• the 2025 document release included documents on two codename leak investigation initiated in August 2017 (Arctic Haze, Sirens Lure). There is solid reporting that there was a third codename leak investigation initiated in August 2017. Why weren’t its documents included in the release?

August 1, 2017 Referral Letters

The 2025 document release included copies of two August 1, 2017 referral letters from DOJ Counterintelligence and Export Control (CECS) to FBI Section Chief Paul Haertel, excerpts from which are shown below. They refer to a June 23, 2017 CIA Crime Report sent to DOJ which had listed eight articles, and, together, list seven (the first seven) of the eight articles in the CIA complaint. The articles are numbered in calendar order and the seventh article is from June 1, 2017, thus establishing a window of June 1, 2017 to June 22, 2017 for the eighth article.

Subject Matter

Examination of the seven known articles in the June 23, 2017 CIA Crime Report shows two types of classified information:

• information obtained from the “T1” source. Some details on the T1 source were provided in the classified annexes to the Horowitz Report (2019) and the Durham Report (2023) that were also released with redactions in summer 2025 (by Grassley). The Rentaria memo was the most prominent example. The classified information in the four articles referred to Arctic Haze investigation all appear to pertain to T1-related information.

• “intercepts” of communications by Russian ambassador Kislyak to Moscow. The three Sirens Lure articles are all of this type. (A July 22, 2017 Washington Post article, also based on a Kislyak intercept, was subsequently added to the investigation - see 2703(d) affidavit link),

Horowitz Report (December 2024)

In December 2024, Horowitz published a report1 (link) which, using different nomenclature, discussed the opening of the Sirens Lure and Arctic Haze leak investigations.

In the paragraphs shown below , Horowitz (2024) described the opening of four leak investigations:

• a leak investigation into the April 2017 Washington Post article revealing the existence of the Carter Page FISA investigation (“Washington Post 1”);

• investigations into “three other unauthorized disclosures of classified information” in which “the originating USIC agencies submitted Crime Reports to NSD” and which NSD had “directed” the FBI to open investigations “in August 2017” (the CNN, New York Times and Washington Post 2 investigations)

Three of the four leak investigations reported by Horowitz can be precisely matched in the August 2025 leak documents:

• the Washington Post 1 leak investigation in Horowitz matches the Foggy Falls codename investigation;

• the New York Times leak investigation in Horowitz matches the Arctic Haze codename investigation;

• the Washington Post 2 leak investigation in Horowitz matches the Sirens Lure codename investigation.

The CNN leak investigation in Horowitz cannot be matched in the August 2025 leak documents. Where are its documents? Why weren’t they included.

The CNN leak investigation, which was initiated in August 2017, appears to have been predicated on the unknown eighth article in the June 23, 2017 CIA Crime Report i.e. on a CNN article published between June 1, 2017 and June 23, 2017.

The existence of a three leak investigations arising from the CIA Crime Report of June 23, 2017 is confirmed by the entry shown below from the DOJ list of leak investigations obtained by POGO (link) in 2021 (h/t walkafyre):

The CNN 2703(d) Search Warrant

The FBI made little to no progress on these leak investigations during the first three years of the Trump 45 administration.

In 2020, Attorney General Barr revived (or tried to revive) the somnolent leak investigations. This included a 2703(d) warrant sought in summer 2020 for non-content metadata for CNN reporter Barbara Starr between June 1, 2017 and July 31, 2017. The predicating article wasn’t identified directly in the published affidavit, but, from collateral details, walkafyre firmly identified it as a July 27, 2017 article on which Starr was a co-author. (I’ll provide an accompanying short article on this identification.)

So there’s a puzzle. The predicating article in the CNN investigation as of July 2020 was a different article than the eight article in the June 23, 2017 CIA Crime Report and almost certainly a different article than in the (third) August 1, 2017 DOJ referral letter for the (withheld) codename CNN Investigation listed by Horowitz. The addition of subsequent articles to a predicated investigation is commonplace, so there wouldn’t be anything unusual in adding a July 27, 2017 CNN article to an existing investigation. But it leaves the identity of the original predicating article unanswered, as well as why it was dropped.

Durham’s purported answer is in a little discussed footnote1 in the Durham Report, in which Durham stated, without explanation, that “we also have not interpreted the Order as directing us to consider the handling of the investigation into President Trump opened by the FBI on May 16, 2017” [what we now know as the Oxferd Comma codename investigation.] 2

The “Order” in question here was Attorney General Barr’s October 19, 2020 order (original here) instructing and commissioning Durham to “ensure a full and thorough investigation” whether “any federal official, employee, or other person or entity” had “violated the law in connection with the intelligence, counter-intelligence, or law-enforcement activities directed at the 2016 presidential campaigns, individuals associated with those campaigns, and individuals associated with the administration of President Donald J. Trump [editorial comment: note double use of Oxford commas], including but not limited to Crossfire Hurricane and the investigation of Special Counsel Robert S. Mueller, III.”

In the Order, Barr stated that he had originally commissioned Durham on May 13, 2019 “to conduct a preliminary review into certain matters related to the 2016 presidential campaigns” and that “Mr Durham’s review subsequently developed into a criminal investigation, which remains ongoing”. The terms of that original May 13, 2019 directive remain withheld.

On December 9, 2019, Inspector General Horowitz released an important report. The report had begun as an investigation into the narrow question of the Carter Page FISA, but raised many other questions. While much subsequent attention has been spent on the single issue of whether there was valid predication for the Crossfire Hurricane enterprise investigation, arguably the most astounding revelation of the Horowitz Report was that the FBI had interviewed Steele’s Primary Sub-Source in January 2017 and again in March 2017 and May 20173 and that Steele’s Primary Sub-Source had disavowed any valid sourcing of the collusion allegations in the Steele Dossier.

One day after receipt of Horowitz Report, Attorney General Barr vigorously drew attention to Horowitz’ revelations from Steele’s Primary Sub-Source. Barr observed that the case against Trump had “collapsed” after the FBI interview of Steele’s Primary Sub-source and asked why the FBI “kept on investigating the president… after the case collapsed”:

in January, after the election, the entire case collapsed when the principal source says, I never told -- I never told Steele this stuff. And -- and -- and -- and this was all speculation. And I have zero information to support this stuff. At that point, when their entire case collapsed, what do they do? They kept on investigating the president and the -- well into his administration, after the case collapsed. …

Barr incisively observed that “irregularities, misstatements [and] omissions” by FBI “were not satisfactorily explained”, that the “possibility to infer bad faith” remained open and that Durham was investigating these “irregularities, misstatements [and] omissions” by FBI. (See link for my prior discussion of Barr’s statement.)

So that’s hard to explain. And I -- the core statement, in my opinion, by the IG, is that these irregularities, these misstatements, these omissions were not satisfactorily explained. And I think that leaves open the possibility to infer bad faith. I think it’s premature now to reach a judgment on that, but I think that further work has to be done, and that’s what Durham is doing.

Conclusion

The opening of the Oxferd Comma investigation (as well as its transfer to the Special Counsel) fell squarely within the terms of reference of Barr’s appointment order to Durham. Durham had been instructed to examine the conduct of “federal officials”, “including but not limited to Crossfire Hurricane and the investigation of Special Counsel Robert S. Mueller, III.”

And yet Durham stated : “we also have not interpreted the Order as directing us to consider the handling of the investigation into President Trump opened by the FBI on May 16, 2017.” Why not? Isn’t that exactly the sort of thing that Durham was supposed to investigate?

At this time, no one knows exactly why the Durham investigation so completely failed to answer Barr’s questions. If Fauci can be recalled, why not Durham?

1

In May 2023, Techno_Fog (link) posted up a screenshot of this footnote 7 in respect to lingering questions about DNC hack attribution that were similarly left unaddressed by Durham. Techno_fog argued that investigation of DNC hack attribution was outside the scope of Barr’s terms of reference to Durham and that Durham should therefore not be blamed for failing to investigate DNC hack attribution. Be that as it may in respect to DNC hack attribution, this argument clearly doesn’t apply to the opening of Oxferd Comma investigation, which was in the same genus as Crossfire Hurricane and Mueller investigations.

The production contained six FBI ECs ranging in date from April 28, 2017 to June 1, 2018 ; four FBI Import forms dating from May 9, 2017 to July 17, 2018 and five FBI 302s, all dated in August 2018.

The production appears to have been made on July 18, 2025. The only previous reporting on this production appears to have been two articles in July 2025, both of which focused on one of the 302s. However, there are useful details in the other 302s which have not been previously discussed.

Previous Reporting

On July 21, 2025, Chip Gibbons of DRAD published an article (link) at DRAP website (entitled “Defending Rights & Dissent Lawsuit Uncovers FBI Surveillance of Journalists and Peace Activists at Left Forum”) in which he reported that two FBI agents had attended a June 1, 2018 Left Forum panel in New York entitled “Russiagate and WikiLeaks”. The panel had been organized by Randy Credico and included several leading “left” critics of the Russiagate hoax. Gibbons described the FBI agents as “dressed like Disney tourists” and reported that Credico only talked to them for “a minute” before referring them to his attorney?

Defending Rights & Dissent reached out to panel organizer Randy Credico. He informed us that on that same day at Left Forum, he also performed a comedy set. After the set, “a young man and woman, who were dressed like Disney tourists, came up to me as I was walking alone and told me how much they loved the show.” As Credico was walking away, they revealed themselves to be FBI agents. After speaking with the agents for “a minute,” Credico put them on the phone with his attorney who made arrangements to speak with them at another date. It is likely this is the “interview” referenced in the FD-302.

The contents of the 302 were mostly redacted, but the top of the second page shows that it purported to be with someone with 13 characters in their name (consistent with Randy Credico).

A few days later, Wyatt Reid at Grayzone (link) reported on the DRAD findings, primarily from the perspective of press freedom.

New Details

On April 28, 2017 - prior to Mueller - FBI Counterintelligence opened a “subfile for documents and information directly related to Roger Stone”.

The purported justification for opening the “subfile” on Stone referred back to the original embellished rumor from Australian diplomat Erika Thompson that was passed to US embassy in London in July 2016.

On May 9, 2017 (pdf 14), the FBI issued an Import Form - contents totally redacted.

A few days later, on May 12, 2017, FBI obtained a search warrant for Stone’s Twitter Accounts. This search warrant was not contained in the court production of Stone search warrants but was referred to in paragraph 29 of Document 29-1 (17-MJ-567).

The FBI expected to find “messages to individuals regarding the hack”.

On July 25, 2017, FBI Counterintelligence D5-REIT (with approval by Peter P Strzok II) opened a full investigation into Roger Stone (see pdf, 4). At the time, Strzok was a key person on Mueller investigation - his removal from Mueller team by Andrew McCabe is reported to have taken place two days later on July 27, 2017.

The Opening EC on Roger Stone is mostly unredacted. It listed a series of public statements by Stone about supposed contacts with Wikileaks and Guccifer 2, withthe ultimate conclusion that Stone’s actions “as discussed above are relevant to the CROSSFIRE HURRICANE investigation, as well as the investigative authorities appointed to the Special Counsel”.

On July 26, 2017, FBI issued an Import Form (pdf, 16). It was almost totally redacted. It was approved by an A/SUPV.

On August 7, 2017, FBI obtained the first of the 34 Stone-related search warrants. Its affidavit was by Mickey Robinson. On August 23, 2017, FBI issued another Import Form related to Stone (pdf, 10). The next four search warrants (Sep 2017 to Dec 2017) had affidavits by Amy Anderson (who had been re-assigned from Steele dossier verification.) In early 2018, Curtis Heide (an early Crossfire hire) did affidavits for three warrants. Then in May 2018, Andrew (Thomas) Mitchell did affidavits for next 12 search warrants, starting with the intriguing search warrant for emails of an Israeli agent.

On January 23, 2018 (pdf 21), the FBI issued another EC - almost totally redacted.

On February 12, 2018, FBI sent EC to their London legat asking for “landing card information” on Stone’s travel to London. Lightly redacted.

On June 1, 2018, FBI (approved by David Archey, senior Mueller official) issued an EC seeking international assistance in regard to Stone, Assange and two redacted persons (pdf, 29).

By this time, the FBI was alleging that Sone had been involved in serious crimes, citing his public statements about contact with Wikileaks and Guccifer 2.

302s

Pages 39-66 contain 302s, several of which overlap with Mueller 302s.

July 11, 2018

Pdf 39 contains a five-page 302 dated July 30, 2018 for an interview in Brownsville TX on July 11, 2018. The 302 contains only 3 of 5 pages and is almost entirely redacted except for first paragraph,

It only shows occasional mentions of Wikileaks and Assange.

This 302 was previously published by Mueller volume 8 page 266 B3651 (see here). Walkafyre has identified the subject, but has not published the identification. THe start was less redacted in Mueller version:

But the mentions of Wikileaks and Assange were totally redacted in the Mueller version. So the connection of this 302 with questions about Assange and Wikileaks is new. Nothing from this 302 was cited in the Mueller report.

June 2, 2018

The June 2, 2018 302, as noted above, was discussed in the July 2025 articles by DRAD and Grayzone. This 302 was not included in the Mueller production.1 SA Andrew Mitchell -who we’ve previously seen in multiple Stone warrant affidavits in this period was (unusually) not redacted in the opening paragraph. His name also occurs in an unusual format - “Andrew Thomas Mitchell” - a character count of 22. This is a distinctive count. During this period, there are many 302s involving an SA with 22 character name, often with Zelinsky on Stone related matters. (One will be discussed below). Mitchell can be pencilled in as the agent providing a thread linking many interviews.

August 1, 2018

On page 53, there is an 11-page 302 for an interview on August 1, 2018. This 302 was previously provided in Mueller 302s (volume 8:339; B3731) with all 11 pages totally redacted except for opening paragraph. The interviewee had a 5-character surname. Not much to go on. Nonetheless, walkafyre had convincingly identified the interviewee as Kristin Davis, a colorful associate of Roger Stone.

Here is an excerpt from walkafyre’s website showing the identification of Kristin Davis.

In this new version, walkafyre’s identification of Kristin Davis was inadvertently confirmed by a missed redaction (shown below.) The first (redacted) FBI agent can be confidently identified as Andrew Thomas Mitchell, as character counts match exactly.

The new version remains almost totally redacted, except for an occasional mention of Assange or Wikileaks e.g. on page 6 below.

02In real time (August 2018), Kristin Davis had publicly reported her account of the Mueller interview on Fox News (link). Davis’ agreement with Special Counsel is on pages 64-66 of the pdf.

November 6, 2017 memorialized in August 2018

There is one other new 302: drafted and dated on August 14, 2018 regarding the “1A” transfer of results to a compact disk on November 6, 2017.

In the Mueller 302 collection, B4981 (volume 10: 386) stated that a “copy of the interview notes were saved to the 1A”. The interview took place on November 6, 2017 but the 302 was not drafted until August 13, 2018. (The date shown in the 302 text below - 11/06/2016 - is an error for 11/06/2017 as easily seen in the footer date.) This interview, whatever it was, appears to connect to Wikileaks and Assange, based on its inclusion in the DRAD production.

1

It is possible B3781-378, withheld.

2

It seems more or less certain that the Washington Post and New York Times investigations connect somehow to the codename leak investigations of reporting in Washington Post and/or New York Times in the same period (i.e. Arctic Haze Solomon less redacted, Sirens Lure, Foggy Falls: see Federalist link; Solomon link). While we know the articles that were subjects of the codename investigations, Horowitz 25-010 didn’t identify the articles which were subjects of the four investigations under his review.

In this article, I will deduce the subject articles of the leak investigations of Horowitz 25-010, which do indeed overlap with the codenamed investigations, and from these identifications, provide some fresh commentary on the leaks and the leak investigations.

Washington Post 1 Investigation

The “Washington Post 1” investigation concerned the disclosure of the existence of the FISA surveillance of Carter Page.

Horowitz observed that this “classified information … originated with the FBI”. This is relevant to leak investigation procedures. According to the documents released this summer on the codename investigations, it appears that it was up to the agency to which the information “belonged” to initiate a leak investigation by filing a crime report with DOJ National Security Division.

The article in question is clearly the April 12, 2017 Washington Post article by Nakashima, Barrett and Entous entitled “FBI Obtained FISA Warrant to Monitor Trump Adviser Carter Page” (link; archive), which was the subject of the Foggy Falls codename investigation opened on May 10, 2017. Unlike the other codename investigations, the ODNI documents do not mention the originating Crime Report for the Foggy Falls investigation, but one presumes that there was an FBI report to DOJ NSD prior to its opening.

There are somewhat differing details between the Foggy Falls documents and the Horowitz 25-010 reporting that I will try to address in a future article. One relevant detail from Horowitz: this particular classified information “belonged” to the FBI and it was up to the FBI to initiate a leak investigation by filing the appropriate crime report with DOJ National Security Division: while the date of such crime reports is reported in ODNI documents for other codename investigations, there is no discussion of this underlying crime report in respect to the Foggy Falls (Carter Page FISA) leak investigation.

As a quick comment: the primary contribution of the Carter Page FISA leak was to lend undeserved credibility to the overall Russia collusion investigation, which, at that time, was primarily dependent on Steele dossier allegations, the provenance of which had been “collapsed” by January 2017 evidence from Steele’s Primary Sub-source - evidence that was concealed by FBI in their operation to announce Russia collusion investigation to the public. The FISA warrant didn’t yield anything relevant to the Russia collusion investigation and, by April 2017, was known to be irrelevant. But the leak made it seem as though there was something “there”.

New York Times and Washington Post 2 Investigations

Horowitz 25-010 reported that the New York Times, Washington Post 2 and CNN investigations were all opened in August 2017.

The Arctic Haze and Sirens Lure codename investigations were both opened on August 14, 2017, based on two letters from DOJ National Security Division (Jay Bratt ?) to Paul Haertel, FBI Counterintelligence Division on August 1, 2017, each of which cited articles listed in a [CIA] Crime Report dated June 23, 2017.

Horowitz 25-010 also noted that other new media outlets “published some of the same classified information” and that these stories had also been referenced in the originating Crime Reports from [CIA], but DOJ had “decided to focus” on the leaks to New Yotk Times and Washington Post.

Arctic Haze ~ New York Times Investigation

With these clues in hand, the Arctic Haze codename investigation is almost certainly equivalent to the New York Times (sensu Horowitz) investigation.

The DOJ NSD letter to FBI for the Arctic Haze codename investigation listed four articles (1,2,3 and 6 from the CIA Crime Report of June 23, 2017) as shown below:

These same four articles were listed in a Letterhead Memorandum dated Sept 15, 2017. But the Arctic Haze Closing Letterhead Memorandum, dated September 8, 2021, cited only one of the four articles: the April 22, 2017 New York Times article by Apuzzo et al.

This is the article that is of concern in the Comey Indictment.

The classified information of concern to the CIA in the April 22, 2017 New York Times article was its disclosure of CIA’s possession of the “Rentaria memo”, which had been acquired by CIA. The “Rentaria memo” was also discussed in two other Arctic Haze subject articles (Demirjan and Barrett, May 24, 2017 and Jenkins, May 27, 2017) , but, as noted by Horowitz - see above, the

Horowitz 25-010 reported that, on January 5, 2021 (during the final days of Trump 45 administration), DOJ obtained a 2703(d) order for non-content communications of the four New York Times reporters listed in the April 22, 2017 article, together with a 2705(b) sealing order. This order was immediately litigated by Google. Under the incoming Biden administration, the sealing order was quickly modified so that New York Times lawyers were notified. Soon thereafter, the Biden administration abandoned the subpoena and sealing order and shut down the leak investigation,

There are two dockets on Courtlistener related to these pleadings. The first docket. APPLICATION OF USA FOR 2703(d) ORDER FOR SIX EMAIL ACCOUNTS SERVICED BY GOOGLE FOR INVESTIGATION OF VIOLATION OF 18 U.S.C. §§ 641 AND 793, 1:20-sc-03361, (D.D.C.), (link) began on December 22, 2020. The original 2703(d) application was unsealed in December 2021 (link). It was heavily redacted, but shows the April 22, 2017 date in paragraph 23.

On June 8, 2021, New York Times filed an unsealing motion (1:21-mc-00091-ZMF Courtlistener link), reported on by Charlie Savage at NYT on June 8, 2021 (archive). The closing decision was issued by J Boasberg in December 2021 (link).

The Arctic Haze closing letterhead memorandum doesn’t contain any unredacted discussion of the attempted subpoena of New York Times reporters that was belatedly initiated in closing days of Trump administration and abandoned under Biden administration. But it does contain several redacted pages which may relate to these proceedings.

The Arctic Haze investigation was closed in early stages of Biden administration. Its Closing Letterhead Memorandum was issued on Sept 8, 2021. The investigation accomplished nothing.

Sirens Lure ~ Washington Post 2 Investigation

The Sirens Lure codename investigation is related to the Washington Post 2 (sensu Horowitz) investigation, but the relationship is more complicated.

The August 1, 2017 DOJ NSD letter to FBI for the Sirens Lure codename investigation listed three articles (4,5 and 7 from the CIA Crime Report of June 23, 2017) as shown below:

All three articles disclose information obtained by CIA through “intercepts” of reports to Moscow by Russian ambassador Kislyak about his meeting with Jared Kushner in December 2016. (The eighth article listed in the June 23, 2017 CIA Crime Report remains unknown, but it almost certainly is connected to the CNN Investigation, the subject article of which is also presently unknown. The date of the article is between June 2, 2017 and June 22, 2017. Walkafyre and I have discussed candidate articles which I will write up separately.)

Horowitz 25-010 also reports that DOJ similarly sought 2703(d) subpoena for three Washington Post reporters (together with 2705(d) sealing order).

The pleadings related to the 2703(d) order are located in DC court records here (h/t to US Press Freedom Tracker link). The 2703(d) application, filed on December 22, 2020 is here. It listed three articles by Nakashima (Reporter A), Entous (Reporter B) and Miller (Reporter C) - one of which (and only one) overlapped the Sirens Lure list. (The June 23, 2017 and July 22, 2017 articles were both subsequent to the June 23, 2017 CIA Crime Report which originated the Sirens Lure codename investigation.)

As noted above, the May 26, 2017 article disclosed that US intelligence agencies had hacked (“intercepted”) ambassador Kislyak’s report to Moscow about his December 2016 meeting with Jared Kushner.

The second article in the Washington Post 2 Investigation was the seminal June 23, 2017 article entitled “Obama’s secret struggle to punish Russia for Putin’s election assault” (link; archive). See brief discussion in footnote1

The third article in the Washington Post 2 investigation was a July 22, 2017 article by Entous, Nakashima and Miller was entitled “Sessions discussed Trump campaign-related matters with Russian ambassador, U.S. intelligence intercepts show” (archive). It disclosed that US intelligence agencies were in possession of Kislyak reports on meetings/encounters with Sessions in April 2016 and July 2016.

The July 22, 2017 article observed that the “intelligence on Sessions … is based on Kislyak’s accounts and not corroborated by other sources”:

Readers may recall that Sessions’ recusal was instigated by a March 1, 2017 article by the same three Washington Post reporters entitled “Sessions met with Russian envoy twice last year, encounters he later did not disclose” (archive). Given that the July 22, 2017 article was based on US intercepts of Kislyak reporting (the existence of which was highly classified), it seems highly likely that the March 1, 2017 reporting was similarly prompted by the same US intercepts of Kislyak reporting. “Prompted” in the sense that the March 1, 2017 article attributed the information to Justice Department officials, but, re-reading, the March 1, 2017 article smells of parallel construction. It is implausible that Justice Department officials volunteered information about Kislyak-Sessions encounters, as opposed to being questioned about such encounters by Washington Post reporters who were already in possession of the information through a leak. Recall that an FBI document dated March 7, 2017 listed “discussion related to the FBI’s input into the AG’s recusal decision” as a “redline re Crossfire Hurricane Cases”. Why was this a redline? Did the FBI leak information to the Washington Post reporters about the Sessions-Kislyak encounters that it had obtained from the highly classified CIA intercepts? Does this connect to Comey indictment?

As in the New York Times investigation, the FBI applied for a 2703(d) subpoena for non-content communications related to three Washington Post reporters (together with a 2705(b) sealing order) in the waning days of the Trump administration (on December 22, 2022. The order was granted on January 5, 2021.

The request for emails was sent to Proofpoint who promptly replied (January 15, 2021) that they didn’t have the emails. The Biden administration arrived a few days later and did not renew efforts to obtain the emails.

On May 11, 2021, in early days of Biden administration, WFO filed a Closing Letterhead Memorandum to close the Sirens Lure investigation. This memorandum discussed information from “a former HPSCI staffer” (the Whistleblower in recent ODNI documents), as a result of which the FBI interviewed a “former HPSCI Staff Director, a main person of interest” (identifiable as Michael Bahar) in May 2020, who “denied leaking any classified information”.

The closing letterhead memorandum noted that FBI subsequently attempted to interview “another former staffer from HPSCI” but were blocked by HPSCI counsel. As a result of this resistance, the FBI gave up further investigative efforts involving congressional members or staffers.

There is no mention of any attempt to subpoena (2703(d)) non-content contacts of the Washington Post reporters in the unredacted portions of the Sirens Lure closing memorandum.

On May 24, 2021, the FBI filed an EC closing the Sirens Lure investigation.

On June 10, 2021, a couple of days after the New York Times order on June 8, 2021, the DOJ filed a motion to unseal and withdraw the corresponding 2703(d) and 2705(d) orders related to Washington Post. These orders were issued in early July 2021 (see docket).

Conclusion

The Arctic Haze and Sirens Lure investigations were total failures. The primary investigative tool appears to have been the examination of official government email and telephone records even though, based on prior experience - see SA Jett affidavit - there was negligible prospect of identifying the leaker from government records. No attempt was made to examine reporter records until the very last days of the Trump 45 administration. Needless to say, these efforts were quickly shut down by the incoming Biden administration and the files closed.

The Arctic Haze/New York Times investigation, such as it was, connects directly to the Comey Indictment: both are connected to the April 22, 2017 New York Times article. So we are going to hear more about this.

The Washington Post 2 investigation (which overlaps the Sirens Lure codename investigation) may have an intriguing - and previously unnoticed - connection to the Sessions’ recusal and the intriguing FBI redline against discussion of the FBI role in the recusal. This is a topic that I plan to address in more detail.

1

This article described or purported to describe a “CIA breakthrough” containing “intelligence on Putin [that] was extraordinary on multiple levels, including as a fear of intelligence”.

Ever since the publication of this article in June 2017, there have been questions about exactly what Brennan’s secret intelligence was. The recently released HPSCI Majority Report provides a possible answer- an answer which casts serious doubt on the validity of Brennan’s secret intelligence and the process by which it was elevated.

In today’s article, I will highlight several articles which were predicates for major leak investigation, showing that each of them cited U.S. intelligence intercepts of reports to Moscow by Russian ambassador Sergei Kislyak. The existence of these intercepts was highly classified. The FBI and intel agencies took these leaks very seriously and investigated them much more diligently than, for example, the leak of the existence of the Carter Page FISA or the leak of the Steele dossier endorsement in the classified version of the ICA.

The trail leads to a dog that didn’t bark, raising many questions.

Sirens Lure Leak Investigation

The Sirens Lure leak investigation (pages 201ff in Federalist release) was opened on August 14, 2017, pursuant an August 1, 2017 CECS memorandum, and addressed the following three Washington Post articles:

• Ellen Nakashima, Adam Entous, and Greg Miller, Russian Ambassador
  Told Moscow that Kushner Wanted Secret Communications Channel with
  Kremlin, May 26, 2017 link archive

• Matt Zapotosky, Sari Horwitz, Devlin Barrett, and Adams Entous, Jared Kushner Now a Focus in Russia Investigation, May 25, 2017 link archive

• David Filipov, Amy Brittain, Rosalind Helderman, and Tom Hamburger, Explanations for Kushner's Meeting with Head of Kremlin-linked Bank
  Don't Match Up, June 1, 2017 link archive

Nakashima et al (May 26, 2017) cited a report by ambassador Sergei Kislyak “to his superiors in Moscow” which had been obtained by U.S. intelligence from “intercepts of Russian communications that were reviewed by U.S. officials”. It referred to a meeting between Kislyak and Jared Kushner in December 2016, so the “intercept” took place in December 2016 or soon after.

Jared Kushner and Russia’s ambassador to Washington discussed the possibility of setting up a secret and secure communications channel between Trump’s transition team and the Kremlin, using Russian diplomatic facilities in an apparent move to shield their pre-inauguration discussions from monitoring, according to U.S. officials briefed on intelligence reports.

Ambassador Sergei Kislyak reported to his superiors in Moscow that Kushner, then President-elect Trump’s son-in-law and confidant, made the proposal during a meeting on Dec. 1 or 2 at Trump Tower, according to intercepts of Russian communications that were reviewed by U.S. officials.

The Kislyak meeting with Kushner was also mentioned in Filipov et al (June 1, 2017), which similarly cited “U.S. officials who received intelligence reports describing Kislyak’s account”:

The Kushner-Gorkov meeting came after Kushner met with the Russian ambassador to the United States, Sergey Kislyak, in early December. At the meeting, Kushner suggested establishing a secure communications line between Trump officials and the Kremlin at a Russian diplomatic facility, according to U.S. officials who reviewed intelligence reports describing Kislyak’s account.

The implication is that U.S. intel agencies had intercepted Kislyak’s reporting back to Moscow in or about December 2016 and that officials had disclosed this highly classified information to Washington Post reporters

“Washington Post 2” Leak Investigation

On December 10, 2024, DOJ Inspector General Michael Horowitz issued a report (“Horowitz (2024)” release pdf) on several leak investigations, one of which was its “Washington Post 2” investigation:

The Washington Post 2 investigation addressed the three Washington Post articles shown below (also see WaPo July 13, 2021 discussion of “Washington Post 2” leak investigation link archive). They were published between May 26, 2017 and July 23, 2017. One of the three (Nakashima et al, May 26, 2017) was also listed in the Sirens Leak investigation.

• Ellen Nakashima, Adam Entous, and Greg Miller, Russian Ambassador
  Told Moscow that Kushner Wanted Secret Communications Channel with
  Kremlin, May 26, 2017 link archive

• Miller, Nakashima and Entous, Obama’s secret struggle to punish Russia for Putin’s election assault, June 23, 2017, link archive

• Entous, Nakashima and Miller, Sessions discussed Trump campaign-related matters with Russian ambassador, U.S. intelligence intercepts show, July 22, 2017, link archive

The Miller et al (June 23, 2017) article was an extremely important article, as it provided the first information on the “secret sauce” which Brennan had brought to the ICA in December 2016. Some light has been shed on the “secret sauce” from releases earlier this summer,. but what was revealed seems incommensurate with the importance attached to the “secret sauce”. So considerable mystery remains. It will not be discussed in this article.

Entous et al (July 22, 2017) contained a remarkable parallel to Nakashima et al (May 26, 2017). It was similarly based on reports by ambassador Kislyak to his “superiors in Moscow” that had been “intercepted by U.S. spy agencies”:

Russia’s ambassador to Washington told his superiors in Moscow that he discussed campaign-related matters, including policy issues important to Moscow, with Jeff Sessions during the 2016 presidential race, contrary to public assertions by the embattled attorney general, according to current and former U.S. officials.

Ambassador Sergey Kislyak’s accounts of two conversations with Sessions — then a top foreign policy adviser to Republican candidate Donald Trump — were intercepted by U.S. spy agencies, which monitor the communications of senior Russian officials in the United States and in Russia. Sessions initially failed to disclose his contacts with Kislyak and then said that the meetings were not about the Trump campaign.

Entous et al (July 22, 2017) additionally reported Kislak said that he had discussed “campaign-related matters” in “two conversations with Sessions.”

Readers may recall that the original reporting leading to Sessions’ recusal was a Washington Post article by the Entous, Nakashima and Miller triumvirate on March 1, 2017 (link archive) which had similarly reported “two conversations”. Entous et al (March 1, 2017) attributed this information to “Justice Department officials”, but, in context, one can scarcely help but wonder whether this was a parallel construction of information coming from the same intelligence sources as the subsequent classified information.

Then-Sen. Jeff Sessions (R-Ala.) spoke twice last year with Russia’s ambassador to the United States, Justice Department officials said, encounters he did not disclose when asked about possible contacts between members of President Trump’s campaign and representatives of Moscow during Sessions’s confirmation hearing to become attorney general.

Readers may also recall a curious redline in the FBI Talking Points Memorandum (March 8, 2017): the FBI was not prepared to discuss “FBI’s input to the AG’s recusal decision” with congressional leadership.

The Dog That Didn’t Bark

The common thread to these two incidents: in regard to both Sessions and Kushner, Kislyak reports to Moscow were intercepted by US intel agencies, which then leaked their contents to Washington Post reporters for use against key Trump appointees. In each case, the Washington Post reporters specifically credited the US intel agency intercept as the source for the story.

Kislyak was also involved in a third, even more notorious incident - his telephone call with Flynn on December 29, 2016. A transcript of the Flynn-Kisylak call has been released. But we haven’t heard anything about an intercept of Kislyak’s report to his superiors in Moscow about his telephone call with Flynn.

Why haven’t we heard anything about an intercept of Kislyak’s report? It seems implausible that Kislyak would have reported to Moscow on inconsequential public encounters with Sessions, but not an important telephone call with incoming National Security Advisor Flynn. Did Kislyak’s report contradict the Obama administration narrative about sanctions being discussed? Why wasn’t the Kislyak reporting disclosed to Flynn’s lawyers?

A dog that didn’t bark.

The new documents shed light on how the FBI, when uninterested, went through the motions of creating an investigation file while taking care not to do anything that might identify the leaker. In this article, I’ll review the investigation.

As a preamble to this review, I’d like readers to reflect on an affidavit by FBI agent Steven Jett (link, January 19, 2021) about government leakers in which SA Jett, after briefly reviewing a series of leading cases, stated that he was “aware of no instance in which a government employee contacted a journalist using the government employee's government-owned email account” and the (obvious) necessity of looking beyond official government accounts for relevant communications:

Indeed, during my conversations with these FBI case agents regarding prosecutions of government employees disclosing classified information to journalists, I am aware of no instance in which a government employee contacted a journalist using the government employee's government-owned email account. Given the general understanding among government officials about banner authorities that allow monitoring of government officials' computers, I believe it more likely those same officials, particularly those who are not assigned to a public affairs office, would elect to use email accounts not affiliated with the government.

While this seems blindingly obvious, keep this issue in mind as we review the “progress” of the Flynn “investigation”.

January 13, 2017 Article and the first Crime Report

The Echos Fate investigation was opened on May 10, 2017 regarding the disclosure of classified information in an article by David Ignatius, Four burning questions on Russia (Washington Post, January 13, 2017 link; archive). The relevant paragraph was as follows:

According to a senior U.S. government official, Flynn phoned Russian Ambassador Sergey Kislyak several times on Dec. 29, the day the Obama administration announced the expulsion of 35 Russian officials as well as other measures in retaliation for the hacking. What did Flynn say, and did it undercut the U.S. sanctions? The Logan Act (though never enforced) bars U.S. citizens from correspondence intending to influence a foreign government about “disputes” with the United States. Was its spirit violated? The Trump campaign didn’t immediately respond to a request for comment.

On January 24, 2017 Bill Priestap (Strzok’s superior) issued a Crime Report to Mary McCord (AAG, National Security Division) reporting that the Ignatius article of January 13, 2017 contained classified information.

Priestap’s Crime Report answered an 11- question questionnaire, that was heavily redacted even in the release more than 6 years later:

January 24, 2017 was a busy date in the Russia collusion hoax calendar. It was the very day that (1) the FBI carried out their ambush interview of Flynn, over which Comey and McCabe were both hovering; (2) separately and at almost exactly the same time, FBI was carrying out a lawyered up interview of Igor Danchenko under a Queen for a Day agreement negotiated by DOJ’s David Laufman (who had previously granted similar sweetheart deals to Huma Abedin and Cheryl Mills). [As we’ve discussed at length elsewhere, at his interview, Danchenko revealed that he’d never even met Sergei Millian, the ostensible “source” of the collusion allegations in multiple Steele dossier reports with dates ranging from June 2016 to August 10, 2016, and that the information attributed to “Millian” derived from a single 10-15 minute anonymous phone call in late July 2016 which was much more innocuous than the dossier reporting. The FBI’s subsequent concealment of Danchenko’s admissions was one of the key manoeuvres in the Russia collusion hoax.]

Little or nothing appears to have been done for the next 3.5 months following Priestap’s January 24, 2017 Crime Report.

According to the Opening EC, the case was referred to the Baltimore Field Office on May 8, 2017. The Baltimore Field Office issued an Opening EC on May 12, 2017 - now four months since the original article.

On May 19, 2017, the FBI issued a Notification Letterhead Memorandum reporting the opening of a full investigation into the Flynn leak:

Then on May 25, 2017, the FBI issued an Import Form documenting that they had issued a Letterhead Memorandum (LHM) on the opening of the investigation.

Subsequent to this opening, a subsequent Crime Report added a February 10, 2017 article in Washington Post by the triumvirate of Miller, Entous and Nakashima entitled “National security adviser Flynn discussed sanctions with Russian ambassador, despite denials, officials say” (link; archive). It began as follows:

National security adviser Michael Flynn privately discussed U.S. sanctions against Russia with that country’s ambassador to the United States during the month before President Trump took office, contrary to public assertions by Trump officials, current and former U.S. officials said.

Flynn’s communications with Russian Ambassador Sergey Kislyak were interpreted by some senior U.S. officials as an inappropriate and potentially illegal signal to the Kremlin that it could expect a reprieve from sanctions that were being imposed by the Obama administration in late December to punish Russia for its alleged interference in the 2016 election.

“U.S. sanctions” were a defined term in Flynn’s subsequent Statement of Offense, which referred specifically to the sanctions against GRU, FSB and associated employees and individuals announced in an Executive Order on December 29, 2016, which was one of several measures announced on December 29, 2016. The expulsion of diplomats was announced in a different executive order. Flynn was aware of this distinction, as evidence in a February 2017 article in Daily Caller.

The eventual release of the transcript of Flynn’s call showed that he did not discuss “U.S. Sanctions” as defined in the Statement of Offense, notwithstanding his plea. Similarly, the 302 of the FBI interview with Flynn showed that he was not even asked about “U.S. Sanctions” as defined in the Statement of Offense. At some point in the proceedings, Mueller attorney Brandon van Grack appears to have become aware of this problem, as he introduced a new defined term “sanctions” to incorporate both “U.S. Sanctions” and the expulsion of diplomats. See my thread from 2020 here (link). In my opinion, Flynn’s lawyers should have insisted on this technical distinction, rather than the more esoteric issues, in their dispute with Judge Emmett Sullivan.

The “Investigation”

The subsequent “investigation” of the Flynn leaks is summarized in the Closing of Investigation LHM (December 5, 2020).

Their “open source research” determined that the classified information was also referenced in three other contemporary articles:

They observed that the information remained classified until June 2020, when most of it (other than “sources and methods”) was declassified.

They determined that the subject pool was comprised of at least 167 individuals and that even this number did not include all individuals involved in “verbal briefings and discussions”.

The FBI then reviewed “over 10,000 [in]ternal government email, call, and Lync message records”, an exercise which “was not successful in narrowing down any persons of interest in the subject pool”. Given SA Jett’s observation that government leakers avoid use of government email and message services for their leaks, any other result would have been astounding.

The FBI also “conducted broad open source research and analysis”, none of which “advanced the investigation”. Something was then redacted - typically anything interesting is redacted. I wonder what it was?

The FBI observed that “most of the prioritized subject pool” had senior positions and “many had official purposes for contacting the media as part of their job duties”. The FBI concluded that it was more or less helpless “absent a confession or admission”.

Closing

During the transition period after the 2020 election, the FBI took steps to close down the senescent Echos Fate investigation. On December 5, 2020, the Closing Letterhead Memorandum was filed (page 84); on December 9, 2020, FBI Headquarters filed Closing Concurrence (page 82); then on December 16, 2020, WFO filed a Closing EC and Closing LHM (page 88) agreeing that “all investigative methods/techniques have been completed and/or discontinued, all leads set have been completed and/or discontinued” and closing the file.

The closing of the investigation attracted some news commentary in early 2021.

In a January 20, 2021 revision (link; archive) of a seemingly unrelated story entitled “Justice Dept. Ends Stock Trade Inquiry Into Richard Burr Without Charges”, New York Times reported the closing of the investigation into the Flynn leak case (“Operation Echo”). This article was covered briefly at Just the News (link).

The article, (apparently) incorrectly, stated that the leak was “under scrutiny” by John Durham.

The Justice Department’s decision in the Burr case came after prosecutors in Washington quietly closed two other politically fraught cases this fall without charges, a person familiar with the matter said on Tuesday when asked about other delicate cases.

In one inquiry, code-named Operation Echo, investigators opened a leak case into a Washington Post column about phone calls in late 2016 between Sergey I. Kislyak, the former Russian ambassador to the United States, and Michael T. Flynn, then Mr. Trump’s incoming national security adviser. The leak was one of several matters under scrutiny by John H. Durham, the special counsel investigating the officials who opened the Russia investigation.

The article stated that prosecutors had “investigated whether the disclosures came from former Obama administration officials who had access to sensitive information about the phone calls” and that the “investigators ultimately found no wrongdoing”. Both of these statements are contradicted by the new documents which (1) show that the investigators were unable to identify the wrongdoer, not that there was “no wrongdoing” and (2) show no evidence that any “former Obama administration officials” were interviewed in connection with the leak.

Prosecutors in the U.S. attorney’s office in Washington investigated whether the disclosures came from former Obama administration officials who had access to sensitive information about the phone calls, according to two people familiar with the investigation. The investigators ultimately found no wrongdoing, one of the people said.

Technofog Theory

In May 2020, Technofog hypothesized (thread) that the original Flynn leak had been to Adam Entous of Washington Post, not to David Ignatius. Technofog’s story was picked up in by Fox News (link).

Technofog had noticed a 2018 presentation by Adam Entous at Georgetown (link) who had recounted that sources were “whispering” to him that there were “mysterious communications” between Flynn and Kislyak -

sources start whispering to me that there were all these mysterious communications between Michael Flynn, who was then the National Security Advisor designate for Trump and the Russian ambassador, Kislyak. ..

…

Initially, I didn’t know what to make of it. ..There were divisions within the newsroom. At that point, I’m at the Washington Post... Why is it news that Michael Flynn is talking to the Russian ambassador? He should be talking to the Russian ambassador. He should be talking to him about saving the children of Aleppo, for example. There’s no reason why he shouldn’t be having that conversation. I was arguing internally that we need something more than just the fact that there was a conversation, but I’m one of many reporters.

Entous explained that, as a news reporter, he didn’t see enough for a news report, whereas Ignatius was writing as an opinion columnist.

A year later, Technofog wrote a follow-up article (link) in which he connected the Flynn leak to a related leak relied upon by the Entous triumvirate in a January 5, 2017 Washington Post story (link; archive).

Technofog observed that Brian Hale, then Director of Public Affairs for the Office of the Director of National Intelligence, had speculated in an email to Stephanie O’Sullivan, Clapper, Michael Dempsey, Timothy Barrett, the ODNI Transition Team and DNI-Media, that the leak came from either the White House or a Democrat source associated with the Senate Intelligence Committee:

Technofog, relying on the New York Times reporting of January 20, 2021, incorrectly believed that the leak had been investigated by Durham - which, from the recent releases, we now know not to have been the case. Technofog observed:

The leak was a felony orchestrated for the purposes of damaging the incoming NSA and, thus, the incoming Trump administration. The fallout was enough to get Flynn removed, which prevented him from overseeing the ongoing Carter Page FISA renewals.

While Technofog correctly highlighted the seriousness of the Flynn leaks, he, like so many others, bizarrely fixated on an issue that was irrelevant to the Russia collusion hoax narrative (the Carter Page FISA warrants) and which had no impact on the wider society, while failing to address the fraudulent existence of the Russia collusion investigation itself which was damaged the incoming Trump administration (not the Page FISA warrants).

Conclusion

The new documents on the Flynn leak investigation show that it was not seriously investigated. Based on many previous cases, there was no legitimate expectation that government leakers would document their activities on government-issue email or messages. So the laborious examination of over 10,000 government-issue emails and messages hardly constitutes a serious investigation. Similarly, if insiders in the ODNI hypothesized in real time that leaks were coming from the White House or Senate Intelligence Committee, interviewing several dozen FBI and government personnel wouldn’t accomplish anything.

The most logical first step towards shortening the list from 167 and counting would have been a non-content (2703(d)) warrant for email and phone records of the Washington Post triumvirate (Entous, Miller, Nakashima) - Mueller issued dozens, if not hundreds, of 2703(d) warrants.

In the waning days of the Trump administration, in late December 2020 during the transition period, the DOJ belatedly issued a search warrant for email and phone records for the WaPo triumvirate but for the period April 1, 2017 to July 31, 2017 (archive) that was of interest in the Sirens Lure investigation (see upcoming article.) Washington Post lawyers fiercely fought against this warrant and, needless to say, it was quickly dropped by the incoming Biden administration under Merrick Garland.

The Flynn leaks deserved a serious investigation. But the FBI under Wray and Comey wasn’t interested. So a serious investigation never took place.

But the list of classified leaks was very long, with a new leak seemingly every few days. Recall the leak about Trump’s telephone call with Australian prime minister (February 2, 2017); the (incorrect) leak that Flynn had talked to Kislyak about sanctions (WaPo, February 10, 2017); the leak that CIA had briefed that "Putin aspired” to help Trump (WaPo, December 9, 2016; NBC, December 15, 2016) ; the leak that classified intelligence showed that Trump campaign aides had “repeated contacts with Russian intelligence” (NYT, February 14, 2017). Or even the in-campaign leak from congressional staff indirectly referring to the alleged meeting between Carter Page and top Russian officials (Isikoff, Sept 21, 2016).

Recently, Sean Davis of the Federalist (August 13, 2025 link; pdf) released documents on seven codename leak investigations. A week later (August 21, 2025), John Solomon (link; pdf) released a slightly less redacted version of one of the investigations (“Tropic Vortex”). The additional details in the less redacted version were critical and shed important new light on events that remain hard to understand.

Boente Opens Investigation (US Postal Inspection Service)

The investigation codenamed Tropic Vortex wasn’t opened until January 31, 2019, but its opening memorandum referred back to a leak investigation opened on March 22, 2017 by then A/Deputy Attorney General Dana Boente as follows:

It was then only three weeks since Sessions had recused himself from oversight of Russia collusion investigation (Comey’s role in which remains uninvestigated), thus placing A/DAG Boente as the senior oversight official. It was then only two weeks since Comey had obtained Boente’s consent to make a public announcement of the Russia collusion investigation, notwithstanding standard FBI policy to neither confirm nor deny an investigation (a policy that Comey had relied on in his discussions with Trump) - a briefing in which Comey withheld the exculpatory information from Igor Danchenko about the anonymous phone call. It was then only one week since Comey had briefed congressional leadership about the Russia collusion investigation, once again leaving out the exculpatory and refuting information. It was then only two days since Comey’s announcement of the Russia collusion investigation at a public hearing of the House Intelligence Committee, a public announcement that dramatically ratcheted up the public demand for a special counsel investigation.

It was at a time when the incoming Trump administration had been beset by classified leaks, with both Trump and Sessions demanding that the leaks stop.

So which leak did Boente open on March 22, 2017? The Steele dossier? The Flynn phone call? Putin “aspired”? The Australian ambassador call?

None of the above. Boente opened on an October 2016 article in New York Times following a criminal referral from REDACTED, putting John Durham and the US Postal Inspection Service in charge of the investigation. The most plausible infill of for redacted complainant who had made the criminal referral (30 characters) is National Security Agency (NSA).

walkafyre almost immediately figured out (correctly) that the “October 2016 NYT article” was an October 5, 2016 article by Charlie Savage and Nicole Perlroth entitled “Yahoo Said to Have Aided U.S. Email Surveillance by Adapting Spam Filter” (archive). The article began as follows:

A system intended to scan emails for child pornography and spam helped Yahoo satisfy a secret court order requiring it to search for messages containing a computer “signature” tied to the communications of a state-sponsored terrorist organization, several people familiar with the matter said on Wednesday.

Two government officials who spoke on the condition of anonymity said the Justice Department obtained an individualized order from a judge of the Foreign Intelligence Surveillance Court last year. Yahoo was barred from disclosing the matter.

To comply, Yahoo customized an existing scanning system for all incoming email traffic, which also looks for malware, according to one of the officials and to a third person familiar with Yahoo’s response, who also spoke on the condition of anonymity.

With some modifications, the system stored and made available to the Federal Bureau of Investigation a copy of any messages it found that contained the digital signature. The collection is no longer taking place, those two people said.

The order was unusual because it involved the systematic scanning of all Yahoo users’ emails rather than individual accounts; several other tech companies said they had not encountered such a demand.

Two days earlier, Joseph Menn of Reuters had broken a similar story (link):

The criminal referral from the [NSA] pertained to the “two government officials” who confirmed the story to the New York Times. Boente referred to the investigation outside because one of the suspected leakers was James Baker, then general counsel to the FBI. By coincidence (or not), this was the exact period in which the FBI was confronted with the Alfa Bank hoax, which had been brought to Baker by Marc Elias of Perkins Coie. On October 5, 2016, FBI counterintelligence officials at headquarters were corresponding with the same FBI agents in San Francisco about the Yahoo story almost concurrently with the Alfa Bank hoax.

This suspicion proved correct. Baker was firmly identified by the US Postal Inspection Service as one of the two government sources for the leaked information in the October 2016 NYT article. The Postal Service investigation also revealed that FBI Chief of Staff Rybicki had “instructed [Baker] to disclose the information to the NYT” and that Baker “understood that Rybicki was conveying this information and authorization from Comey”:

The information on when Durham’s report was filed is inconsistent. In the FBI Opening EC for Tropic Vortex (January 31, 2019), it was dated to December 22, 2017 as a report to AG Sessions.

But in the Closing Concurrence (February 25, 2020]), it was dated to December 11, 2018 as a report to A/AG Matthew Whitaker.

Thus far, neither of these important reports has been declassified or released.

In any event, Durham recommended “NO prosecution of Baker or anyone else” in response to the NSA criminal referral.

Tropic Vortex, January 2019

In January 2019, the US Attorney for DC submitted a memorandum to FBI Counterintelligence advising them that the case file from the Postal Service investigation “may contain information relevant” to several codenamed leak investigations (Echos Fate, Foggy Falls, Genetic Christmas and Sirens Lure.

The opening paragraph of one of the opening documents was anomalously completely redacted - even the date.

On April 8, 2019, WFO completed their review of the US Postal Service investigation documents, from which they identified one incident of considerable potential interest.

They observed that “multiple DOJ and FBI officials were asked [by US Postal Inspection Service] about their discussions, actions, and responses” to Trump’s March 4, 2017 tweet about phones at Trump Tower being wiretapped and a March 5, 2017 NYT article which reported that “Comey asked the DOJ to publicly reject the assertions” in Trump’s tweets - leaked information that had not then been released by DOJ, The document stated that the “tweets and article occurred shortly after the initiation of the USPIS investigation” - a statement that is seemingly inconsistent with the official opening date of March 22, 2017. However, the US Postal Service investigation had not determined the source of this leak.

WFO investigated this incident further and, on October 21, 2019 (during first impeachment hearings), WFO reported that Rybicki had “forwarded an email containing a proposed statement to the news media regarding the tweets to his (Rybicki’ s) presumed personal email account” and that “the proposed statement originated from Comey”. WFO “assessed Rybicki did so in furtherance of a potentially unauthorized disclosure to the news media, which appeared to be at the impli[ed direction of C]omey”. WFO presented these findings to the “attorneys, agents and” various other concerned parties.

However, USAO-DC [Jesse Liu] “declined to pursue additional legal process as the proposed statement appeared to be UNCLASSIFIED”.

On January 20, 2020, USAO-DC Liu issued a prosecution declination on this issue. Liu resigned soon afterwards.

Reprise

Nearly all of the classified leak investigations came up empty. Nobody was identified in regard to leaks re Flynn (Echo Falls), leaks re Putin “aspired” (Genetic Christmas), leaks re Carter Page FISA (Foggy Falls, Riding Hood), leaks re use of hacked Russian intercepts (Sirens Lure).

Only two of the codenamed leak investigations (so far reported) were able to identify leakers: Baker and Rybicki (both at Comey’s direction) in Tropic Vortex; and Strzok also to New York Times (Arctic Haze, April 22, 2017 article) also at Comey’s direction. None of the leakers operating at Comey’s direction were charged. Ironically, A/DAG Boente’s opening of the leak investigation on March 22, 2017 (eventually implicating senior FBI officials) occurred in the midst of Strzok’s briefings to NYT (later the subject of Arctic Haze) also implicating classified information:

Here’s a question that no one has asked yet.

Under normal circumstances, it’s inconceivable that an Acting Deputy Attorney General would commission a US Attorney from Connecticut and the US Postal Service Inspection Service to investigate a criminal referral from NSA potentially implicating the highest FBI officials without advising and obtaining approval from the Attorney General, who would, in turn, have advised and obtained approval from White House Counsel.

But is this what happened with the US Postal Service Inspection Division investigation?

AG Sessions isn’t mentioned in connection with the opening - only A/DAG Boente. AG Sessions had recused himself from the Russia collusion investigation, but the leak in the October 5, 2016 Yahoo article wasn’t connected to the Russia collusion investigation. It’s possible that A/DAG Boente had fully briefed and fully informed AG Sessions on the NSA criminal referral potentially implicating senior FBI personnel, but, in the febrile atmosphere of March 22, 2017, it’s equally, maybe more possible, that he didn’t. If they had known, it’s hard to believe that Trump and/or White House Counsel wouldn’t have used the information when it came to firing Comey.

Be that as it may, the backstory of how A/DAG Boente appointed Durham and the US Postal Service Inspection Division remains untold and a definite dig-here.

Postscript

Incorporating comments by @walkafyre in prior discussion (see, for example, thread).

On October 4, 2016, Strzok sent an email to Baker, Priestap, Lisa Page and a redacted (NSD)(JMD) that the “article under discussion was out”. This was the Reuters article of October 4, 2016 about the Yahoo backdoor for US intel agencies.

The next day (one day before the NYT article), Strzok sent an email to three SF agents (Elvis Chan et al?), a USACAN agent (Jeffrey Shih?), Trish Anderson and Lisa Page, presumably to respond to Reuters article on Yahoo backdoor.

During the meeting *link), Strzik sent a Lync to Page mentioning “Madsen”, who walkafyre plausibly identified as Chris Madsen, then Yahoo Assistant General Counsel.

xxx

On January 17, 2019, Robert Litt (former DNI official) published article in Lawfare (link) stating that Baker’s lawyer had stated “that Baker could not answer certain questions during his congressional testimony because Baker was the subject of a criminal investigation into leaks being conducted by Durham”. He cited a letter from Republican HPSCI members (link). We now know that this is the Durham-USPIS investigation.

walkafyre also observed that Durham had been trying to interview Peter Strzok on or about May 17, 2017 (link) - just as Mueller investigation was being announced. This can now be interpreted as pertaining to the USPIS leak investigation. (As of September 2020, Strzok still hadn’t been interviewed by Durham - in either iteration (link)

On December 21, 2017 (again h/t walkafyre), Barrett, Nakashima and Leonnig at Washington Post reported that Baker was going to be re-assigned. This was on the eve of the December 22, 2017 date on which, according to xx, Durham submitted his no charge recommendation re Baker. The story gave some details on the subject of the leak.

I’ll explain the identifications below. Here’s an early paragraph from the December 5, 2017 302. The font is non-proportional (Courier New) and easy to character count. The staff director has 12 characters and staffer has 16 characters.

Here is a contemporary listing of Democratic (minority) staff (link). Michael Bahar (12 characters) is listed as Staff Director. (He resigned in June 2017 and was replaced by Timothy Bergreen, Rheanne Wirkkala is the only staffer with a 16 character name. Both can be confidently infilled into the above paragraph.

Wirkkala had been previously identified by Sean Davis (link) in the second bullet in the paragraph shown below, listing three “potential pathways” identified by WHISTLEB for HPSCI leaks. Davis, using Grok, determined that Wirkkala was married to Ian Duncan, then a reporter for the Baltimore Sun. Identification of Wirkkala as bullet also shows that first line of each bullet is one character longer than the rest of the bullet. Thus, the first bullet is 5 characters and third bullet is eight characters.

Eager and Bahar

The person in the first bullet can be identified from clues in the two prior paragraphs. A senior employee “brought a new staffer” to the committee. The new staffer’s name has 12 characters. This matches Thomas Eager, who has 12 characters in his name and who, according to his LinkedIn, began work at HPSCI in (then recent) July 2015.

Eager’s patron can be confidently identified among the 5-character surnames as Michael Bahar himself, who, as walkafyre discovered, provided an “Insider’s Take on Encryption and 702” in an article published on July 6, 2017 (link) only a couple of weeks after Bahar left the HPSCI for employment at a Washington law firm:

Walkafyre proved the link between Bahar and Thomas Eager with this remarkable find (link): Bahar became a Universal Life minister in order to officiate at Eager’s marriage to Rachel Dolin.

The first bullet in paragraph cited by Sean Davis therefore reads:

[Eager]: He sits in on the Russian briefings after the Russian Team reads documents at [CIA] or [FBI]. It is likely he tells [Bahar] what he learned and [Bahar] takes it to the media.

The FBI did investigate Bahar in connection with leaks. In the Horowitz report entitled “A Review of the Department of Justice’s Issuance of Compulsory Process to Obtain Records of Members of Congress, Congressional Staffers, and Members of the News Media” (link; pdf) , there are numerous mentions of the investigation of “the Senior Committee Staffer” in connection with leaks. Horowitz’ “Senior Committee Staffer” can be confidently identified as Michael Bahar, who was repeatedly mentioned in the 302s from WHISTLEB.

Ultimately, no charges were filed against either Bahar or Eager.

Bergreen

The third bullet in the paragraph cited by Davis is an 8-character last name, who is acquainted with a “Dan (LNU) from NBC”. There’s a good chance that this 8-character is the 8-character in next paragraph who sometimes calls from Schiff’s office. This can be confidently identified as Timothy Bergreen (8 character surname), who succeeded Bahar as Staff Director.

Bergreen, as Staff Director, would plausibly have access to Schiff’s office. Bergreen was quoted in a 2023 NBC article by Dan De Luce (link) - some slight support for Dan De Luce possibly being the Dan (LNU) from NBC.

The “Russian Team”

The 302s described a system in which three people from Schiff’s staff (the “Russian Team”) would visit secure reading rooms at [CIA] and [FBI] where they were not allowed to take notes or copy documents, but would memorize as much as they could and then return to HPSCI offices where they would memorialize their visit in a standalone computer, and then brief a wider staff of 4 or so. The system was described in both the August 2, 2017 and December 5, 2017 302s, as shown respectively below:

and

The three members of the Russian Team visiting the CIA and FBI reading rooms are 16, 16 and 11 characters. The two 16s are convincingly Rheanne Wirkkala and Timothy Bergreen; there are multiple candidates for the 11: Carly Blake, Maher Bitar, Linda Cohen. Maher Bitar (who started at HPSCI in April 2017 as General Counsel specializing in Russia file) seems most plausible.

In the August 2, 2017 302, the briefees were a 12, two 11s and a 5+7(13) plus a 13 (the new hire). In the December 5, 2017 302, the briefees were a 6+5(12), an 11, two 13s and Schiff’s communications director (a 14). The 12 is Thomas Eager; the communications director (14) is Patrick Boland; the new hire 13 is Shannon Green; the 5+7(13) is Wells Bennett. The 11 in the December 302 is probably Carly Blake (also one of the 11s in the August 302). The second 11 in the August 302 would then be Linda Cohen. The second 13 in the December 302 is probably Amanda Thorpe.

Following are infilled transcripts of these 302s.

In this note, I haven’t discussed a couple of interesting incidents in the 302s and will try to do so on another occasion.

20170802 302 Interview

587KB ∙ PDF file

Download

Download

20171205 302 Interview

303KB ∙ PDF file

Download

Download

First, here is an excerpt from the July 30, 2025 documents in which the July 30 Whistleblower describes his background:

Here is the front page of the 2016 ICA declassified and released on July 18, 2025. It was ICA 2016-37HC entitled “Cyber Threats to the 2016 Presidential Election” and is on page 15 of the July 18 release (link).

In addition to this connection, there is a second closely related connection between the July 30, 2025 Whistleblower document and the original July 18, 2025 ODNI release. On page 12 of the July 30, 2025 Whistleblower release, the Whistleblower observed that “as recently as September of 2016, other elements of the IC had pushed back during analytic coordination on warnings of Russian intent to influence the 2016 presidential election stating that such a judgement would be misleading”, This statement was footnoted to email with subject line “Cyberthreat to the 2016 Presidential Election -drafting - comments requested by 1100 AM Friday”. The footnote was redacted (like most of the other footnotes.)

However, on page 8 of the July 18, 2025 release, there is an email thread with this exact title. The most recent email in the thread (as published) was from an Intelligence Analyst in the Technology Cyber Intelligence Unit, Cyber Intelligence Section and contained “inputs from the FBI”:

The original email in the thread was from the DNIO, Cyber soliciting comments on the draft September 2016 ICA. No wonder the Whistleblower took an interest in the July 18, 2025 release. However, the email thread (details of which were redacted in the July 30 release) had already been declassified and published in the July 18 release.

The footnotes to Enclosure 2 of the July 30, 2025 Whistleblower refer to multiple other email threads that were not included in the July 18, 2025 declassification and release, but which logically belong to the overall disclosure: IC SR comments on your PDB on Cyber Activity against US Election (2016-22827-IC) on deck for Friday; US Election machines - hacked????; TPs for 2 December DC on Sensitive Topic (The term “Sensitive Topic” is also used in Senate Intelligence Committee report in the heading for a section that was entirely redacted.); Why RT cheerleading is consistent with- but NOT. in and of itself - an act of disruption; But…. RT cheerleading; SENSETIVE; ACTION REQUIRED: FOIA Search DF-2019-00269 (Hermann); and ICIG/ AG Durham/ Russia potential irregularities in analytic practice.

The Wikileaks July 22, 2016 tranche contained emails from seven accounts: Luis Miranda emails exfiltrated on May 23. 2016; and, on May 25, 2016, mailboxes from Jordan Kaplan, Erik Stowe, Wright, Zach Allen, Parrish and Scott Comer in that order.

The above plot shows some details that weren’t discussed by Forensicator.

• Within each mailbox, the emails were exported in order of folder, then latest to earliest within each folder. In each case, the Sent folder (gold) was exported last.

• the “folder” structure observed in the export pattern is clearly consistent with the folder structure of Microsoft email system. A minimum of three folders (Inbox, Sent, Drafts) plus, presumably, one or more Archive or other folders.

The 30-day DNC retention policy (previously reported) is clearly visible in the structure of sent_dates. It was strictly observed in the Sent folders and in nearly all of the probably Inbox folders. The presence of emails with datestamps prior to the 30-day retention period has been noted previously (e.g. link), but never explained. The vast majority of pre-retention emails occur in two folders: a Scott Comer folder containing voice mails and a Zach Allen inbox folder. I haven’t parsed the other stragglers, but they all appear to be from Archive or Draft folders.

Metadata extracted by Tralfamadorenik showed presence of numbered DNCDAG servers in inbound metadata. Tralfamadorenik observed a shift from DNCDAG1 to DNCDAG2 between May 23, 2016 and May 25, 2016 - see his discussion on X.

The Miranda emails were exported from about 02:13 to 02:46 AM (Pacific time) and the May 25 emails were exported from about 05:21 to 06:04 AM (Pacific time.) The time zone was first identified as Pacific time by Forensicator in April 2019 (link). The exfiltration rates - originally calculated by with_integrity and Forensicator (and verified by me) were all “slow” - about 400 KB/second. This is opposite of claims associated with VIPS. See link.

August 26 and September 21, 2016 Tranches

Subsequent Wikileaks tranches of DNC emails had datestamps of August 26, 2016 and September 21, 2016. In these tranches, the distinctive sent_date-time versus exfiltration_time patterns observed in the July 22, 2016 do not exist, as shown below:

However, there was pattern to exfiltation sequence: the August 26, 2016 and September 21, 2016 emails were in timestamp batches, each of which was sorted by increasing size (Mb). Shown below are plots for two August 26, 2016 batches: left - Brinster; right - Banfill. (These are NOT cumulative size, but the size of each email and attachments).

Order of Exfiltration on May 23, 2016

The emails in the three mailboxes in the August 26, 2016 and September 21, 2016 tranches all appear to have been exfiltrated on May 23, 2016 in the hour prior to 2:04AM Pacific time. The reasoning (due to Forensicator) is as follows:

• the latest email in each of the “May 23” mailboxes (Banfill, Brinster, Crystal) is earlier than the latest email in the Miranda mailbox.

• From this detail, Forensicator plausibly assigned their export to the period immediately preceding the Miranda export - which began at 02:04 AM Pacific time on May 23, 2016. This would place the exfiltration of the Banfill, Brinster and Crystal emails to approximately 1:00AM - 2AM on May 23, 2016 Pacific time.

• All three, like Luis Miranda of the July 22, 2016 drop, had a latest sent date of May 23, 2016.

Earliest Sent_Dates

Long ago (September 2017), I observed (link) that nearly all of the DNC emails were in the 35 days prior to May 25, 2016 - the date of the latest email in the archive, as shown in the figure below copied from that article.

The figure below shows additional detail on the late April 2016 period, color coding the mailbox count for each day. The “May 25” mailboxes have substantial volumes beginning on April 25, 2016. Two of the four “May 23” mailboxes have first volume on April 23, 2016; the Jeremy Brinster mailbox, anomalously, has significant volume beginning on April 19, 2016; the fourth “May 23” mailbox starts later in early May 2016. This suggests earlier access to the Jeremy Brinster mailbox.

Jeremy Brinster Anomaly

Some time ago, I observed (link) that Brinster was last Modifier for all the docx and xlsx documents in the June 21 Guccifer 2 blog (about the HRC_pass zipfile) as shown below:

At the time, I also identified (link) Brinster as the unidentified “member of the DNC’s research team” referred to in Sussmann defense exhibit DX-165 (an email dated October 14, 2016) as recognizing Guccifer 2 documents that appeared to have come from his desktop, as, to his knowledge, he had not attached them in emails:

Forensicator (link) had previously identified Brinster as the author of nearly all the documents in the hrc_pass_.zip file uploaded by Guccifer 2 to his blog on June 21. Separately, Bruce Leidl had observed that the documents in the hrc_pass..zip file had been exfiltrated on April 26, 2016 at a very slow rate - a result confirmed by Forensicator (link) who calculated exfiltration at an average of about 26 kB/second.

DETAILS - APPENDIX

Following are some notes on three individual inboxes (Miranda, Comer, Kaplan) that were in my inventory.

Luis Miranda, May 23, 2016

Miranda inbox was exported on May 23, 2016. All the emails were within the 30 day retention period. The mailbox appears to consist of a large Inbox folder, a large Sent folder and several minor folders - all ordered latest to earliest.

• a very large Inbox (9064) - latest 5/23, earliest 4/23

• a large Sent folder (1244)- latest 5/23, earliest 4/23

• first folder (156) consists of voice mails and (apparently) unsent drafts. Filenames in form 05E01258E71AC046852ED29DFCD139D54DEF4239@dncdag1.dnc.org.

• second folder consists of a small Inbox and small Sent (9)

Scott Comer

The Scott Comer mailbox was exfiltrated on May 25, 2016.

·       Large (525) folder of voice mails in both current and past. (May 24 latest) These have 5C041 format.

·       334 emails inbox in current period DAG-format

·       Tiny folder (4) from Jan 2016. Non-5C041

·       Large current inbox 5C041 format from May 25 to Apr 25

·       Snall folder (8) old – notes to self and passwords.

·       Large current folder (Sent) May 25 to Apr 25

·       Small (current 9 ) folder

Jordan Kaplan

This was first inbox exfiltrated on May 25, 2016. It contains the following folders.

• 1.     Small (9) folder – current and old.

• 2.     Large(1894) inbox May 25 to Apr 25

• 3.     One email (May 23) Inbox.

• 4.     Sent (80) – a couple of current. Mostly old.

• 5.     Big inbox (1148) -5/25 to 4/24

• 6.     One (1) oddball inbox (E93A19). Old.

• 7.     Large Sentbox (670) – May 35 to Apr 24. Phone format.

Because Steyn was so weak, nearly all of the defense was taken up by Simberg’s lawyers. They were highly professional, but their strategy was focused almost entirely on the lack of damages to Mann, and, in particular, to Mann’s claims about lost grants. In my opinion, the issues about, for example, Mann’s concealment of adverse verification statistics were issues that ought to have been raised in cross-examination of Mann (rather than late in the day in direct examination of McKitrick or me), but none of this took place. Instead, the cross-examination went on and on about Mann’s grants - an issue which seemed far less important to me than putting Mann on the spot about his concealment of adverse verification statistics,

However, the defense focus on Mann’s grants was vindicated by the scathing comments of the judge in his recent sanctions order against Mann and his lawyers (link; link), including the following:

"Dr. Mann's assertion that there was no falsehood or misrepresentation in his testimony or his counsel's conduct borders on frivolity."

"the record plainly shows the deliberate and knowing misconduct of Dr. Mann's counsel in eliciting false testimony from Dr. Mann and misrepresenting his grant funding."

"Dr. Mann's counsel's bad faith misconduct is an affront to the Court's authority and an attack on the integrity of the proceedings warranting sanctions."

The judge focused on two components of Mann’s testimony on supposedly lost grants following the blog articles: overstatement of non-funded grants; and under-statement of funded grants.

But neither the judge nor the defense lawyers had deep background in Mann’s “statistical” techniques and, as a result, the judge’s disparagement of the conduct of Mann and his lawyers, scathing as it was, merely scratched the surface. For today’s article, I’ve done a fresh analysis of Mann’s presentation and shown that there was much more to “Mann’s DC Trick” than discussed in the sanctions order. (I’ll do a separate article elucidating the sanctions order, but, in this article, will focus on issues that were overlooked in the trial and order.)

The centerpiece of Mann’s claim for lost damages was his assertion that his grant successes went from from “just under a million a year” in the four years ($3.3 million total) prior to the Simberg-Steyn blogs to “a little more than 100,000 a year” in the four years after ($500,000 total). They illustrated this claim with the “demonstrative” shown below right. This claim was asserted in the opening statement, in Mann’s direct evidence and the closing statement. An excerpt from Mann’s direct is below left. In the sanctions order, J Irving observed a significant exaggeration in the statements and demonstrative: according to Mann’s own data, the total value of grants after the blogs was $895,000, not $500,000; and reduced the before-and-after “disparity” from $2.8 million to $2.4 million. The judge was very troubled by this exaggeration.

But there were several other issues that go much deeper, issues that call into question the very existence of the mid-2012 breakpoint asserted by Mann and his lawyers and which strongly suggest that Mann’s grant claims were the product of data manipulation - the exact subject of the underlying science controversy.

It’s nearly always a good idea in statistical analysis to begin by plotting the data.

In the figure below, I’ve plotted Mann’s annual grants from 1996 to 2021 by US fiscal year ending September 301 using information in Mann’s CV circa 2022 and his amended interrogatory responses (March 2023). In the figure below, the 2008-2016 period selected into Mann’s demonstrative is highlighted in yellow background. The step function in the highlighted area illustrates Mann’s evidence: $1 million per year in the four years prior and $100,000 in the four years subsequent. As a reality check: does this step function fit the data? Obviously not. It’s not even close.

Some comments:

• there is NO - repeat NO - evidence of a July 2012 breakpoint in the data. Any such claim is completely false. This is immediately visible in the above figure.

• the claimed amount of Mann’s grants in 2009 was uniquely high. It was more than 10 times greater than the median value of Mann’s annual grants. Without 2009, the values for the three fiscal years prior (2010-2012) had no statistically significant difference to values for the three fiscal years subsequent (2013-2016). This is immediately visible in the above figure.

• Because the 2009 value is so anomalously high, the timing of the step in Mann’s step function depends on the arbitrary length selected for the step. If a comparison period of two years is chosen beginning in 2008.5, the step will be 2010.5; for three years, the step will be 2011.5; for four years, the step will be 2012.5; for five years, the step will be 2013.5. One can reasonably surmise that Mann’s choice of four years prior as the comparison period was selected in order to place the “step” at the target date of 2012.5,

• as an overall point on grants as a statistical distribution, grants were zero approximately 40% of the time over the 26 years, and between $100K and $500K about 54% of the time, with two outliers (2006, 2009)2. The distribution has peculiar “tail” behavior: almost 50% of Mann’s total grants over 26 years were obtained in these two outlier years.

The 2009 Outlier

Because the 2009 grant claim is such an extreme outlier compared to the other grants and because Mann’s “loss” claim is so dependent on this outlier, the outlier needs to be specifically examined3. There are three large issues.

ARRA

Mann’s 2009 grant claim consisted of two grants funded under the 2009 Obama “stimulus” bill - the so-called American Recovery and Reinvestment Act (ARRA): one grant ($541,000) in which he was the Principal Investigator and one much larger grant related to vector-borne disease ($1,885,000) in which he is listed as a Co-PI. The figure re-states the 1996-2021 grant figure by adding color coding by sponsor type, ARRA grants in red and magenta. The other anomalously large grant was a USAID grant in 2006 in which Mann was a Co-PI.

The American Recovery and Reinvestment Act (ARRA) was passed on February 17, 2009, in the first month of the Obama presidency, and had a total budget of $831 billion - about the same, allowing for inflation, as the $893 billion budget of Biden’s so-called Inflation Reduction Act in 2022. Approximately $3.1 billion of ARRA funding was allocated to the National Science Foundation (NSF).

In an interesting recent Jon Stewart podcast (link at 44 minutes), Ezra Klein noted the total failure of the ARRA program to deliver anything on its signature promises: high-speed rail, “smart” grid or interoperable electronic health care records, although, in fairness, others have pointed out (link) that it did succeed in building thousands of “ADA corner crosswalk things that didn't actually connect to anything”. It also funded research by Michael Mann (link) that may or may not “actually connect to anything”. In retrospect (and probably in real time), one would have thought that the purpose of the stimulus would have been better served elsewhere than academic researchers4.

In any event, by 2012, ARRA funding had almost entirely run its course. The implication of Mann’s claim to a “$2.8 million” shortfall is that Mann was entitled to a second helping of the ARRA bonanza during the second Obama term, even though the program had expired - a notion so unpalatable that neither Mann nor his lawyers expressed it in those terms.

In Steyn’s cross-examination of Mann, Steyn repeatedly asked Mann whether there were other factors besides the Simberg-Steyn blog articles which could have contributed to reduced grant funding. Obviously the expiry of the ARRA program removed the very source of funding which had funded Mann’s outlier 2009 grants. But Mann, needless to say, didn’t mention ARRA.

Contract or Subcontract?

The 2009 claim related to the vector-borne disease disease ($1,884,991) was much larger than other grants in Mann’s CV (most of which appear to have funded a couple of grad students). Mann’s claim in the interrogatories was equal to the full amount of the grant as reported in the NSF summary report (see link). The NSF summary report listed 29 articles attributable to this grant, but only one lists Mann as a coauthor. This strongly suggests that Mann was a subcontractor to this project.

In other interrogatory cases where Mann was a subcontractor, Mann’s amended interrogatory only claimed the amount of the subcontract, which, in an important example cited in J Irving’s sanctions order, was a tiny fraction of the total contract.

In Mann’s June 2020 interrogatory responses, he had claimed an amount of $9,713,924 in non-funded grants in relation to a grant application entitled “WAter VariabilitiEs Stressors and Sensitivities (WAVESS)”, dated 9/1/2014. (He had listed this amount in his CV at the time.) In his amended March 2023 response, Mann reduced the claim to $112,000! The lesser amount was the amount attributable to his Penn State group; the larger amount was the amount attributable to the entire project.

This became an issue in the trial because Mann’s team presented the incorrect June 2020 information to the jury in an exhibit. When the defense objected to the exhibit, Mann’s team falsely reassured the judge that there were no significant differences between the exhibit and the final numbers. In the sanctions order, J Irving excoriated Mann and his team both for presenting the false number to the jury and for falsely reassuring the judge about the validity of the numbers.

The purpose of this example is to show the difference between the value of the full contract and the value attributable to a subcontractor. The question then is whether Mann’s calculation should have shown the full value of the grant (most of which went to a different department) or the amount attributable to Mann’s putative subcontract. If the latter, then the appropriate amount is likely more like $125,000-150,000, as opposed to $1,885,000.

Mann similarly appears to have been a subcontractor on the 2006 USAID grant that comprised the majority of the 2006 outlier. It was listed in his CV at its total face value, rather than the value of Mann’s subcontract.

Climategate, November 2009

The third factor against inclusion of 2009 as a comparandum is, of course, that the Climategate emails were released in November 2009, about 6 months after the extravagant 2009 ARRA “stimulus” grants.

On January 20, 2010, during the midst of Climategate controversy. Mann’s receipt of 2009 “stimulus” funds became the subject of a Wall Street Journal opinion editorial (archive; link) entitled “Michael Mann’s Climate Stimulus: A case study in one job ‘saved’”.

The editorial observed that they had contacted NSF about the awards to Mann, but were told by a representative that she was "unaware of any discussion regarding suspending or changing the awards made to Michael Mann." The op ed concluded with the observation that “your tax dollars will continue to fund a climate scientist whose main contribution to the field has been to discredit climate science”.

The NSF made these awards prior to last year's climate email scandal, but a member of its Office of Legislative and Public Affairs told us she was "unaware of any discussion regarding suspending or changing the awards made to Michael Mann." So your tax dollars will continue to fund a climate scientist whose main contribution to the field has been to discredit climate science.

Mann didn’t mention this editorial as a contributing factor nor did the defense ask him about it.

Conclusion

J Irving was scathing at Mann’s understatement of funded grants after the Simberg-Steyn blogs which reduced the supposed “disparity” from $2.8 million to $2.4 million. But when the 2009 outlier is excluded (for any one of the three reasons cited above), the so-called disparity between 2010-2012 and 2013-2016 grants is eliminated, as shown below. (In the figure below, estimated value of 2006 and 2009 subcontracts are shown, but these are outside the highlighted period anyway.) Readers who are familiar with Mann’s “scientific” work will be unsurprised at Mann’s “research” into his grants.

2

Here is a histogram

Nearly all of the produced documents can be matched to documents previously published by HGSAC on December 6, 2020 or by John Solomon in early 2021. All of the documents submitted as an exhibit in Solomon v Garland can be identified in more redacted (often much more redacted) versions in the FBI Vault version (link).

In some cases, pages that are withheld in the FBI Vault version can be firmly identified by concordance with other versions, either HGSAC or Solomon.

In the following notes, I’ve done a concordance of 815 pages (22-cv-2264 Bates numbers) to known contents, together with known versions at HGSAC, Solomon or elsewhere.

The summary shows why I expect the binder to be a nothingburger. There are only a few ranges of withheld documents where I’m unable to presently propose a match, but, even in those cases, my base case is that they will come from already known documents which were quixotically withheld in the FBI Vault version.

Concordance

4-31: the 302 for the 2017 Christopher Steele interview. Only one page is in the FBI vault version. These correspond to A168-193 in Solomon v Garland and were fully published by Solomon in early 2021 link.

32-60. FBI emails from December 2016. These also have prior Bates numbers from Senate HGSAC Transition. These emails were previously published by HGSAC in less redacted format.(archive)

61-145. Various CHS reporting documents almost entirely redacted. Previously online (also almost entirely redacted) at FBI Vault entitled Records between FBI and Christopher Steele (link; link)

146-148. FBI email (Strzok) dated October 11, 2016. Withheld in volume 1 release. Issued in volume 3. Corresponds to A119-A121 in Solomon v Garland release. Previously released in HGSAC December 2020 FBI release, 17-19.

150-223. Withheld 74 pages (see redaction codes on page 1 of volume 1.) Good chance that these come from the HGSAC December 2020 FBI release. 224-225 are entitled Appendix B: Confidence in Assessments and Judgements Based on a Body of Information (FBI Internal Use Only) and are standard boilerplate, presumably as an appendix to an FBI report.

226-265. Numerous ECs connected to Halper. Correspond to Solomon v Halper A132-A168. Originally published in early 2021 by Solomon (link)

266-267. Steele closing document. See FBI Vault (link)

268-351. McCabe texts. See HGSAC, Oct 9, 2020 and Oct 14/2020: HGSAC, December 6, 2020. Also Solomon (link).

352-355. Comey texts: HGSAC, 10/15/2020; 10/19/2020. See HGSAC, December 6, 2020. Also Solomon (link).

356-357. Priestap texts, HGSAC, Oct 15, 2020. See HGSAC, December 6, 2020. Also Solomon (link).

358-393. Strzok texts, HGSAC Oct 20, 2020 and Dec 3, 2020. See HGSAC, December 6, 2020. Also Solomon (link).

394-419. Page texts, HGSAC, Dec 2,2020. See HGSAC, December 6, 2020. Also Solomon (link).

420-436. Page Lync, HGSAC, Dec 2, 2020 HGSAC. See HGSAC, December 6, 2020. Also Solomon (link).

437-461. Strzok lync, HGSAC Oct 22, 2020, Dec 3, 2020, Nov 10, 2020. HGSAC. See HGSAC, December 6, 2020. Also Solomon (link).

462-463. Page dividers - “Pending with DOJ”

464-475. Flynn 302s for January 24, 2017 dated 2/15/2017 and 5/31/2017. Long available.

476-483. Withheld. Referral/consult.

484-494. McCabe memos, May 2017. Previously available from Solomon (link; link; link)

495-521. Multiple Ohr 302s. Previously available including Mueller 302s. Solomon here.

522-522. Blank

523-560. Steele dossier reports. Widely available.

561-566. Defensive brief to Trump. Available in 2020 e.g. Politico here.

567-571. Blank or redacted

572-585. State department emails. In Vault, Volume 5. Previously released by HGSAC, December 6, 2020.

586-587. Placeholder for Request #14 re Perkins Coie. A saucy refusal by DOJ to outgoing Trump administration. This is indicative of the DOJ unresponsiveness that pervades the “binder”.

588-589. Mifsud 302. Also available in Mueller 302s.

590-591. Another placeholder and insolent DOJ refusal to request for information about meetings with FBI officials and DOJ officials Bruce Ohr, Andrew Weissman and (presumably) either Bruce Swartz or Zainab Ahmad.

592-685. 85 pages withheld. A rough guess: the redacted Danchenko EC, published in July 2020, was 59 pages and it might be included here. If it’s not included here, it would further demonstrate the lackadaisical and insolent incompleteness of the “binder”. For sure, the March 2017 and May 2017 Danchenko interviews are not included, though they should be.

686-694. Michael Rogers 302 for 6/12/2017 interview. Also available in Mueller 302s.

695-815. Third Renewal of Carter Page FISA. Also available from HGSAC and Solomon (link)

1

Here is the specific FOIA request made by Judicial Watch:

Neither Horowitz, the FISA Court or anyone else seems to have realized at the time that Durham had interviewed the two Australian diplomats (Alexander Downer and Erika Thompson) in October 2019 and that the Australians had given evidence that contradicted the opening predicate of the Russia collusion investigation (and a key element of the Russia collusion predicate as at the opening of the Mueller investigation.)

It turned out that, during the Durham interview, Downer denied that Papadopoulos had actually stated that Russia had made an “offer to assist the Trump campaign”. The statement attributed to Papadopoulos had originally appeared in a May 16, 2016 cable sent by junior diplomat Erika Thompson (but not in Downer’s own cable on May 11, 2016) and, based on Downer’s evidence in October 2019, appears to have been a deduction or surmise on Thompson’s part and not something that Papadopoulos had actually said.

Worse, it turns out that, shortly after these interviews, Horowitz had asked Durham to “share whatever evidence they had that might be relevant to [the Horowitz] investigation” and had even sent a draft report to Durham for comment. But instead of advising Horowitz of this important information (or notifying DOJ or the FISA court), Durham sat on it for four years. When Durham did eventually disclose this disquieting information in the May 2023 Durham report, it was disclosed only in passing, buried within his report, not even mentioning it in the summary or conclusions.

If Durham had not concealed this evidence from Horowitz, the Horowitz report would almost certainly arrived at a dramatically different conclusion on the opening predicate of the Russia collusion investigation. Had Horowitz done so, subsequent events would have unfolded differently.

In this article, I will provide receipts for the above summary in the context of the overall events. This will be (too) long.

May 2016

Papadopoulos’ memoir Deep State Target contains a detailed chronology of his encounter with the Australian diplomats and events leading up to it. While Papadopoulos is not necessarily reliable, especially in regard to his theories, his dates and chronology are internally consistent and need to be considered before freezing (say) Mueller dates as firm.

According to the SSCI volume 52, on April 19, 2016, shortly after Papadopoulos’ return from a conference in Israel, Israeli diplomat Christian Cantor, then Political Counselor in London, introduced Papadopoulos by email to Erika Thompson, then Political Counselor in London for Australia. In his memoir, Papadopoulos described Thompson as Cantor’s “girl friend” in her 30s. A few years later, Cantor and Thompson were both ambassadors to Colombia at the same time - Cantor for Israel, Thompson for Australia.

Most recently, both were stationed in Australia. Papadopoulos had been introduced to Cantor by a “friend who was an economic counselor” at the Israeli embassy in the U.S.

According to the SSCI Report, Thompson replied to Cantor’s email with a suggestion that they meet following Obama’s visit to the UK (April 21-24, 2016.) Papadopoulos responded by email on April 21, suggesting a meeting on April 26, 2016. The SSCI “assesse[d]” that the introductory meeting took place on April 26, 2016.

According to Papadopoulos’ memoir, two days after Trump’s (April 27, 2016) foreign policy speech at CNI, Israeli diplomat Christian Cantor, then Political Counselor in London, called Papadopoulos to arrange an introduction to his “girl friend” , at a pub later that evening. Papadopoulos later wrote that she was virulently anti-Trump.

The next event in Papadopoulos’ memoir was a May 3, 2016 call from Francis Elliot, political editor at the Times (of London). Papadopoulos made some ill-considered comments that made him briefly front page news in Britain and was duly chastised by Trump campaign (Sam Clovis, Hope Hicks.) Next, on May 5, 2016, Papadopoulos was hosted for lunch at the Army and Navy Club in London by two US Embassy officials, Terrence Dudley and Gregory Baker. Dudley was later interviewed by Mueller.

Continuing on in his memoir, Papadopoulos said that, on May 6, 2016, he received an email from Erika Thompson saying that her boss, ambassador Alexander Downer, wanted to meet him.

Papadopoulos and Thompson scheduled a meeting for May 10, 2016 at a Kensington wine bar. Papadopoulos’ memoir contains a detailed account of the incident.

Next, according to Papadopoulos, Downer told him that he (Downer) was connected to Hakluyt, a British intelligence firm, and aggressively challenged Papadopoulos’ advocacy of a pipeline from Israel to Greece, arguing instead for Turkey as a hub. In a 2019 interview (link) with Australian Broadcasting Corporation, Downer criticized Papadopoulos’ memoir claiming that he had been “targeted” as delusional and fantastic. ( A totally correct criticism in my judgement, but Papadopoulos’ chronology of events in this period can be cross-checked.)

After some more narrative, Papadopoulos gets to the punch line - Russia and Trump. According to the memoir, Papadopoulos had “no memory” of saying that “Russians have a surprise or some damaging material related to Hillary Clinton”. “None. Zero. Nada.” His recollection was that Downer left “brusquely”.

Downer’s narrative (link) in the full interview is worth listening to - the discussion of the Russians is towards the end - since it is probably the most accurate rendering of events. Downer had asked Papadopoulos about Trump’s chances in the primaries and then in the election - this was at a time (May 2016) when Hillary seemed unbeatable.

Downer plausibly rejected Papadopoulos’ claim that he hadn’t talked about the Russians, observing acidly that Papadopoulos seemed to remember other details about the conversation, but not the most important one, noting that he made the same statement in Greece subsequently. Downer’s question was why Papadopoulos was “blathering his mouth off” in the first place. Why was he “telling high commissioners that that Russians had material on Hillary Clinton’s campaign that they might dump before the election to her damage”?

He knew what he can’t remember…. If he did know this, why was he telling us why was he blathering his mouth off? And how would that help Trump? To go around telling high commissioners that that Russians had material on Hillary Clinton’s campaign that they might dump before the election to her damage? Why would you go around telling people that?

As in other interviews, Downer specifically said that Papadopoulos “didn’t say anything about emails”.

Did I believe him or not believe him? … He didn’t mention it at the time. Hillary emails are different than DNC emails. He didn’t say anything about emails.

Downer concluded his interview with the surmise that “the Russians” “obviously told somebody” - but this was a surmise, not something that Papadopoulos had said. Downer also mentions Mifsud in this 2019 interview, but, to be clear, Mifsud

Why were the Russians doing this? They obviously told somebody.

The story about Papadopoulos’ meeting with Downer at the London wine bar was first reported by New York Times on December 30, 2017 (see link). The story, sourced to “four [anonymous] current and former American and foreign officials with direct knowledge of the Australians’ role”, was leaked (by coincidence or not) not long after the discovery that the Clinton campaign had paid for the Steele dossier.

Back to the narrative in Papadopoulos’s memoir which continues: “within forty-eight hours of our meeting, Downer sends a cable to Australian intelligence reporting my alleged remark. With that single act, he upends my life.”

Details first available in the May 2023 Durham report showed that Papadopoulos was mistaken on this point. Downer did send a cable on May 11, 2016, but his cable did not contain any reporting of the Papadopoulos statements3. This detail is not generally appreciated. It was a later cable sent by Erika Thompson on May 16, 2106 that caused the damage.

On or about May 12, 2016 link , a “few days later”, Papadopoulos once again encountered Cantor, Thompson and Downer at an Israeli Independence Day party thrown by the Israeli embassy. Papadopoulos said that Cantor and Thompson “chaperoned” him at the party, with Thompson looking at Papadopoulos “with scorn and horror as if [he] had some kind of toxic disease”:

Downer also mentioned the incident in his ABC interview, but as an inconsequential encounter. Downer’s take seems more plausible than Papadopoulos’ conspiratorial conjecture. Curiously, this third meeting between Papadopoulos and Thompson (and second meeting with Downer) wasn’t mentioned by Mueller or Durham.

On May 16, 2016 (subsequent to the party hosted by the Israeli embassy), Thompson sent a second cable to Australia. The existence of this second cable was first clearly reported by Durham in May 2023.

Durham also reported (for the first time) that the money phrase which predicated the Russia collusion investigation was paragraph five from Thompson’s cable on May 16, 2016 - not Downer’s cable on May 11, 2016. 4

When and to Whom

Given the importance to the predicate of Papadopoulos’ supposed information about the “suggestion from Russia that it could assist”, one would presume that the FBI and Mueller would have determined with absolute precision when and to whom the statement was made.

In the original reporting by New York Times ( link; archive), Papadopoulos’ statement was made to Downer “during a night of heavy drinking at an upscale London bar” i.e. on May 10, 2016:

Comey in 2018 (link) stated that the investigation began “because of reliable information that Papadopoulos was having conversations about obtaining information from the Russians”:

However, to some contemporary surprise, the Mueller report stated that “on May 6, 2016… Papadopoulos suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release of information”:

Durham noted5 that the May 6, 2016 date for the Papadopoulos statement was based on the FBI 302 of the August 2, 2016 interview of Downer and Thompson by Strzok and Pientka.

Mueller’s May 6, 2016 date implies:

1. that the Papadopoulos statement wasn’t made at the wine bar on May 10, 2016 with Downer, but at an earlier meeting, which necessarily was the introductory meeting with Erika Thompson and Christian Cantor;

2. that the introductory meeting was on Friday, May 6, 2016 (rather than the previous Friday, April 29, 2016 as stated in Papadopoulos’ memoir or April 26, 2016 as assessed by the SSCI); and

3. the audience for Papadopoulos’ statement was Thompson and Cantor, rather than Downer and Thompson.

In October 2019, Downer and Thompson were interviewed separately by the Durham investigation. Each Australian told Durham that the Papadopoulos statements had been made at the May 10, 2016 meeting at the wine bar with Downer and Thompson (and not the prior introductory meeting with Thompson and Israeli diplomat Christian Cantor):

In his May 2023 report, Durham observed the “inconsistency” between the when and to whom information provided by (or reported to have been provided by) the Australians in August 2016 and their statements given to Durham investigation in October 2019:

However, Durham apparently didn’t notify Horowitz of this inconsistency. Also note that the May 6 introductory wasn’t “only with Australian Diplomat-1”; Israeli diplomat Christian Cantor was also at this meeting, but surprisingly (or not) Cantor does not appear to have ever been interviewed by the FBI, Mueller investigation, Horowitz investigation, Durham investigation, Senate Intel Committee or House Intel Committee.

In any event, the when and to whom inconsistency was known to Durham by October 2019 and should have been disclosed to Horowitz, as Horowitz might well have had a different assessment of the opening predicate if he had fully understood that no one really knew when or to whom Papadopoulos made his statement about the “Russian offer to assist”.

The Thompson Embellishment

While the October 2019 evidence from the Australian diplomats raised troubling questions about the when and to whom regarding Papadopoulos’ statement (given its importance as predicate for such an important investigation), their evidence was even more troubling in regard to what can only be regarded as an untrue embellishment in paragraph five of the Erika Thompson cable6.

In his memoir Compromised, Strzok had observed that the explosiveness of the information in the Australian cable did NOT come from the bare assertion that Russians had “harmful information”. (Speculation about Russia being in possession of Hillary Clinton’s deleted emails was commonplace in spring 2016 e.g. Paul Gregory (a former colleague of Papadopoulos on Carson campaign) (link; archive) in Feb 2016, Andrew Napolitano on Megyn Kelly on May 8, 2016 (link; archive), Gateway Pundit earlier on May 10, 2016 (link), Sorcha Faal on May 6, 2016 (link, archive), Laura Ingraham’s Lifezette on May 11, 2016 (link), and even Alexandra Chalupa (link).

What was explosive in the Australian cable was the supposed “Russian offer to assist the Trump campaign” - something that Strzok referred to over and over in his memoir. Here’s Strzok himself on the distinction:

the intelligence in the email from the Legat wasn't simply that the Russians had the harmful information.…[but that] the Russian government had offered to assist the Trump campaign through a coordinated release of the material.

By the time of the Horowitz Report, “our corner” of Twitter was already questioning (link) whether the “Russian offer to assist” was something that Papadopoulos had actually said, or whether it had been an embellishment at some stage in the chain of reporting:

By March 2021, Walkafyre (link) had correctly surmised that the speculated embellishment derived from Erika Thompson's cable in May 2016

Downer’s statements to Durham in October 2019 confirmed the surmise about the “Russian offer to assist” being an embellishment by Erika Thompson7.

Durham reported that Downer said that “Papadopoulos made no mention of …. any specific approach by the Russian government to the Trump campaign team with an offer or suggestion of providing assistance”.

No mention of a Russian offer to assist by Papadopoulos.

Downer’s statement in October 2016 was literally the opposite of the opening predicate of the Russia collusion investigation. If Papadopoulos hadn’t said anything about a “Russian offer to assist”, then the language in Erika Thompson’s cable to that effect was necessarily an embellishment- or even fabrication.

Downer said “that he would have characterized the statements made by Papadopoulos differently than Australian Diplomat-I did in Paragraph 5”. Indeed, Downer’s public statements, not just in the July 2019 interview, but as early as April 2018 (see link), similarly made no mention of a supposed Russian “offer to assist” - only that Russia might use potentially “damaging” information on Hillary Clinton (i.e. the commonplace speculation that was not what troubled Strzok):

For that matter, it’s notable that Downer’s May 11, 2016 cable (still not published) evidently did not mention anything about a “Russian offer to assist”. Or else we’d have heard about it (rather than just the Erika Thompson cable.) So in that sense, one can say that Downer’s cable did “characterize the statements made by Papadopoulos differently than [Thompson] did in Paragraph 5”.

Furthermore, Durham’s report was surprisingly (or not) uninformative about Erika Thompson’s evidence on the incident. Durham referred back to the 302 from the August 2, 2016 interview with the two Australian diplomats, according to which, Thompson had told the FBI that Paragraph Five was “written in a ‘purposely vague’ way” because Papadopoulos “left a number of things unexplained” and which had stated that Papadopoulos “did not say he had direct contact with the Russians”.

Given the longstanding interest in the validity of the opening predicate of the Russia collusion investigation, one would have thought that Durham would have highlighted the impact of this remarkable walkback on the opening predicate, but Durham merely mentioned this incident in passing on page 58.

Sandbagging Horowitz

There is a very disturbing and totally ignored thus far interaction between the revelations regarding the statements of the Australian diplomats in October 2019 and the Horowitz Report published two months later.

The Horowitz report contained approximately two dozen references to the Russian “offer” of “assistance” to the Trump campaign supposedly reported by Papadopoulos to the Australians, but not a single caveat that Downer had told the Durham investigation that “Papadopoulos had made no mention … of any specific approach by the Russian government to the Trump campaign team with an offer or suggestion of providing assistance”.

According to his testimony at a Senate committee8,9 , Horowitz had specifically asked Durham to “share whatever evidence they had that might be relevant to [his] investigation”.

FEINSTEIN: Did your office ask Attorney General Barr and U.S. Attorney - U.S. Attorney John Durham to share whatever evidence they had that might be relevant to your investigation?

HOROWITZ: We asked Mr. Durham to do that.

Further, Horowitz had provided a copy of the draft report to Durham soliciting comments, then met with Durham and even discussed the opening of the Russia collusion investigation. Here’s the relevant answer in the Horowitz Transcript:

We did meet with Mr. Durham, as I mentioned, we provided him with a copy of the report, as we did others, to - through our factual accuracy review process. We met with him in November. With regard to that, we did discuss the opening issue. He said he did not necessarily agree with our conclusion about the opening of a full counterintelligence investigation, which is what this was, but there are also investigative means by which the FBI can move forward with an investigation, it's called a preliminary investigation. So there are two types of investigations, full and preliminary. They opened a full here. He - he said during the meeting that the information from the friendly foreign government was, in his view, sufficient to support the preliminary investigation.

Re-examining the events, the only plausible conclusion is that Durham did not disclose the highly exculpatory information from the Australian diplomats to Horowitz. Or even that Durham had interviewed the two Australian diplomats.

Given that much of the focus of the Horowitz Report was the litany of failures of the FBI to disclose exculpatory information (“material omissions”) to the DOJ/FISA Court, it is disquieting, to say the least, that Durham failed to provide Horowitz with the important and highly exculpatory information from the Australian diplomats - information that was far more damaging than any of the material omissions identified in the Horowitz report other than the revelations from Steele’s Primary Sub-Source.

Making matters much worse: if Horowitz had known that the “Russian offer to assist the Trump campaign” was an embellishment by Erika Thompson, and not something that Papadopoulos actually said, it seems entirely possible that Horowitz could have drawn a different conclusion on the validity of the opening predicate than the conclusion of his report (shown below) and subsequent events would have unfolded quite differently:

Additionally, given the low threshold for predication in the AG Guidelines and the DIOG, we concluded that the FFG information, provided by a government the United States Intelligence Community (USIC) deems trustworthy, and describing a first-hand account from an FFG employee of a conversation with Papadopoulos, was sufficient to predicate the investigation. This information provided the FBI with an articulable factual basis that, if t rue, reasonably indicated activity const ituting either a federal crime or a threat to national security, or both, may have occurred or may be occurring.

Mueller and the FBI August 2, 2016 302

The Australians’ evidence to Durham also raises questions about the original FBI interview with the Australians on August 2, 2016 and the reliance of the Mueller investigation on that 302 without additional due diligence.

On August 2, 2016, only two days after the opening of the Russia collusion investigation on July 31, 2016, Peter Strzok and SSA Joe Pientka interviewed the two Australian diplomats in London. While the 302 remains withheld, the Durham report observed that it had been prepared by Pientka and that the 302 attributed the Papadopoulos statements to the “introductory meeting” at which Downer was not in attendance. (But Durham incorrectly stated that Papadopoulos “met only with [Erika Thompson]”. Israeli diplomat Christian Cantor was also at this introductory meeting , but does not appear to have ever been interviewed either by FBI or Mueller.)

The narrative in Downer’s ABC interview in 2019 (link) strongly indicates that Downer was present for the Papadopoulos statements about Russia which Strzok and Pientka attributed to the introductory meeting at which Downer wasn’t present. So why did Strzok and Pientka attribute the Papadopoulos statements to the earlier meeting? Was it an attempt to rationalize the embellishment in the Thompson cable? An embellishment which contained the critical “Russian offer to assist” which Downer had denied being stated?

We separately know that Strzok’s memoir Compromised contained a false “recollection” of what prompted Downer to go to the US embassy on July 26, 2016. Strzok falsely stated that Downer had been triggered by Trump’s “Russia, are you listening” quip (which took place on July 27, 2016.) So it was impossible for Trump’s quip to have triggered Downer. When confronted with the falsehood (first brought to light by Hans Mahncke), Strzok blamed the “mistake” on unavailability of his records. However, the same “mistake” also occurs in notes on a February 2017 FBI briefing so the “mistake” was present very early on. So the possibility of outset errors cannot be precluded.

It is also more than disquieting that Mueller doesn’t appear to have interviewed either of the two Australian diplomats. We now know that they agreed to interview with Durham in October 2019. Did they refuse a request from Mueller? Or did Mueller simply fail to make any request?

Conclusion

In late 2016 and through to Mueller’s appointment in May 2017, there were two legs to the Crossfire Hurricane collusion investigation:

1. the Steele dossier allegations of collusion between Trump campaign and Russia, especially Reports 80 and 95;

2. the Erika Thompson cable allegation that Papadopoulos had stated that there had been a Russian offer to assist the Trump campaign.

No predication other than these two “legs” can be seen in notes reporting FBI briefings in 2017 (especially the March 8, 2017 Talking Points memorandum.) The predicate for the Mueller investigation was recursively defined: it was the predicate for the Russia collusion investigation described by Comey in his March 20, 2017 testimony to House Intelligence Committee. In others, the predicate described in the March 8 Talking Points memorandum i.e. about 80% Steele dossier and 20% Erika Thompson cable.

The collusion allegations in the Steele dossier were fatally contradicted by Steele Primary Sub-source Igor Danchenko in his late January 2017 interview. The Mueller investigation appears to have recognized the invalidity of Steele dossier allegations with Mueller even testifying (falsely) that the Steele dossier was not within the “purview” of the Mueller investigation (even though it constituted the primary predicate for the FBI investigations as of late March 2017).

This leaves the alleged Papadopoulos statements as the sole remaining predicate for the Mueller investigation as originally defined. But Downer’s October 2019 statements flatly contradicted this remaining predicate of the Russia collusion investigation. Durham was aware of this contradiction in October 2019 but withheld the information for four more years until May 2023., and even then, this information - perhaps the most important single information in the entire Durham report - was not included in the executive summary or conclusions, merely a passing mention on page 53. By then, everyone had lost track of Russiagate details and the information, which would have been explosive in October 2019, was more or less totally ignored both in mainstream media and even in the small skeptical community.

Postscript: over the years, there has been considerable speculation about the supposed role of Joseph Mifsud with speculation, fueled by Papadopoulos’ fantasies that he had been “set up”. Hans Mahncke and I have researched this topic at length and have concluded that Mifsud was a “nothing” - neither a Russian agent nor a Western provocateur. Mifsud’s interest in Papadopoulos arose from ordinary motives. London Academy of Diplomacy, where Mifsud was employed, was losing money and about to go insolvent. Mifsud was cultivating a possible new gig. Mifsud had no knowledge of Russian intelligence operations and was not a conduit from Russia to Papadopoulos. Papadopoulos appears to have mentioned Mifsud to FBI in January 2017 to distract from his contacts with Timofeev - in which Timofeev was trying to politely fend off out-of-protocol inquiries from Papadopoulos without offending anyone. But in fevered atmosphere of January 2017 (from Steele dossier), Papadopolous unwisely didn’t volunteer his contacts with Timofeev from FBI and FBI never asked Papadopoulos the right question that would have elicited that information. It’s a long story that’s more like the movie Burn After Reading than Tinker, Tailor, Soldier, Spy.

3

A more or less totally redacted version of Downer’s May 11, 2016 cable was published by Buzzfeed (link) on April 19, 2019 (one day after publication of Mueller Report.)

4

A redacted version of Paragraph Five had previously been published as a quotation in the July 30, 216 Opening EC for Crossfire Hurricane as follows:

6

The EC stated that [Mr Downer] “recalled” [reporting] “of the meetings between Mr Papadopoulos and [the Australian diplomats] concerning statements Mr Papadopoulos made about suggestions from the Russians that they (the Russians) could assist the Trump campaign with the anonymous release of information during the campaign that would be damaging to Hillary Clinton”.

As is now well known, the opening Electronic Communication for the Russia collusion investigation was issued on July 31, 2016 by Peter Strzok, as directed by McCabe and Priestap. Five days earlier (Tuesday, July 26, 2016), Australian ambassador Alexander Downer had met with US Deputy Chief of Mission Elizabeth Dibble in London to inform her of statements made by George Papadopoulos in May 2016. Downer gave Dibble a copy of a May 2016 cable sent by an Australian diplomat, the fifth paragraph of which was quoted in the Opening Electronic Communication (as shown below). DCM Dibble, in turn, passed a copy of the cable to the FBI Assistant Legat in London [Brian Boetig] who drafted a covering email which quickly went up the chain to the most senior FBI officials and was later quoted in the Opening Electronic Communication.

This article will collect some of my notes on two forms of metadata for each DNC email at Wikileaks (link):

• its sent date and time;

• the date and time of underlying eml. (The eml document is available at the View Source tab.)

My interest in this topic arose from my prior Climategate experience, where metadata of Climategate documents yielded solid information on the time period of the operation.

To my knowledge, no cybersecurity firm or news organization has done any reporting on DNC email metadata; the analysis has been done entirely in “this corner” of Twitter, especially Adam Carter (@with_integrity), Forensicator and @Tralfamadorenik.

sent_dates (2017)

The first quantitative analysis of DNC email metadata (to my knowledge) was my September 2, 2017 analysis (link) of sent dates. At the time, the emails were typically described as extending from January 2015 to May 2016, with the implication that the hack had been a long term operation. Questioning by House Intelligence Committee members to Crowdstrike, for example, paid particular attention to whether earlier warning to the DNC from the FBI could have prevented the DNC email hack - the form of the question assuming that the hack had been a sort of long-term surveillance.

The sent_dates did extend from January 2015 to May 2016, but, if one calculated the number of emails per day, one could see that nearly all the emails were sent after April 19, 2016 and ended on May 25, 2016. Over 98% of the hacked emails were sent after the April 22, 2016 “staging” that Crowdstrike drew attention to (contradicting the implication that the DNC emails had themselves been staged). In fact, the majority of hacked DNC emails were sent after CrowdStrike installed their monitoring software i.e. the hack occurred on Crowdstrike’s watch, not prior to their arrival (as they had implied.) Crowdstrike not only failed to prevent the hack, but, as it turned, failed to even detect the hack. So how would earlier installation of their software have made a difference?

Around the same time, wh1sks (see Github here) analysed sent times broken down by the 10 different targets in the Wikileaks archive. For each individual, he compiled both the latest sent time and the earliest sent time, and deduced that five targets (Comer, Allen, Parrish, Wright) had been exfiltrated on May 25, 2016; Kaplan on both May 23 and May 25, 2016; Crystal and Banfill on late May 22 and May 23 respectively; Miranda on May 19 and May 23, 2016; and Brinster the earliest on May 19, 2016.

I am unaware of any relevant technical discussion of DNC email metadata in 2018. As discussed in my recent article (link), in his book published in June 2018 (link; Isikoff podcast around minute 24; Isikoff covering article), former DNI James Clapper placed the exfiltration in April 2016 - an observation that was wildly impossible with even the most trivial examination of DNC email metadata. As was Shawn Henry’s assertion that the emails had been “staged” for exfiltration on April 22, 2018 (see link).

eml_dates (2019)

Carter 2019-01-27

On January 27, 2019 - 2.5 years after Wikileaks published the DNC emails - Adam Carter (@with_integrity) made the first report (to my knowledge) on the timestamp metadata of the Wikileaks DNC emails as eml documents (link; archive). In retrospect, it’s quite amazing that no one seems to have done this previously.

Associated with the webpage for each email in the Wikileaks DNC archive was an underlying document: the email in *.eml (Thunderbird) format. Carter collated the eml_date, eml_time and size for each for the 44,053 emails. Carter observed that the eml metadata for the Wikileaks DNC emails contained four dates: May 23, May 25, August 26 and September 21, 2016. The first tranche of DNC emails (published on July 22, 2016) had May 23 and May 25 eml_dates. The second and final tranche of DNC emails (which attracted little attention) was published on November 7, 2016 and had eml_dates of August 26, 2016 and September 21, 2016.

Carter also compiled eml metadata for the Podesta emails and observed that all but 2 Podesta emails had eml_dates of September 19, 2016 (with two anomalous eml_dates of November 6, 2017.)

Carter also observed that the first three batches of DNC emails (May 23, May 25 and August 26) were in FAT format. FAT format rounds the timestamp to nearest even second, as opposed to the millisecond detail available in non-FAT formats. The FAT format timestamps were subsequently shown by Forensicator to have been in the local time of the computer; as discussed below, Forensicator deduced the local timezone from collateral information.

FAT formats were commonplace in thumb drives, giving rise to Carter’s speculation that “2 of them [batches] could have ended up on a USB device around the dates of acquisition”. Bruce Leidl later observed that some zip programs were in FAT format, so that FAT format did not prove use of a thumb drive.

Johnson and Binney, 2019-02-13

On February 13, 2019, Larry Johnson and William Binney (both of VIPS) published an article (link) that (apparently independently) reported FAT format in Wikileaks eml’s.

Analytically, the Johnson and Binney article (also see their followup here) regressed substantially from the Carter tweet. Their analysis was based on a sample of 500 emails, as opposed to the comprehensive census of over 44,000 emails that was carried out by Carter. They also failed to notice the tranche of emails datestamped on 2016-09-21 - which were not FAT format.

They also totally muddied the water through a calculation of copying rates implied by timestamps in the Guccifer 2 ngpvan.7z zipfile (49.1 megabytes per second) - a different dataset with July 5, 2016 datestamp, six weeks later than the DNC email exfiltration. They observed that this copying rate was too rapid for a hack and postulated that the DNC emails had been exfiltrated on a thumb drive - a theory that has become widespread in “skeptic” circles.

Carter 2019-02-17

A few days later (February 17, 2019), Carter published an article (here) that made the first attempt to calculate the exfiltration rate of the DNC emails from eml timestamps. This was possible only for the emails in the first Wikileaks tranche (the emails with datestamps May 23, 2016 and May 25, 2016. Carter sorted the emails by timestamp and then plotted the cumulative size of the emails against the cumulative time of exfiltration, as shown in the diagram below.

Carter obtained an exfiltration rate of approximately 3 Mb/second, an order of magnitude less than the 49 MB/second copying rate cited by Johnson and Binney in regard to the Guccifer 2 ngpvan documents. But while Carter’s procedure was directionally correct, the correct answer using his data was only about 400 kb/second, as Forensicator reported on April 20, 2019 (discussion follows below). This was two orders of magnitude less than the 49 MB/second speed discussed by Johnson and Binney,

Forensicator, April 2019

On April 10, 2019, Forensicator substantially extended Carter’s analysis in the most comprehensive article on DNC metadata thus far (link), including consideration of other metadata additional to simple metrics of sent_time and eml_time.

Forensicator corrected Carter’s calculation of export speeds, obtaining a value of approximately 400 KB/sec. The validity of this correction can be easily seen: on May 25, 2016, just under 1 Gb of data was exfiltrated over approximately 44 minutes. Thus, the issue is the opposite of that posed by Johnson and Binney: for the DNC emails, it’s not a question of explaining a very “high” copying speed (47 MB/second), but of a very low copying speed (400 KB/second). A low copying speed that is entirely consistent with exfiltration.

Forensicator deduced the (unknown) timezone of the eml timestamps was Pacific Time through a clever calculation. For each of the six individuals with May 25, 2016 eml dates, he compared the sent time of the latest email (in GMT) to the eml timestamp (shown below). The eml timestamp - which was necessarily after the sending of the email - was 6-7 hours earlier. The logical conclusion is that the unknown relative timezone of the eml documents was -07:00 — Pacific time. (Diagram below is from Forensicator April 10, 2019 article).

From the above analysis, Forensicator then deduced that “the May 25 Emails Were Likely Acquired and Exported Simultaneously (and not Vetted)”. Once the eml_times were identified as Pacific timezone, the last email times and beginning and end of export operations for each May 25 individual was organized into a tight and very convincing chronology:

The latest emails for each of the four individuals with Aug 26 and Sep 21 eml_dates were on May 23, 2016. Forensicator also re-examined the earliest emails for each individual, reporting that “99% of the DNC emails were within the 30 day retention”.

Of the May 23 individuals, only one (Jeremy Brinster) had emails before April 23, 2016: Brinster’s emails began (in volume) a few days earlier on April 19, 2016, leading to the surmise that exfiltration may have begun with him. Emails going back to 2015 (only a trickle) were limited to the May 25 individuals. Forensicator also extracted a variety of other metadata from the DNC emails: whether they were received or sent and related attributes. (I’ve recently done some re-analysis of these “too early” emails to see if there are any relevant patterns and will try to write it up.)

Conclusion

In the Climategate hack, where I had a front row seat (so to speak), eml_timestamps on the emails themselves were “bleached”, but export timestamps on some documents were not and that this data yielded some insight into the Climategate hacker (when combined with other knowledge).

Here too, one way to find at least some solid ground is through metadata. The metadata reviewed here enables the contradiction of the legend that the emails were “staged” in April 2016. They also clearly show that the exfiltration took place on Crowdstrike’s watch and should have been observed on May 23, 2016 and May 25, 2016.

They also contradict the curiously incorrect dates of Mueller investigation (“between May 25, 2016 and June 1, 2016”). While the Mueller dates are close to the correct dates, they were incorrect nonetheless and the reason for the Mueller dates remain unexplained.

US agencies have rigorously redacted nearly everything in FOIA productions related to the DNC hack - see the Clevenger FOIA where over 900 pages were produced and over 900 pages were more or less totally redacted. It is hard to understand the continuing purpose of such redactions. An unfortunate by-product is that it permits suspicion to linger, even in circumstances where it could be dispelled.

Worse, there is evidence that the original intel assessments on the DNC hack - the assessments which influenced the Crossfire Hurricane investigation and the January 6, 2017 ICA - incorrectly placed the exfiltration of DNC emails one month too early - in April 2016.

Such an error would have multiple consequences:

• first, the incorrect dating to April 2016 meant that the emails were exfiltrated before CrowdStrike arrived on scene and, thus, by the time that CrowdStrike arrived, it was too late. The search for fault accordingly turned to why CrowdStrike was called so late. (This theme dominates the Senate Intelligence Committee report.) In fact, the emails were exported three weeks after CrowdStrike arrived on the scene. Which makes it entirely legimate to ask why CrowdStrike’s supposedly super-duper cybersecurity not only failed to protect the DNC from exporting of emails by an “adversary” known to be in the system, but didn’t even observe the exfiltration of 2 GB of emails and data. The April 2016 misdating seems to have totally forestalled such questioning1.

• second, and perhaps most importantly, an April 2016 misdating was essential for the Crossfire Hurricane predicate that Papadopoulos had foreknowledge of the DNC hack at his meetings with the Australian diplomats on May 6, 2016 and/or May 10, 2016. An April 22, 2016 exfiltration date meant that it would be (theoretically) possible for Mifsud to have told Papadopoulos of this development at their (supposed) meeting of April 26, 2016. But since the DNC emails were not exported until May 23-25, 2016, it was impossible for Papadopoulos to have had the (supposed) foreknowledge that predicated the Crossfire Hurricane investigation.

The One of the few windows into early intelligence on this issue was the memoir of James Clapper, the Obama administration Director of National Intelligence, published in June 2018. Clapper clearly and incorrectly placed the export of DNC emails in April 2016 - one month prior to their actual export.

In this article, I will first discuss what is known for sure from metadata about the exfiltration of DNC emails, then, after discussing Clapper’s dating, will examine other contemporary reporting that pointed to incorrect April 2016 dating.

Known For Sure

Every email in the Wikileaks DNC archive was linked to its eml format version, which contained date and timestamp information on the date-time that the eml document was copied, as well as the date-time that the email was sent.

While the sent-time metadata attracted attention early on (Climate Audit, Sep 2, 2017; wh1sks, Oct 2017), the first known utilization of the eml-time metadata appears to have been in January 2019, when with_integrity reported (X link) that all of the DNC emails in the original July 22, 2016 publication (emails 1-22456) had datestamps of May 23, 2016 or May 25, 2016. He also observed that the second publication (November 5, 2016) of DNC emails at Wikileaks had eml-timestamps on August 26. 2016 and September 21, 2016 and that Podesta email archive (except for two anomalous emails) had eml-times on September 19, 2016. His key table is shown below.

This tweet was followed up with more detailed reporting by with_integrity in February 2019 here and more definitively in April 2019 by Forensicator here.

In these articles, other key details were described:

• the DNC archive published on July 22, 2016 was just under 1 GB in size; its component eml’s had sequential timestamps showing a continuous and steady rate of exfiltration over a combined period of approximately 76 minutes (May 23 - 33 minutes; May 25 = 43 minutes). The observed exfiltration rate for DNC emails was approximately 0.4 MB/second (two orders of magnitude slower than the widely publicized copying rate (47 MB/second) of the Guccifer 2 documents on July 5, 2016 - a different operation which will not be discussed today.)

• the May 25 export was done sequentially for six individual mailboxes without interruption between mailboxes.

• the sent times for emails within each mailbox go right up to the exfiltration times.

• Forensicator’s analysis timestamps proved convincingly that the timestamps for the DNC emails shown above were in Pacific timezone - a surprising discovery that has been little discussed

• in the second (little discussed) publication of DNC emails - published on November 5, 2016, the latest sent times were on May 23, 2016, from which it was convincingly argued by Forensicator that these were exported on May 23, 2016 in the same operation as the single May 23 mailbox (Miranda) published in the first tranche;

• in the first publication (July 22, 2016), within each mailbox, the emails were exported in the following order: by folder within the mailbox (Sent folder last) and latest-to-earliest within each folder. The Wikileaks numbering was in order of export. In the second publication, the emails were exported in order of increasing size. (Unpublished analysis).

• the DNC had a 30-day retention policy. While the original general understanding was that the emails went back to January 2015, most of the folders do not contain any emails prior to the 30-day retention period and, for the four mailboxes exported on May 23, 2016, none show emails prior to a 30-day retention period2.

• In total, 97.5% of all the emails were sent between April 19, 2016 and the latest date of May 25, 2016, contrary to any implication that there had been continuous monitoring. This was pointed out (by myself) as early as September 2, 2017 and independently in fall 2017 by wh1sks.

• the eml-times for the DNC emails with datestamps on May 23, 2016, May 25, 2016 and August 26, 2016 are in FAT format - a format used in thumb drives. According to past technical discussion, FAT format also occurs in some older forms of zip compression.

• in general terms: if eml documents are uploaded to a server within a zip file (or similar compression file), the underlying eml-timestamps remain unchanged, but if they are uploaded as contents in a directory, the timestamps are updated to the time of copying. This suggests that a zipfile containing the May 23 and May 25, 2016 emails were transferred to the Wikileaks server and unzipped on the server, whereas (for the DNC emails) we know that the emails in the August 26, 2016 and September 21, 2016 batches had been exfiltrated on May 23, 2016 and that the later eml-times showed that the emails had been unzipped prior to the server and uploaded sequentially.

Clapper 2018

Turning now to Clapper’s 2018 memoir (link) entitled “Facts and Fears: Hard Truths from a Life in Intelligence”. Clapper stated that “in April [2016], Russia used a third-party ‘cutout’ to send more than nineteen thousand DNC emails and more than eight thousand documents to Wikileaks and Julian Assange” (The numbers - 19,000 emails and more than 8,000 documents - match the figures originally reported by Wikileaks at their website.)

Clapper was interviewed by Michael Isikoff (one of the earliest users of Steele dossier claims) in June 2018 shortly after publication (covering article; podcast).

Isikoff was particularly interested in the “cutout” (about minute 24:30-26:30 in podcast) who, according to Clapper, transferred the hacked emails to Wikileaks. Isikoff said to Clapper:

One line in the book leapt out at me. It’s never been clear how the Russians transmitted DNC and Podesta emails to Wikileaks. It’s always been a gap - how did they get there. In the book, in April, Russia used a third party cutout attempting to cover their tracks. That suggested to me that you know who the cutout was”.

Clapper refrained from divulging anything further, but said that they were “pretty confident” that they had identified the “cutout” who had transmitted the DNC emails to Wikileaks in April.

In the memoir, Clapper said that DNC had realized the problem in April and that Crowdstrike “did what it could to quietly remediate the damage” [from the exfiltration of emails and data in April 2016]:

However, as pointed out above, Clapper’s dating of the exfiltration of the DNC emails to April 2016 was both incorrect and knowably incorrect at the time.

The obvious question: was Clapper was relying on (incorrect) information provided by the intel community at the time of the January 2017 Intel Community Assessment?

Washington Post, December 9, 2016

Clapper’s description of the “cutout” closely matches to a key, but mostly overlooked, detail in one of the seminal articles of the Russiagate collusion narrative - the December 9, 2016 Washington Post article (archive, discussed by me here). This article, which first broke news of the CIA assessment that Russia was trying to help elect Trump, was published simultaneously with the Obama admin announcement of the then forthcoming ICA, the primary finding of which was that Russia was trying to elect Trump.

However, in addition, Entous et al stated that intel agencies had “identified” the individuals, described as “one step removed” from the Russian government, who passed the DNC emails to Wikileaks:

Intelligence agencies have identified individuals with connections to the Russian government who provided WikiLeaks with thousands of hacked emails from the Democratic National Committee and others, including Hillary Clinton’s campaign chairman, according to U.S. officials….

For example, intelligence agencies do not have specific intelligence showing officials in the Kremlin “directing” the identified individuals to pass the Democratic emails to WikiLeaks, a second senior U.S. official said. Those actors, according to the official, were “one step” removed from the Russian government, rather than government employees. Moscow has in the past used middlemen to participate in sensitive intelligence operations so it has plausible deniability.

This appears to be the same story as Clapper’s “cutout”.

Shawn Henry Testimony, December 2017, published May 2020

The testimony of CrowdStrike’s Shawn Henry to the House Intelligence Committee in December 2017 (not published until May 2020) indicates that the still concealed CrowdStrike report on the DNC hack may have caused readers to place the export of emails to April 2016 (prior to CrowdStrike’s arrival).

Henry’s surprise admission that Crowdstrike had not actually observed the exfiltration of DNC emails attracted commentary in June 2020 (e.g. Aaron Mate). See my article link. Little to no attention was paid to Henry’s evasive responses to direct questions about dates.

The questioners generally talked about “data”, but their questions made it clear (or ought to have made it clear that their primary interest was the export of the emails, as for example the following excerpt:

MR. STEWART OF UTAH: And, in this case, the data I am assuming you're talking about is the email as well as everything else they may have been trying to take.

MR. HENRY: There were files related to opposition research that had been conducted.

MR. STEWART OF UTAH: okay. what about the emails that everyone is so, you know, knowledgeable of? Were there also indicators that they were prepared but not evidence that they actually were exfiltrated?

and later:

For example, at least for many of us, this was the first time where we saw that emails or data were weaponized and used in the political arena. Had you seen that before?

At one point, Schiff directly asked Henry whether he knew “the date in which the Russians exfiltrated the data from the DNC”. After some prevarication, Henry said that the date was in the CrowdStrike report (which the House Intelligence Committee was in possession of):

MR. SCHIFF: … My colleague asked you whether the damage that was done to the DNC through the hack might have been mitigated had the DNC employed your services earlier. Do you know the date in which the Russians exfiltrated the data from the DNC?

MR HENRY: I do. I have to just think about it. I do know. I mean, it’s in our report that I think the committee has.

MR. SCHIFF: And, to the best of your recollection, when would that have been?

MR. HENRY: counsel just reminded me that, as it relates to the DNC, we have indicators that data was exfiltrated. We did not have concrete evidence that data was exfiltrated from the DNC, but we have indicators that it was exfiltrated.

Eventually, Schiff pinned Henry down to a date of “April 2016”, but Henry said that he was “confused on the date” but “it’s in the report”, whereupon Schiff helped him out stating that it “provides in the report” that the “data” was staged for exfiltration on April 22, 2016:

MR. SCHIFF: And the indicators that it was exfiltrated, when does it indicate that would have taken place?

MR. HENRY: Again, it's in the report. I believe -- I believe it was April of 2016. I’m confused on the date. I think it was April, but it's in the report.

MR. SCHIFF: It provides in the report on 2016, April 22nd, data staged for exfiltration by the Fancy Bear actor.

MR. HENRY: Yes, sir. So that, again, staged for, which, I mean, there’s not -- the analogy I used with Mr. Stewart earlier was we don't have video of it happening, but there are indicators that it happened. There are times when we can see data exfiltrated, and we can say conclusively. But in this case, it appears it was set up to be exfiltrated, but we just don't have the evidence that says it actually left.

I think that this exchange strongly indicates that the (still concealed) CrowdStrike report did not state that the emails were exfiltrated on May 23, 2016 and May 25, 2016 - or else, Schiff and/or Henry and/or one of other committee members or staff would have mentioned this date from the report, rather than discussing an April 22, 2016 file said to have been “staged” for exfiltration. (We don’t currently know what was in this April 22, 2016 file, but we //know// for certain that it wasn’t the DNC emails sent to Wikileaks, since 98% hadn’t even been sent as of April 22, 2016.

The connection of the incorrect dating of DNC email exfiltration to the delusion that Papadopoulos had advance knowledge of the DNC hack was exemplified in Schiff’s follow-up question to Shawn Henry. Schiff (embellishing) stated that the Papadopoulos indictment (then about one month old) stated that “Papadopoulos was informed at the end of April that the Russians were in possession of stolen DNC or Clinton emails” and invited Henry to agree that this was “only days after that data had been staged for exfiltration [on April 22, 2016]”. Henry immediately agreed.

MR. SCHIFF: ln your report, when you stated the data was staged for exfiltration on April 22nd of last year, that would have been the first time that you found evidence that the data was staged for exfiltration?

MR. HENRY: I believe that is correct.

MR. SCHIFF: Did you have a chance to read the information that was filed in conjunction with the George Papadopoulos plea?

MR. HENRY: I did not.

MR. SCHIFF: In that information, it states that Mr. Papadopoulos was informed at the end of April that the Russians were in possession of stolen DNC or Clinton emails. If that information is correct, that would be only days after that data was staged for exfiltration?

MR. HENRY: Yes.

However, the exfiltration of the DNC emails was several weeks in the future when Papadopoulos met the Australians on May 6, 2016 and/or May 10, 2016 and more than a month in the future when Papadopoulos met Mifsud on or about April 26, 2016. So whatever Papadopoulos was talking about was not the DNC emails - contrary to the implication of Schiff and Henry.

As a closing comment on Henry’s testimony: Henry told the House Intelligence Committee that his “goal was to protect the client”, that Crowdstrike “were hired to protect the client”:

Henry did not explain - and the Committee did not ask (nor has media asked) - how and why Crowdstrike failed so miserably - allowing more than 2 GB of emails and attachments to be exfiltrated from the DNC on May 23, 2016 and May 25, 2016 literally under their noses and without the removal being observed by Crowdstrike. (As an editorial comment, I think that the emails were exfiltrated by hack and //not// by an insider on a thumb drive. See commentary on X.)

The Intelligence Community Assessment

On the same day (December 9, 2016) as the leak of the CIA assessment, the Obama administration announced its commissioning of the Intelligence Community Assessment that undermined the incoming administration (see my discussion here). Press Secretary Eric Schultz (link) promised that the assessment “is going to be a deep dive, that this will be a review that is broad and deep at the same time”.

However, the published intelligence assessment was neither.

The first fruit of this effort was a risible document jointly from the DHS and FBI on December 29, 2016, entitled “GRIZZLY STEPPE – Russian Malicious Cyber Activity”(link). Its most prominent technical feature was its highlight of a YARA rule, that was quickly shown to be a technique used for hacking Wordpress sites that had been developed by a Ukrainian university student and which could be purchased on the internet. It not only didn’t report the date of the DNC hack, it didn’t even refer to the DNC hack.

On January 6, 2017, Clapper’s Office of the Director of National Intelligence (ODNI) published the Intelligence Community Assessment entitled “Assessing Russian Activities and Intentions in Recent US Elections” (link). The report was long on assertions and confidence, but short to non-existent on evidence. In respect to the DNC hack, it stated (imprecisely) that “by May, the GRU had exfiltrated large volumes of data from the DNC”:3

The General Staff Main Intelligence Directorate (GRU) probably began cyber operations aimed at the US election by March 2016. We assess that the GRU operations resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.

As written, this last sentence seems to be in line with the information in the CrowdStrike report about large amounts of data being staged for exfiltration on April 22, 2016 and to reflect that misunderstanding. (The imprecise language doesn’t totally preclude the possibility of a correct understanding, but currently there’s no evidence of a correct understanding of dates.)

The lack of details and evidence in the JAR report and ICA was severely derided even by cyber specialists who were sympathetic to its conclusions. Ron Deibert of Citizens’ Lab wrote (link):

when a government makes decisions with such huge ramifications and risks, the public should expect its government to produce credible information on behalf of its case. Faith-based conclusions based on partial evidence and anonymous leaks are no basis to make informed public policy.

Sam Biddle of the Intercept similarly wrote:

Unfortunately for us, it appears virtually anything new and interesting was removed in the redaction process, leaving us without the conclusive, technical evidence we were hoping for — and that the American people are owed... The immensely confident report, based on the combined findings of the NSA, CIA, and FBI, includes virtually no new details about why the nation’s intelligence agencies attributed the attacks to the Russian government (and in some cases, directly to Vladimir Putin)…

Strzok Memoir

Lead Crossfire FBI agent Peter Strzok appears to have had an almost identical misunderstanding of the exfiltration chronology. In his memoir “Compromised”, Strzok (like Schiff) interpreted Papadopoulos’ comments to the Australian diplomats on May 6 and/or May 10, 2016 as “advance knowledge” of the “cybertheft” of the “stolen Democratic emails”. Like Schiff and Clapper, Strzok appears to have been misled by the same incorrect analysis/reporting that placed the primary exfiltration of emails in April 2016, rather than at the end of May 2016.

Netyshko Indictment and Mueller Report

The Netyschko indictment, filed on July 13, 2018, placed the exfiltration of DNC to the period from May 25, 2016 to June 1, 2016. (These dates subsequently appear in the Mueller Report.)

29. Between on or about May 25, 2016 and June 1, 2016, the Conspirators hacked the DNC Microsoft Exchange Server and stole thousands of emails from the work accounts of DNC employees. During that time, YERMAKOV researched PowerShell commands related to accessing and managing the Microsoft Exchange Server.

The Mueller Report, published in April 2019, similarly purported to date the exfiltration incorrectly to between “May 25, 2016 and June 1, 2016”, as follows:

The GRU also stole documents from the DNC network shortly after gaining access. … Between approximately May 25, 2016 and June 1, 2016, GRU officers accessed the DNC's mail server from a GRU-controlled computer leased inside the United States. During these connections, Unit 26165 officers appear to have stolen thousands of emails and attachments, which were later released by WikiLeaks in July 2016.

The Mueller Report did not explain the apparent inconsistency between the observed eml_datestamps (May 23, 2016 and May 25, 2016) and their dating (May 25 to June 1, 2016). Their language “appear to have stolen” is surprisingly weak. I’ll try to analyse this issue on another occasion.

Crowdstrike, June 2020

In response to critical comments on Henry’s testimony after its publication in May 2020, Crowdstrike published an update to the original article on the DNC hack on June 5, 2020 (link), purporting to respond to criticisms of CrowdStrike’s failure to interdict (or even observe) the exfiltration of emails.

One of the headings to their article was the question:

Is it true that part of the exfiltration happened after Crowdstrike was already engaged by the DNC?

The truthful answer is: “Yes. All of the exfiltration of DNC emails happened after Crowdstrike was already engaged by the DNC.”

But, needless to say, that’s not what Crowdstrike said. Their answer was unresponsive to the question. Instead, they stated that they complied with “industry best standards”, while conspicuously avoiding answering the actual question. Here’s an excerpt:

Crowdstrike’s response also included a supposed answer to the synthetic question “What is the timeline of the DNC hack?”

Their timeline including many minor details on the hack, but baldfacedly jumped from May 1-2, 2016 (when CrowdStrike was retained) to June 10-13, 2016 (when system remediation took place.) Their timeline omitted the critical dates of May 23, 2016 and May 25, 2016 when the exfiltration of emails took place:

Conclusion

The DNC hack was the centerpiece of the Russiagate investigation. It has been the subject of multiple official reports and an endless number of news articles and presentations. But have any of you ever seen an official report or mainstream news article which correctly reported the exact dates on which the DNC emails were removed? To my knowledge, there isn’t one.

We know that James Clapper incorrectly placed the exfiltration approximately one month too early (April 2016 versus May 23-25, 2016). Clapper’s incorrect understanding seems to have been ultimately based on a (still withheld) CrowdStrike report which stated data was “staged” for exfiltration on April 22, 2016. This date and report were referred to by Adam Schiff during Shawn Henry’s testimony at the House Intelligence Committee.

This incorrect dating was integral to the theory that Papadopoulos had foreknowledge of the DNC hack - an incorrect (and knowably incorrect) theory that underpinned both the predication of the original Crossfire Hurricane investigation and Mueller’s interpretation of the mandate of their investigation. With correct dating, the DNC emails were exfiltrated long after Papadopoulos’ exchange with the Australian diplomats, contradicting the possibility of Papadopoulos having knowledge of the DNC hack when he met with the Australians.

Most importantly, the various contradictions raise questions about the underlying intelligence reports. Did the withheld CrowdStrike report fail to disclose the correct exfiltration dates of the DNC emails? Did contemporary intelligence reports and assessments (including the ICA) similarly fail to disclose the correct exfiltration dates? If the correct exfiltration dates were reported in contemporary intelligence reports, why did so many people (e.g. Clapper) get the dates wrong?

In contemporary interviews, Alperovitch stated:

our firm, CrowdStrike, actually did catch them [the hackers] in the act.. We were able to watch everything that the adversaries were doing

So we were able to literally shoulder surf and observe what these attackers were doing while inside the network

We saw them going after e-mail communication servers, stealing e-mails from the DNC for a period of nine months going back to 2015,

Alperovitch’s December 2016 comments appear to have been influential in damping down contemporary criticism of the weakness of the evidence for hack attribution that was presented to the public during a critical period in which the intel community was preparing the ICA that destabilized the incoming Trump administration.

In May 2020, long after public interest had moved on, the testimony of CrowdStrike’s Shawn Henry December 2017 testimony to the House Intelligence Committee was belatedly released. It contained some surprising admissions, in particular, the surprising disclosure that CrowdStrike’s supposedly high-powered monitoring network had not only failed to prevent the exfiltration of DNC emails, but had even failed to observe the actual exfiltration.

There's not a network sensor that actually saw traffic actually leaving …

We didn't have a network sensor in place that saw data leave. We said that the data left based on the circumstantial evidence. That was a conclusion that we made.

On its face, Henry’s statements appear to contradict Alperovich’s previous statements. If CrowdStrike was unable to observe the actual exfiltration of the DNC emails, it wasn’t “able to watch everything that the adversaries were doing” nor was it “able to literally shoulder surf and observe what these attackers were doing while inside the network”. In fact, it turned out that CrowdStrike had been unable to observe the most critical step of the hacking operation.

One wonders whether events might have played out differently if Henry’s surprising admissions had been disclosed in December 2016 while the ICA was being prepared.

In this article, I’ll review the interesting events leading up to Alperovitch’s December 2016 claims and then segue forward to the Henry transcript.

December 9, 2016 - Washington Post leaks secret CIA assessment

A blockbuster Washington Post story by Entous, Nakashima et al on December 9, 2016 (link; archive) was arguably the first major article in the development of the Russiagate hoax. See my previous discussion of this article (link) and the origins of the ICA (link plus followup linked articles).

Based on a “secret CIA assessment”, it was the first report claiming that “Russia was trying to help Trump win the White House” - as opposed to the prior view held by other agencies that Russia was simply sowing discord. Soon after, this assertion became the lead finding in the Intelligence Community Assessment that was announced on December 9, 2016 and published on January 6, 2017.

Trump fiercely resented the claim, which he (reasonably) interpreted as undermining the legitimacy of his selection. The article, based on insider leaks, presaged the subsequent stream of leaks that both undermined the incoming administration and fostered the Mueller investigation lawfare.

The December 9, 2016 Washington Post article also contained a second major claim - that intelligence agencies had identified the individuals who had provided the DNC emails to Wikileaks, describing them as “‘one step’ removed from the Russian government, rather than government employees”. These supposed individuals have never been identified. (The Mueller investigation later charged 12 GRU employees with hacking-related offenses, but not the supposed “middlemen”).

Trump’s Response, December 9-12, 2016

Trump responded almost immediately to the then startling claim in the Washington Post story. Later on December 9, 2016 (link), the Trump transition team disparaged the claim, stating that the assertion came from the “same people” who had made the erroneous WMD assessment:

“These are the same people that said Saddam Hussein had weapons of mass destruction,” the Trump transition team said in a statement late Friday. “The election ended a long time ago in one of the biggest Electoral College victories in history. It’s now time to move on and “Make America Great Again.’”

Two days later, on a Sunday news show on December 11, 2016 (link), Trump said that the suggestion that the Russians were trying to help him win was “ridiculous”, additionally asserting that “nobody knows” whether it was Russian hackers who targeted Democrats.

The next day (Monday December 12, 2016), Trump continued his vehement pushback against the intel community leaks. First, he asked: “Can you imagine if the election results were the opposite and WE tried to play the Russia/CIA card. It would be called conspiracy theory!” Then, Trump (Twitter archive) challenged the attribution of the hack itself, saying: “Unless you catch ‘hackers’ in the act, it is very hard to determine who was doing the hacking”.

In a contemporary review of the dispute, John Cassidy (Atlantic link) observed that Trump’s rejection of the leaked assessment “made an enemy of the intelligence community” and presciently (shall we say) speculated that the intel community counter-attack against Trump would take place in the U.S. Senate:

Just like that, Trump made an enemy of the intelligence community. Many intelligence professionals had already been suspicious of him—because of his disregard for facts, and because of his embrace of the retired Lieutenant General Michael Flynn, the National Security Adviser designate, whom some people in Washington regard as a conspiracy theorist. But this latest episode was something far more direct and personal. Never before has a President or President-elect spoken so dismissively of the C.I.A.

In taking this tack, Trump also invited his political opponents to attack him where his Administration’s grip on power will be weakest: in the U.S. Senate, where the Republicans will have a majority of just two seats.

In fact, as we now know, the Senate Intelligence Committee (SSCI), which consisted almost entirely of anti-Trump and Democrat neocons, had already been co-opted in the choreography of the Intel Community Assessment (see my article here ^) and would subsequently play a critical role in the institutionalization of the Russiagate hoax.

Contemporary Criticism of Insufficiency of Attribution Evidence

While contemporary contemporary dumped on Trump’s skepticism of the intel agencies e.g. New Yorker (Dec 12 link); Atlantic (Dec 12 link), there were still a few critics of the sufficiency (or insufficiency) of evidence for the attribution of the hack.

For example, Sam Biddle of the Intercept (Dec 14, 2016 link) thoroughly reviewed the purported evidence and concluded that the attribution contained an “enormous inductive leap that’s not been reckoned with, and Americans deserve better”. Biddle’s article is worth reading or re-reading as a useful summary of the attribution evidence as of mid-December 2016 (and little has changed since then.)

It certainly remains plausible that Russians hacked the DNC, and remains possible that Russia itself ordered it. But the refrain of Russian attribution has been repeated so regularly and so emphatically that it’s become easy to forget that no one has ever truly proven the claim. There is strong evidence indicating that Democratic email accounts were breached via phishing messages, and that specific malware was spread across DNC computers. There’s even evidence that the attackers are the same group that’s been spotted attacking other targets in the past. But again: No one has actually proven that group is the Russian government (or works for it). This remains the enormous inductive leap that’s not been reckoned with, and Americans deserve better.

Leonid Bershinsky (Bloomberg, Dec 22 link) similarly argued that conclusions ought to be based on “solid demonstrable evidence” and that such was then lacking:

In the real world outside of soap operas and spy novels, however, any conclusions concerning the hackers' identity, motives and goals need to be based on solid, demonstrable evidence. At this point, it's inadequate. This is particularly unfortunate given that the DNC hacks were among the defining events of the raging propaganda wars of 2016.

Carr concluded by observing that the White House would have presented any unclassified evidence (if it existed) and concluded that the evidence either “doesn’t exist or is classified”. He then sensibly proposed that any classified evidence be examined by an independent commission (something that obviously hasn’t happened) since there were too many indications that the White House had “relied heavily on questionable intelligence generated by a for-profit cybersecurity firm with a vested interest in selling “attribution-as-a-service”.

If the White House had unclassified evidence that tied officials in the Russian government to the DNC attack, they would have presented it by now. The fact that they didn’t means either that the evidence doesn’t exist or that it is classified.

If it’s classified, an independent commission should review it because this entire assignment of blame against the Russian government is looking more and more like a domestic political operation run by the White House that relied heavily on questionable intelligence generated by a for-profit cybersecurity firm with a vested interest in selling “attribution-as-a-service”.

Crowdstrike’s Alperovitch Interjects, Dec 12-14, 2016

Crowdstrike’s Dmitri Alperovitch forcefully and immediately interjected himself against Trump’s questioning of the CIA assessment, including interviews on CNN, NPR and a written response to The Atlantic.

CNN

On December 12, 2016, Alperovitch appeared on CNN (link; transcript).

Wolf Blitzer directly asked Alperovitch whether there was proof that GRU had given the emails to Wikileaks as follows:

And so the working assumption is the GRU, the Russian intelligence agency, then gave these documents, all these e-mails to WikiLeaks, and then WikiLeaks would release them on a daily basis; is that your understanding?

Alperovitch forcefully responded that CrowdStrike “did catch [the hackers] in the act” and that they had “watched these adversaries for a number of days and weeks”:

Well, president-elect Trump said yesterday and today again that you have to catch these hackers in the act. And actually he may not be aware, he may not have been briefed that our firm, CrowdStrike, actually did catch them in the act. When the DNC hired us back in May, we actually came in, deployed our technology called Falcon on all of the systems inside their corporate network. We actually watched these adversaries for a number of days and weeks, as we were preparing to kick them out.

Alperovitch stated that CrowdStrike “saw them going after e-mail communication servers, stealing e-mails from the DNC for a period of nine months gong back to 2015 and then going after sensitive documents … on Donald Trump”:

They brought us in, in early May. And we deployed our technology, this Falcon technology, across all their systems. And we immediately picked up the trace of these two attackers. We saw them going after e-mail communication servers, stealing e-mails from the DNC for a period of nine months going back to 2015, and then going after sensitive documents that the campaign was preparing on Donald Trump and other Republican candidates that were running for the primary.

The Atlantic

Alperovitch similarly informed The Atlantic by email (link) on December 12, 2016 that CrowdStrike had “caught the adversaries in the act” and had been “able to watch everything that the adversaries were doing”:

CrowdStrike did in fact “catch the adversaries in the act,” said Dmitri Alperovitch, the company’s co-founder and CTO, in an email. “We were able to watch everything that the adversaries were doing while we were working on a full remediation plan to remove them from the network.”

Atlantic author Kaveh Waddell sneered at Trump’s skepticism of the leaked attribution, arguing that attribution of the DNC leak differed from typical attributions because CrowdStrike’s Falcon software had been able to observe the “act”:

In general, yes, when computers come under attack, it’s not always immediately clear who’s behind it. …But the specifics around this year’s election-related hacking are very different. In early May, the Democratic National Committee asked CrowdStrike, one of many cybersecurity companies that identifies and defends against hacking attacks, to investigate a potential intrusion into the organization’s network. Using a program called “Falcon,” the company’s security researchers soon determined that the cyberattack came from Russia.

NPR

Alperovitch followed up on NPR (link) on December 14, 2016. He stated that they installed their Falcon software on “every machine within the DNC” such that they had “essentially as a video camera inside the computer, allowing us to record and look at every activity that was taking place inside that machine”:

We did that by installing our software that we call Falcon on every machine within the DNC, every one of their laptops and servers on their corporate network. And it functioned essentially as a video camera inside the computer, allowing us to record and look at every activity that was taking place inside that machine. So we were able to literally shoulder surf and observe what these attackers were doing while inside the network.

Ironically, despite Alperovitch, presuming that the government must have had information from its own sources on the hack, called on the Obama administration to show conclusive information on the attribution. (PBS, Dec 22, 2016, link)

Shawn Henry December 2017 Testimony, Released May 2020

In December 2017, CrowdStrike’s Shawn Henry testified to the House Intelligence Committee but tiptoed around several key questions, in large part because the committee members and staff lacked the knowledge to question Henry properly.

Henry’s transcript was not released until May 2020, by which time Alperovitch’s December 2016 interviews were long forgotten. So while Henry’s testimony occasioned consternation among a few public skeptics (e.g. Aaron Mate, May 13, 2020 link), none contrasted Henry’s testimony with Alperovitch’s original claims.

Henry had told the committee that, upon arrival on scene, Crowdstrike had discovered a large package of documents that had been assembled on April 28, 2020, presumably for exfiltration. But, after a while, one of the committee members asked Henry about the exfiltration of the DNC emails.

Here are two extended excerpts which are particularly interesting, one exchange with Schiff (p31ff) and one towards the very end of the interview with Stewart of Utah (75ff):

MR. SCHIFF: … My colleague asked you whether the damage that was done to the DNC through the hack might have been mitigated had the DNC employed your services earlier. Do you know the date in which the Russians exfiltrated the data from the DNC?

MR'HENRY: l do. l have to just think about it. I do know. l mean, it’s in our report that I think the committee has.

MR. SCHIFF: And, to the best of your recollection, when would that have been?

MR. HENRY: Counsel just reminded me that, as it relates to the DNC, we have indicators that data was exfiltrated. we did not have concrete evidence that data was exfiltrated from the DNC, but we have indicators that it was exfiltrated.

MR. SCHIFF: And the indicators that it was exfiltrated, when does it indicate that would have taken place?

MR. HENRY: Again, it's in the report. I believe -- I believe it was April of 2016. l,m confused on the date. I think it was April, but it's in the report…

MR. SCHIFF: It provides in the report on 2016, April 22nd, data staged for exfiltration by the Fancy Bear actor'

MR.HENRY: Yes, sir. So that, again, staged for, which l mean, there’s not -- the analogy I used with Mr. Stewart earlier was we don't have video of it happening, but there are indicators that it happened. There are times when we can see data exfiltrated, and we can say conclusively. But in this case, it appears it was set up to be exfiltrated, but we just don't have the evidence that says it actually left.

MR. SCHIFF: ln that information, it states that Mr. Papadopoulos was informed at the end of April that the Russians were in possession of stolen DNC or Clinton emails. lf that information is correct, that would be only days after that data was staged for exfiltration?

MR. HENRY: Yes.

Here is the Stewart excerpt:

MR. STEWART of UTAH: … okay. what about the emails that everyone is so, you know, knowledgeable of? Were there also indicators that they were prepared but not evidence that they actually were exfiltrated? Did I write that down correctly?

MR. HENRY: Yes.

MR. STEWART OF UTAH: And, in this case, the data I am assuming you're talking about is the email as well as everything else they may have been trying to take.

MR. HENRY: There were files related to opposition research that had been conducted.

MR. STEWART OF UTAH: okay. what about the emails that everyone is so, you know, knowledgeable of? Were there also indicators that they were prepared but not evidence that they actually were exfiltrated?

MR' HENRY: There's not evidence that they were actually exfiltrated. There's circumstantial evidence… but no evidence that they were actually exfiltrated. But let me also state that if somebody was monitoring an email server, they could read all the email… and there might not be evidence of it being exfiltrated, but they would have knowledge of what was in the email.

MR, STEWART OF UTAH: But they wouldn’t be able to copy that email; they could only watch it in real time.

MR. HENRY: There would be ways to copy it. you could take screenshots. You could copy it.

MR. STEWART OF UTAH: All right. so I think that's one of the more interesting things that we've learned from you today, again, that there is no evidence it was actually exfiltrated. ls it -- it seems unlikely to me that in the real time that they're watching these emails that they'd be able to collect the hundreds or thousands that they had but with screenshots or whatever.

MR. HENRY: So there is circumstantial evidence that it was taken.

MR. STEWART oF UTAH: l understand, but not conclusive.

MR. HENRY: We didn't watch it happen. There's not a network sensor that actually saw traffic actually leaving, but there's circumstantial evidence that it happened… And, also, the Cozy Bear actor that I mentioned earlier that was in the environment going back to July of 2015, there were many months before we ever got there where data may have …

…

MR. HENRY: So, to go back, because I think it's important to characterize this. We didn't have a network sensor in place that saw data leave. We said that the data Ieft based on the circumstantial evidence. That was a conclusion that we made. When I answered that question, I was trying to be as factually accurate. I want to provide the facts. so I said that we didn't have direct evidence. But we made a conclusion that the data left the network.

In effect, when Wikileaks published the DNC emails, CrowdStrike arrived at the conclusion that the DNC emails had “left” the DNC - a conclusion that non-specialists had managed to arrive at already.

As noted above, the release of Henry’s testimony prompted some consternation and criticism of CrowdStrike e.g Aaron Mate, which responded on June 5, 2020 (link) with a webpage statement confirming that they hadn’t seen the exfiltration of DNC emails in real time, purporting to explain that this was “typical for incident response cases” since responders are “often called in after theft has taken place”.

Did CrowdStrike see in real-time the adversaries exfiltrate data and emails from the DNC network? 

No and that’s typical for incident response cases. In the vast majority of cyber investigations, incident responders don’t witness exfiltration in real-time. In fact, often we are called in after theft has taken place. We collect forensics, evidence of prior activity on the network, map where the adversary has gained access and prepare remediation plans.

This response was, to say, deceptive, given that CrowdStrike had been in charge of DNC cyber for over three weeks and the exfiltration was carried out after CrowdStrike had claimed to have installed their software on every DNC computer and server.

Conclusion

In retrospect, many of Alperovitch’s key statements in December 2016 appear to have been incorrect. Alperovitch claimed that they were “able to watch everything that the adversaries were doing”, “able to literally shoulder surf and observe what these attackers were doing while inside the network”:

our firm, CrowdStrike, actually did catch them [the hackers] in the act.. We were able to watch everything that the adversaries were doing ….

So we were able to literally shoulder surf and observe what these attackers were doing while inside the network

We saw them going after e-mail communication servers, stealing e-mails from the DNC for a period of nine months going back to 2015,

However, it now appears that CrowdStrike’s “shoulder surfing” and observation did not include “a network sensor that saw data leave”. In other words, CrowdStrike’s monitoring and observation failed to observe the actual removal of the data; CrowdStrike did not, after all, catch the hackers in the actual act of exfiltration.

As noted above, one cannot help but wonder whether events might have played out differently if, in December 2016 while the ICA was being prepared, Henry’s surprising admissions had been disclosed instead of Alperovitch’s over-egged and over-confident claims.

Nor did CrowdStrike observe the hackers “stealing emails from the DNC for a period of nine months going back to 2015”. In fact, all but handful of emails post-dated April 19, 2023, with the majority actually being sent after CrowdStrike was on the scene (as I observed in September 2017 here). I’ll discuss the interesting backstory of this issue in my next article on this topic.

Postscript Nov 13, 2024

Alperovich’s false claim that Crowdstrike had observed the removal of DNC emails by Russian hackers seems to have made its way into FBI briefings to DOJ in early 2017 as the collusion hoax gained momentum. DOJ notes of the FBI briefing on February 16, 2017 stated “had success w[ith] DNC and saw take info”. As noted above, Crowdstrike’s Shawn Henry subsequently admitted that Crowdstrike had not observed the exfiltration of DNC data.

A few days ago, @walkafyre received several FOIA documents related to the Russiagate hoax, one of which was the pdf uploaded here. This FOIA production considered 139 pages, of which 134 pages were withheld. For each withheld page, a FOIA bureaucrat itemized reasons for withholding.

Only two documents were produced.

First was a highly redacted email from an SSA in Operations Branch II, Counterintelligence Division, to Jennifer Boone, then its Deputy Assistant Director. (The same level as Peter Strzok, then Deputy Assistant Director, Operations Branch I.) The email referred to two interviews, but the subjects of each interview was redacted.

The second non-withheld document was a lightly redacted four page FBI form 302 for a Feb 10, 2017 interview of George Papadopoulos, filed on February 17, 2017 (first page shown below). This 302 had been previously released in volume 4 of the Mueller files at FBI (link) and the new version is word for word identical. So, in itself, it adds nothing new.

This doesn’t seem very promising, but never under-estimate walkafyre.

First of all, the email referred to an interview “from 17 February 2017”. This matches the filing date of the included Papadopoulos 302, strongly indicating that the Papadopoulos 302 was the second attachment to the Feb 22, 2017 email to DAD Boone. As a corollary, the redaction was “Interview of [Typhoon] from 17 February 2017.” (Typhoon was the FBI codename for Papadopoulos.)

If you then look closely at the metadata for withheld pages (as walkafyre did), you will see that the only not withheld pages were page 19 (one page only) and pages 79-82 (four pages) - see red arrows below. These lengths correspond to the email (one page) and the Papadopoulos 302 (four pages). There are 57 withheld pages between the two documents. This matches the Bates numbering - there are 57 pages between B1318 (the covering email) and B1379-1382 (the second attachment).

57 pages. Hmmmm.

As it happens, we know of an interview report from this period that is exactly 57 pages long - the Danchenko EC! Is it possible that this highly redacted and seemingly unremarkable email proves that the Danchenko EC was sent to DAD Boone on February 22, 2017. It sure does.

In addition to length and date, walkafyre noticed a subtle detail that clinches the identification. On pages 43 and 61 of the production (see below), there were redactions due to NSD (DOJ). These correspond to pages 22 (=43-21) and 40 (=61-21) of the 57 page document. And, sure enough, on pages 22 and 40 of the Danchenko EC, there were references to the presence of an NSD official - see excerpts below.

The NSD official in attendance at the second and third days of the Danchenko interview was subsequently identified as Richard Scott of CECS, a deputy to David Lautman, then its chief.

Curiously, the FOIA production almost certainly contains a second copy of the Danchenko EC. Following the Papadopoulos 302 (pages 79-82 of the production), there are exactly 57 more pages: pages 83-139, with NSD redactions on pages 104 and 122 (i.e. relative pages 22 and 40.)

SSA3

The Horowitz Report described a re-organization of Crossfire Hurricane in January 2017. In the January-April 2017 period, Operations Branch II under DAD Boone was responsible for the Carter Page investigation (with Strzok’s Operations Branch I retaining responsibility for the Flynn and Papadopoulos investigations and the WFO White Collar Criminal Squad retaining Manafort.)

SSA3 (Horowitz alias) was the senior Crossfire agent reporting to Boone. It seems more or less certain that the SSA of the February 22, 2017 email (containing the Danchenko EC and Papadopoulos 302) was SSA3. We also know that SSA3 was designated as Bruce Ohr’s point of contact between January 2017 and April 2017 (until superseded in May 2017 by SSA4 and Case Agent 5 [Brock Domin].)

The takeaway: while public and congressional attention has overwhelmingly focused on Peter Strzok (and Joe Pientka even though he left Crossfire in January 2017), the senior FBI agents with carriage of the Danchenko information were almost certainly DAD Boone and SSA3 (who is perhaps Richard Mains, who retired in spring 2017) = neither of whom was ever interviewed by a congressional committee (though each was interviewed by Horowitz and Durham.)

Conclusion

Proving that SSA3 and DAD Boone received the Danchenko EC on February 22, 2017 is an important foothold.

Only two weeks later, Comey and FBI obtained DOJ approval for use of its March 8, 2017 Talking Points (see discussion here; original here in attachments) for briefing congressional leadership on the Russiagate investigation and to obtain unusual permission to announce the investigation to the public.

The Talking Points memorandum (which became public by accident) relied primarily on Steele dossier allegations and secondarily on the earliest reports of Papadopoulos’ encounter with the Australians, but failed to disclose Danchenko’s more or less completely exculpatory interview (or for that matter, exculpatory information on what Papadopoulos actually said.)

The lead author for the Talking Points memorandum was Lisa Page. It was arguably her most important role in the Crossfire affair, but one that Horowitz appears to have been unaware of when he assessed her contribution to have been negligible.

A couple of obvious questions:

• were DAD Boone and SSA3 (and also Auten) asked to approve the language of Lisa Pages’s inaccurate March 8 Talking Points memorandum?

• If so, what did they say?

• If not, why weren’t they asked?

Kent stated that ambassador Pyatt’s landmark speech in September 2015, which chastised the Prosecutor General Office and prepared the way for U.S. removal demands in November/December 2015, had been triggered by Shokin’s obfuscation of the diamond prosecutor case.

This explanation has been generally accepted by commentators who reject efforts to associate Shokin’s firing with Burisma and/or Hunter Biden.

However, there has been little to no critical examination of the “diamond prosecutor” case itself, even in the congressional hearings in which it was referred to. Why was it about this case that prompted U.S. officials to intervene so ostentatiously in the appointment and dismissal of a Ukrainian official with primarily domestic responsiblities?

Also, what happened to the diamond prosecutor case after Shokin was dismissed?

If Shokin had been obfuscating the diamond prosecutor case such that U.S. officials felt obliged to intervene, one would presume that, following Shokin’s removal, the case would have moved rapidly to conviction of the offenders. And that this rapid progress would have been closely monitored by U.S. State Department officials and even U.S. media.

Several weeks ago, I idly wondered: “what was the eventual outcome of the ‘diamond prosecutor’ case?

Answering the question wasn’t easy. I’ve spent days trying to re-construct the long arc of the diamond prosecutors case, primarily using online translations of Ukrainian reporting, doing dozens of site-specific google searches in Cyrillic of both obscure and non-obscure sites.

The bottom line: nine years since the original arrest, the “diamond prosecutors” case remains undecided. Court proceedings stalled years ago. In 14 months, the statute of limitations will expire. To the extent that anything was done in this case, it was done during Shokin’s term as Prosecutor General or in the momentum of the subsequent six months.

By the time that U.S. State Department officials were testifying at the 2019 impeachment and 2020 HGSAC hearings, the “diamond prosecutor” case had more or less totally stalled under Shokin’s successors. But none of the State Department officials reported this. Nor did any of the lawyers or congressmen ask them a single question about the progress and outcome of the diamond prosecutors.

From my review of events, the “diamond prosecutor” case did not provide a legitimate reason for U.S. State Department officials to demand Shokin’s removal (let alone so vociferously). On the other hand, it is also clear that they were demanding Shokin’s removal prior to demands from Burisma and Hunter Biden for “deliverables”. In my opinion, the most likely explanation is that the U.S. demand for Shokin’s head arose from his resistance to the “lustration” program backed by the U.S. embassy and Soros NGOs - a program which (as recently reported by New York Times) had already been carried out at the Ukrainian SBU (security police) in coordination with the CIA - and that the “diamond prosecutor” case was a cudgel to remove Shokin, quickly forgotten once he was wrongfully removed.

Illegal “Sand Mining”

The “diamond prosecutors” case had its origin in an unglamorous dispute about allegedly illegal sand mining near Pogreby village in Kyiv region - see map below.

Hydroekorsurs (Hydro-eco-resource), a private company, appears to have had some sort of agreement with the municipality to clear the Pogrebskii drainage channel, receiving a sand mixture which it could sell as compensation, rather than payment from the municipality. Under the guise of clearing the drainage channel, the operation was carried out without a permit for sand mining (a profitable enterprise in the Kyiv area.) Government inspectors, unsurprisingly, investigated the operation for illegally sand mining without a permit.

The Hydroekorsurs company had a sketchy setup. It had been incorporated by Oleksandr Kyrylenko, a lawyer and important figure in subsequent events. Kyrylenko was the only person named on official documents, but it had three “unofficial co-owners” not named on official documents. Two of the co-owners - Andriy Guz and Yuriy Baranovich - had put up money to finance the dredge used in the operation. Both were long-time friends/acquaintances of Vyacheslav Konstaninovsky, a prominent local oligarch and member of parliament, who later played an important role in events. Kyrylenko was responsible for inspections carried out by law enforcement and control bodies.

The fourth co-owner was Valentyn Rak, whose specific contribution to the enterprise is unclear. Rak subsequently becomes a central figure in the case: without him, there was no link between the sand mining operation and the “diamond prosecutors”. Rak was the intermediary who arranged the alleged payment to the diamond prosecutors (whose identity was unknown to the other co-owners) and through whom the bribes were supposedly paid.

Rak’s background, to say the least, was extremely shady. In June 2014 (only ten months before the opening incident in this case), Rak had been convicted of a large-scale fraud in which had defrauded a victim of $370,000 under false pretenses. Rak’s appeal was denied by regional court of appeals in June 2016 and by Ukrainian Supreme court in July 2019. Here is a short summary:

According to the case file, Rak and his accomplice Andriy Zakharchenko convinced a man to lend them $200,000. As a guarantee for the return of funds, the borrower was given a state deed for a plot of land, the owner of which was Rak's wife. At the same time, Rak convinced the borrower not to enter into a pledge agreement. Later, Rak and his accomplice allegedly borrowed another 170,000 dollars and 50,000 UAH from the same man. In return, they promised to include the borrower's wife in the company, which will issue a lease for a granite quarry in the Zhytomyr region. The money was not returned.

Rak was sentenced to 5 years of imprisonment with confiscation, and Zakharchenko - to 7 years with confiscation.

The April 9, 2015 Incident

Matters seem to have come to a head on April 9, 2015, less than two months after Shokin’s appointment as Prosecutor General on Feb 15, 2015, when a government official, accompanied by “people in balaclavas” (also described as “50 people from Azov”) forcibly removed the dredger and stopped the operation.

Kyrylenko described the incident in May 2016 as follows:

"In April, police officers and prosecutors simply took away the dredger without any decision and blocked the work," said Mr. Kyrylenko…

and in August 2021 as follows:

When 50 people from Azov with law enforcement agencies arrive, overturn your car and cut the wheels, and the law enforcement agency is behind it. What do you think the pressure is?!

The senior on-scene official appears to have been Alexander Kurko, an employee of the Kyiv Regional Prosecutor’s Office, later interviewed in court in August 2017, where he testified that his concern was illegal sand mining and that he knew nothing about any prosecutor receiving any benefits related to the case.

Guz and/or Baranovich immediately contacted their friend, member of parliament Vyacheslav Konstantinovsky, who arrived on the scene in the evening, witnessing the mob of men in “balaclavas”. One or more videos of the event was taken.

Subsequently, member of parliament Konstantinovsky went to Davit Sakvarelidze, a Biden cadre from Georgia who had recently (March 2015) been appointed as Deputy Prosecutor General, with whom he was acquainted. Konstantinovsky showed a video with “people in balaclavas”. Sakvarelidze recognized an investigator in the video (presumably Kurko) and offered to help.1

The Arrests - July 5, 2015

Guz and Baranovich urgently wanted to get their dredge back and resume operations. At some point in the next three months (and precise timing is unclear on present record), Rak told them that the problem was with the prosecutors. According to Rak’s later testimony, Rak contacted “entrepeneur” Valeriy Hybalenko about recovering the dredge and “Hybalenko offered legal assistance to the company in the courts, in the search for a dredger, in the repair of a dredger”, but there would be costs. Rak explained to Guz and Baranovich that the amount required to “solve” the problem would be $200,000 in three tranches: a first tranche of $50,000; a second tranche of $100,000 and a third tranche of $50,000 after the case was dismissed. Rak didn’t give any names to Guz or Baranovich.

According to the later indictment, Rak transferred the first tranche of $50,000 to Hybalenko on June 26, 2015, who then transferred $50,000 to Korniets and Shapakin on June 27, 2015. Sakvarelidze stated in an interview that the exchanges were under “covert surveillance”. (However, no witnesses to the exchange have thus far been produced in hearings to date.) On the following week (July 3, 2015), according to the indictment, Rak transferred the next tranche of $100,000 to Hybalenko; Hybalenko then met with Korniets, but Korniets noticed the surveillance and the transfer didn’t take place.

Then,on July 5, 2015, in a major operation, the two “diamond prosecutors” - Oleksandr Korniyets, then deputy prosecutor of the Kyiv region and Volodymyr Shapakin, then first deputy head of the Main Investigation Department of the Prosecutor General Office) were arrested on suspicion of taking bribes to close the investigation into illegal sand mining. The arrests were carried out by the “Alpha” (Counter-Terrorist) unit of the Ukrainian SBU under Sakvarelidze’s authority. Hybalenko was also arrested. The arrests were accompanied by high-profile searches of the homes and offices of the two prosecutors, in which the SBU reportedly broke down office doors in the Prosecutor General Office building. At the time, Shokin was in the U.S. for surgery and out of action.

Meanwhile, the SBU announced that they had recovered $500,000 in cash from Shapakin’s home and 500,000 hyrvynias ($15,000) in diamonds from Korniets. The story, needless to say, got huge coverage in Ukraine2.

The timing of events between the seizure of the dredge on April 9 and the SBU raid and arrests at the Prosecutor General Office on July 5 is murky. In a March 2016 interview3, Sakvarelidze stated that he contacted “head of the SBU Hyrtsak” after he had met with one of the Hydroekosurs co-owners (probably Kyrylenko) in a follow up to Konstantinovsky’s complaint. At a time when Shokin was “in America” for surgery.

the applicant [presumably one of Kyrylenko, Guz or Baranovich] came and said: "They need me." … I told him: "Write an application." The man was very scared, his hands were really shaking. I sent an SMS to the head of the SBU Hrytsak and said: "I need your operational support and the most trusted, reliable people." …

Shokin was then in America, he was operated on. I say that trusted people are needed. He sent me Viktor Trepak and his guys. They took on this matter very competently - 120 operatives, investigators, special forces "Alfa" and so on..

Hyrtsak had become acting head of SBU on June 18, 2015, after the resignation of his predecessor Valentyn Nalyvaichenko on June 16, 2015. (Nalyvaichenko featured prominently in the recent New York Times story (link) on the CIA as the Ukrainian official who embedded the CIA in Ukrainian intelligence operations after the Maidan regime change coup in February 2014.)

If Hyrtsak was “head of the SBU” when contacted by Sakvarelidze about the sand mining operation, the schedule of events is remarkably compressed. The payoff operation began one week after Hyrtsak’s appointment - only a few days after Sakvarelidze had contacted the SBU. It’s a remarkable coincidence (or not) that the payoffs were not initiated until after Sakvarelidze had arranged for SBU surveillance. (One can help but wonder whether the SBU surveillance team were wearing khaki pants, navy blue shirts and aviator sunglasses.)

The SBU surveillance and raid of the Prosecutor General Office also took place in the context of a festering dispute between SBU and the Prosecutor General Office, which had resulted in Nalyviachenko’s resignation only a few days previously. A dispute which (by coincidence or not) touched on an incident involvement Biden cadre Michael Carpenter, Elizabeth Zentos and “whistleblower” Eric Ciaramella.

On June 12, 2015, SBU chairman Nalyvaichenko had publicly charged that a former Deputy Prosecutor General4 was co-owner of an illegal oil depot, at which a serious fire had killed five people in early June. Nalyvaichenko didn’t name the official. The Prosecutor General Office immediately issued a subpoena to Nalyvaichenko, thus preventing him from attending a June 15, 2015 meeting in Washington with Ciaramella, Zentos and Carpenter. Ukrainian official Naida attended in his stead.5

On June 15, 2015, Nalyvaichenko identified Anatoly Danilenko as the former Deputy Prosecutor General in question6,7. Danilenko was the Ukrainian prosecutor who had supposedly told George Kent about Burisma bribes in early February 2015. When Shokin became Prosecutor General in mid-February 2015, Danilenko resigned (presumably at Shokin’s request.) Once Danilenko was identified as a person of interest, the Prosecutor General Office immediately determined that Danilenko did not have any connection to the oil depot or the fire. Nalyvaichenko resigned as head of SBU on June 16.8 He had given a lengthy interview a few days earlier.9 He still remained an important figure in Ukrainian politics and re-appeared a few years as author of an October 2019 Wall St Journal editorial10 endorsing the investigation of payments to Hunter Biden.

On June 18, 2015, Vasyl Hyrtsak was appointed head of SBU. Previously, he had led SBU Counter-terrorism, which included Alpha Group. Hyrtsak assigned Viktor Trepak to lead the operation on behalf of SBU. Trepak later had an important role in the Black Ledger operation: it was Trepak - not Leshchenko - who announced the existence of the notorious “Black Ledger” in early June 2016, which Trepak claimed to have received it in an anonymous package several weeks earlier. Trepak turned the documents over to Artem Sytnyk at NABU (who had been one of the attendees at the January 2016 Washington meeting between U.S. officials, Biden cadres and Ukrainian prosecutors favored by the U.S. administration in Ukraine.)

Thus, the sensational July 5, 2015 arrests of the two prosecutors, together with military-style SBU raids on their homes and offices, including the unusual spectacle of SBU breaking into offices in the Prosecutor General building, took place within a few weeks of the Prosecutor General preventing the SBU head from traveling to Washington and the Nalyvaichenko’s forced resignation.

It also appears that Sakvarelidze was liaising with the U.S. embassy on his operations, but not his ostensible superiors at the Prosecutor General Office. First Deputy Prosecutor General Huzyr, in charge during Shokin’s absence, immediately opened an investigation into who authorized the raid by Sakvarelidze and the SBU, as Sakvarelidze does not appear to have obtained authorization from his superiors at the Prosecutor General Office or to have even informed them. The circus, needless to say, got huge coverage in Ukraine.

While Sakvarelidze’s actions took senior management at the Prosecutor General Office by surprise, it appears almost certain that Sakvarelidze had briefed George Kent and/or Jeffrey Cole at the U.S. Embassy. We know for certain that, on June 11, 2015, Sakvarelidze had sent an email to [Jeffrey Cole] of the U.S. embassy reporting the arrest of an obscure prosecutor in Poltava. Sakvarelidze’s email was forwarded by [Cole] to George Kent, and thence to Rob Storch (Michael Horowitz’ deputy IG) and then to Horowitz himself. Kent mentioned the Poltava incident in his testimony.

While there hasn’t been any production of documents proving that Sakvarelidze was briefing U.S. embassy officials on his operation against the “diamond prosecutors”, it defies logic that Sakvarelidze would have reported to them on the minor Poltava arrest but not on the “diamond prosecutor” incident. One can also see how Sakvarelidze’s coziness with U.S. embassy officials, while snubbing his ostensible superiors at the Prosecutor General Office, would be a recipe for dissension.

Back to the narrative.

On July 6, 2015 (the day following the searches), Poroshenko summoned11 Hrytsak (SBU), Sakvarelidze and Huzyr to his office and tried to get everyone to play nice: he told Huzyr to shut down the investigation into whether the raid was properly legal; he told Sakvarelidze to remove his Facebook post asserting “rampant” corruption in the Prosecutor General Office; and issued his own Facebook post with everyone at the same table.

Shokin returned to Ukraine about July 10, 2015.

On July 14, 2015, Poroshenko met with both Sakvarelidze and Shokin12 as there were still festering issues - see picture below from Poroshenko’s Facebook. On July 10, 2015, the Kyiv Post (reflecting opinions of the NGOs) had called for Shokin’s resignation - one of the earliest manifestations of the increasing ambitions of Sakvarelidze and Vitaliy Kasko, another opportunistic young Deputy Prosecutor General also backed by the U.S. embassy.13 Sakvarelidze and Kasko emerged ascendant from the meeting.14 On July 16, 2015, both prosecutors (Korniets and Shapakin) were fired. The Prosecutor General Office also announced that the ongoing investigation would be under the direction of Sakvarelidze and Kasko15. Two weeks later, it was announced that First Deputy Prosecutor General Huzyr had submitted his resignation.

Meanwhile, both Sakvarelidze and Vitaliy Kasko, the other Deputy Prosecutor General who was coordinating with the US embassy, gave multiple public interviews pouring salt onto the wounds of their superiors16.

The September 2015 Pyatt Speech and Aftermath

Eight weeks later, in September 2015, U.S. ambassador Pyatt made a landmark speech17 in which he accused the Prosecutor General Office (i.e. Shokin) of “aggressively undermining reform”, while “applaud[ing]” the work of Sakvarelidze and Kasko, both then reporting to the US Embassy:

Pyatt’s speech was subsequently cited by U.S. officials as evidence that State Department demands for Shokin’s resignation originated well before Biden’s trip to Ukraine in December 2015 and, more importantly in regard to subsequent controversy, prior to Burisma’s demand for “deliverables” from Hunter Biden in late October 2015.

In his 2020 testimony to a Senate subcommittee, Pyatt was asked about the origin of his September 2015 speech. He gave credit to the “INL [International Narcotics and Law Enforcement] office, which was generously funded by the Assistant Secretary [Victoria Nuland]”. As noted above (see the June 11, 2015 email), Deputy Prosecutor General Sakvarelidze was reporting to the INL office, whose perspective on the inter-necine intrigues within the Ukrainian Prosecutor General Office were shaped by what they were told by Sakvarelidze and Kasko (a point made elsewhere in the 2020 testimony by State Department officials.)

In August and September 2015, Kasko and Sakvarelidze were feuding with Shokin and the Prosecutor General Office over several other issues considerably more consequential than the diamond prosecutor case - the context of which is too complicated to review in this already too lengthy article.

One dispute was over the “special confiscation” law proposed by Tetiana Chornovol (and supported by Shokin) to facilitate seizure of funds believed to have been embezzled by oligarchs who had fled Ukraine. Chornovol’s proposal was opposed by U.S. officials. In particular, on September 14, 2015, Mary Butler of DOJ MLARS wrote to Kasko and Daria Kaleniuk, Executive Director of an NGO backed by both the State Department and Soros, to express opposition to the bill.18 (The choice of recipients is curious: Butler wrote to Kasko (not Prosecutor General Shokin) and to a US-backed NGO.) The proposed legislation was defeated.

A second contemporary dispute was over efforts by Elena Tyshchenko (then recently reported to lead asset recovery efforts on behalf of Ministry of Internal Affairs), Chornovol and Shokin to recover $80.5 million in funds frozen in Latvia, the recovery of which was under Kasko’s jurisdiction, but, according to Chornovol, not being pursued. In August and early September, in the period leading up to Pyatt’s speech, there was a bitter fight with Kasko over his apparent failure to take required steps to recover the funds, while simultaneously purporting to blame Shokin while reporting to the U.S. Embassy. On October 2, 2015, Chornovol published a bitter account of her experience with Kasko (link)1920. The Latvian information on money-laundering came into closer view four years later when Andrii Derkach (who was later sanctioned by “Trump” administration) revealed that the Burisma payments to Hunter Biden, Devon Archer and others were made from Latvian bank accounts of offshore companies and had been reported to Ukrainian authorities as potential money laundering. These Latvian transactions were exactly the sort of transaction that ostensibly interested U.S. officials concerned with money laundering, but were ignored at the time.

The criminal investigation of the prosecutors continued actively in the next few months. In October 2015, Kasko filed suspicions against Korniets in an unrelated incident.21

The first (thus far) expressly documented demand for Shokin’s resignation within State Department documents occurred on a month later, on November 22, 2015, in a Talking Points memo prepared for Biden’s then forthcoming trip to Ukraine. See my X thread on this memo,22 which originated in Bridget Brink’s section. The memo was distributed by a redacted official, identified in my thread as Jamie Gusack, a recent transferee to Brink’s section. In January 2016, the Ukrainian prosecutors met with Brink and Gusack subsequent to their better known meeting with Ciaramella and Zentos. It is my belief (as articulated in a X thread) that the association of the demand for Shokin’s resignation with approval of the $1 billion loan was first articulated at the meeting of the Ukrainian prosecutors with Brink and Gusack (taking Ciaramella by surprise as evidenced by the “yikes” email.)

As is now well known, in his trip to Ukraine on December 6-9, 2015, Biden issued this demand to Ukrainian parliamentarians and officials. Daria Kaleniuk of AntAC had visited officials in Washington on December 1, a few days earlier. And Leshchenko visited officials in Washington a few days after the trip.

The idea of a visit to Washington by the Ukrainian prosecutors most closely linked to the U.S. administration appears to have developed in December 2015 in the wake of Biden’s trip to Ukraine. Invitations were issued to Sakvarelidze, Kasko, the recently appointed NABU head (Artem Sytnyl) and the just appointed Special Anti-Corruption Prosecutor (Nazar Kholodnitsky). U.S. officials do not appear to have invited Prosecutor General Shokin and it is unclear whether they even sought Shokin’s permission in advance. By this time, Kasko and Shokin were in more or less open warfare and Shokin refused exit permission to Kasko (but permitted Sakvarelidze to go). At the January 2016 meetings, the two main interests of U.S. officials were later reported to have been: (1) getting the Ukrainian prosecutors to get money-laundering dirt on Paul Manafort; (2) firing Shokin.

Diamond Prosecutor Case Progress

Shokin Period - July 2015 to March 2016

Rather than the “diamond prosecutor” case being stalled, on January 4, 2016, the suspicions registered in July 2015 were crystallized into indictments against Shapakin, Korniets and Hybalenko in the Pechersky court.23 One day later (January 5, 2016), the Pechersky court pronounced itself unable to identify enough unconflicted judges available for the trial and referred the case to the Kyiv Court of Appeals for resolution. After some legal manoeuvring, the case was sent to a different Kyiv court - the Holosiivskiy Court of Kyiv - which, by March 10, 2016, had assigned a panel of three judges24.

Meanwhile, an investigation into Kasko by the Prosecutor General Office revealed that he had obtained valuable apartment real estate in questionable transactions.25 Kasko resigned in mid-February 2016, excoriating Shokin on the way out. Concurrent with Kasko’s exit, Biden ratcheted up the pressure on Poroshenko to obtain Shokin’s resignation in a telephone call, a tape of which was released in May 2020 by Andrii Derkach (who was subsequently sanctioned by the “Trump” administration.)

Consideration of the case began on March 21, 2016. Korniets and Shapakin were arraigned on March 23, 2016 and pled not guilty. Korniets claimed: “Not a single hryvnia or dollar that is related to this criminal proceeding was confiscated from either me or Shapakin. Therefore, I believe that (this is) fiction and a lie. Not a single evidence of the transfer of funds to me from any person in the materials There are no criminal proceedings. Not a single piece of evidence of my meeting with entrepreneurs or other persons exists in the case materials".

Sakvarelidze continued to publicly excoriate Shokin. On March 24, 2016, Sakvarelidze publicly asserted26 that Shokin himself was corruptly connected to Korniets. By then, Shokin was in his final days as Prosecutor General - he was removed on March 30, 2016. However, on March 28, 2016, in one of his final acts at Prosecutor General, Shokin fired the disloyal Sakvarelidze (who remain fired, even after Shokin’s removal.)

Prosecutor Yuri Simonov, who had been assigned to the case by Sakvarelidze/Kasko, continued as lead prosecutor throughout the case.

Lutsenko Period- May 2016 to Sep 2019

Lutsenko was Prosecutor General from May 2016 to September 2019.

The first publicly reported court examination of witnesses (two) in the “diamond prosecutors” case took place on May 10, 2016. In the Ukrainian system, trials do not take place on consecutive days, but, in the case, once a month or every few months at best. It’s hard to imagine a more chaotic system.

Member of parliament Konstantinovsky testified27 about his arrival at the melee on April 9, 2015. He said that he had known Guz and Baranevich for about 15 years, that Guz had called him on April 9, 2015 complaining about the arrival of “police and SBU employees”, that he had gone to the site where he witnessed “men in balaclavas”, that the company gave him a video of events which he took to Sakvarelidze, identifying an official [presumably Kurko] from the PGO and that Sakvarelize undertook to figure out what was going on. (Also see contemporary interview with Konstantinovsky28).

The second witness on May 10, 2016 was company lawyer and co-owner Kyrylenko. Kyrylenko stated29 that "in April, police officers and prosecutors simply took away the dredge without any decision and blocked the work" and “that representatives of the prosecutor's office demanded $200,000 from the company's management through an intermediary so that ‘the issue was resolved at the level of the regional and General prosecutor's offices.’” BBC reported30 that “the representative of the company [Kyrylenko] was interrogated for almost two hours, but he did not testify specifically about the transfer of the bribe, as well as about who exactly demanded it”.

In other words, neither of the opening witnesses connected either Shapakin or Korniets to the bribe.

After the day’s proceedings, BBC interviewed Sakvarelidze, Kasko (both of whom attended the examination despite having been removed) and prosecutor Simonov . BBC Ukraine reported31:

He [Sakvarelidze] believes that the most important thing in this case is not even the testimony of witnesses, but the evidence - materials of secret investigative actions during the controlled transfer of bribes.

Mr. Kasko also assured that the diamonds are in the materials of the criminal case, but they are not evidence during the court process, but only seized property value.

State prosecutor Yanis Simonov told journalists after the meeting that the next witnesses will tell about the circumstances of the case and the transfer of bribes.

The next meeting, where the questioning of prosecution witnesses will continue, is scheduled for May 18.

After hearing the prosecution's witnesses, the court will study the evidence in the case, and after that the questioning of the defense's witnesses will begin.

On May 13, 2016, Korniets was beaten up by assailants in Kyiv. The next reported hearing was on June 13, 2016.

On June 13, 2016, company co-owner Baranovich testified32 that “that the company was not engaged in sand mining, but was engaged in cleaning the bottom of reservoirs, however, during numerous inspections, none of the inspectors wanted to look at the documents” and that “over time the management of the enterprise was told the amount of “resolving the issue” - 200 thousand dollars… in three stages. At the first stage, 50 thousand dollars were paid to unlock and remove security from the facility, another 100 thousand were supposed to be paid for closing criminal cases, returning documentation, and another 50 thousand dollars were to be transferred upon completion of the above procedures.”

Thus, despite Sakvarelidze’s promise of testimony about “covert” transfers, Baranovich’s testimony on June 13, 2016 did not connect the bribes to either of the two prosecutors, or, for that matter, even to co-defendant Hybalenko.

Ten days later, the appeal of the 2014 fraud conviction of Valentyn Rak, the key intermediary, was denied by the Vinnytsia Court of Appeal.33

On August 15, 2016, three more witnesses (unidentified in contemporary reporting) were questioned by the court. “Each of them told the court that they did not recognize the accused”.34 This reporting also stated that five witnesses were scheduled for August 23, 2016, but there does not seem to be any contemporary reporting on this.

In September 2016, one of the three judges on the panel (Drozdova) was dismissed due to health reasons. The nominee replacement (Rudyk) recused himself. Oleksandr Boyko was appointed as third judge. The replacement of one of the three judges resulted in the defense having the right to require re-examination of all witnesses from the beginning, but this does not seem to have taken place.35

On November 9, 2016, two witnesses were reported to have been examined , but nothing relevant to the criminal case was reported.

The next information on proceedings is three months later. In February 2017, a PGO prosecutor involved in checking the legality of sand mining, “did not say anything useful for the criminal case”.36

In February 2017, in a development not directly related to the case, Dmytro Neskoromnoy, the leader of the SBU operation against the “diamond prosecutors” in June-July 2015, was dismissed from the position of deputy head of the "K" Department of the SBU for corrupt actions earlier in 2015.37

The case appears to have been inactive for the next six months, in part due to scheduling conflicts among the three judges.38

In August 2017, Alexander Kurko, the PGO employee who attended the melee on April 9, 2015 was examined. Contemporary reporting stated: “Kurko did not give any testimony about the former employees of the prosecutor's office receiving undue benefits for closing the case of illegal sand mining. ‘Nothing is known’, witness Kurko answered the question of GPU prosecutor Alexander Proskurnikov.”39

Two months passed. A scheduled hearing on October 23, 2017 was adjourned because (1) one of the judges had a scheduling conflict; and (2) neither of the witnesses (deputy head of the Ministry of Internal Affairs, Vadym Troyan, and first deputy prosecutor of the Kyiv region, Ihor Hrabets) showed up. Prosecutor Simonov blamed the court for not issuing summons.

On November 13, 2017, Hrabets was examined. He testified that he had been acting prosecutor of Kyiv region in April 2015 and had been aware of active investigation of illegal sand mining in Kyiv region under Korniets’ direction, stating that active investigations were done on the basis of a court ruling:

In 2015, circumstances developed such that for 4 or 5 months I acted as the prosecutor of the Kiev region. Powers between deputy prosecutors regions are clearly distributed. Therefore, I was responsible for my direction as the first deputy prosecutor of the region. The specified powers of the former prosecutor - I realized that this was temporary... I learned about the criminal proceedings regarding illegal sand mining in the Kiev region from numerous parliamentary appeals that came at that time. , and in connection with the preparation of answers, since the answers are prepared with the signature of the head at the address of the people's deputy, Korniets reported on the case and, as a rule, on those days when active investigative actions were carried out on the basis of a court ruling, searches, reviews, and seizure of equipment directly. at the scene of the crime. It’s difficult for me to tell you in more detail now

Hrabets was unable to “confirm receipt of a bribe” by either of the two prosecutors.40

The next scheduled witness was co-owner Valentyn Rak, who had been the supposed intermediary to the defendants. Six months passed before Rak’s belated appearance.

First, Rak failed to show up for a scheduled appearance on January 24, 2018.41 Two months passed. Then, on March 24, 2018, Rak once again failed to appear. According to contemporary reporting, the judges stated that this was the 10th time that Rak had failed to appear; this time, the court issued a warrant requiring his appearance at next session. Prosecutor Simonov said that Rak was in attendance, but that his lawyer wasn’t there.

On May 3, 2018, Rak finally appeared.42

Rak testified that, after being informed by the other co-owners of the disappearance of the dredger, he contacted Hybalenko about locating and recovering the dredge. He said that Hybalenko introduced him to Shapakin and Korniets, but Korniets was unhelpful. He said that Hybalenko told him that it would cost $150,000 to recover the dredger, but said nothing about sending money to law enforcement agencies. After Guz and Baranovich put up the money, Rak handed $50,000 and later $100,000 to Hybalenko. Rak denied any knowledge of a bribe to law enforcement officials.

While Rak’s denial of any knowledge of a bribe seems implausible, the prosecution record at that point does not appear to have included any witness that actually linked the delivery of $150,000 to Shapakin and Korniets.

Two months passed. Rak was supposed to continue his testimony on July 18, 2018, but two of the judges were unavailable and the hearing was adjourned.43 Rak never did finish his testimony.

Two months passed. Then, in September 2018, Judge Boyko, one of the three judges on the panel, was suspended by the High Council of Justice for driving while intoxicated. His replacement, Halyna Bondarenko, agreed to hear the case from the stage at which it was stopped, but she wanted to re-examine the key witness Rak.44

Three months passed. Then, on December 3, 2018, Rak once again failed to appear. Prosecutor Simonov stated “that they could not contact the witness. Rak's relatives refused to talk to prosecutors, and the lawyer defending Rak himself from criminal prosecution promised to pass on the information. According to Simonov, Raka's phone is not answering.” The court once again issued a warrant compelling Rak’s appearance.45

Seven weeks passed. Rak was scheduled to appear on January 20, 2019, but once again failed to appear. A contemporary report stated: “Judge Dmytro Valigura reported that Rak's wife [provided] a copy of the certificate that, since January 21, he has been undergoing inpatient examination and treatment in the psychiatric department of the hospital.” Prosecutor Simonov suggested that “if the health of the witness does not improve, the court can change the order and start examining the written evidence”. Judge Valigura ruled otherwise and placed the onus on the prosecution who had offered Rak as a key witness to demonstrate that his evidence “can be used as the basis of any procedural decision”:

"It is advisable to wait for Rak [to be] mentally healthy and with the appropriate document. This certificate changes a lot of what he told... The question of finding out the circumstances of how he got there [in mental hospital] is not within the competence of the court. This is a prosecution witness. The prosecution must not only ensure his appearance, but also prove that the words of the witness, the interrogation... can be used as the basis of any procedural decision".46

Four months passed. The court once again convened to examine Rak on May 16, 2019, but Rak once again failed to show. This time, according to a contemporary report: “Prosecutor Simonov brought a certificate from the hospital that on January 21-23, [2019], Rak underwent an outpatient examination, according to the results of which no treatment was required.” Simonov said Rak “was supposed to appear at the hearing, because the day before he was invited to continue the interrogation, but he never came to the court.”47 The case was adjourned once again.

Two months passed. On July 24, 2019, the court convened once again.48 This time, both defendant prosecutors were absent for supposed medical reasons: Shapakin was recovering from surgery and Korniets’ sister was in the hospital. Once again, the hearing was adjourned.

Meanwhile, the next day (on July 25, 2019), Rak’s conviction for fraud (for which he had received a five year sentence) was upheld by the Supreme Court.49 This is the last news of Rak.

By coincidence, July 25, 2019 was also the date of Trump’s fateful telephone call with then newly elected President Zelensky.

Riaboshapka Period - Sep 2019 to March 2020

On August 29, 2019, Ruslan Riaboshapka50 was appointed as the new Prosecutor General. Kasko was re-appointed as Deputy Prosecutor General on September 5, 2019, followed soon after by the appointment of Viktor Trepak also as Deputy Prosecutor General on October 9, 2019. (Trepak had led the 2015 SBU operation in which Korniets and Shapakin had been arrested.)

On September 5, 2019, changes to the legislation governing the new High Anti-Corruption Court came into effect.51

Two months had passed since Rak’s non-appearance on July 25, 2019. A hearing was scheduled for September 25, 2019, but was adjourned because Hybalenko’s lawyer was absent.52

On September 30, 2019, the prosecutor requested that the case be transferred to the High Anti-Corruption Court; the Holosiivsky court of Kyiv referred the request to the Kyiv Court of Appeals.53 On October 18, 2019, the Kyiv Court of Appeals rejected the application and returned the case to the Holosiivsky court of Kyiv.54

On November 4, 2019, the Holosiivsky court directly referred the case to the High Anti-Corruption Court anyway. The High Anti-Corruption Court accepted the case and assigned three judges on November 8, 2019.55

However, on November 22, 2019, the Appellate Chamber of the High Anti-Corruption Court decided that the case did not fall under their jurisdiction and returned the case to the Holosiivsky court of Kyiv.56

The Prosecutor General Office then asked the Kyiv Court of Appeals to transfer the case from the Holosiivsky Court of Kyiv to the Obolon Court of Kyiv, citing the “inefficiency” of the proceedings thus far.57

While these machinations were taking place - three and one-half years since Shokin’s removal - George Kent was testifying at House impeachment hearings58 that Shokin’s obfuscation of the diamond prosecutor case in summer 2015 had precipitated the State Department demand that Shokin be fired.

Three more months passed. Then, on February 18, 2020, the transfer of the diamond prosecutor case to the Obolon Court was granted59. On February 27, 2020, Судовий репортер (sudreporter) published a useful review of the dismal proceedings, observing that almost 5 years had passed since the original rest and (presciently) pointed out that there were “only” another 5 years before the 10-year statute of limitations expired.60

Venediktova Period - March 2020 to July 2022

In March 2020, Riaboshapka was removed as Prosecutor General and replaced by Irinia Venediktova. Her appointment more or less coincided with the transfer of the diamond prosecutor case from the Holosiivsky Court to the Obolon Court with new judges starting more or less from the beginning.

The transfer to the Obolon Court ushered in even slower proceedings. Ten months later (January 2021), the Obolon Court still hadn’t held its first hearing on the case.61

During this hiatus in the diamond prosecutor case, the Senate HGSAC hearings took place in summer 2020, during which multiple State Dept witnesses (Pyatt, Blinken, Nuland and George Kent himself) recited the supposed obfuscation of the "diamond prosecutor” case under Shokin without blinking.

On January 21, 2021, Korniets requested that the case be transferred to the Desnyansky Court of Kyiv, where a separate case against him and his sister were being heard. Prosecutor Simonov opposed the transfer on the grounds that it would result in further delay (notwithstanding fact that prosecution’s request that case be transferred to Obolon Court had already resulted in a year of delay.)62 On February 15, 2021, the Kyiv Court of Appeal rejected the transfer to the Desnyansky Court and returned the case to the Obolon Court.63

On February 26, 2021, in a separate case, criminal investigation against Lev Trubnikov, Sakvarelidze’s lead SBU investigator in the diamond prosecutor case, for theft of seized property was extended in February 2015.64

Two months passed. On April 22, 2021, in a television interview, Sakvarelidze and the then Prosecutor General Iryna Venediktova were asked about the diamond prosecutor case. Venediktova admitted that, six years later, the case had still not been heard.65

Another month passed. It was now 15 months since the case had been transferred to Obolon Court in order to expedite it. On May 24, 2021, the Obolon court reported that it had completed its preparations and assigned the indicted case to a panel of three judges - Serhiy Rodionov, Inna Belokonnaya and Natalia Yatsenko. Prosecutor Simonov asked that the court first examine the “written evidence”, but the court determined that it would start with the questioning of witnesses.

Another month passed. On June 18, 2021, the Obolon court held its first hearing, to which five witnesses had been summoned. None appeared. Prosecutor Simonov stated:

"There is no data that witnesses have received subpoenas. As a prosecutor, I was not obliged to ensure the appearance of these witnesses. As a prosecutor, I have a completely different vision - I want to start with the materials, I am preparing a list of these pieces of evidence. The materials of the case are unchanged, but it is a large volume. Perhaps the list will be ready for the next meeting and I will ask to change the order," said prosecutor Simonov.

The case was adjourned.66

Another month passed. On July 20, 2021, the first witness appeared before the Obolon Court (and the only witness that I have been able to identify in public reporting). Company co-owner and lawyer Oleksandr Kyrylenko (identified in the Sudreporter article as “a man named Oleksandr”), who had already testified in the Holosiivsky Court on May 10, 2016, five years earlier, gave testimony virtually identical to his previous testimony.

He first described the structure of Hydroecoresource, the accusations of illegal sand mining, the seizure of the dredge. Kyrylenko then testified that Rak had stated the amount of money necessary to settle the issue, but specific names of law enforcement officials were never mentioned. Kyrylenko said that he recognized defendant Hybalenko as someone that he had been introduced to by Rak as someone who had experience in resolving conflicts with law enforcement officials. Kyrylenko said that he “was not personally extorted” and “was not a witness to such an extortion”.67 Kyrylenko described the mob of enforcers on April 9, 2015 as “50 people from Azov”68 (a faction that was associated with Shokin’s opponents rather than Shokin himself):

When 50 people from Azov with law enforcement agencies arrive, overturn your car and cut the wheels, and the law enforcement agency is behind it. What pressure do you think?!

Four months passed. A hearing was scheduled on November 30, 2021, but was adjourned due to Korniets’ unavailability due to sickness.69

Andriy Kostin - July 2022 to Present

In July 2022, Andriy Kostin was appointed as Prosecutor General, replacing Irina Venediktova. To my knowledge, there are no publicly documented interviews since his appointment.

However, on June 12, 2023, Shapakin was separately charged with presenting a false loan document70 in two attempts to recover the cash seized during his 2015 arrest, originally in July 2015 and then again in July 2022:

The prosecutor, who was still in office, persuaded a businessman he knew to provide him with a false document stating that he allegedly borrowed 350,000 dollars from the businessman. Moreover, this loan agreement was drawn up retroactively. On the basis of the forged document, the law enforcement officer submitted an application to the General Prosecutor's Office of Ukraine for the return of currency values ​​belonging to him, seized during the search.

In the 2.5 years since November 30, 2021, there do not appear to have been any hearings on the diamond prosecutor case at the Obolon Court or elsewhere. (I have been unable to locate any reference in a diligent search of local media using Ukrainian search terms.)

Conclusions

It is now almost nine years since the original arrest in the “diamond prosecutor” case - more than eight years since Shokin’s removal - and the “diamond prosecutor” case remains undecided. It appears almost certain that the case will expire in 2025 with the statute of limitations.

Despite all the complaints by Kasko, Sakvarelidze and the State Department, more work was done on the diamond prosecutor case under Shokin’s tenure (together with momentum carrying through the next few months) than during the next eight years. During Shokin’s tenure, the criminal investigation of the diamond prosecutors was carried out under the direction of Sakvarelidze and Kasko; the indictment had been handed down; the panel of judges had been appointed, the defendants arraigned and court examination of witnesses had begun.

After Shokin’s removal, the case became inactive, gradually at first and then more or less totally. In the past five years - during the entire Zelensky presidency - the case has been somnolent: court examination of only one witness is publicly documented. (And that witness had already testified five years earlier.)

More or less the opposite of the obfuscation later asserted by George Kent and State Department officials.

Also, while multiple State Dept officials cited the importance of the “diamond prosecutor” case as justification for firing Shokin, none of them seem to have taken any interest in the outcome of the case after Shokin was fired. One has to wonder why the diamond prosecutor case was only of interest to the State Department when it was used to remove Shokin, but not of interest to them under successor prosecutors.

It appears plausible that the two prosecutors were corrupt. Like nearly every other Ukrainian official except (possibly) Shokin himself. But were they guilty of the specific extortion from the sand mining company with which they were charged? Thus far, none of the witnesses attested in public reporting linked the two accused prosecutors to the extortion. Even Valentyn Rak, the convicted fraud who was the prosecution’s key witness, did not identify the two accused prosecutors. And Rak’s conviction and imprisonment for a prior fraud opens an obvious defense - if, by chance, the prosecution rests its case prior to the expiry of the statute of limitations. It is surprising that, after nine years, prosecutor Simonov (one of Sakvarelidze’s original team) apparently hasn’t presented any evidence from the covert surveillance.

There’s one other large unanswered question in this affair. The animus of Pyatt (and his U.S. embassy staff) towards Shokin evidenced in Pyatt’s September 2015 seems extraordinarily disproportionate to Shokin’s actual conduct in summer 2015. But the timing is too early relative to the subsequent (late October 2015) Burisma demand for deliverables. The evidence of State Department officials on this issue has to be parsed carefully, since they tended to conflate later events (subsequent to the U.S. declaration against Shokin) with events as they stood at the time of Pyatt’s speech. I’ll discuss this issue in a follow-up post.

What does seem certain is that it was a fool’s errand for U.S. embassy officials to try to determine personnel decisions in the Ukrainian Prosecutor General Office, based on their favoritism for opportunists like Kasko and Sakvarelidze, who had agendas of their own.