rigorousintuition.ca

1. UH OH
an hour ago
Report: Mueller Witness Used Trump Fundraiser to Push Saudi, UAE Interests in White House

Report: Mueller Witness Pushed Saudi, UAE Interests in WH

AARON P. BERNSTEIN/REUTERS

A Lebanese-American businessman and United Arab Emirates adviser cooperating with special counsel Robert Mueller used one of President Trump’s top fundraisers to push the interests of Saudi Arabia and the United Arab Emirates in the White House, The New York Times reports. Previously undisclosed documents cited in the report are said to detail a year-long effort by the adviser, George Nader, to use Republican National Committee deputy finance chairman Elliott Broidy to do the bidding of the Saudi and UAE governments inside the White House. The firing of Secretary of State Rex Tillerson was among the top priorities Nader pushed in the White House, as was the president taking a harder line on Iran and Qatar. Nader is said to have offered Broidy more than $1 billion in contracts for his security company, Circinus, at one point in their correspondence. He also reportedly offered Broidy millions of dollars worth of business deals with the UAE. Nader praised Broidy for his ability to “handle” Trump and told Broidy he’d informed the leaders of Saudi Arabia and the UAE of the “Pivotal Indispensable Magical Role you are playing to help them,” according to the report.
https://www.thedailybeast.com/report-mu ... hite-house

Leaked documents detail close liaison between Trump and Saudi, UAE: Report


A witness in the Robert Mueller investigation of US President Donald Trump cultivated Elliot Broidy, another suspect in the investigation, to become a high-level liaison between Saudi Arabia, the United Arab Emirates and the White House, according to a New York Times report on Wednesday.

In leaked documents obtained by the New York Times, Nader used Broidy to argue for the ousting of Secretary of State Rex Tillerson on behalf of the UAE and Saudi Arabia because of their diplomatic spat with Qatar.

The leaked documents illuminate an “effort to cultivate President Trump on behalf of the two oil-rich Arab monarchies,” the Times report said.

Nader allegedly told Broidy about “how well you handle Chairman,” the Times said, a name apparently given to Trump.

The documents also claim that Nader acted as an intermediary between Trump and Saudi Crown Prince Mohammed bin Salman, who this week visited the White House and is currently touring the US.

The Times did not disclose where the documents came from, but said they “were provided by an anonymous group critical of Mr. Broidy’s advocacy of American foreign policies in the Middle East”.

A lawyer for Broidy said the leak came from Qatar.

“We now possess irrefutable evidence tying Qatar to this unlawful attack on, and espionage directed against, a prominent United States citizen within the territory of the United States,” said Lee S. Wolosky.

Earlier this week, Middle East Eye revealed that Nader organised a secret summit of Arab leaders on a yacht in the Red Sea in late 2015 in order to set up an elite regional group of six countries, which would supplant both the Gulf Cooperation Council (GCC) and the moribund Arab League.

The Times recently reported that Mueller’s investigators have questioned Nader and pressed witnesses about any possible attempts by the Emiratis to buy political influence by directing money to Trump’s presidential campaign.

On Friday, reports emerged of a slew of convictions of Nader on charges of sexually abusing underage boys and possessing child pornography. Newsweek reported that Nader had been sentenced to six months on child pornography charges in Virginia. According to federal court records seen by Newsweek, Nader was convicted of bringing child pornography into the US from Germany.
http://www.middleeasteye.net/news/leake ... 2012406277

IRAN-CONTRA COVER-UP KING DOESN’T ADDRESS SESSIONS’ OTHER LIES, OR CONSPIRACY-IN-CHIEF

March 21, 2018/6 Comments/in 2016 Presidential Election, Mueller Probe /by emptywheel
Fresh off several witnesses revealing that Jeff Sessions wasn’t as offended by George Papadopoulos’ plan to pitch meetings with Putin as he claims he was, ABC reported that, Andrew McCabe approved an investigation into whether Jeff Sessions lied to Congress about his ties with Russia.

Nearly a year before Attorney General Jeff Sessions fired senior FBI official Andrew McCabe for what Sessions called a “lack of candor,” McCabe oversaw a federal criminal investigation into whether Sessions lacked candor when testifying before Congress about contacts with Russian operatives, sources familiar with the matter told ABC News.

An anonymous source tried to claim that Sessions would not have known that McCabe briefly oversaw an investigation into Sessions’ own perjury, but Sessions’ lawyer pointedly refused to confirm that.

One source told ABC News that Sessions was not aware of the investigation when he decided to fire McCabe last Friday less than 48 hours before McCabe, a former FBI deputy director, was due to retire from government and obtain a full pension, but an attorney representing Sessions declined to confirm that.

Sessions’ lawyer is Chuck Cooper. Most recently, he got famous failing spectacularly to defend Prop 8. But years and years ago, he played a key role in excusing Iran-Contra, notably by inventing the concept of pixie dusting executive orders.

Given his past as a great cover-up artist, take note of how carefully he words his more general denial.

Two months ago, Sessions was interviewed by Mueller’s team, and the federal inquiry related to his candor during his confirmation process has since been shuttered, according to a lawyer representing Sessions.

“The Special Counsel’s office has informed me that after interviewing the attorney general and conducting additional investigation, the attorney general is not under investigation for false statements or perjury in his confirmation hearing testimony and related written submissions to Congress,” attorney Chuck Cooper told ABC News on Wednesday.

The AG is not under investigation for any lies in his confirmation hearing testimony, Cooper said.

Here’s what that leaves out:

Obstruction charges for inventing the reason to fire Comey, pretending to be involved in the firing of US Attorneys including Preet Bharara, and for firing McCabe

False statements charges tied to Sessions’ later testimony before Congress

False statements charges tied to his Mueller testimony about whether he opposed the Russian outreach (we now know Mueller has gotten conflicting statements on this point)

Implication in the Russian conspiracy directly

It’s the last one that is most interesting (and where all these false statements charges are headed anyway). We now know some of the people at the March 31, 2016 meeting believe Sessions was not opposed to the Russian outreach. We know that Sessions’ close aide, Stephen Miller, was in the thick of things.

And then there’s this bizarre exchange from a November exchange with Patrick Leahy (who seems to have known that Sessions was then under investigation for lying to Congress).

Leahy asked about each item in turn.

Leahy: Let’s take this piece by piece. Did you discuss any of the following: Emails?

Sessions: Repeat the question again about emails.

Leahy: Since the 2016 campaign, have you discussed with any Russian connected official anything about emails?

Sessions: Discuss with them. I don’t recall having done any such thing.

Right after this exchange, Sessions totally balks when Leahy asks him if he has been interviewed or asked for an interview by Mueller, saying he should clear it with the Special Counsel.

Now, there was some imprecision in this questioning. It’s clear that Sessions believed he was answering the question about during the campaign, not since it.

But of the things Leahy asked about — emails, Russian interference, sanctions, or any policies or positions of the Trump campaign or presidency — Sessions ultimately not-recalled in response to just one question: the emails.

Based on the past practice Leahy had just laid out, Sessions claimed to not recall issues that he had actually done. Which would suggest Sessions is worried that there’s evidence he has discussed emails — with someone. It’s just not clear how he interpreted that question.

Sessions refused to deny he had discussed emails with a “Russian connected official” since the election.

None of these potential ties in the conspiracy are included in Cooper’s carefully worded denial (nor is Sessions’ knowing that McCabe had okayed an investigation into him for failing to meet his duty of candor, the same thing Sessions just fired McCabe for).

That speaks volumes.

In any case, it seems we’ll be hearing a lot more about Sessions’ implication in all this, in the wake of his firing of McCabe.
https://www.emptywheel.net/2018/03/21/i ... -in-chief/

The 23% who voted Dowd may now collect their winnings! (Tho admittedly the story thus far is that he quit.)

emptywheel
‏
If you were Trump and NBC told you you had to flamboyantly fire one of your lawyers this week, who would it be and why?

1. 23% John Dowd

2. 19% McGahn

3. 29% Cobb

4. 29% Cohen

Also, anyone remember Jay Sekulow? Who'd have thunk he'd be the one lying low?

emptywheel
‏
I mean, if Di Genova CAN'T resolve conflict posed by his wife repping Clovis, Prince, and (most importantly) Corallo, then Trump would have lost Dowd w/o getting Di Genova.

TRUMP’S LEGAL TEAM: “IF THE LAW AND THE FACTS ARE AGAINST YOU, POUND THE TABLE AND YELL LIKE HELL”

March 20, 2018/41 Comments/in 2016 Presidential Election, Mueller Probe /by emptywheel
Folks in the White House keep telling Maggie Haberman and Mike Schmidt about imminent changes to his legal team.

MARCH 10: EMMET FLOOD
On March 10, it was that the superb Emmet Flood — who among other things, kept Dick Cheney out of the pokey — would join his team. The possibility was based on a meeting (now over 10 days ago) described as “an overture.”

The lawyer, Emmet T. Flood, met with Mr. Trump in the Oval Office this past week to discuss the possibility, according to the people. No final decision has been made, according to two of the people.

Should Mr. Flood come on board, the two people said, his main duties would be a day-to-day role helping the president navigate his dealings with the Justice Department.

Two people close to the president said that the overture to Mr. Flood did not indicate any new concerns about the inquiry. Still, it appears, at the least, to be an acknowledgment that the investigation is unlikely to end anytime soon.

The story admitted that Flood had said no to a similar offer last summer, at such time when Flood might have set the legal strategy and established ground rules for his client.

As recently as the summer, Mr. Flood, who currently works at the law firm Williams & Connolly, turned down an opportunity to represent Mr. Trump. It is not clear what has changed since then.

It also claimed that Flood was the only lawyer the White House had approached.

Mr. Flood had been on the wish list of some of the president’s advisers to join his legal team last year, and he is the only person the White House has been in contact with about such a leading role.

It also included the bizarre notion that Ty Cobb’s job was meant to end as soon as the White House had turned over all the documents Robert Mueller wanted.

Mr. Cobb has told friends for weeks that he views his position as temporary and does not expect to remain in the job for much longer.

Mr. Cobb’s primary task — producing documents for Mr. Mueller and arranging for White House aides to meet with prosecutors — is largely complete.

MARCH 19: JOSEPH DI GENOVA
Then, on Monday, Maggie and Mike reported that Joseph Di Genova would join the team. The former US Attorney wouldn’t actually be lawyering so much as pounding the table and inventing conspiracy theories (best as I can tell, pounding tables is supposed to be Trump’s current lawyer, Jay Sekulow’s job, but he seems to have taken to hiding under the bed of late).

Mr. diGenova, a former United States attorney, is not expected to take a lead role. But he will serve as an outspoken player for the president as Mr. Trump has increased his attacks on the special counsel, Robert S. Mueller III. Mr. Trump broke over the weekend from the longstanding advice of some of his lawyers that he refrain from directly criticizing Mr. Mueller, a sign of his growing unease with the investigation.

It’s just as well that Di Genova wouldn’t be doing any lawyering given that in 1997, he argued that sitting presidents could be indicted, a view that would make it easier for Mueller to charge his supposed client.

Somehow, this story didn’t explain a big puzzle about the hiring: how Di Genova could represent the president when his wife, Victoria Toensing, has represented three other people in the investigation, at least one of whom gave apparently damning testimony to Mueller’s investigators.

Mr. diGenova is law partners with his wife, Victoria Toensing. Ms. Toensing has also represented Sam Clovis, the former Trump campaign co-chairman, and Erik Prince, the founder of the security contractor Blackwater and an informal adviser to Mr. Trump. Mr. Prince attended a meeting in January 2017 with a Russian investor in the Seychelles that the special counsel is investigating.

Ms. Toensing also represents Mark Corallo, the former spokesman for the Trump legal team who has accused one of the president’s advisers of potentially planning to obstruct justice with a statement related to a 2016 meeting between Donald Trump Jr. and a Russian lawyer who supposedly had damaging information on Hillary Clinton.

While it’s certainly possible Di Genova could clear up the conflict with Clovis and Prince, Corallo reportedly testified that Hope Hicks, having met one-on-one with Trump, suggested that emails regarding the June 9, 2016 meeting could be buried.

MARCH 20: TED OLSON
Then, today, multiple outlets claimed that Ted Olson was under consideration. That’d be weird, given that Trump wants to claim that Robert Mueller has conflicts on account of his association with Jim Comey, yet Olson was as integrally involved in the most famous Comey-Mueller event — the hospital hero challenge to Stellar Wind in 2004 — as Mueller was. Plus, Olson’s name is on the Supreme Court precedent that deemed even the more expansive special prosecutor statute constitutional.

Which is to say that Olson may be the best active Republican lawyer with the possible exception of his former deputy, Paul Clement (hey, why isn’t Clement being floated?), but it’s not clear he would help Trump much, even if he could get Trump to follow instructions.

Yet the pushback from Olson’s firm suggests he was never really considering this offer (which raises questions about whether Flood, who like Olson also considered and rejected the position last year, is taking this offer any more seriously). It seems Trump wants to create the appearance, at least, that serious lawyers will still consider representing him.

TRUMP’S EXISTING LAWYERS PREPARE TO BOLT
As it turns out, Trump didn’t tell his existing lawyers about a number of these conversations. And even aside from the shit shingle they’re facing, particularly as it becomes clear to Trump they were lying to him all last year about how long this inquiry would be and how serious Trump’s jeopardy is, they’re all getting tired babysitting the president.

The hiring of diGenova on Monday, first reported by the New York Times, infuriated Dowd, who responded angrily to the development, according to people familiar with his reaction, who spoke on the condition of anonymity to share internal details. Dowd views diGenova as pushing him to be the second chair rather than top dog on Trump’s legal team, these people said. But Dowd said in an email to a Post reporter that he’s perfectly happy with the new addition: “Love Joe.”

Dowd, however, has lost the confidence of many in the president’s orbit, both inside and outside the White House. In December, after Trump tweeted that he had fired his former national security adviser Michael Flynn because Flynn had lied to both the vice president and the FBI, Dowd later claimed that he was the one who had drafted the missive.

One outside adviser described Dowd as “the weakest link” in the team.

McGahn and Cobb have also had their share of tension. While Cobb has urged the president to cooperate with Mueller and hand over documents to his investigators, McGahn has pushed a more aggressive approach, according to people familiar with his work.

McGahn has said the legal team should make the special counsel subpoena every document, explain every interview and fight for every piece of information, one person said. A second White House aide said McGahn has questioned the constitutional status of the special counsel position.

But McGahn and Trump have also clashed repeatedly since entering the White House, and one former administration official said the president mused at least three times that perhaps he should hire a new counsel.

McGahn has told associates that he is exhausted and frustrated at times in the job, but that he has been able to make a historic impact on appointing judges and reducing regulations and that he would like to be around for a second Supreme Court opening, one friend said. McGahn also has a strong relationship with Kelly.

So Trump’s lawyers (with the possible exception of Don McGahn, who’ll stay so long as he can pack the courts with unqualified ideologues) want out, and none of the real lawyers he’s approaching want to have anything to do with him.

When Rick Gates ran his defense team like this, he had a way out: to flip on Paul Manafort and Trump himself.

But who will Trump flip on? Vladimir Putin?

This is the most remarkable thing to behold. The most powerful man in the world is having difficulties getting anyone but a washed out table-pounder to represent him in the most high profile investigation in recent years.
https://www.emptywheel.net/2018/03/20/i ... like-hell/

More
Wonder how many of the 17 + 1 lawyers in Robert Mueller's office managed to suppress a smirk when they read this?


https://www.nytimes.com/2018/03/22/us/p ... &smtyp=cur

Only Ryan and McConnell Can Pen in Tyrannosaurus Trump
Somebody needs to scream in the president’s face that if he fires Mueller, he will go down in disgrace. And we know who that somebody needs to be.

Rick Wilson
03.22.18 5:25 AM ET
Of course, he’s going to fire Mueller.

Of course, it’s going to trigger a constitutional crisis.


Of course, Republicans will do nothing.

Every single day, Tyrannosaurus Don tests the limits of his enclosure. Every day, he pushes against the walls, looking for weak spots and for places where the electric fence isn’t working. Outside, the zookeepers in this Jurassic political park toss a cow carcass over the wall, praise their big boy dino, and marvel how large his fingers look. They smile and congratulate themselves that they’ve appeased the monster for another day, managing its violent, ravenous urges.

The beast never rests, though. It’s never satisfied with boundaries, limits, laws, or traditions. Every day, Trump wants what he wants, even if it destroys everything around him. What he wants right now is to fire special counsel Robert Mueller, end the Russia investigation, and prevent his allies, friends, and family members from being sent to the Graybar Hotel and his legacy to the dustbin of history.

Republicans who believe firing Mueller will change the political dynamic and free Trump to do whatever the hell they think he’d do without the special counsel on the scene are dreaming. Trump is already permanently stained, a president with an asterisk next to his name, a joke, a con, and a political poison that’s devouring their campaigns and their legacies. Even the White House clown bus of mooks, slowcoaches, edge case cranks, and kissers of his double-wide backside seem to understand more than the GOP in Congress; he’s crazier than a rat in a septic tank, and only Congress has any power over his behavior.


The Trump signals that he’s going to fire Robert Mueller need a more real, vigorous, and blunt response than any member of the House or Senate has yet provided. For being such fans of the Constitution, Republicans seems to have forgotten they’re in a co-equal branch of government and swore an oath to protect the Constitution from all enemies, foreign and domestic. Dismissing the special counsel in the middle of an investigation of foreign interference, obstruction of justice, and ties to hostile foreign powers isn’t just reckless; it’s politically idiotic.

I understand the argument that both Speaker Ryan and Leader McConnell need to calibrate their remarks to stay in the middle of the sentiment of their respective caucuses. Paul Ryan knows the Trump-hadis, yahoos, InfoWars conspiracy fanboys (looking at you, Matt Gaetz), dead-enders, and political anarchists on his right flank are restive, worrisome, and would stone him to death in a hot minute if Trump asked them to do so. In the center of the GOP caucus, the sense of doom is so thick you can cut it with a knife. For McConnell, his crafty, baroque mental calculus is less clear, but with Jeff Flake and John McCain headed out the door, he’s left with almost no one willing to publicly stand up and take on this president. For all that, both men are on the hot seat this week as Trump edges closer to Muellerdämmerung.


McConnell’s statement on Tuesday was a Rorschach test. Some praised it for being a clear signal, and it was to the D.C. media. For Trump? Not as much.

“Bob Mueller should be allowed to finish his job. I think it was an excellent appointment. I think he will go wherever the facts lead him and I think he will have great credibility with the American people when he reaches the conclusion of this investigation. So I have a lot of confidence,” McConnell said. “This is a thoroughly credible individual, I think it was an appropriate appointment, and we all anticipate his finishing the job and telling the American people what they need to know about this episode.”

Ryan’s statement on Mueller was deeply embarrassing. “I received assurances that his firing is not even under consideration,” said the speaker of the House, before noting he had to get back and reply to an urgent email from a Nigerian prince, finalize a bridge purchase, and order some totally legit Viagra from ReelMedz4U.ru.

My first response was, “Are you kidding me?” For this president, these statements didn’t even rise to the level of a mild, hypothetical caution, much less a reprimand. Just as a rat can crawl into spaces that seem impossibly tight, Trump looks at these elliptical, subtle signals as a sign he can fire Mueller and get away with it.

In Trump’s mind, their statements were nothing. They weren’t warnings; they were permission slips.

Donald Trump isn’t subtle. He isn’t strategic. He needs to be told in vivid, sharp, clear words, “If you do this, you’re going to be impeached, dragged hard, humiliated, investigated, have your taxes made public, pictures of your junk on poster boards as we discuss porn star payoffs on the Senate floor.” He needs to hear it loud and clear; “We know you’ve already wrecked our chances of holding the majority, but we’re not letting you drag the country down with us.”

The way to accomplish this is by passing legislation that protects the special counsel from Trump’s obstruction and tampering. The chances of that are roughly the same as me waking up tomorrow 50 pounds lighter and with a full mane of luxurious golden hair.

Understanding how to contain Donald Trump isn’t complicated. In every single domain of his entire life, Donald Trump is a cheater. This isn’t ad hominem. It’s documented fact in every part of his career in business, marriage, and politics. He will take advantage of any leeway, loophole, gullibility, or porn starlet he sees.

Donald Trump views red lines as green lights. The transgressive, disruptive nature of Trump is beloved by his base, and by an army of formerly conservative writers now eagerly fluffing the president’s rampant statism, corruption, and obstruction. They desperately want the narrative to become, “Donald the Magnificent girds his loins, defeats Mueller and evil sorceress Hillary in single combat, as bountiful harvests and happy peasants follow. Bards sing his praises for a thousand years.”

Even if Republicans believe Mueller ought to be fired, and hate him for being the skunk at the garden party of Trumpism, their political fortunes rest in part on whether voters see them as accomplices to a lawless, dishonest, corrupt president. If Trumpism is so powerfully hypnotic that they put their political survival after this president’s whims, I suppose they’re beyond counsel and help, but it hasn’t stopped me from trying.

For over a year, I have warned members of House and the Senate that Trump’s erratic behavior, shitbird affect, Putin-philia, moronic economic beliefs, hair-trigger temper, evident political disloyalty, and grunting, reckless dick-swinging bravado would rebound on them, and hard. The things Trump does please a narrow base repel everyone else. Trump voters are loyal to Trump, not to the GOP and certainly not to its members. Other Republicans take all the damage and reap none of the benefits.

In race after race, we’ve seen the future, and for Republicans, it’s dark. I’ve warned Republicans before he is driving an electoral and demographic wedge in American politics we can’t easily overcome, and imposing on the party a suite of problems no amount of money or Democratic Party campaign incompetence will solve.

The idea that the tax bill would save the GOP is so three months ago. It won’t. Trump has consumed the political space like a hungry singularity, dragging every issue, every policy, every one of the precious, focus-grouped “this’ll work” message points into the well of his entropic gravity. Firing Mueller will set off a chain of political consequences so far-reaching, and a crisis so sharp that Republicans will be marked by it for generations in the political wilderness. This will make 1974 look like high tea.

Trump repays loyalty with betrayal, obedience with abuse, and compliance with humiliation. Inaction, silence, acquiescence on firing Mueller and the political firestorm to follow is inevitable unless Paul Ryan and Mitch McConnell personally step up, give Trump a clear warning even the slowest president in modern history could understand, and pass legislation to protect the special counsel’s work.
https://www.thedailybeast.com/only-ryan ... urus-trump

Of course, it’s going to trigger a constitutional crisis.

Jason Leopold

REUPPING as I'm pretty confident more details will be disclosed soon.

Investigators Are Scrutinizing Newly Uncovered Payments By The Russian Embassy
US authorities are poring over hundreds of newly uncovered payments from Russian diplomatic accounts. Among them are transactions by former ambassador Sergey Kislyak 10 days after the 2016 presidential election and a blocked $150,000 cash withdrawal five days after the inauguration.

Posted on January 17, 2018, at 7:47 a.m.
Jason Leopold

BuzzFeed News Reporter
Anthony Cormier

Nico Ortega for BuzzFeed News
Officials investigating the Kremlin’s interference in the 2016 US presidential election are scrutinizing newly uncovered financial transactions between the Russian government and people or businesses inside the United States.

Records exclusively reviewed by BuzzFeed News also show years of Russian financial activity within the US that bankers and federal law enforcement officials deemed suspicious, raising concerns about how the Kremlin’s diplomats operated here long before the 2016 election.

Special counsel Robert Mueller’s team, charged with investigating Russian election interference and possible collusion by the Trump campaign, is examining these transactions and others by Russian diplomatic personnel, according to a US official with knowledge of the inquiry. The special counsel has broad authority to investigate “any matters” that “may arise” from his investigation, and the official said Mueller’s probe is following leads on suspicious Russian financial activity that may range far beyond the election.

The transactions reveal:

One of the people at the center of the investigation, the former Russian ambassador to the US Sergey Kislyak, received $120,000 ten days after the election of Donald Trump. Bankers flagged it to the US government as suspicious in part because the transaction, marked payroll, didn’t fit prior pay patterns.

Five days after Trump’s inauguration, someone attempted to withdraw $150,000 cash from the embassy’s account — but the embassy’s bank blocked it. Bank employees reported the attempted transaction to the US government because it was abnormal activity for that account.

From March 8 to April 7, 2014, bankers flagged nearly 30 checks for a total of about $370,000 to embassy employees, who cashed the checks as soon as they received them, making it virtually impossible to trace where the money went. Bank officials noted that the employees had not received similar payments in the past, and that the transactions surrounded the date of a critical referendum on whether parts of Crimea should secede from Ukraine and join Russia — one of Vladimir Putin’s top foreign policy concerns and a flash point with the West.

Over five years, the Russian Cultural Centre — an arm of the government that sponsors classes and performances and is based in Washington, DC — sent $325,000 in checks that banking officials flagged as suspicious. The amounts were not consistent with normal payroll checks and some transactions fell below the $10,000 threshold that triggers a notice to the US government.

The Russian Embassy in Washington, DC, sent more than $2.4 million to small home-improvement companies controlled by a Russian immigrant living not far from there. Between 2013 and March 2017, that contractor’s various companies received about 600 such payments, earmarked for construction jobs at Russian diplomatic compounds. Bankers told the Treasury they did not think those transactions were related to the election but red-flagged them because the businesses seemed too small to have carried out major work on the embassy and because the money was cashed quickly or wired to other accounts.

Each of these transactions sparked a “suspicious activity report” sent to the US Treasury’s financial crimes unit by Citibank, which handles accounts of the Russian Embassy. By law, bankers must alert the government to transactions that bear hallmarks of money laundering or other financial misconduct. Such reports can support investigations and intelligence gathering — but by themselves they are not evidence of a crime, and many suspicious activity reports are filed on transactions that are perfectly legal. Intelligence and diplomatic sources who reviewed the transactions for BuzzFeed News said there could be justifiable uses for the money, such as travel, bonuses, or pension payouts.

The Treasury Department turned over the suspicious activity reports to the FBI after the bureau asked for records that might relate to the investigation into the election, according to three federal law enforcement officials with knowledge of the matter. The bureau did not respond to requests for comment on what, if anything, it has done to investigate the transactions.

Got a tip? You can email tips@buzzfeed.com. To learn how to reach us securely, go to tips.buzzfeed.com.
The Senate Intelligence Committee, which is conducting its own investigation into the election, requested suspicious activity reports on former ambassador Kislyak as far back as August. It is unclear whether senators have received those documents yet. The top Republican and Democrat on the committee each declined to comment.

“All the transactions which have been carried out through the American financial system fully comply with the legislation of the United States,” said Nikolay Lakhonin, a spokesperson for the Russian Embassy. “We are not going to comment on any concrete names and figures mentioned in BuzzFeed articles.” He added, “We see such leaks by US authorities as another attempt to discredit Russian official missions.”


Kislyak, through a spokesperson, declined to comment. The home improvement contractor said all the payments he received were aboveboard for legitimate work.

A Citibank spokesperson said the bank would not comment or confirm any particular report because they are confidential. “Consistent with our commitment to protect the integrity of the financial system,” wrote Jennifer Lowney, the spokesperson, “Citi is diligent in filing Suspicious Activity Reports with the US Treasury Department when appropriate.”

Sergei Kislyak
Stanislav Krasilnikov / TASS / Getty Images
Sergei Kislyak

An ambassador at the center of Washington

Former ambassador Kislyak left the US in 2017 and now serves in the legislature of the Republic of Mordovia, which is part of Russia. But his contacts with people in Trump’s inner circle have shaken the administration.

Attorney General Jeff Sessions recused himself from the Russia investigation largely because he failed to mention a Kislyak meeting when he was confirmed.

Jared Kushner, the president's son-in-law and adviser, drew criticism after he discussed setting up a secure communications channel at the Russian Embassy with Kislyak during the transition.

And Michael Flynn, the former national security adviser, pleaded guilty last year to lying to the FBI about multiple calls with Kislyak during the transition, one of which Kushner apparently asked him to make.

Now, according to the US official with knowledge of Mueller’s inquiry, the special counsel’s team is examining two financial transactions from Kislyak’s final weeks in the US.

The first occurred on Nov. 18, 10 days after Americans went to the polls. The Russian embassy sent $120,000 to Kislyak’s personal bank account, marked for “payroll.” Employees at Citibank raised an alarm about the transaction because it didn’t fit with prior payroll patterns and because he immediately split the money in half, sending it by two wire transfers to a separate account he maintained in Russia.


BuzzFeed News
Then on Jan. 25, five days after Trump was inaugurated, someone attempted to withdraw $150,000 in cash from an embassy account. Citibank officials blocked that transaction. It is not clear why bankers stopped the withdrawal, but they flagged the attempt to the government as suspicious. Treasury officials then sent it on to the FBI, according to the three law enforcement sources with knowledge of the matter.

Kislyak, a nuclear scientist who became ambassador in 2008, was an affable figure in Washington who was known to throw lavish parties, including a 2010 bash with edible Fabergé eggs, baton twirlers, and a guest list that included a US Supreme Court justice and at least two senators.

As Russia annexes Crimea, checks get cashed

Now authorities appear to be digging into the entire Russian diplomatic corps operating in the US, with bank records dating back 10 years that show financial conduct flagged as suspicious. The official with knowledge of Mueller’s probe said it is examining a wide range of financial behavior by Russian diplomats.

One of Putin’s main strategic goals was the annexation of Crimea from Ukraine, key to controlling the Black Sea and home to a large Russian naval base. He accomplished the takeover on March 18, 2014, two days after a widely disputed Crimean referendum in favor of joining Russia.

Around that critical period, from March 8 to April 7, 2014, Citibank officials flagged nearly 30 checks totaling about $370,000 to Russian Embassy employees, including military attachés, living in Washington. The checks, which were for nearly identical amounts, were all cashed as soon as they were received.


BuzzFeed News
Bank officials noted that the employees had not received similar payments in the past, and that the timing of the transactions matched that of the Crimean referendum.

The embassy would not say what the money was used for. Capt. Vyacheslav Khlestov, in charge of the Russian Office of the Defense, Military, Air, and Naval Attachés, did not return an email seeking comment. Even though the transfers were first noted by American officials in 2014, it is not clear whether the Treasury Department or the FBI took further action to investigate.


But it wouldn’t be the last time a diplomatic financial transaction raised alarms.

In August of that year, Alexey Voronov, an assistant air attaché, made a cash deposit of $44,000 in his account and then sent the money to an unknown individual. Voronov did not return emails seeking comment.

The Russian Consulate in New York City
Ben King / BuzzFeed News
The Russian Consulate in New York City
In the fall of 2015, bankers noted deposits into an account identified as “Russian Cultural Center in New York.” No such entity could be found in public filings, but the banking records show its address as 9 East 91st Street in New York, the same address where the Russian Consulate General is located. The phone number listed in banking records is disconnected. Bankers noted that the cash deposits appeared to be “structured,” which means they were separated into small amounts that seemed designed to stay under the $10,000 daily threshold that would trigger an alert to authorities. For example, in a single afternoon, someone made ATM cash deposits into the “Russian Cultural Center in New York” account of $5,000, $4,400, and $600.

Bank employees also raised alarms about payments to a home improvement contractor. They reported that his companies didn’t appear to have the capacity to perform large construction projects such as those at the embassy.

Bankers flagged to the Treasury Department’s financial crimes unit about 600 payments from the Russian Embassy to this contractor’s companies. The bankers found that those transactions did not appear connected to the presidential campaign but that they were suspicious for other reasons. For example, a company controlled by the contractor received multiple checks from the Russian Embassy for a total of about $320,000; he then withdrew cash in amounts below the level that would have triggered an alert to government watchdogs.


BuzzFeed News
The Treasury, in turn, reported the transactions to the FBI, according to a law enforcement report shared with the bureau. The FBI declined to comment on what, if anything, it did with the information.


The contractor said the payments were normal for a small business like his and he had no idea why investigators would think the transactions were suspicious. He explained that he used multiple accounts at different banks to pay workers, vendors, and suppliers, and that he often deposited money in one account and immediately transferred it to another to make payments.

The contractor and his wife registered a computer company in the greater Washington, DC, area in June 2016. There is little else publicly available about this company, which was dissolved in late 2016. The contractor said the company sold computers to businesses and estimated the firm made only $400 in revenue during its brief life.

The Senate Intelligence Committee’s investigation

For the past five months, the bipartisan leadership of the Senate Intelligence Committee has been trying to get records on any financial transactions involving Kislyak that the Treasury Department may have. It is unknown if they have received them or not.

In August, the committee sent a letter to the Treasury’s financial crimes unit requesting any suspicious activity reports or other “derogatory notification” the Treasury might have received from financial institutions on the former ambassador, as well as more than 30 other people and entities. The August letter, signed by the committee’s top Republican and Democrat, also asked for any records that the Treasury may have provided to the FBI, the intelligence community, and the Office of the Special Counsel.

The committee’s letter does not indicate that any financial institution has actually issued reports or other notifications to the Treasury about any of the people or entities named in the letter, or that the Treasury actually has records about them.

The senators made it clear they wanted the Treasury to turn over whatever records it might have to the committee before handing them over to special counsel Mueller.

“It is our expectation that these documents will be provided directly to the Committee, without pre-review by any outside entities, including the Office of Special Counsel,” said the letters, marked “committee sensitive,” meaning they are not intended to be made public. “Treasury is free to provide a copy of any documents provided to the Committee to the Office of Special Counsel for review in parallel to production to the Committee, but these documents should not be provided to the Office of Special Counsel prior to receipt by the Committee.”

In a follow-up letter sent in December, the committee leaders asked again for any records, as well as information that the Treasury might have on still more people. “We trust that your staff is working to provide those documents as soon as possible,” Sen. Richard Burr, a Republican and the committee’s chair, and Sen. Mark Warner, the ranking Democrat, wrote.

Sen. Mark Warner (left) and Sen. Richard Burr
Bill Clark / CQ-Roll Call,Inc.
Sen. Mark Warner (left) and Sen. Richard Burr
It is not clear why the Treasury had not fulfilled the original request for almost four months. “We generally refrain from providing specifics on requests related to committee investigations,” a spokesperson for the department said.

But the committee’s letters — not previously made public — raise a curtain on its secret investigation.


The senators requested financial information that the Treasury may have on a total of 45 people or entities. While most of the names in the Senate letters have been mentioned publicly in connection with the Trump–Russia investigation, at least three have not.

The committee also asked for financial information, if the Treasury has any, on Ivan Tavrin, a Putin ally who is the chief executive at telecom giant MegaFon and has a stake in the Russian social media site VKontakte. And the senators sought any records the Treasury might have on Bob Foresman, who once ran the Russia desk at Barclays bank and was in charge of Renaissance Capital, a Moscow-based investment firm. No suspicious activity reports on Tavrin or Foresman have been located, according to two law enforcement officials.

Got a tip? You can email tips@buzzfeed.com. To learn how to reach us securely, go to tips.buzzfeed.com.
The senators also requested any records on Alisher Usmanov, one of the richest men in Russia and a close ally of President Putin. He has majority control of the Russian social media site VKontakte and was an investor in Facebook.

It is not known why the committee is seeking records on these individuals, and they did not return messages asking for comment.

In its December letter, the committee also asked for documents “connected in any way to funds, sent from Russia or Russian banks, that are designated to ‘finance election campaign of 2016.’”

That request came after BuzzFeed News reported in November that the FBI had been investigating those transactions. Almost 60 such transfers were flagged as suspicious after they were sent by the Russian foreign ministry to embassies across the globe, including nearly $30,000 to the compound in Washington.

Russian officials labeled the BuzzFeed News story “propaganda” and said the money, which totaled almost $380,000, was used to help Russian nationals living overseas vote in their country’s parliamentary election held last year.

https://www.buzzfeed.com/jasonleopold/n ... gkKdPXPML0

BURIED AMID THE JOHN DOWD NEWS, MUELLER’S TEAM SEEMS TO THINK TRUMP KNOWS ABOUT THE JUNE 9 MEETING

March 22, 2018/0 Comments/in 2016 Presidential Election, Mueller Probe /by empty wheel

I didn’t get a chance to unpack this story before John Dowd up and resigned. It lays out the four areas that Dowd was, until yesterday, negotiating with Mueller’s office regarding Trump’s testimony. It actually provides less detail than the WaPo and CNN stories I covered here. Those stories laid out that Mueller’s team was asking specific questions about:

Flynn’s Firing

Whether Trump knew about Flynn’s communications with Russian Ambassador Sergey Kislyak during the presidential transition?

What instructions, if any, the president gave Flynn about the contact?Whether he fired Flynn because he had misled Vice President Pence about his contact with Kislyak?

Comey’s Firing

Whether he fired Comey because he had mishandled an investigation of Democratic presidential candidate Hillary Clinton?

What was Attorney General Jeff Sessions’ involvement in the Comey dismissal?

While far less detailed than those earlier articles, however, yesterday’s pre-Dowd departure story describes Mueller’s team asking questions about four areas (I’ve reordered these to make them chronological):

1.The circumstances surrounding [the June 9, 2016] Trump Tower meeting

2. The President’s role in crafting a statement aboard Air Force One that miscast Donald Trump Jr.’s campaign June 2016 meeting with Russians in Trump Tower

3. The firing of national security adviser Michael Flynn

4. The firing of FBI Director James Comey

It was this focus, according to CNN, that pissed Trump off because,

The focus on Trump himself in Mueller’s pursuits has alarmed and angered the President, who adhered to a legal strategy of holding back set by his attorney John Dowd and White House special counsel Ty Cobb, who have said for months the investigation was likely to conclude soon.

And now Dowd is gone and Ty Cobb is reportedly likely to follow him, to be replaced by table-pounders who will make noise rather than argue the facts.

Bullet 1 — seven words slipped into the CNN story between stuff we’ve long talked about Trump’s involvement in — ought to be blaring headlines.

BREAKING: “Robert Mueller’s prosecutors are going to ask the President about the circumstances surrounding the meeting at which some Russians, including representatives from Trump’s old business associate Aras Agalarov, pitched Junior, Jared, and Trump’s corrupt campaign manager, on dirt about Hillary in the context of relaxing sanctions,” the headline should have read.

Call me crazy. But I doubt Mueller’s team would ask the President about this unless they had reason to believe Trump knew something about it.

And that changes the import of the three other bullets dramatically.

For example, most people have assumed Bullet 2, Trump’s claim this meeting pertained to adoptions and not dirt-for-sactions, is about obstruction charges (Elizabeth de la Vega lays out how that might serve as the basis for one or another conspiracy charge here). But that ignores that Trump spent the weekend leading up to that statement meeting, twice, with Vladimir Putin, including that bizarre meeting over dinner with no babysitter right before the White House released the statement.

BREAKING: The President met twice with Vladimir Putin while he was taking the lead on responding to questions about a meeting we’re all pretending Trump knew nothing about, and then came out with the spin that Vladimir Putin would most likely give it, the designated Russian propaganda line to cover up its campaign against Magnitsky sanctions.

Which brings us to Bullet 3: Whether Trump (via KT McFarland serving as a go-between from Mar a Lago) ordered Flynn to ask Sergey Kislyak to hold off on responding to sanctions, and if so, why he fired Flynn for doing what he told him to do.

Trump surely didn’t fire Flynn because he lied to Mike Pence (if indeed he did lie). Did he fire Flynn because he didn’t lie about it, making an otherwise marginally legally problematic discussion a legally problematic issue? Or did he fire Flynn because he believed it was the most efficacious way to make the focus on his efforts to roll back sanctions on Russia go away?

Bullet 4. Mueller’s prosecutors want to know why, a day before the Russians showed up for a meeting at which Trump refused to have US press, Trump fired Comey, and then told the Russians,

“I just fired the head of the F.B.I. He was crazy, a real nut job,” Mr. Trump said, according to the document, which was read to The New York Times by an American official. “I faced great pressure because of Russia. That’s taken off.”

Mr. Trump added, “I’m not under investigation.”

Laid out like this, this is what Mueller’s four bullets might look like:

1. What Trump knew about the dirt-for-sanctions relief deal his one-time business partner Aras Agalarov pitched

2. Whether Trump gave his National Security Adviser orders to deliver that dirt-for-sanctions deal even before being inaugurated

3.Why Trump fired Flynn if he was following his orders delivering on that dirt-for-sanctions deal

4. What Trump meant when he said he fired Comey because firing him took care of the great pressure he had because of Russia

Even as Mueller was negotiating these four questions, Trump called up Putin, at which, according to the Kremlin, “It was agreed to develop further bilateral contacts in light of [the fact that Trump had just fired Rex Tillerson, the next guy standing in the way of fulfilling the dirt-for-sanctions relief deal]. The possibility of organizing a top-level meeting received special attention.” “We will probably get together in the not-too-distant future,” Trump said of the call on Tuesday. “I suspect that we’ll probably be meeting in the not-too-distant future,” he said a second time, a line that reportedly surprised his aides, another piece of news lost in the legal team shake-up. “I think, probably, we’ll be seeing President Putin in the not-too-distant future,” Trump said a third time in his public comments.

So now Dowd is gone, which is probably lucky for him because otherwise he’d be business negotiating over

Bullet 5.

5. Why did Trump fire Rex Tillerson and how does that relate to this big new push to meet with Putin again?

https://www.emptywheel.net/2018/03/22/h ... 9-meeting/

Stormy Daniels lawyer plans to subpoena Trump Org and bank records: report
BY JOSH DELK - 03/22/18 02:10 PM EDT 281

Stormy Daniels lawyer plans to subpoena Trump Org and bank records: report

An attorney representing the former adult film star suing President Trump over a nondisclosure agreement covering their alleged affair filed requests to the Trump Organization and two banks on Thursday to preserve all records pertaining to a nondisclosure payment to the actress.

Attorney Michael Avenatti sent requests to the president's family business and two banks involved in the $130,000 payment initiated by Trump's attorney Michael Cohen to porn star Stormy Daniels, whose real name is Stephanie Clifford, as part of a nondisclosure agreement, NBC News reported.

"We request that you immediately preserve all evidence, documents, tangible things and electronically stored information ("ESI") potentially relevant to the claim," Avenatti said in the statement to the three entities, according to the report.

The requests are the first step to subpoenaing the records for the ongoing legal case, Avenatti indicated.

Though Cohen has claimed he paid Daniels out of his own pocket and was not reimbursed by the Trump Organization, Avenatti cited "unmistakable links" between the company and the payment, including Cohen's use of his Trump Organization email in dealings with the bank that facilitated the wire transfer.

Avenatti requested that First National Bank and City National Bank, the banks that sent and received the payment from Cohen, preserve all records and documents related to the payment.

"Failure to do so may subject you to liability," Avenatti warned City National Bank in the letter.

The attorney also demanded that the Trump Organization preserve all internal communications and financial records pertaining to the matter, and indicated interest in communication from February "whereby Mr. Cohen attempted to interfere with Ms. Clifford/Daniels' ability to hire new counsel (i.e. Michael Avenatti)."

Cohen, whom the White House has suggested made the payment without Trump's knowledge, also claims that the payment made just one month before the election in 2016 had nothing to do with the president's campaign.

The adult film star, is now suing for the ability to share details of the affair she said she had with Trump in 2006, which was after he married first lady Melania Trump.

The agreement, she says, is not legally binding because Trump never personally signed it.
http://thehill.com/homenews/administrat ... -to-retain

GRU’D UP
EXCLUSIVE: ‘Lone DNC Hacker’ Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer
Robert Mueller’s team has taken over the investigation of Guccifer 2.0, who communicated with (and was defended by) longtime Trump adviser Roger Stone.

SPENCER ACKERMAN
KEVIN POULSEN
03.22.18 7:00 PM ET
Guccifer 2.0, the “lone hacker” who took credit for providing WikiLeaks with stolen emails from the Democratic National Committee, was in fact an officer of Russia’s military intelligence directorate (GRU), The Daily Beast has learned. It’s an attribution that resulted from a fleeting but critical slip-up in GRU tradecraft.

That forensic determination has substantial implications for the criminal probe into potential collusion between President Donald Trump and Russia. The Daily Beast has learned that the special counsel in that investigation, Robert Mueller, has taken over the probe into Guccifer and brought the FBI agents who worked to track the persona onto his team.

While it’s unclear what Mueller plans to do with Guccifer, his last round of indictments charged 13 Russians tied to the Internet Research Agency troll farm with a conspiracy “for the purpose of interfering with the U.S. political and electoral processes, including the presidential election of 2016.” It was Mueller’s first move establishing Russian interference in the election within a criminal context, but it stopped short of directly implicating the Putin regime.

Mueller’s office declined to comment for this story. But the attribution of Guccifer 2.0 as an officer of Russia’s largest foreign intelligence agency would cross the Kremlin threshold—and move the investigation closer to Trump himself.

“The attribution of Guccifer 2.0 as an officer of Russia’s largest foreign intelligence agency brings the investigation closer to the Kremlin’s doorstep—and to Trump himself.”
Trump’s longtime political adviser Roger Stone admitted being in touch with Guccifer over Twitter’s direct messaging service. And in August 2016, Stone published an article on the pro-Trump-friendly Breitbart News calling on his political opponents to “Stop Blaming Russia” for the hack. “I have some news for Hillary and Democrats—I think I’ve got the real culprit,” he wrote. “It doesn’t seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 2.0.”


Five months later, in January 2017, the CIA, NSA, and FBI assessed “with high confidence” that “Russian military intelligence (General Staff Main Intelligence Directorate or GRU) used the Guccifer 2.0 persona and DCLeaks.com to release US victim data.” But the assessment did not directly call Guccifer a Russian intelligence officer. Nor did it provide any evidence for its assertions.

It turns out there is a powerful reason to connect Guccifer to the GRU.

Guccifer 2.0 sprang into existence on June 15, 2016, hours after a report by a computer security firm forensically tied Russia to an intrusion at the Democratic National Committee. In a series of blog posts and tweets over the following seven months—conspicuously ending right as Trump took office and not resuming—the Guccifer persona published a smattering of the DNC documents while gamely projecting an image as an independent Romanian hacktivist who’d breached the DNC on a lark. As Stone’s Breitbart piece demonstrated, Guccifer provided Moscow with a counter-narrative for the election interference.


Guccifer famously pretended to be a “lone hacker” who perpetrated the digital DNC break-in. From the outset, few believed it. Motherboard conducted a devastating interview with Guccifer that exploded the account’s claims of being a native Romanian speaker. Based on forensic clues in some of Guccifer’s leaks, and other evidence, a consensus quickly formed among security experts that Guccifer was completely notional.

“Almost immediately various cyber security companies and individuals were skeptical of Guccifer 2.0 and the backstory that he had generated for himself,” said Kyle Ehmke, an intelligence researcher at the cyber security firm ThreatConnect. “We started seeing these inconsistencies that led back to the idea that he was created hastily… by the individual or individuals that affected the DNC compromise.”

Proving that link definitively was harder. Ehmke led an investigation at ThreatConnect that tried to track down Guccifer from the metadata in his emails. But the trail always ended at the same data center in France. Ehmke eventually uncovered that Guccifer was connecting through an anonymizing service called Elite VPN, a virtual private networking service that had an exit point in France but was headquartered in Russia.

“Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow.”
But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter.

Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. (The Daily Beast’s sources did not disclose which particular officer worked as Guccifer.)

Security firms and declassified U.S. intelligence findings previously identified the GRU as the agency running “Fancy Bear,” the ten-year-old hacking organization behind the DNC email theft, as well as breaches at NATO, Obama’s White House, a French television station, the World Anti-Doping Agency, and countless NGOs, and militaries and civilian agencies in Europe, Central Asia, and the Caucasus.

Timestamps in Guccifer 2.0’s first leaks show they were packaged for release over the course of a single day in June 2016, beginning just hours after the DNC intrusion and its attribution to Russia were made public. The moniker was an homage to Romanian hacker Marcel Lazăr Lehel, who as “Guccifer” achieved notoriety in 2013 for a string of hacks against celebrities and politicians.

In his inaugural blog post, Guccifer 2.0 disputed Russia’s involvement and claimed credit personally for the DNC breach, positioning himself as a one-time hacking operation working to expose “the Illuminati.” The post included the world’s first glimpse of the enormous cache of documents siphoned from the DNC’s network, including the Democrats’ opposition research report on Trump. Presaging the leaks that would roil the election, Guccifer 2.0 declared that he’d already sent the bulk of the stolen material to WikiLeaks—which has spent the time since obfuscating whether Guccifer was its source.

On July 22, 2016, WikiLeaks began releasing its cache of approximately 19,000 emails and 8,000 attachments stolen in the hack. While Trump promoted the leak on Twitter and in rallies, his surrogate Roger Stone pushed back against the Kremlin attribution. In his August 2016 article for Breitbart, he argued that Guccifer 2.0 was the Romanian hacktivist he claimed to be. “Guccifer 2.0 is the real deal,” he wrote.

Last May, Stone admitted that he’d also exchanged direct messages with the Guccifer 2.0 persona, and he released what he claimed was a complete transcript of his communications with the account. The transcript is brief and banal, showing Stone congratulating Guccifer 2.0 on returning to Twitter after a brief suspension, and then mostly ignoring him. Then and since, Stone has consistently denied that Guccifer was connected to the Kremlin.

“I myself had no contacts or communications with the Russian State, Russian Intelligence or anyone fronting for them or acting as intermediaries for them,” he wrote.

“I myself had no contacts or communications with the Russian State, Russian Intelligence or anyone fronting for them or acting as intermediaries for them.”
— Roger Stone
Guccifer 2.0 maintained a sporadic online presence throughout the election, posting to his dedicated WordPress blog and on Twitter, and spilling more DNC documents, sometimes in private emails to journalists.

While the national election clearly interested him (“Democrats prepare new provocation against Trump,” he thundered in October 2016), Guccifer 2.0 reached down the ballot as well, posting documents from the Democrats’ national campaign committee on his WordPress blog. There, readers could find internal Democratic candidate assessments relevant to battleground states like Pennsylvania and Florida; internal assessments of key congressional districts, with granular analyses of their demographics; and campaign recruitment material.

The GRU officer was eager to share this trove, as well. A GOP political operative in Florida, Aaron Nevins, DM’d Guccifer 2.0 a request for “any Florida based information” and received 2.5 gigabytes’ worth, according to The Wall Street Journal. The data, he enthused to Guccifer 2.0, was “probably worth millions of dollars.” A consultant for a successful Florida Republican congressional candidate told the paper, “I did adjust some voting targets based on some data I saw from the leaks.”

Sometime after its hasty launch, the Guccifer persona was handed off to a more experienced GRU officer, according to a source familiar with the matter. The timing of that handoff is unclear, but Guccifer 2.0’s last blog post, from Jan. 12, 2017, evinced a far greater command of English that the persona’s earlier efforts.

“It’s obvious that the intelligence agencies are deliberately falsifying evidence,” the post read. “In my opinion, they’re playing into the hands of the Democrats who are trying to blame foreign actors for their failure.”

(Contrast that with the language from a June 2016 post: “I made some conclusions from the Marcel’s story and decided not to put all eggs in one basket. Moreover, other cases weren’t so successful and didn’t bring me the glory.”)

Today the most popular counter-narrative surrounding Guccifer 2.0 concedes that the account was a fake persona but posits that it was created by the DNC to support a false-flag operation implicating Russia. In this theory, advanced in two widely cited anonymous blogs, Guccifer 2.0 was the DNC posing as Russia posing as a Romanian hacker.
https://www.thedailybeast.com/exclusive ... r?ref=home

THE DAILY BEAST GUCCIFER SCOOP AND THOSE GRU OFFICERS SANCTIONED LAST WEEK

March 22, 2018/6 Comments/in 2016 Presidential Election, Cybersecurity, emptywheel, Mueller Probe, Russian hacks /by emptywheel
The Daily Beast has a story reporting (in addition to the already reported news that the DNC hack got moved under Robert Mueller) that the person behind the Guccifer 2.0 persona “slipped up” once and failed to use the VPN hiding his location in the GRU headquarters in Moscow.

[O]n one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation.

The US identified which particular officer was behind the Guccifer persona.

Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow.

And then, according to TDB, the Guccifer persona was handed off to a more experienced GRU officer, with better English skills.

Sometime after its hasty launch, the Guccifer persona was handed off to a more experienced GRU officer, according to a source familiar with the matter. The timing of that handoff is unclear, but Guccifer 2.0’s last blog post, from Jan. 12, 2017, evinced a far greater command of English that the persona’s earlier efforts.

TDB’s sources did not reveal the name of the officer identified from the VPN “slip up.”

The Daily Beast’s sources did not disclose which particular officer worked as Guccifer.

But we may already know the name or names of the GRU officers involved. As I noted last week, Treasury added two names to the list of GRU officers sanctioned in conjunction with the DNC hack: Sergei Afanasyev and Grigoriy Viktorovich Molchanov. Both would actually be (very) experienced officers — they are 55 and 62. And both include very interesting “as of” dates identifying the last point when our intelligence officials identified their positions: February 2017 and April 2016, respectively.

The latter is of particular interest, as it came during the period when Guccifer 2.0 was setting up his infrastructure. But the government doesn’t know a ton about this guy — they know his birth year, but not his birth date, and possibly not even his passport information.

In any case, last week, the government revealed two new people it blames (and therefore sanctioned) for the DNC hack.

As TDB notes, the revelation that the government has tied Guccifer 2.0 to a known GRU officer is utterly damning for Roger Stone, who has admitted talking to him. But they don’t lay out how squirrelly Stone was in early March when trying to deny he was in trouble for his dalliances with Guccifer 2.0 and Wikileaks, which I laid out here.

In his response he does the following:

Raises doubts that he was actually talking to Guccifer 2.0 (even though Guccifer 2.0’s only identity was virtual, so Stone’s online interactions with any entity running the Guccifer Twitter account would by definition be communication with Guccifer 2.0)
Repeats his earlier doubts that Guccifer 2.0 is a Russian operative
Emphasizes that he couldn’t have couldn’t have been involved in any hack of the DNC Guccifer 2.0 had done because he first spoke to him six weeks after the email release (in reality, he was speaking to him three weeks after the Wikileaks release)
Admits he once believed Guccifer 2.0 did the hack but (pointing to the Bill Binney analysis, and giving it a slightly different focus than he had in September) claims he no longer believes that
Invents something about a WaPo report that’s not true, thereby shifting the focus to receiving documents (as opposed to, say, information)
Denies he received documents from anyone but not that he saw documents (other than the Wikileaks ones) before they were released
This denial stops well short of explaining why he reached out to Guccifer. And it does nothing to change the record — one backed by his own writing — that Stone reached out because he believed Guccifer, whoever he might be, had hacked the DNC.

At the time Stone reached out to Guccifer (as I pointed out, he misrepresented the timing of this somewhat in his testimony), he believed Guccifer had violated the law by hacking the DNC.

He never does explain to Todd why he did reach out.

Guccifer 2.0 never comes back in the remainder of the interview.

Just weeks ago, when his buddy Sam Nunberg was giving (potentially immunized) testimony to the grand jury, Stone was really really squirrelly about whether his conversations with Guccifer 2.0 put him at legal jeopardy. The confirmation of the GRU tie may provide one reason why he’s so squirrelly.

Update: As Kaspersky’s Aleks Gostev notes, Treasury should know far more on Sergei Afanasyev. RT publicly described him as Deputy Chief of GRU in April 2016. And Molchanov is, at least now, head of GRU’s academy.
https://www.emptywheel.net/2018/03/22/t ... last-week/

Confirmed: Trump confidante communicated with Russian intel during election
By Caroline Orr - March 22, 20182281

It may soon be Roger Stone's time in the barrel.

Guccifer 2.0, the hacker who claimed responsibility for providing WikiLeaks with a trove of emails hacked from the Democratic National Committee during the 2016 presidential campaign, has been conclusively identified as an officer working out of Russia’s military intelligence agency.

According to The Daily Beast, which reported on the explosive revelation late Thursday, FBI agents were able to identify that Guccifer 2.0 was working out of Russia’s military intelligence agency, GRU, when the hacker failed to activate their virtual private networking (VPN) service.

That seemingly minor slip-up exposed Guccifer 2.0’s IP address as one belonging to a specific GRU officer working out of the agency’s headquarters in Moscow.

While Guccifer 2.0 was long believed to be a front for Russian intelligence, Thursday’s report confirms that the hacker was working directly for a Russian intelligence operation under the control of Russian president Vladimir Putin.

Last January, Guccifer 2.0 denied having any connections to Russia, calling such reports a “crude fake.”

The Daily Beast also reported Thursday that special counsel Robert Mueller has taken over the investigation into Guccifer 2.0, teaming up with the same FBI agents who tracked down the hacker’s identity.

As Axios noted, “Special counsel Robert Mueller never explicitly implicated Russian President Vladimir Putin in his investigation. Connecting Guccifer to ‘Russia’s largest foreign intelligence agency’ would do exactly that.”

The new evidence confirming the true identity of Guccifer 2.0 has profound implications for the Russia probe and those involved in it — especially former campaign aide and longtime Trump confidante Roger Stone, who has admitted to exchanging direct messages on Twitter with Guccifer 2.0.

Stone, like many others in Trump’s inner circle, has tried to cast doubt on the U.S. intelligence community’s assessment that Russia was behind the DNC hack, claiming that Guccifer 2.0 was a creation of the DNC — and that the hack was secretly an inside job.

In a 2016 Breitbart article published just after he communicated with Guccifer 2.0, Stone admonished the U.S. intelligence community and demanded that people “Stop Blaming Russia” for the DNC leaks.

“I have some news for Hillary and Democrats,” he wrote. “I think I’ve got the real culprit. It doesn’t seem to be the Russians that hacked the DNC, but instead a hacker who goes by the name of Guccifer 2.0.”

In his messages with Guccifer 2.0, Stone asked the hacker to retweet that article — a request that was granted.

Just days after exchanging direct messages with Guccifer 2.0, Stone sent a series of tweets raising questions about whether he had advanced knowledge that WikiLeaks was about to publish emails hacked from the account of Hillary Clinton’s campaign chairman, John Podesta.

“Trust me, it will soon the Podesta’s time in the barrel. #CrookedHillary,” Stone tweeted on Aug. 21, 2016.

With forensic evidence confirming that Guccifer 2.0 was working for a Russian intelligence operation, Stone’s communications with the hacker — and his statements in the days and weeks following those exchanges — are sure to be of intense interest to special counsel Mueller.

The new report also casts fresh doubt on Trump’s frequent claims of “no collusion.” If, as the report states, Guccifer 2.0 was a Russian intelligence operative carrying out the orders of Putin, then there is now definitive proof that a Trump campaign associate was in extensive contact with a Russian spy during the 2016 presidential campaign.

Meanwhile, amid this deluge of new evidence, Trump has just appointed a new national security adviser who once suggested that Russian interference could be a “false flag operation.”

But try as he might, Trump can’t escape the reality that is quickly catching up with him — and encircling those around him.
https://shareblue.com/roger-stone-russi ... cifer-2-0/

Seth Abramson
‏

(THREAD) New evidence suggests Rick Gates' plea has much more to do with Russia than we thought.

And that's because it may have more to do with Trump advisor Erik Prince and Trump fundraiser/RNC deputy finance chair Elliott Broidy than we thought.

Hope you'll read on and share.


1/ When Gates pleaded guilty, the White House insisted his crimes had nothing to do with Trump or Russia. But it's increasingly clear the reason Mueller offered Gates a plea deal did in fact have to do with Russia-related information Gates had about not just Manafort but others.

2/ First, understand how significant Gates was to Trump's campaign: he was its Deputy Campaign Manager; he ran its operations at the RNC, where Trump campaign aides made contact with Russian nationals and subsequently changed the RNC platform to benefit Putin and lied about it...

3/ ...per media reports, he was effectively running Trump's campaign—more so than Manafort—for several months in the summer of 2016; when Manafort was fired, Trump stayed in contact with his former Campaign Manager and declined to fire Gates, instead giving him a critical role...

4/ ...as his campaign's liaison to the RNC, a move which at the time surprised political observers because (a) that was a critical campaign role, and (b) it was assumed that Gates, Manafort's deputy, would've been removed from the campaign at the same time Manafort was because...

5/ ...like Manafort, Gates had ties to the Ukraine and therefore should've been as big a liability as Manafort was—by then—thought to be, at least publicly; Trump then made him Deputy Chairman of his inaugural committee (a key role) during the transition, which we now know was...

6/ ...lousy with secret meetings and calls with Russian nationals—even as Trump (and, one presumes, let's be honest, Gates as well) stayed in touch with Manafort behind the scenes (and of course Trump and Manafort lived in the same building and could meet up whenever they liked).

7/ So Gates was at the top of Trump's campaign and transition; was at the top of the campaign and transition at all points at which suspicious Trump-Russia contact occurred; and was definitively tied to that contact, at least in terms of the lied-about platform change at the RNC.

8/ But Trump's decision not to fire Gates in mid-2016, but put him in a key position as the link between himself and the RNC, never sat right with me, or with many others in the media. Gates came in with Manafort and had all the same liabilities; so why didn't he go out with him?

9/ Indeed, Trump responded to the *loss* of Manafort (against Trump's wishes, and only in public, to be clear) by *promoting* Manafort's equally compromised deputy to a position of even *greater* prominence and power than he had before—which he stayed in through the inauguration.

10/ And now Rick Gates has pleaded guilty.

Immediately after that happened, sources in the White House successfully got the media to pass on (essentially without analysis) two lies: (a) Gates wasn't a particularly prominent Trump-campaign figure; (b) he'd no knowledge of Russia.

11/ But you know who Gates was linked up with as a result of Trump shocking the media and naming him his RNC liaison? The man pictured atop this thread, Elliott Brody, who less than 90 days after Gates ceased to be Trump's RNC liaison became the deputy finance chair of the RNC.

12/ Days after Gates was indicted, McClatchy reported Mueller was looking into new charges against Gates involving a shady film-production scheme. As part of that scheme, two producers sent $100K in fraudulently-obtained funds to a nonprofit run by Broidy.
http://www.mcclatchydc.com/news/nation- ... 22106.html

13/ That wasn't the first time Gates was involved with Broidy: Broidy was Vice Chairman of the Trump Victory Committee during the 2016 campaign, a joint operation between Trump and the RNC, which linkage therefore—per Trump's surprising summer promotion of Gates—was run by Gates.

14/ As soon as the campaign ended, Gates and Broidy continued working together, this time on Trump's inaugural committee—for which Broidy was the Vice Chairman and Gates the Deputy Chairman. So the compromised-by-Ukraine-cash Gates was hand in glove with Broidy for *many* months.

15/ And after he worked with the compromised-by-Ukraine-cash Gates for many months, Broidy was rewarded by the RNC with a promotion of his own—to deputy finance chairman. So Trump saw to Rick Gates' elevation, and the RNC saw to Broidy's. Both sides of that partnership prospered.

16/ Three weeks ago, a story dropped suggesting that Broidy's wife was trying to collect millions of dollars in return for influencing Trump Administration policy.
https://www.huffingtonpost.com/entry/el ... ba4ad18d65

17/ Two days later, the George Nader news dropped—Nader, a Trump insider-turned-Mueller-informant, established that Erik Prince had lied about his Trump-sanctioned secret meeting with a Russian in the Seychelles—and Nader was immediately tied to Broidy too.
https://www.motherjones.com/politics/20 ... stigation/


18/ Lest you wonder if Broidy is only connected to Nader, not Prince, understand first that Broidy is in the same niche industry as Prince—private Middle East military contractors—specifically in the UAE, which is where Prince lives. He's tied to the UAE royal family—like Prince.

19/ But wait! I'm just getting warmed up. Just four days after the Broidy-Nader scandal (which itself was two days after Broidy's wife's scandal), this bombshell dropped: Broidy was possibly connected to a scandal involving (wait for it) Russian sanctions.
https://www.aljazeera.com/news/2018/03/ ... 32781.html


20/ According to docs held by a Ukrainian prosecutor, Broidy has been acting as an agent of a sanctioned Kremlin-owned bank—in other words, the Kremlin. And the media reports Broidy has "significant access to Trump" and is lobbying him. On what? Why, Russian sanctions, of course.

21/ That's right, Broidy appears to be lobbying Trump to do just what Trump has done: slow or avoid the imposition of any new Russian sanctions, and militate publicly for an end to all sanctions on Russian entities. Thank god there's no evidence that Broidy is giving Trump money!

22/ (Surely, if you're reading this, you know what's coming next.)

23/ Broidy has been a major Trump fundraiser since 2016, and the money sure didn't stop flowing once (allegedly) Broidy began working for both the RNC and—apparently—Putin's VTB Bank.

One week ago Broidy hosted a $35,000-a-person fundraiser (!) for Trump.
https://www.hollywoodreporter.com/news/ ... er-1093125


24/ The Al-Jazeera investigation linked to in this thread implies that Mueller now could be investigating Broidy—who, again, apparently has shady ties to both the Kremlin, the RNC, Ukraine, Erik Prince, and the UAE—for FARA violations and more. And who could help him? Rick Gates.

25/ (I wish I could tell you this thread is about to get *less* complicated, but it's about to get *more* complicated. But also *absolutely stunning*.)

26/ Trump (and Jared) are surrounded by a horde of fundraisers and advisors who are trying to lobby Trump not just about private military contractors in the Middle East but, more significantly, about *nuclear power* in the Middle East.

Specifically, gifts of U.S. nuclear tech.

27/ Rick Gates is part of that horde. And so is another man Mueller has in his pocket due to a plea: Michael Flynn.
https://www.propublica.org/article/whit ... udi-arabia

Trump pal Thomas Barrack is also in that horde. So is Bud McFarlane, who was a VIP at Trump's Mayflower Speech in April 2016. So is Broidy.

28/ So now we have a story involving Gates, Flynn, Prince, Broidy, Barrack, McFarlane, Kushner, Nader, and Donald Trump. But guess what: it all comes back to Russia and the UAE, the two parties Prince secretly met with and lied about meeting with while under oath before Congress.

29/ If you read the ProPublica story, you'll see the UAE can only get U.S. nuclear tech if we give it to Saudi Arabia first. Trump's pals are all either working to get that tech to Saudi Arabia or lobbying on behalf of the UAE—which, as to nuclear tech, amounts to the same thing.

30/ What does this have to do with Putin and sanctions? That's a reasonable question to ask.The answer: Moscow wants the contracts to build all new nuclear power plants in the Middle East, and stands to make *hundreds of millions* doing so.

Just one thing stops them: sanctions.
https://twitter.com/SethAbramson/status ... 6051769344

GAME-CHANGER

Guccifer 2.0 is a Russian Agent. Does That Mean Trump Team Colluded?

Whoever assisted a Kremlin intelligence officer regarding the DNC hack is open to a charge of criminal conspiracy. None other than Roger Stone already said they talked.

Barbara McQuade
03.23.18 11:13 PM ET

The link between Russia and the Trump campaign that special counsel Robert Mueller has been looking for may finally have materialized.

On Friday, The Daily Beast reported that the hacker of the Democratic National Committee emails known as “Guccifer 2.0” is, in fact, a Russian intelligence agent. The Daily Beast further reported that Mueller has brought onto his team the FBI investigator who tracked down the intelligence agent. Reportedly, Guccifer 2.0 inadvertently revealed his identity by failing to conceal his use of a Russian computer server on one occasion.

Although the intelligence community had speculated that Guccifer 2.0 was Russian, until now, that fact had not been publicly confirmed. This news is significant for what it could mean to the Mueller investigation.

When Deputy Attorney General Rod Rosenstein appointed Mueller, he tasked him to investigate the Russian government’s efforts to interfere in the 2106 presidential election, including: (1) links and/or coordination between the Russian government and individuals associated with the campaign of President Donald Trump; (2) any matters that arose or may arise directly from the investigation; and (3) any other matters within the scope of the governing regulation, such as perjury or obstruction of justice. The news regarding Guccifer 2.0’s identity could be the key to the first item on that list.

One individual associated with the Trump campaign was Roger Stone, who served as a campaign advisor. Stone has previously admitted to communicating with Guccifer 2.0, who has claimed to be a native Romanian speaker. If the report is accurate, and Guccifer 2.0 is, in fact, a Russian intelligence agent, this could be the crucial link that allows Mueller to charge Stone and any other members of the campaign who assisted Guccifer 2.0.

Stone has denied having advance knowledge of the publication of the hacked emails, but, in August 2016, before the emails of Clinton campaign chairman John Podesta were released by Wikileaks in October 2016, Stone tweeted that “it will soon be Podesta’s time in the barrel.” His tweet suggested that he knew that Podesta’s emails had been hacked and would be released.


What might this mean for Mueller and his team? The indictment filed against 13 Russians in February provides a clue. That indictment charged the defendants with what is known as a Klein conspiracy, that is, a conspiracy to defraud the United States. A Klein conspiracy is an agreement to impair, obstruct or defeat the lawful functioning of some agency of the federal government. In this case, the affected agency was the Federal Election Commission, among others, in its role to administer federal elections. The February indictment focused on the use of social media to improperly influence the election. Until then, it was unclear whether Mueller would pursue such a theory. Now that he has done so in one case, it would not be a stretch to envision another indictment charging the Russian intelligence agent known as Guccifer 2.0 and others under a similar theory based on the hacking of the emails.

And in addition to charging Guccifer 2.0, Mueller could also charge anyone who conspired with him or aided and abetted him. One feature of the Klein conspiracy theory is that Mueller need not show that the co-conspirators were involved in the hacking, as long as he can show that they agreed that the emails would be disseminated afterwards, since the crime is not based on the computer intrusion, but on the disruption of the election.

Besides conspiracy, Stone or other members of the Trump campaign could be charged with aiding and abetting if they assisted or even encouraged either the hacking or the publication of the emails. Another potential charge is accessory after the fact for anyone who might have advised how or when to release the emails after they had been hacked.

Mueller is likely looking to see whether Stone or other members of the Trump campaign played a role in suggesting the timing of the release of the Podesta emails, which occurred on the same day as the release of the Access Hollywood tape in which Trump spoke in vulgar and disparaging ways about women. The release of the tape was a potentially campaign-ending event for Trump. Instead, that story competed for attention with the story of the Podesta emails.

Sam Nunberg, a former Trump campaign member, has recently stated that during questioning by Mueller’s team, he was asked questions about Stone. It seems likely that Mueller is closely examining the relationship between Stone and Guccifer 2.0, which could provide the link he has been seeking to fulfill his mandate. And if other members of the campaign participated in the decision to release the emails, then they could find themselves named in an indictment along with Guccifer 2.0.
https://www.thedailybeast.com/guccifer- ... ia=desktop

Guccifer 2.0 Was Always Sloppy

A sloppy mistake linked Guccifer 2.0 to Russian military intelligence officers, according to a new report. But this was hardly the only mistake the hacker made in his months-long existence.

Lorenzo Franceschi-Bicchierai

Mar 23 2018, 9:48am

When I spoke with Guccifer 2.0, the individual who claimed responsibility for the DNC hack in the early summer of 2016, he claimed to be a “hacker, manager, philosopher, women lover.”

“I also like Gucci! I bring the light to people. I'm a freedom fighter! So u can choose what u like!” the hacker told me in a lengthy Twitter chat, the first interview the hacker gave after he came out of nowhere.

It also seems he forgot to say he was an officer at Russia’s military intelligence directorate, also known as GRU.


A screenshot of the beginning of my conversation with Guccifer 2.0.
That’s according to an anonymous source close to the US government investigation, run by special counsel Robert Mueller, who told The Daily Beast that American investigators have identified two people behind the Guccifer 2.0 persona, both officers of the GRU. The investigators were apparently able to unmask the hacker thanks to one crucial mistake: the hacker forgot to turn on his VPN once, revealing his real IP address, presumably when he used either WordPress or Twitter.

We don't know at this point how the US government was able to link that IP address to specific people. But this kind of precise pinpointed attribution—when it comes from government investigators—shouldn’t surprise anyone. Dutch intelligence officers reportedly infiltrated the computer networks of Russian spies so deep, they were able to literally watch the Russians hacking at their computers through their offices’ CCTV system.

Cybersecurity experts had long come to the conclusion that Guccifer 2.0 was, at the very least, a hired gun; a character created with the only goal of spreading disinformation and confusion about the DNC hack in an attempt to sow distrust in the official attribution against Russia.

Read more: All Signs Point to Russia Being Behind the DNC Hack

Forgetting to turn on a VPN, exposing the real origin of the operation was certainly sloppy. But Guccifer 2.0 was always sloppy.

When he posted stolen documents to prove he really hacked the DNC, Guccifer 2.0 forgot to remove metadata that revealed he used a computer set to Russian language when handling the PDFs. The hacker also used a cracked version of Office 2007 particularly popular in Russia. Throughout his blog posts and Tweets, his English was not not only painfully bad at a grammatical level, but it also didn’t really paint a credible motive or story behind the character.

After we called him out for claiming to be Romanian, Guccifer 2.0 slowly got better. He stopped giving interviews, his posts became more polished, the docs he released didn’t contain any revealing metadata. It was clear, even from the outside, that the operation became more professionalized as the months went by. At the time, we didn’t know how that happened, but The Daily Beast reports that was because an older, more experienced officer took over.

But at that point, in many ways, it was too late.
https://motherboard.vice.com/en_us/arti ... ce-gru-vpn

Belligerent Savant » Sun Mar 25, 2018 11:33 am wrote:.

https://medium.com/homefront-rising/dum ... fa522ff44f

Excerpt:

“If I give you a malware binary to reverse engineer, what do you see?” This is the question that had been posited by Michael Tanji, the retired cyber intelligence analyst. “Exactly what the author wants you to see.”

I want you to see words in a language that would throw suspicion on someone else.

An article published in ArsTechnica highlighted the work of an independent security researcher, Adam Carter, who had uncovered evidence that some of the documents released by Guccifer 2.0 in his initial document dump had been manipulated in a manner which introduced Russian words, in the Cyrillic alphabet, into the metadata of the documents, including a reference to “Felix Edmundovich,” the first name and patronymic of the founder of the Soviet security service, Felix Dzerzhinsky. The combination of the Cyrillic alphabet and the reference to a Russian spymaster seems ideal if one is trying to attribute its existence to the Russian intelligence services.

I want you to see that my code was compiled in a particular foreign language (even though I only read and/or write in a totally different language).

FireEye, a well-known cyber security company, has written a report on APT-28 (another name for Fancy Bear), highlights a number of Russian language indicators, including the consistent use of Russian language in malware code over the course of six years.


I want you to see certain comments or coding styles that are the same or similar to someone else’s (because I reuse other people’s code.)

Fidelis Security, another well-known cyber security company, was provided samples of the Cozy Bear and Fancy Bear malware for “independent analysis.” According to Fidelis, these samples matched the description provided by CrowdStrike and “contained complex coding structures and utilized obfuscation techniques that we have seen advanced adversaries utilize in other investigations we have conducted,” Michael Buratowski, the senior vice president of security consulting services at Fidelis, noted. The malware was “at times identical to” malware that other cyber security vendors, such as Palo Alto Networks, have attributed to Fancy Bear. Many of these similarities have been previously identified by other cyber security vendors and made public as far back as 2013.

I want you to see data about compilation date/time, PDB file path, etc., which could lead you to draw erroneous conclusions have no bearing on malware behavior or capability.

FireEye, in its report on APT-28 (i.e., Fancy Bear), also notes that the compile times associated with the malware align with the work hours and holiday schedules of someone residing in the same time zone as Moscow and St. Petersburg.

The fascinating thing about Michael Tanji’s observations was that they were made in 2012, largely in response to the spate of China attributions headed up by Dmitri Alperovitch’s highly publicized 2011 Shady Rat report. Four years later, the fixation on pattern-derived attribution remained a problem within the cyber security collective, this time with Russia as the target de jour. In 2011, the Chinese caseload was spread across a broad field of separate cyber attacks. In 2016, the Russian data set was limited to a single event — the DNC cyber attack.

Moreover, the data set in 2016 was under the exclusive control of a single entity — CrowdStrike. While select malware samples were farmed out to like-minded vendors, for the most part outside analysis of the DNC cyber penetration was limited to the information provided by CrowdStrike in its initial report. Even the FBI found itself in the awkward position of being denied direct access to the DNC servers, having instead to make use of “forensic images” of the server provided by CrowdStrike, along with its investigative report and findings.

There is much unknown about these scans — were they taken from May 6, when CrowdStrike first detected what it assessed to be a Russian presence inside the DNC server? Or are they from June 10, the last day the server was in operation? The difference could be significant, keeping in mind the fact that there were more than 30 days between the two events.

In this intervening time, CrowdStrike watched Guccifer 2.0 exfiltrate documents. It also possibly engaged in offensive measures, such as the dangling of so-called “attractive data” (the Russian-language tainted opposition research documents come to mind.) The possibility of additional manipulation of data cannot be discounted. However, even though members of Congress are starting to call for the FBI to take physical possession of the server and conduct its own independent forensic investigation, the server remains in the possession of the DNC.

Through the release of its “Bears in the Midst” report, CrowdStrike anticipated that the US government and, by extension, the American people, would place their trust in CrowdStrike’s integrity regarding Russian attribution. The media has, for the most part, accepted at face value CrowdStrike’s Russian attribution regarding the DNC cyber attack.

The US government, while slower to come onboard, eventually published a Joint Statement by the Office of Director of National Intelligence and the Department of Homeland Security in October 2016 that declared, “The recent disclosures of alleged hacked e-mails…by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts.”

On December 29, 2016, the FBI and DHS released a Joint Analysis Report (JAR) that directly attributed the presence of both the Cozy Bear and Fancy Bear actors on the DNC server to “spearfishing” attacks, thereby eliminating from consideration any possibility that Guccifer 2.0 penetrated the DNC server through a “zero day” exploit. This was a curious assessment, given that the only data in existence regarding what had transpired inside the DNC server was the data collected by CrowdStrike — data CrowdStrike maintains did not provide evidence pertaining to how the DNC server was initially breached by either Cozy Bear or Fancy Bear.

The Director of National Intelligence followed up with a National Intelligence Assessment, released on January 6, 2017, that similarly endorsed the findings of CrowdStrike when it came to Russian attribution for the Cozy Bear and Fancy Bear penetration of the DNC, as well as linking Guccifer 2.0 to the GRU, or Russian military intelligence. It was the strength of this national assessment that closed the book on debate on the matter of Russian attribution. Senators and Congressmen, intelligence officials and media pundits — all seem to be in agreement that Russia was singularly responsible for the cyber attack against the DNC, and the subsequent release of documents acquired from that breach. “Without a doubt,” “undeniable,” “incontrovertible” — this was the verbiage that accompanied any discussion of the case against Russia.

The genesis moment for this collective clarity, however, remains the carefully choreographed release of the CrowdStrike report, “Bears in the Midst,” and the accompanying Washington Post exclusive laying the blame for the DNC cyber attack squarely at the feet of Russia. From this act all else followed, leading to the certainty that accompanied this attribution was enough to overcome the challenge posed by the sudden appearance of Guccifer 2.0, enabling the same sort of shoehorned analysis to occur that turned Guccifer 2.0 into a Russian agent as well.

Much of this discussion turns on the level of credibility given to the analysis used by CrowdStrike to underpin its conclusions. Alperovitch, the author of the “Bears in the Midst” report, does not have a good record in this regard; one need only look at the controversy surrounding the report he wrote on Shady Rat while working for McAfee. A new report released by Alperovitch and CrowdStrike casts further aspersions on Alperovitch’s prowess as a cyber analyst, and CrowdStrike’s overall methodology used to make its Russian attribution.

On December 22, 2016, CrowdStrike published a new report purporting to detail a new cyber intrusion by the Fancy Bear actor, titled “Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units.” This analysis, prepared by Adam Meyers, CrowdStrike’s vice president for intelligence, was claimed to further support “CrowdStrike’s previous assessments that Fancy Bear is likely affiliated with the Russian military intelligence (GRU). This report was used to promote a Jan. 4 live discussion event with Meyers and Alperovitch, titled “Bear Hunting: History and Attribution of Russian Intelligence Operations,” which was intended to educate the audience on the links between Fancy Bear and the GRU.

The “Danger Close” report was presented as further validation of CrowdStrike’s Falcon Program, which CrowdStrike claims helps organizations stop cyber penetrations through proactive measures developed through a deep understanding of the adversary and the measures needed to stop them. It was Falcon that “lit up” ten seconds after being installed on the DNC server back on May 6, 2016, fingering Cozy Bear and Fancy Bear as the culprits in the DNC attack. Falcon was now being linked to this newest effort at Russian attribution.

The only problem for Meyers, Alperovitch and CrowdStrike was that “Danger Close” was wrong — dead wrong — in every aspect of its analysis. The report was dissected by none other than Jeffrey Carr — the same individual who criticized Alperovitch over his Shady Rat claims. One of Carr’s most important findings deals directly with the credibility methodology used by CrowdStrike to attribute Fancy Bear to the GRU. “Part of the evidence supporting Russian government involvement in the DNC and related hacks (including the German Bundestag and France’s TV5 Monde),” Carr writes, “stemmed from the assumption that X-Agent malware was exclusively developed and used by Fancy Bear. We now know that’s false, and that the source code has been obtained by others outside of Russia.” Carr cites at least two examples, one a security company, the other a hacker collective, of the X-Agent malware existing “in the wild.” If these two entities have the X-Agent malware, Carr notes, “then so do others, and attribution to APT28/Fancy Bear/GRU based solely upon the presumption of ‘exclusive use’ must be thrown out.”

In one fell swoop, Carr destroyed the very premise upon which CrowdStrike not only attributed the DNC cyber attack to Russia, but the heart and soul of CrowdStrike’s business platform — the Falcon Platform used by CrowdStrike to provide “end point” protection to its clients. Far from representing an intelligent platform capable of discerning threats through advanced algorithms and proprietary techniques, the Falcon Platform seems to be little more than a database pre-programmed to deliver a preordained finding — X-Agent equals Fancy Bear, and Fancy Bear equals Russia.

Also, metadata analysis by an independent researcher which contradicts the 'Russia Hack' narrative:

https://theforensicator.wordpress.com

Forensicator maintains his position that the most probable and plausible interpretation of the observations derived from the NGP VAN 7zip metadata is:

There is evidence that suggests the files in the NGP VAN archive were copied (twice) locally, on the East Coast, US. Further, there are indications that a USB-2 capable media may have been used for the first copy operation on July 5, 2016 and that a FAT-formatted media was used in the second copy operation on Sept. 1, 2016. (A USB flash drive is one of the most popular FAT-formatted media, but there are others including SD cards and removable hard drives.)

Essentially: files eventually published by the Guccifer 2.0 persona were likely initially downloaded by a person with physical access to a computer possibly connected to the internal DNC network. The individual most likely used a USB drive to copy the information.

Belligerent Savant » 26 Mar 2018 01:23 wrote:.

Did you actually read the content in the links provided in my prior post? What, specifically, "hasn't aged well"?

Did The Daily Beast, bastion of objective journalism, initiate its own analysis of metadata/available evidentiary artifacts?

(Also: is there anything in your Daily Beast posting that's unique compared to all the prior Guccifer-related Daily Beast articles already pasted in this thread?)