw sitting outside Trump’s dining room door (and once, going in to pass off Mark Meadows’ phone). They would have had two grand jury appearances from the two Pats, Cipollone and Philbin, the White House Counsel and Deputy Counsel described in the passage. They would have had at least one interview with Eric Herschmann — the Senior Advisor trying to calm him down.

They did not yet have privilege waived testimony from the Chief of Staff — Mark Meadows — or the Deputy Chief of Staff — Dan Scavino.

And Dan Scavino was the most likely other person to know about that near murder by tweet, because Dan Scavino was in his position, the Deputy Chief of Staff, first and foremost because he had masterminded Trump’s own mastery of Twitter going back to 2016.

So one thing DOJ needed to know before they conducted an interview that took place after Beryl Howell rejected yet another frivolous Executive Privilege claim in March was how Dan Scavino accessed Trump’s Twitter account when he did, from what device.

Who else had access to Trump’s Twitter account, one part of the murder weapon?

ABC News reported details from several of the interviews that took place after Jack Smith got that Twitter warrant, including extensive details about what Scavino told prosecutors. Sure enough, he claimed that he had nothing to do with the Tweet that almost got Pence killed — that instead, he had left Trump alone with the murder weapon. He claimed — as the indictment made it clear he must have — that he wasn’t in the room.

According to what sources said Scavino told Smith’s team, Trump was “very angry” that day — not angry at what his supporters were doing to a pillar of American democracy, but steaming that the election was allegedly stolen from him and his supporters, who were “angry on his behalf.” Scavino described it all as “very unsettling,” sources said.

At times, Trump just sat silently at the head of the table, with his arms folded and his eyes locked on the TV, Scavino recounted, sources said.

After unsuccessfully trying for up to 20 minutes to persuade Trump to release some sort of calming statement, Scavino and others walked out of the dining room, leaving Trump alone, sources said. That’s when, according to sources, Trump posted a message on his Twitter account saying that Pence “didn’t have the courage to do what should have been done.”

Trump’s aides told investigators they were shocked by the post. Aside from Trump, Scavino was the only other person with access to Trump’s Twitter account, and he was often the one actually posting messages to it, so when the message about Pence popped up, Cipollone and another White House attorney raced to find Scavino, demanding to know why he would post that in the midst of such a precarious situation, sources said.

Scavino said he was as blindsided by the post as they were, insisting to them, “I didn’t do it,” according to the sources. [my emphasis]

Why would Pat Cipollone confront Scavino about the Tweet if “Scavino and others walked out of the dining room” — implicitly, walked out together — “leaving Trump alone”? Cipollone would only confront Scavino if he had believed that Scavino were still there with Trump, as his testimony describes he had been until just before Trump sent the Tweet.

The warrant on Twitter, which would have shown whether it is really true that Scavino was the only other person with access to Trump’s Twitter account, is not the only way Jack Smith tested this claim, knew the answer to this claim before interviewing Scavino.

As an expert witness notice revealed last month, Smith will call a witness at Trump’s trial to describe what they found on Trump’s White House phone and that of one other person — which might be Scavino, Nick Luna (whose testimony is also described in detail in the ABC piece), or one of several other people. That witness will explain when Trump’s phone was unlocked and using Twitter on January 6.

Expert 3 has knowledge, skill, experience, training, and education beyond the ordinary lay person regarding the analysis of cellular phone data, including the use of Twitter and other applications on cell phones. The Government expects that Expert 3 will testify that he/she: (1) extracted and processed data from the White House cell phones used by the defendant and one other individual (Individual 1); (2) reviewed and analyzed data on the defendant’s phone and on Individual 1’s phone, including analyzing images found on the phones and websites visited; (3) determined the usage of these phones throughout the post-election period, including on and around January 6, 2021; and (4) specifically identified the periods of time during which the defendant’s phone was unlocked and the Twitter application was open on January 6.

So whether it is true that Scavino was blindsided by the Tweet, as he told Jack Smith he told Cipollone, Jack Smith has Scavino’s testimony that he wasn’t present (again, as I said he must), Cipollone’s testimony that Scavino said he wasn’t present, and metadata consistent with Trump sending the Tweet himself.

As you read the rest of the ABC piece, keep two things in mind. This leaked testimony concentrates on other aspects of the claims made to Jack Smith about how Twitter was used that day, such as this description of Luna’s testimony, describing that he warned Trump before the then-President sent a Tweet making him look “culpable” the day of the attack.

According to the sources, shortly before 6 p.m. on Jan. 6, Trump showed Luna a draft of a Twitter message he was thinking about posting: “These are the things and events that happen when a sacred landslide election victory is so unceremoniously and viciously stripped away from great patriots. … Remember this day for forever!” it read.

The message echoed what Trump had allegedly been saying privately all day.

Sources said Luna told Trump that it made him sound “culpable” for the violence, perhaps even as if he may have somehow been involved in “directing” it, sources said.

Still, at 6:01 p.m., Trump posted the message anyway.

That testimony — that Luna warned Trump the Tweet would make him look like he was responsible for the violence — will only strengthen the extent to which this Tweet was already going to be used to prove that Trump ratified the violence, effectively showing that Trump remained in a conspiracy with those who violently attacked the Capitol even after watching them do so.

Which brings me to the second point. Multiple people who gave this testimony — and probably the person or persons who shared it with ABC — claim to believe that they witnessed that Trump almost murdered his Vice President, someone who had been just as (or in Scavino’s case, almost as) loyal as they had been.

Again, there has to be a bunch of metadata that is consistent with the stories told to Jack Smith, so it’s not so much I doubt Scavino’s claim that he was not in the room when that Tweet was sent out. It’s that this testimony came from people who chose to stick around — some of whom, including Scavino, continue to stick around — knowing that if Trump ever turns on them he wouldn’t stop short of using his mob to get them killed.

It Was Donald Trump, in the Dining Room, with the Twitter Account

/27 Comments/in , /by

In spite of the fact that Jack Smith recognizes Trump’s interlocutory appeals of absolute immunity and double jeopardy will stay proceedings, as promised, his team nevertheless met a preexisting deadline yesterday: To provide expert notice.

Two of the notices describe how DOJ will show that the mob moved to the Capitol after Trump told them to.

The demonstration, and probably even the experts, are a version of something shown in a great number of January 6 trials already.

The third expert, however, has generated a great deal of attention. That expert will describe what two White House phones show about the actions Trump — and possibly another person, Individual 1 — took with those phones.

Expert 3 has knowledge, skill, experience, training, and education beyond the ordinary lay person regarding the analysis of cellular phone data, including the use of Twitter and other applications on cell phones. The Government expects that Expert 3 will testify that he/she: (1) extracted and processed data from the White House cell phones used by the defendant and one other individual (Individual 1); (2) reviewed and analyzed data on the defendant’s phone and on Individual 1’s phone, including analyzing images found on the phones and websites visited; (3) determined the usage of these phones throughout the post-election period, including on and around January 6, 2021; and (4) specifically identified the periods of time during which the defendant’s phone was unlocked and the Twitter application was open on January 6.

I’m particularly interested in the identity of Individual 1. Johnny McEntee told the January 6 Committee that Trump sometimes used his phone (albeit while traveling); the stolen documents indictment shows that he also used Molly Michael’s phone. Dan Scavino had access to Trump’s Twitter account.

But I’m not at all surprised by the fourth bullet point: The focus on when the phone was unlocked and open to Twitter on January 6.

It’s the counterpart of what I laid out in this post — and will undoubtedly be mirrored by the search returns from Trump’s Twitter account.

That post explained that the metadata involving attribution that Jack Smith’s team obtained from Twitter was probably at least as important as any DMs Trump received (and they only obtained around 32 DMs involving Trump’s account, what prosecutors called a “minuscule proportion of the total production”), because prosecutors would need to attribute the Tweet that almost got Mike Pence killed.

Donald Trump nearly killed his Vice President by tweet — the tweet he sent at 2:24PM on January 6, 2021.

111. At 2:24 p.m., after advisors had left the Defendant alone in his dining room, the Defendant issued a Tweet intended to further delay and obstruct the certification: “Mike Pence didn’t have the courage to do what should have been done to protect our Country and our Constitution, giving States a chance to certify a corrected set of facts, not the fraudulent or inaccurate ones which they were asked to previously certify. USA demands the truth!”

112. One minute later, at 2:25 p.m., the United States Secret Service was forced to evacuate the Vice President to a secure location.

113. At the Capitol, throughout the afternoon, members of the crowd chanted, “Hang Mike Pence!”; “Where is Pence? Bring him out!”; and “Traitor Pence!”

114. The Defendant repeatedly refused to approve a message directing rioters to leave the Capitol, as urged by his most senior advisors-including the White House Counsel, a Deputy White House Counsel, the Chief of Staff, a Deputy Chief of Staff, and a Senior Advisor.

As the indictment tells it, at the time Trump sent his potentially lethal tweet, inciting the mob bearing down on Mike Pence, Pence’s spouse, and daughter, Donald Trump was alone in his dining room with the murder weapon: an unknown phone, and his Twitter account.

But when DOJ served a warrant on Twitter for Trump’s Twitter account on January 17, they couldn’t be sure who was holding the murder weapon. They also wouldn’t know whether triggering the murder weapon was coordinated with other events.

[snip]

[O]ne thing DOJ needed to know before they conducted an interview that took place after Beryl Howell rejected yet another frivolous Executive Privilege claim in March was how Dan Scavino accessed Trump’s Twitter account when he did, from what device.

Who else had access to Trump’s Twitter account, one part of the murder weapon?

When DOJ asked Twitter to go back and figure out which other accounts shared IP addresses, cookies, or other device identifier with Trump’s Twitter account, they were asking for a list of other people (or at least clues to identify those people) who might be holding that murder weapon on January 6, Trump’s Twitter account, instead of Donald Trump.

Indeed, Thomas Windom said as much: “user attribution is important.”

What Jack Smith plans to do with the other evidence — what images the two phones had on them and what websites they visited — may actually be more interesting. After all, we know far less about the December 19 Tweet that kicked off the entire insurrection than we do the Tweet that almost got Trump’s Vice President killed. Somehow Trump’s Twitter account got the data from Peter Navarro that Trump’s account then tweeted out, announcing the January 6 rally. This expert testimony will be part of how prosecutors describe what happened.

But as to the Tweet that almost got Mike Pence killed? We know that. It was Donald Trump, alone in the dining room, with the lethal Twitter account.

Boris Epshteyn’s Absence and Presence in Trump’s Alleged Crime Spree

/19 Comments/in , , /by

ABC had a story yesterday revealing details about Trump attorney Jennifer Little’s role in the former president’s stolen document case. Most commentators are focused on the warning that Little testified she gave Trump: that failing to comply with a subpoena would be a crime.

But the backstory it tells is more interesting to me. It describes that Little — who continues to represent Trump on the Georgia case, though specialists in Georgia’s RICO law have also joined that team — was hired (the implication is, for the Georgia investigation) in March 2021 and only a year later did some other things for him.

Little was first hired by Trump in March 2021, only a couple of months after he left the White House, and shortly after authorities in Georgia launched their election-related probe. But more than a year later, she ended up briefly helping Trump with other matters.

When DOJ subpoenaed Trump in May 2022, Little suggested bringing in someone, “who had handled federal cases,”  which is reportedly why Evan Corcoran — someone totally inappropriate to a classified documents case, but someone who was then representing Steve Bannon in his contempt case — was brought in. In any case, I’m fairly certain Trump was already represented by people who had federal experience.

Little attended a May 23 meeting and, per ABC’s report, told Trump to take the subpoena seriously.

Four months later, believing Trump still possessed even more classified documents, the Justice Department issued its subpoena to him. Little suggested retaining an attorney who had handled federal cases before, so Corcoran was then hired, and she essentially handed over the matter to him, sources said.

On May 23, 2022 — 12 days after receiving the subpoena — Little and Corcoran met with the former president at Mar-a-Lago. It was Corcoran’s first time meeting Trump in person, and Little allegedly wanted to help ease Corcoran into his new role.

But, as sources described it to ABC News, Little told investigators she had a bigger purpose in going to that meeting: She wanted to explain to Trump that whatever happened before with the National Archives “just doesn’t matter,” especially because Trump never swore to them, under the penalty of perjury, that he had turned everything over, sources said. But whatever happens now has “a legal ramification,” Little said she tried to emphasize to Trump, according to the sources. [emphasis of passive voice my own]

That means that Little — and not Boris Epshteyn, as I and others had suspected — is Trump Attorney 2 in the indictment.

The indictment describes that Little and Evan Corcoran informed Trump about the subpoena, after which he authorized Corcoran, not Little, to accept service. The two lawyers met with Trump together on May 23.

53. On May 11, 2022, the grand jury issued a subpoena (the “May 11 Subpoena”) to The Office of Donald J. Trump requiring the production of all documents with classification markings in the possession, custody, or control of TRUMP or The Office of Donald J. Trump. Two attorneys representing TRUMP (“Trump Attorney 1” and “Trump Attorney 2”) informed TRUMP of the May 11 Subpoena, and he authorized Trump Attorney 1 to accept service.

54. On May 22, 2022, NAUTA entered the Storage Room at 3:47 p.m. and left approximately 34 minutes later, carrying one of TRUMP’s boxes.

55. On May 23, 2022, TRUMP met with Trump Attorney 1 and Trump Attorney 2 at The Mar-a-Lago Club to discuss the response to the May 11 Subpoena. Trump Attorney 1 and Trump Attorney 2 told TRUMP that they needed to search for documents that would be responsive to the subpoena and provide a certification that there had been compliance with the subpoena. TRUMP, in sum and substance, made the following statements, among others, as memorialized by Trump Attorney 1:

a. I don’t want anybody looking, I don’t want anybody looking through my boxes, I really don’t, I don’t want you looking through my boxes.

b. Well what if we, what happens if we just don’t respond at all or don’t play ball with them?

c. Wouldn’t it be better if we just told them we don’t have anything here?

d. Well look isn’t it better if there are no documents?

56. While meeting with Trump Attorney 1 and Trump Attorney 2 on May 23, TRUMP, in sum and substance, told the following story, as memorialized by Trump Attorney 1:

[Attorney], he was great, he did a great job. You know what? He said, he said that it – that it was him. That he was the one who deleted all of her emails, the 30,000 emails, because they basically dealt with her scheduling and her going to the gym and her having beauty appointments. And he was great. And he, so she didn’t get in any trouble because he said that he was the one who deleted them.

TRUMP related the story more than once that day.

57. On May 23, TRUMP also confirmed his understanding with Trump Attorney 1 that Trump Attorney 1 would return to The Mar-a-Lago Club on June 2 to search for any documents with classification markings to produce in response to the May 11 Subpoena. Trump Attorney 1 made it clear to TRUMP that Trump Attorney 1 would conduct the search for responsive documents by looking through TRUMP’s boxes that had been transported from the White House and remained in storage at The Mar-a-Lago Club. TRUMP indicated that he wanted to be at The Mar-a-Lago Club when Trump Attorney 1 returned to review his boxes on June 2, and that TRUMP would change his summer travel plans to do so. TRUMP told Trump Attorney 2 that Trump Attorney 2 did not need to be present for the review of boxes.

This section of the indictment relies heavily on Corcoran’s notes. Perhaps the only thing that relies on Little’s testimony is the description that Trump told her she did not have to be present to review the boxes — in retrospect, a weird decision, since the task of reviewing the contents of 35 or so boxes in one day is pretty daunting.

The indictment does not include the warning that ABC describes Little giving.

But, she told Trump, if there are any more classified documents, failing to return all of them moving forward will be “a problem,” especially because the subpoena requires a signed certification swearing full compliance, the sources said.

“Once this is signed — if anything else is located — it’s going to be a crime,” sources quoted Little as recalling she told Trump.

The sources said that when investigators asked Little if those messages to Trump “landed,” she responded: “Absolutely.”

The former president said something to the effect of, “OK, I get it,'” the sources said she recalled to investigators.

ABC notes in the story that they previously broke the news of Corcoran giving Trump warnings, warnings which also don’t appear in the indictment.

ABC News reported in September that, according to the notes and what Corcoran later told investigators, Corcoran had warned Trump that if he didn’t comply with the subpoena, he could face legal trouble and that the FBI might search his estate.

As I noted, I and others had previously assumed that Attorney 2 was Boris Epshteyn. That’s because he was centrally involved in this process: he had previously been credited with hiring Corcoran (which is why I bolded the passive voice reference above), he was reported to have recruited Christina Bobb to be the fall-gal on the false declaration, he pushed an aggressive strategy, and then he attempted to retroactively claim that at the time he was doing that, he was representing Trump as a lawyer, not a political consultant.

Remarkably, reporting on Boris’ role in all this has completely disappeared from the story.

Reports obviously sourced to witnesses friendly to the defendant are often an attempt to share information otherwise covered by a protective order with those potentially exposed: it’s a way to compare stories without leaving an obvious trail of witness tampering.

And this story, revealing details of testimony that would be of interest to the quasi-lawyers who were also involved in this process but who weren’t even mentioned in the indictment, comes just weeks after another such leak, of the video testimony from flipped witnesses in the Georgia case.

There may have been two leaks: one, of just the depositions of Jenna Ellis and Sidney Powell, to ABC, and a second, of fragments of the depositions of all four known cooperating witnesses, to WaPo. The lawyer for Misty Hampton, implicated with Powell in the Coffee County plot, admitted to leaking the videos, or at least some of them. But that doesn’t explain why there appear to be two sets of videos.

The ABC set describes Jenna Ellis describing first learning about the fake elector plot from an text thread Epshteyn initiated.

Ellis, who in her remarks alternated between speaking on and off the record with prosecutors, instead discussed only the context surrounding the two incidents she couldn’t divulge, including saying that she first learned about the concept of the fake electors plot from Giuliani and current Trump adviser Boris Epshteyn.

“There was one group [text] thread that Boris initiated when — which was the first time that I learned of it — asking me to just join a phone call,” Ellis told prosecutors, who then stopped her from discussing the details of the call.

The WaPo report includes a version of that.

The former Trump attorney also told prosecutors that she was asked to join a Dec. 7, 2020, conference call with Giuliani and two other Trump campaign officials — Mike Roman, who is also charged in the Georgia case, and Epshteyn — as they talked “legal strategy” with several Republicans who were slated to serve as Trump electors in Pennsylvania.

Ellis said she had not initially been privy to the “fake elector plot” and believed “it had been shielded from me specifically” — though she did not elaborate on why. Ellis said she became aware of the effort when she was added to a group text chain about the plan that included Giuliani, Epshteyn, Roman and Eastman.

It also adds Kenneth Chesebro’s description that Epshteyn, not Rudy Giuliani, was quarterbacking Trump’s efforts to undermine the election.

At one point, a prosecutor asked Chesebro who he thought was “quarterbacking” the Trump campaign’s legal efforts — Giuliani, Eastman or Epshteyn. Chesebro replied that it appeared to be Epshteyn. Epshteyn declined to comment.

Remember: Epshteyn is not charged in the Georgia indictment; Epshteyn is unindicted co-conspirator 3. Mike Roman is charged for the coordinating that both accomplished.

Epshteyn is, however, believed to be co-conspirator 6 in the DC indictment.

I suggested during the discussions about a protective order in DC that Epshteyn may have been the person prosecutors had in mind when objecting to including “other attorney[s] assisting counsel of record” in the case, not least because Trump attorney Todd Blanche also represents Epshteyn.

Epshteyn is not just someone who is known to have been closely involved in the fake elector conspiracy, but he is someone who in the stolen document case served as an “other attorney assisting counsel of record.” Crazier still, Epshteyn shares an attorney with Trump: Todd Blanche, who represents Trump in the Alvin Bragg case, the stolen documents case, and now the January 6 case. Epshteyn, who has never filed a notice of appearance for Trump, has followed him around to his various arraignments as if he is family.

If DOJ has a specific concern about Trump sharing discovery with Epshteyn — who has been centrally involved in Trump’s efforts to combat his legal jeopardy by attacking rule of law — this is the kind of objection they might raise.

I had already contemplated whether some of the exhibits submitted with a discovery motion (which on reflection, was submitted by Blanche) were intended to share information, including details about what Trump is trying to obtain under CIPA. For example, the initial 49-page discovery memo included with the motion would be really valuable to any unindicted co-conspirators who might find a way to access the unredacted copy submitted under seal. Aside from references to the general January 6 database (which is mentioned at more length in another file submitted), it is otherwise only cited for references to this redacted paragraph that by context appears to pertain to discovery relating to the Secret Service.

The motion itself has helpful details about how prosecutors on one Jack Smith investigation sat in on interviews of witnesses in the other Jack Smith investigation.

For example, the Special Counsel’s Office used the same grand jury in this District for matters relating to both cases. Assistant Special Counsel John Pellettieri has appeared on behalf of the Office in this case and in the Florida Case. Senior Assistant Special Counsel (“SASC”) Thomas Windom, who has entered a notice of appearance for the prosecution in this case, participated in at least 27 of the interviews described in discovery produced in the Southern District of Florida. SASC Julie Edelstein, counsel of record in the Florida Case, participated in 29 of the interviews that have been produced in discovery in this case. Jay Bratt, also counsel of record in the Florida Case and Counselor to the Special Counsel, participated in 10 of the interviews that have been produced in discovery in this case. Notwithstanding the clear overlap of personnel and intermixed responsibilities, the Office has sought to artificially narrow its definition of the prosecution team to an unidentified subset of individuals who, apparently in its sole judgment, “are working on this case.” Ex. D. Not so. As the entire Office has participated in this prosecution, both in fact and by General Garland’s Order, the entire Office is subject to the prosecution’s discovery obligations.

This is likely highly misleading: for people who are witnesses in both cases — as, for example, Molly Michael and Alex Cannon would be — DOJ shared both sets of witness 302s in both places (and so some of the Edelstein and Bratt interviews would simply be stolen document interviews shared in January 6 discovery and some of the Windom interviews would be the counterpart). But it is also likely the case that some prosecutors sat in on interviews that would touch on investigative subjects of interest.

Then there’s Blanche’s treatment of it. After objecting back in September when DOJ submitted a filing along with the motion to seal it, that’s what Trump did here (for which Judge Chutkan scolded them), so if DOJ had any objection to the non-redactions in these filings, it would have been too late.

Boris Epshteyn, who was the focus for months of reporting about his role in Trump’s twin federal indictments, has all but disappeared. Indeed, ABC’s scoop about Little makes clear that his reportedly significant role in the stolen documents case never even made the indictment.

But as other recent leaks make clear, his role in both alleged felony conspiracies remains significant.

DOJ’s Responses on Trump’s Motions to Dismiss

/9 Comments/in , /by

DOJ submitted their responses to Trump’s motions to dismiss today. As a reminder, here’s my summary of Trump’s arguments.

I’ll write them up tomorrow, but here are links:

Here’s my Xitter thread on the omnibus response to MTD on Statutory and Constitutional Grounds.

I, Too, Got Hoodwinked by Donald Trump’s Demands to Be Tried Like a Seditionist

/60 Comments/in /by

I’m about to write a post about what, per the DOJ, the discovery in Trump January 6 case is like.

But first, I have to confess.

When I read Trump’s own pitch for a trial in 2026, I missed one of his more clever deceits. It’s this one:

Indeed, the median time from commencement to termination for a jury-tried § 371 charge is 29.4 months—many times longer than the government’s proposal schedule. 12 (And this reflects only the median, meaning half of all such cases take more time based on individualized assessments of discovery volume, complexity, and similar concerns.)

12 Administrative Office of the United States Courts, Table D-10: U.S. District Courts–Median Time Intervals From Commencement to Termination for Criminal Defendants Disposed of, by Offense, During the 12-Month Period Ending September 30, 2022, at 2, jb_d10_0930.2022.pdf (uscourts.gov). [my emphasis]

To be sure, I should have been alerted to the deceit by this paragraph, in the same section.

Likewise, this Court regularly allows far more time than the government proposes, even in cases involving protests at the Capitol on January 6, 2021. See, e.g., United States v. Foy, No. 21- cr-0108 (28 months from indictment to stipulated bench trial on 4-page indictment); United States v. Nordean, et al, No. 21-cr-0175 (TJK) (21 months); United States v. Crowl, et al, No. 21-cr-0028 (APM) (23 months); United States v. Kuehne, et al, Case No. 21-cr-160 (29 months); United States v. Hostetter, et al, Case No. 21-cr-0392 (RCL) (24 months). [my emphasis]

Trump was calling now-convicted seditionists — and other militia members accused of attacking our democracy — “protestors”!!!!

My only excuse is that I read it in the middle of the night and figured I’d deal with it–as I intend to–once the government replied, which they now have.

One reason I’m so angry that I didn’t see this particular lie, though, is because I’ve pointed out what a blindspot this is among TV lawyers and insipid NYT columnists who like to blather about the investigation taking too long.

Everything got held up by COVID, not just the January 6 investigation. The first felony trial for Jan6ers was delayed until March 2022, partly because of COVID backlogs, and partly because of discovery challenges.

Only after that did Trump stall everything with frivolous Executive Privilege claims in the wake of SCOTUS upholding Judge Chutkan’s own ruling on the topic (another complaint Trump raised in his motion almost no one called out).

It turns out, as DOJ explained in a filing today, that Donald Trump was using the delays in the January 6 investigation necessitated by COVID to claim he shouldn’t be tried for January 6 until he gets a shot at being President again.

The defendant’s references to Section 371 statistics and January 6th cases overlook important underlying facts and context. See ECF No. 30 at 12. First, the defendant cites the median time from commencement to termination for jury trials of Section 371 charges—29.4 months—without explaining that this median time runs through the completion of sentencing, not the beginning of trial. That means that it includes the time required for jury selection, trial, verdict, and several months (or more) afterward before sentencing and final judgment. See https://www.uscourts.gov/sites/default/files/data_tables/jb_d10_0930.2022.pdf. The question here is when it is appropriate to start trial in this case, and statistics regarding the length of time from indictment to sentencing in other Section 371 cases have no bearing on that decision

Second, the data cited by the defendant spans October 2021 through September 2022, when federal courts were pulling out of a backlog caused by COVID-19 closures. During that period, only 22 cases went to trial nationwide. This small and skewed sample provides no help to the Court in deciding an appropriate trial date.

The defendant’s listed January 6th cases also omit important details and context. He fails to mention, for instance, that in one case he cites, disposition was delayed because of, among other reasons, litigation over pre-trial detention, a superseding indictment, and plea negotiations. See United States v. Foy, 21-cr-108, ECF No. 55, Superseding Indictment (11/10/21); 2/7/22 Minute Entry (setting jury trial for 9/19/22); ECF No. 67, Defendant’s Unopposed Motion to Vacate Trial Date (for, among other reasons, plea negotiations). All of the defendant’s other cited cases included multiple co-defendants—as many as seventeen. See United States v. Crowl, et al., 21- cr-28 at ECF No. 328, Fifth Superseding Indictment. The Court should set these inapposite comparisons aside when weighing the individual factors here under the Speedy Trial Act.

Trump was cherry picking data skewed by the catastrophe that might have been mitigated had his own COVID response been less irresponsible. He was cherry picking from among the other January 6 defendants (some adjudged seditionists), some of whose trials established precedents for his own.

Donald Trump argued that his trial, all by himself, should take as long as the Proud Boy leaders and other charged militia defendants, even without the COVID delays. He’s demanding that his trial take as long as it could if Jack Smith chose to try him for the whole kit and kaboodle, in which he might be guilty, but of which he is not yet charged.

And I fell for it.

As Xitter’s Lawyer Stalled DOJ, Elon Musk Met with Jim Jordan (Twice!) and Kevin McCarthy

/52 Comments/in , , /by

Elon Musk has been eerily quiet about being held in contempt by Beryl Howell since the DC Circuit opinion was first released on August 9.

It’s not like him to pass up the opportunity to make an obnoxious comment.

Which is why I’m interested in what Musk was doing during the period when Xitter’s counsel was stalling on the DOJ request — including a visit to Kevin McCarthy on January 26.

Beryl Howell approved the warrant on January 17. After several failed attempts, the government served it to the official portal on January 19. But then Xitter’s senior-most legal person stalled for 12 days, until she told DOJ that Xitter was going to make a First Amendment challenge so Trump could invoke executive privilege.

The government’s initial service attempts on Twitter filed twice, with the government’s receipt both times of an automated message indicating that Twitter’s “page [was] down.” Gov’t’s Mot. at 2 (alteration in original). On January 19, 2023, the government was finally able to serve Twitter through the company’s Legal Requests Submissions site. Id

Twitter, however, somehow did not know of the existence of the Warrant until January 25, 2023—two days before the Warrant returns were due. That day, the government contacted Twitter about the status of the company’s compliance with the Warrant, and Twitter’s Senior Director of Legal, JN [redacted], indicated she was not aware of the Warrant but would consider it a priority.” Id; see also Decl. of [redacted], Senior Director of Legal for Twitter (“[redacted] Decl”) 2 (SEALED), ECF No. 9-1. The government indicated that they were looking for an on time production in two days time” to which [J redacted] responded, “without knowing more or taking any position that would be a very tight turn around for us.” [Jl Decl. ¶ 2. The government sent the six pages of the Warrant and the NDO directly to [J redacted] later that evening Meanwhile, [J redacted] directed Twitter’s personnel to preserve data available in its production environment associated with the Target Account, and “have confirmed that the available data was preserved.” Id. ¶ 4.

Twitter notified the government in the evening of January 26, 2023, that the company “would not comply with the Warrant by the next day, “Id. 5, and responded to the government’s request for more specific compliance information, by indicating that “the company was prioritizing the matter and taking it very seriously” but that [redactedl had the Warrant and NDO only “for two days,” id. ¶ 8, even though the government had tried to submit the Warrant and NDO through Twitter’s Legal Requests Submissions site nine days earlier. The Warrants deadline for compliance makes no exception for the provider’s failure to have a fully operational and functioning system for the timely processing of court orders.

On January 31, 2023, Twitter indicated for the first time that the company would not comply with the Warrant without changes to the NDO, stressing as “essential to Twitter’ business model including [its] commitment to privacy, transparency, and neutrality) that [Twitter] communicate with users about law enforcement efforts to access their data.” 1d. 10.

The Legal Director’s declaration is more obnoxious than that. She made no mention of DOJ’s attempts to serve the warrant before she got involved and makes much of a claim that it took the AUSA two efforts to email a separate copy to her. Her assurances that everything was preserved — made as of January 25 — don’t rule out any deletions before that.

It wasn’t until February 1 that WilmerHale was officially involved.

And in the meantime, Elon Musk had made a widely covered trip to DC. He met with Jim Jordan on Thursday January 26, Kevin McCarthy that evening, and then Jordan (again) with James Comer the next day (Axios, NYT, CNN)

As of now, at least, Jordan and McCarthy are two of the just 51 people that Trump follows, who could have sent him DMs.

The next week, Comer formally announced his dick pics hearing, which (as Allison Gill observed yesterday) took place the day between two hearings on the warrant, as contempt fees started piling up. In that hearing, Republicans spun Musk’s willful violation of the consent decree against Xitter as an assault on the First Amendment.

As it was happening, Musk posted a tweet with nothing more but a period.

This was happening in the period when Xitter was doing more intensive searches to get — for example — the second preservation of Trump’s account from January 12, 2021 and all other accounts associated, via common device, cookie, or IP, with Trump’s own.

In the February 7 hearing, then-Chief Judge Beryl Howell questioned whether Xitter was stalling on this production because Musk “wants to cozy up with the former President, and that’s why you are here?”

But it may be more than that.

Musk is solidly part of the far right culture that might have been involved in any DM lists organizing the insurrection. One of the main reasons he started considering buying Xitter is because of the efforts Xitter took in the aftermath to crack down on violence.

And in the lead-up to Musk’s purchase of Xitter, someone — there’s reason to believe it might be Stephen Miller, who had been interviewed by Jack Smith’s prosecutors in November, before he was interviewed in a privilege-waived interview in April — texted Musk personally to raise the sensitivities of restoring Trump to Xitter.

And one of Musk’s phone contacts appears to bring Trump up. However, unlike others in the filings, this individual’s information is redacted.

“It will be a delicate game of letting right wingers back on Twitter and how to navigate that (especially the boss himself, if you’re up for that),” the sender texted to Musk, referencing conservative personalities who have been banned for violating Twitter’s rules.

The anonymous texter then offers up a suggestion for “someone who has a savvy cultural/political view to be the VP of actual enforcement.” That suggestion: “A Blake Masters type.”

Any delays and obstruction may not just be an effort to protect Trump.

It could be Musk’s effort to protect his own network — and people in DC like Jim Jordan.

Death by Tweet: “User Attribution Is Important”

/102 Comments/in , , /by

Donald Trump nearly killed his Vice President by tweet — the tweet he sent at 2:24PM on January 6, 2021.

111. At 2:24 p.m., after advisors had left the Defendant alone in his dining room, the Defendant issued a Tweet intended to further delay and obstruct the certification: “Mike Pence didn’t have the courage to do what should have been done to protect our Country and our Constitution, giving States a chance to certify a corrected set of facts, not the fraudulent or inaccurate ones which they were asked to previously certify. USA demands the truth!”

112. One minute later, at 2:25 p.m., the United States Secret Service was forced to evacuate the Vice President to a secure location.

113. At the Capitol, throughout the afternoon, members of the crowd chanted, “Hang Mike Pence!”; “Where is Pence? Bring him out!”; and “Traitor Pence!”

114. The Defendant repeatedly refused to approve a message directing rioters to leave the Capitol, as urged by his most senior advisors-including the White House Counsel, a Deputy White House Counsel, the Chief of Staff, a Deputy Chief of Staff, and a Senior Advisor.

As the indictment tells it, at the time Trump sent his potentially lethal tweet, inciting the mob bearing down on Mike Pence, Pence’s spouse, and daughter, Donald Trump was alone in his dining room with the murder weapon: an unknown phone, and his Twitter account.

But when DOJ served a warrant on Twitter for Trump’s Twitter account on January 17, they couldn’t be sure who was holding the murder weapon. They also wouldn’t know whether triggering the murder weapon was coordinated with other events.

That explains why, as Thomas Windom described in a February 9 hearing, metadata from Trump’s Twitter account showing any other account associated with his own may have been just as important for the investigation as any DMs obtained with the warrant.

MR. HOLTZBLATT: Well, Your Honor, we don’t — the issue, Your Honor — there isn’t a category of “associated account information”; that’s not information that Twitter stores.

What we are doing right now is manually attempting to ascertain links between accounts. But the ascertainment of links between accounts on the basis of machine, cookie, IP address, email address, or other account or device identifier is not information that Twitter possesses, it would be information that Twitter needs to create. So that’s the reason why we had not previously produced it because it’s not a category of information that we actually possess.

[snip]

MR. WINDOM: It is, as explained more fully in the warrant — but for these purposes, it is a useful tool in identifying what other accounts are being used by the same user or by the same device that has access to the account is oftentimes in any number of cases, user attribution is important. And if there are other accounts that a user is using, that is very important to the government’s investigation.

[snip]

MR. HOLTZBLATT: That’s right. If the records — if the linkage between accounts, which is what we understand this category to be referring to, is not itself a piece of information that we keep, then it’s not a business record that we would ordinarily produce.

What I understand the government to be asking is for us to analyze our data, as opposed to produce existing data. And we are trying to work with the government in that respect, but that is the reason that it is not something that — that is a different category of information. [my emphasis]

By that point, DOJ would have had Cassidy Hutchinson’s testimony describing what she saw sitting outside Trump’s dining room door (and once, going in to pass off Mark Meadows’ phone). They would have had two grand jury appearances from the two Pats, Cipollone and Philbin, the White House Counsel and Deputy Counsel described in the passage. They would have had at least one interview with Eric Herschmann — the Senior Advisor trying to calm him down.

They did not yet have privilege waived testimony from the Chief of Staff — Mark Meadows — or the Deputy Chief of Staff — Dan Scavino.

And Dan Scavino was the most likely other person to know about that near murder by tweet, because Dan Scavino was in his position, the Deputy Chief of Staff, first and foremost because he had masterminded Trump’s own mastery of Twitter going back to 2016.

So one thing DOJ needed to know before they conducted an interview that took place after Beryl Howell rejected yet another frivolous Executive Privilege claim in March was how Dan Scavino accessed Trump’s Twitter account when he did, from what device.

Who else had access to Trump’s Twitter account, one part of the murder weapon?

When DOJ asked Twitter to go back and figure out which other accounts shared IP addresses, cookies, or other device identifier with Trump’s Twitter account, they were asking for a list of other people (or at least clues to identify those people) who might be holding that murder weapon on January 6, Trump’s Twitter account, instead of Donald Trump.

Before Dan Scavino told the grand jury that he wasn’t in the room when that tweet was sent, as he must have, DOJ would have needed a better idea whether Scavino sent the tweet, to know whether he was telling the truth once he did sit for a privilege waived interview.

But they were also asking for a very specific clue about the other part of that murder weapon: some way to identify the phone from which the potentially deadly tweet was sent. Identifying which phone was alone in the room with Donald Trump on January 6 would also identify which phone to go seize to learn who else Trump was communicating with when he was sitting alone in his dining room as he watched his supporters assault the Capitol. Identifying which phone was alone in the room with Donald Trump on January 6 would help to fill the gap in communications that the January 6 Committee never completely filled.

And not just that phone.

Obtaining the associations to Trump’s Twitter account would also help explain one of the most enduring mysteries about January 6: What happened between the time Sidney Powell left after a screaming meeting on December 18 and the time Trump announced the rally in the early hours of December 19, leading thousands of his most rabid followers to start planning to come to DC?

87. On December 19, 2020, after cultivating widespread anger and resentment for weeks with his knowingly false claims of election fraud, the Defendant urged his supporters to travel to Washington on the day of the certification proceeding, tweeting, “Big protest in D.C. on January 6th. Be there, will be wild!” Throughout late December, he repeatedly urged his supporters to come to Washington for January 6.

That December 19 tweet, and the phone it was sent from, was another kind of murder weapon, the shot that would set off the entire riot. And to figure out who was wielding it, the circumstances in which it went off, investigators would work backwards from where it was stored, on Twitter.

They would want to know, too, how Ali Alexander and Alex Jones copped on so quickly — whether any of the participants in the DM lists via which Stop the Steal was coordinated had a user who also had access to Trump’s Twitter account.

Even before Trump became President, his communication habits made it very difficult to pin down his actions. Roger Stone, for example, would call Trump during the 2016 election on Trump’s cell, his Trump Tower phone, two work phones, via three different assistants, and Keith Schiller. And Stone often used other people’s phones to call on.

Trump still has a habit of using other people’s phones. The stolen documents indictment reflects Molly Michael telling Walt Nauta that Trump had had her phone. Several of Trump’s aides were asked by J6C whether Trump ever used their phones; several probably didn’t tell the truth in response.

But much of execution of January 6 went through the single most stable means of communication Donald Trump had: his Twitter account. And to attribute any actions that happened using Trump’s Twitter account, DOJ needed as much data as possible about who else used it and in what circumstances.

User attribution is important. Especially with a guy who has the ability to murder by tweet.

“Poor Mr. Zebley:” Both Xitter’s Lawyers and Journalists Responding to Boilerplate Need to re-Read Mueller

/53 Comments/in , /by

I’ve stopped trying to convince Russian denialists on Xitter that they’re willfully ignorant of facts. At this point, denialists are just trolls exploiting Xitter’s algorithm to create scandal.

I try to focus my time, instead, on conspiracy theorists platformed by prominent schools of journalism.

But when others try to correct denialists on Xitter, they almost always say the denialists haven’t read the Mueller Report closely enough.

So I found it wildly ironic that Chief Judge Beryl Howell, during a period in February when Elon Musk was letting denialists like Matty Dick Pics Taibbi invade the privacy of then-Twitter’s users so he could spew conspiracy theories, Howell scolded Twitter’s lawyer George Varghese that he hadn’t read the Mueller Report closely enough.

THE COURT: You need to read the Mueller report a little bit more carefully.

The transcript of the court hearing and much of the rest of the back-up to Xitter’s attempt to stall compliance of the warrant was unsealed yesterday.

Mind you, Howell was trying to convey to Twitter’s team that there is precedent for investigating Donald J. Trump without giving him advance warning of every investigative step.

MR. VARGHESE: Yes, Your Honor. Our —- by

THE COURT: You think that for 230 orders, 2800 subpoenas, and 500 search and seizure warrants the Mueller team gave advance notice to the former President of what they were about?

MR. VARGHESE: I don’t know that, Your Honor.

THE COURT: You do not know that.

The hearing made it pretty clear that Howell is convinced that Trump will stop at nothing to obstruct criminal investigations into himself.

Howell, who knows what went into the Mueller Report as well as anyone outside the investigative team, does know that.

In fact, when she told Varghese he should have read the Mueller Report more closely, she had just pointed to private comms described in the Mueller Report — the ones where Trump told Mike Flynn to stay strong — where Trump had not gotten advance notice, as prosecutors were demanding he not get advance notice about a warrant to Twitter.

THE COURT: Because the Mueller report talks about the hundreds of Stored Communications Act — let me quote.

Let’s see.

The Mueller report states that: As part of its investigation, they issued more than 2800 subpoenas under the auspices of the grand jury in the District of Columbia.

They executed nearly 500 search and seizure warrants, obtained more than 230 orders for communications records under 18 U.S.C. Section 2703(d); and then it goes on and on and on for all of the other things they did.

And some of those communications included the former President’s private and public messages to General Flynn, encouraging him to “Stay strong,” and conveying that the President still cared about him, before he began to cooperate with the government.

So what makes Twitter think that, before the government obtained and reviewed those Trump-Flynn communications, the government provided prior notice to the former President so that he can assert executive privilege?

MR. VARGHESE: My understanding, Your Honor, is that the Mueller investigators were in contact with the White House counsel’s office about executive privilege concerns.

THE COURT: You quoted the one part that said that, and that was for testimony, testimony, where it was not covert.

Side note: Xitter’s lawyers may not have been entirely wrong about consultations with the White House counsel, even for materials obtained covertly.

This exchange happened on February 7. Two days later there was a follow-up hearing, and WilmerHale counsel Aaron Zebley — someone who knows better than Beryl Howell what happened to the materials for which Howell approved legal process after it got handed over but before they ended up in the Report itself — filed an appearance in this challenge. He never spoke though; he showed up late, if at all, and at one point, after Twitter had presented their opening argument, Howell asked someone to check whether “poor Mr. Zebley” was standing outside a locked door waiting to get in.

THE COURT: Okay. Well, let me just —

Mr. Windom, do you want to think about that or do you want to respond?

Do you think Mr. Zebley is standing outside the locked door?

MR. HOLTZBLATT: I think there is a chance.

THE COURT: Could you check? Poor Mr. Zebley.

MR. WINDOM: Should I wait, Your Honor, or proceed?

THE COURT: Proceed. In my chambers we wait for no man.

Twitter was trying to make an argument that someone had to attend to potential Executive Privilege claims. Howell and the prosecutors nodded several times to a filter protocol addressing privilege issues, of which Twitter was ignorant. And yet Twitter was refusing to comply unless they had the opportunity to tell Donald Trump about the warrant in advance.

Beryl Howell, who was years into her second investigation of Donald Trump at this point, might be forgiven for impatience with lawyers who don’t understand how many Executive Privilege disputes she had presided over between those two investigations. They might be forgiven for their ignorance of all the resolutions of Trump’s current challenges to Executive Privilege in the January 6 investigation.

That said, Twitter’s lawyers aren’t the only ones who should have read the Mueller Report more closely. So are the journalists reporting on this.

One after another journalist (CNN, NYT, Politico, all involving journalists who covered the Mueller investigation) has mistaken DOJ’s request for data — attachment B to the warrant — as some kind of statement of what DOJ was most interested in receiving. Based on that, their stories focus on the fact that DOJ asked for or obtained DMs involving the former President.

But that attachment looks to be largely boilerplate. It is not much different from warrants obtained five years ago, in the Mueller investigation, such as this one, also served on Twitter, apparently targeting Trump’s rat-fucker Roger Stone in an investigation into whether he was serving as a foreign agent of Russia, a warrant that also came with a gag, one Twitter did not contest. One main — telling — difference, is that the Trump request included standard subscription information, which Mueller’s investigators appear to have already requested; one of the items on which Twitter held up compliance, in fact, was Trump’s gender, a sure testament to obstruction within the company.

While Twitter’s services have changed significantly in the interim years, both ask for the same kind of information: DMs, drafts, deleted content, favorited content.

And for good reason!!! These warrants may well have been targeting the same kind of behavior, the kind of organized troll campaigns that exploit Twitter’s algorithms, in which users use a variety of means to obscure their identity. There is a significant likelihood these warrants were targeting precisely the same group of far right online activity, the very same people.

One of the most important Twitter users leading up to January 6, Ali Alexander, is the protégé of Roger Stone and the effort to drive attendance at January 6, Stop the Steal, was a continuation of the effort Stone started in 2016, an effort that may well have been covered by that 2018 warrant or one of the others targeting Stone’s Twitter activity.

To be sure: There are DMs in Trump’s account, though it’s not entirely clear when they date to. Without reading any of the DMs, Twitter checked to see whether the volume of data in Trump’s account indicated the presence of DMs.

MR. VARGHESE: So, Your Honor, we went back — because this was an important issue for us to compare, whether or not there were potentially confidential communications in the account, and we were able to confirm that.

THE COURT: How?

MR. VARGHESE: So, Your Honor, there was a way that we compared the size of what a storage would be for DMs empty versus the size of storage if there were DMs in the account. And we were able to determine that there was some volume in that for this account. So there are confidential communications. We don’t know the context of it, we don’t know —

THE COURT: They are direct messages. What makes you think — do you think that everything that a President  says, which is generically a presidential communication, is subject to the presidential communications privilege?

MR. VARGHESE: No, Your Honor.

But Twitter’s focus on DMs arose from their frivolous basis for delaying response to the warrant — their claim that some of these DMs might be subject to a claim of Executive Privilege.

Moreover, having DMs in the account is not the same thing as a prosecutor confirming that they ultimately obtained DMs, or that any DMs were relevant to the investigation, or that DMs were one of the things they were most interested in.

I don’t doubt that’s likely! But what prosecutors asked for and what was in the larger account is not the same thing as what DOJ ultimately received and used.

And the DMs — most of them, anyway — are something that were available elsewhere. At least as represented in the dispute, NARA already has Trump’s DMs from the period (DOJ chose not to go to NARA, in part, because they wanted to avoid notice that NARA has provided to Trump along the way).

There were three more things that DOJ showed perhaps more interest in, requiring Twitter to go beyond their normal warrant response tools to comply.

The first has to do with emails to Twitter about the account, of which prosecutor Thomas Windom was most interested in emails from people on behalf of Trump.

But this information about, you know, what it is that we say that we’re most specifically interested in, I did not represent that we were most interested in communications betueen government officials and Twitter regarding the account.

We did point out that — much as Your Honor did just now — it seemed beyond comprehension that there weren’t communications regarding the account when it was suspended and terminated, but that doesn’t mean government officials at least cabined to that. It can mean campaign officials. It can be anybody acting on behalf of the user of the account, or the user of the account himself.

THE COURT: So any person regarding the account is broader than what you just said, though, Mr. Windom.

“Any person regarding the account” is quite broad. It could be all the complaints of all of the Trump supporters out in the world saying: What are you doing, Twitter?

So I take it, from what you just said, that you are interested only in =- rather than “any person,” a person who was the subscriber or user of the account or on behalf of that person regarding the account?

MR. WINDOM: Yes, ma’am. An agent thereof.

When Twitter cut Trump off in 2021, they cut off active plans for follow-up attacks. And these emails might indicate awareness of how Trump was using Twitter as a tool to foment insurrection.

Another item on which Windom focused in the following hearing was associated accounts — other accounts the identifiers used with Trump’s accounts also use. Twitter claims they don’t have that — at least not in their law enforcement portal — and so had to collect it manually. But DOJ did ask them to produce it. (Note, the fact that Xitter doesn’t store this is one reason why they’re so bad at tracking information operation campaigns, because visibility on these kind of associations are how you discover them.)

MR. HOLTZBLATT: Well, Your Honor, we don’t — the issue, Your Honor — there isn’t a category of “associated account information”; that’s not information that Twitter stores.

What we are doing right now is manually attempting to ascertain links between accounts. But the ascertainment of links between accounts on the basis of machine, cookie, IP address, email address, or other account or device identifier is not information that Twitter possesses, it would be information that Twitter needs to create. So that’s the reason why we had not previously produced it because it’s not a category of information that we actually possess.

[snip]

MR. WINDOM: It is, as explained more fully in the warrant — but for these purposes, it is a useful tool in identifying what other accounts are being used by the same user or by the same device that has access to the account is oftentimes in any number of cases, user attribution is important. And if there are other accounts that a user is using, that is very important to the government’s investigation.

[snip]

MR. HOLTZBLATT: That’s right. If the records — if the linkage between accounts, which is what we understand this category to be referring to, is not itself a piece of information that we keep, then it’s not a business record that we would ordinarily produce.

What I understand the government to be asking is for us to analyze our data, as opposed to produce existing data. And we are trying to work with the government in that respect, but that is the reason that it is not something that — that is a different category of information.

As Windom explained, this information is critical to any attribution, but it’s also important to learning the network of people who would Tweet on Trump’s behalf, and any overlap between his account and their own (as Roger Stone’s showed in 2016).

Then there’s something that remains only partially explained. For some reason — even Twitter could not figure out why — there were two preservations of Trump’s account in January 2021, before the preservation associated with this warrant. One was on January 9. The other covered January 11 and 12. And when asked, the government of course wanted the latter preservation too — and it is in the possession of Twitter, and so covered by the warrant.

MR. HOLTZBLATT: At 5 p.m. on February 7th, I think that was our day, we produced all data in this category that was in the standard production tools of Twitter.

We communicated with the government on February 8th that there were prior preservations of the subject account that are not within Twitter’s standard production tools and that would, therefore, require engineering to obtain information. And we asked the government whether it wished us to undertake that effort, and the government confirmed that it did.

And we have since then — when we produced on February 7, we indicated to the government in our production letter that there was potentially deleted data that might exist, which is what would be found in prior preservations, but that it would require additional engineering efforts.

At 2 a.m. last night, or this morning, Twitter produced additional information from those prior preservations that falls within category 2A. There are —

THE COURT: When you say “prior preservations” what are you talking about?

Prior litigation holds of some kind or that you  had a stash or a cache of preserved data sitting in different places? What are you talking about?

MR. HOLTZBLATT: I am referring — with respect to this particular account, I am referring to preservations from two specific dates. There is a preservation that was made that includes the subject account covering January 3rd to 9th, 2021. There is a second preservation of this that includes this account that covers January 11 to 12, 2021.

Those are collections of data that — they are not — it’s not coterminous with the categories that would exist in the active account right now and — and that’s data that does not exist within a production environment. So it’s not data that you can just click — we have a system to just click a button and produce, which is why we indicated that further engineering efforts might be necessary.

We asked the government if they wished us to undertake those efforts. We had an engineer working through the night, after the government asked us to, to undertake those efforts. At 2 a.m. in the morning we produced additional information that came from those preservation.

There are two categories of information that — actually, I’m sorry, three categories of information that we are still working to produce because of the engineering challenges associated.

One of those categories is the list of — I am not sure this is from 2A. But I think, for purposes of coherence, it would be helpful for me to describe it now because it connects to this preservation; that is,  followers — a list of followers for this account that were contained within the January 11 through 12th prior preservation. We have segregated that information. It is a complicated and large set of information. And we are unable to deliver it in the manner that we normally deliver information to law enforcement, which is to send a token.

We believe right now it would require physical media to put that information on and to hand it over to the government.

[snip]

MR. HOLTZBLATT: As I mentioned, Your Honor, there were two prior preservations, and then there is the current production tools. In two of the three of those sets, the January 3 through 9 and the current one, we have produced the tweets and related tweet information for the account.

In the January 11 to 12th prior preservation, the way that the tweet and tweet-related information is stored, it goes all the way back to 2006. We don’t have a warrant — that is contents of user communications. He don’t nave a warrant that would permit us to produce the entirety of that information. So what we have is a tool 7 that — what we refer to as a redaction (sic) tool or trimming tool. Because this is not a production environment, a human being has to go in and manually trim the information to isolate the date range. That, I think Your Honor can understand, is a laborious process, including for this particular account, given the time frame; and we need to isolate it, I think, over a three-month, four-month period, I’m sorry, Your Honor. So we are undertaking it.

Unsurprisingly, DOJ wanted to be able to compare the accounts as they existed on January 8 and January 12, 2021, because Trump’s attack was still ongoing and because people were beginning to delete data.

Trump’s DMs, if he used them or even just received them in this period, would be critically important. But Twitter was one of Trump’s most important tools in sowing an insurrection. And the data showing how he used the account, and who also used it, is as important to understanding how the tool worked as the non-public content.

Protection Racket: Donald Trump Thinks He’s More Special Than Steve Bannon

/51 Comments/in , , /by

As you no doubt know, Trump and his January 6 prosecutors had a bit of a spat about the protective order governing evidence in the case.

The timeline goes like this:

August 2, 9:55PM: A Jack Smith prosecutor — given the initials, probably Thomas Windom — sends John Lauro a proposed protective order, “largely track[ing] the existing protective order in SDFL.”

“Evening of August 3 and early afternoon of August 4:” DOJ reaches out twice more.

Friday, August 4, 1:09PM: Trump’s latest defense attorney sends their own proposed protective order.

Friday, August 4, 2:39PM: A prosecutor (probably Windom) responds saying that Trump’s proposed order doesn’t make sense, notes that DOJ is again proposing the same order as adopted (by Aileen Cannon) in SDFL.

Friday, August 4, 2:45PM: Someone responds saying they adopted their proposal “form [sic] similar orders used in the district.”

Friday, August 4, 6:06PM: An AUSA responds, noting that Trump’s proposed order “would leave large amounts of material completely unprotected in a way not contemplated by standard orders in” DC.

Friday, August 4, 6:39PM: Someone responds saying they should brief it to Magistrate Judge Upadhyaya, whom they do not name, and ask that DOJ note “that we have did not have adequate time to confer.”

Friday, August 4: Trump tweets out video attacking the prosecutors prosecuting him and Joe Biden.

Friday, August 4: Trump tweets, “IF YOU GO AFTER ME, I’M COMING AFTER YOU!”

Friday, August 4, at least 3 hours after Trump’s tweet: DOJ files for a protective order, noting that Trump plans to just spill out grand jury information. The proposed motion is closely modeled on the Steve Bannon one.

Saturday August 5: Judge Chutkan orders Trump to respond by 5PM Monday

MINUTE ORDER as to DONALD J. TRUMP: It is hereby ORDERED that by 5:00 PM on August 7, 2023, Defendant shall file a response to the government’s 10 Motion for Protective Order, stating Defendant’s position on the Motion. If Defendant disagrees with any portion of the government’s proposed Protective Order, ECF No. 10-1, his response shall include a revised version of that Protective Order with any modifications in redline

Saturday, August 5: Trump attorney John Lauro moves for reconsideration, claiming — while misrepresenting the timeline — that the government had not conferred with him about the protective order.

Saturday August 5: DOJ responds noting that Trump is holding things up and noting that Lauro left out other efforts to consult.

In emails not appended to the defendant’s extension motion, the Government followed up on the evening of August 3 and early afternoon of August 4. Thereafter, defense counsel finally responded by sending an entirely different protective order.

Saturday, August 5: Judge Chutkan denies Lauro’s motion, ordering him to comply by 5PM on Monday.

MINUTE ORDER as to DONALD J. TRUMP: Defendant’s 11 Motion for Extension of Time is hereby DENIED. Defendant may continue to confer with the government regarding its proposed protective order before or after the August 7, 2023 5:00 PM deadline for his response. The court will determine whether to schedule a hearing to discuss the proposed protective order after reviewing Defendant’s response and, if included, his revised proposed protective order with modifications in redline.

But what has been missed is this: The protective order the government proposed last Friday is the protective order Judge Carl Nichols, the former Clarence Thomas clerk appointed by Trump, issued for the Steve Bannon contempt case.

Here’s that order, which Chutkan has ordered Trump to modify.

Here’s the order Trump appointee Carl Nichols adopted in 2021 for a similarly situated defendant. They’re not identical: the one the government proposed includes more detail about what should be treated as sensitive. But otherwise, they’re the same.

What this boils down to is that Trump — after issuing threats targeting prosecutors and judges — thinks he’s more special than Steve Bannon.

And Judge Chutkan isn’t buying that bullshit.

Update: In Trump’s response, he didn’t include the protective order he wants. He included a great deal of other shit, including the docket from SDFL. But this is a protective order adopted in DC District that separates out sensitive material; it’s from the Russian troll farm case.

31 Flavors of Stolen Classified Documents

/130 Comments/in , /by

In days ahead, there’ll be a heated discussion of what kind of sentence Espionage Act defendant Donald Trump might face. But even among the really experienced people — who correctly point out that Trump’s sentence would be a tiny fraction of the total 400 max he faces — I think the discussions are wrongly conceived. To explain why, I plan to return to my argument that the Mar-a-Lago indictment is tactical.

But first, I want to emphasize the magnitude of the fact DOJ charged Trump with hoarding 31 documents, each charged as an individual count and described, with classification markings, in the indictment. Virtually all of these documents are the type that the government is normally loathe to include at trial, and yet DOJ piled them on, compartmented document on top of compartmented document. The decision to commit to presenting all of them at trial is really remarkable, and must be (and is not being) accounted for in discussions of potential sentencing.

As background I’d like to review five similar prosecutions.

Daniel Hale

First consider two recent prosecutions (Chelsea Manning’s court martial, after which she was sentenced 35 years, is a third) where the indictments listed a long catalog of stolen documents like DOJ did with Trump: Hal Martin and Daniel Hale.

In Hale’s case, the indictment first listed all 23 documents he printed out from his job at a defense contractor, only four of which were as sensitive as most of the documents Trump was charged for hoarding.

DOJ only described the 11 documents that were published by The Intercept (document H, the fourth TS document, was not published by The Intercept and so not included in the charged documents). It then charged five counts:

  • 18 USC 793(c) for taking the 11 documents ultimately published
  • 18 USC 793(e) for taking and sharing the files with Jeremy Scahill
  • 18 USC 793(e) for causing to be published the files
  • 18 USC 798(a)(3) for sharing 4 SIGINT documents (documents A, D, E, and K, above)
  • 18 USC 641 for taking the files, charged to include the 11 that got published and a few other unclassified documents that they had proof he had taken

Hale pled guilty to one count without a plea agreement immediately before trial and got a 45 month sentence. He is due to be released in July 2024.

Had Hale gone to trial, the government wouldn’t have had to expose any new information (though it would need to declassify it), because every charged document had been published already. So DOJ really risked very little by charging all 11 documents published by The Intercept. Any damage was already done.

Hal Martin

The way DOJ charged Hal Martin, though, is more akin to how DOJ has charged Trump.

Martin, remember, was arrested, guns-a-blazing, immediately after Shadow Brokers pegged him as the source of the documents being released in 2016. When the FBI searched his home, they found stacks and stacks of documents, including in his car. It took six months to charge Martin, presumably because DOJ had to do an investigation into what and why he had taken — including whether he was Shadow Brokers or had wilfully leaked the documents to Shadow Brokers. Unlike Trump, he was in pre-trial custody that whole time.

In the end, there were no dissemination charges (ultimately, the public record in his case is inconclusive whether he wilfully leaked these documents or not, but if he did, DOJ either couldn’t prove it or chose not to try). As DOJ did with Trump, each of a bunch of documents, a total of 20, were charged as separate counts.

There are descriptions of each of these 20 documents in the indictment, but not classification markers. The indictment describes that they were a mix of Secret, Top Secret, and SCI.

DOJ presumably got sign-off from the agencies to present these documents at trial, but after a very long pre-trial process, Martin ultimately pled guilty in March 2019 to one count of 18 USC 793(e) as part of a plea agreement, with an agreed on sentence of 9 years, one year short of the 10-year max. He’s scheduled for release in May 2024.

Nghia Pho

By comparison, Nghia Pho — the other presumed source of Shadow Brokers, from whom hackers stole a bunch of NSA files loaded onto his home computer — entered into a plea agreement from the start. His Information didn’t describe any of the documents he took home, though suggested many were TS/SCI. Pho was sentenced to 66 months. Pho, who was in his 60s when he was sentenced and is now 72, is due for release in September.

This is the way DOJ normally prefers to treat those responsible for leaks and other compromises, because the prosecution does little additional damage. Of course, there was never a chance in hell such an approach would work for Trump.

Note that Thomas Windom, who is one of the lead January 6 prosecutors, was on the Pho prosecution team.

Jeremy Brown

Two other relevant cases involve Floridians prosecuted in the last year. With Oath Keeper Jeremy Brown, the government did list and present the five documents, all classified Secret, he was accused of hoarding. They used the Silent Witness rule to present the classified documents at trial, all of which were far more dated and less sensitive than the ones Trump is accused of stealing. Here’s how they described that process in the pre-trial process.

First, the government would provide each juror, the Court, and the defense with a binder of unredacted copies of the Classified Documents. The same process was followed in Mallory, 40 F.4th at 173, and it would enable the jurors to examine the Classified Documents while the government elicits unclassified testimony about the same from its expert witness. As in Mallory, the defense would be permitted to follow the same procedures during cross examination and/or with its own cleared expert, should the defense choose to retain one. Id. This procedure ensures that the jury has full access to the information it needs to fulfill its obligations. Id. at 178 (“But a review of the record reveals that the silent witness rule denied the jury none of the information on which Mallory based his defense.” (emphasis in original)). Second, the government will have Bates and line numbers added to the Classified Documents to enable the witness, the government, and the defense to direct the jurors to specific portions of the material.

Brown was only convicted of one of five Espionage Act counts, but nevertheless was sentenced to 87 months for the document as well as the illegal weapons he was convicted of hoarding.

Robert Birchum

Finally, there’s Robert Birchum, a retired Lieutenant Colonel who was just sentenced to 36 months a few weeks ago. Birchum was found hoarding over 300 documents he had collected before 2008, in 2017, six years ago. The Air Force declined to court martial him, and he was honorably discharged (it sounds like the Air Force really valued the counterinsurgency work he did). The first his case was made public was in January, when he was charged by Information with one count of 793(e). That Information did describe two documents he was charged with:

two documents classified at the TOP SECRET/SCI level from the National Security Agency (NSA) relating to the national defense that discuss the NSA’s capabilities and methods of collection of information.

The government asked for a bottom of guidelines sentence of 78 months, emphasizing Birchum’s abuse of a position of trust and the sensitivity of the documents he took. Among other things Birchum raised at sentencing is that he was so important to the Air Force, they sent him back to Afghanistan even after diagnosing him with PTSD. He also invoked all the high ranking people, including Trump, who had brought classified records home.

Among others, Mr. Birchum’s case now shares a stage with the current President of the United States, the former President and Vice-President of the United States, and a former Secretary of State. Looking a bit further back in time, one can see examples of other high-level government executives involved in the same type of offenses, including a former national security adviser who pled guilty to knowingly removing classified documents from the National Archives and a former CIA director and retired four-star general who pled guilty to sharing classified documents with his biographer and mistress. Both the former national security adviser and the former CIA director were sentenced to pay a fine and probation. No charges have been bought against any of the other individuals noted above. Similar cases involving lower-level government employees that did result in prison sentences typically involved attempts to obstruct the investigation or actual dissemination of the information or both.

He was sentenced to 36 months.

The reason I laid all this out is to suggest how remarkable it was that DOJ listed 31 documents Trump allegedly stole. Of the cases above, they did so with less sensitive, dated records that Brown was charged with, with the 11 documents already published in Hale’s case, and then the catalog of documents charged against Martin, some of which may also have been compromised as part of the Shadow Brokers release. If Martin’s charged documents were already compromised as part of the Shadow Brokers case, it means that among these cases, there is no precedent for the government choosing to charge a catalog of incredibly sensitive documents like they have with Trump.

That’s one reason I keep harping on the footnote in a DOJ filing in the Trump case from last September, invoking the Pho case (where we know the documents were badly compromised) to suggest that sometimes the Intelligence Community has to operate on the assumption that programs have been compromised and shut them down.

Once the government loses positive control over classified material, the government must often treat the material as compromised and take remedial actions as dictated by the particular circumstances. Depending on the type and volume of compromised classified material, such reactions can be costly, time consuming and cause a shift in or abandonment of programs. In this case, the fact that such a tremendous volume of highly classified, sophisticated collection tools was removed from secure space and left unprotected, especially in digital form on devices connected to the Internet, left the NSA with no choice but to abandon certain important initiatives, at great economic and operational cost.

We know one of the 31 documents charged against Trump — the document described in Count 8 that fell out of a box in the storage closet — would be treated as compromised, particularly if someone knocked the box over or is believed to have found it (remember that there are no cameras inside the storage room).

I can’t emphasize this point enough: One possible explanation for the catalog of charges against Trump is that the IC knows, or made a decision last September to assume, that all of these documents have been compromised. It’s one of the most likely ways to explain DOJ’s willingness to include all of them in charges, just like they did with the documents charged against Hale.

That possibility is not being factored into any of the discussions about sentencing, and it should be. The IC likely has to assume that the many intelligence services that targeted Mar-a-Lago, including two known Chinese infiltrators, found some of these documents, or maybe just the musicians and partygoers who could have had access while they were taking a shit.

Importantly, all the documents charged remained in an unsecured storage room after it became public that there were classified documents among the ones that Trump had delivered to NARA in January 2022. (Note, among the really sensitive documents that weren’t included in Trump’s charges are ones classified HCS-O, describing HUMINT operations.)

The Pho and Birchum examples show that DOJ would far prefer negotiating a plea agreement in advance, to minimize further damage to national security. But Trump made quite clear after the search last year, he was unwilling to go quietly.

The only one of these five who went to trial was Brown, and DOJ used the Silent Witness rule for him. That rule is rightly controversial even with disfavored shithole defendants like Brown (or Kevin Mallory, who was convicted of spying for China using it). I simply can’t imagine using the Silent Witness rule in a trial with a former President. The issues of legitimacy are too great. And so, if this thing goes to trial, I assume redacted copies of all these documents would be introduced as evidence that would get shared with the public.

Which is why I point to the Martin case as the one most similar to Trump. My read of that case is that DOJ charged so many documents — just 20, though, rather than 31 — as part of the coercion process to get Martin to plead.

The problem, in Donald Trump’s case, is that he has more incentive to start a civil war than plead guilty to these charges.

Those are some of the assumptions — not to mention that by charging this in West Palm Beach, where Aileen Cannon was likely to and did get the assignment — that Jack Smith must have had in mind when he charged the MAL case like he did.

With every other similarly situated defendant, DOJ has pursued strategies to get the defendant to plead before exacerbating the damage of the compromise at trial. But with Donald Trump, they’re facing a uniquely intransigent defendant. And that is what Jack Smith was facing when he decided to charge this case this way.