An FBI agent testifying Tuesday on the second day of the trial of 2016 Hillary Clinton campaign attorney Michael Sussmann discredited evidence Sussmann gave the agency attempting to connect the Trump Organization with Russia's Alfa Bank, a purported hotline to the Kremlin.
Describing a white paper analyzing internet data between the email server of the Trump Organization and the Russian Alfa Bank as "not objective" and "far-reaching," FBI Special Agent Scott Hellman said the authors' conclusion of a secret communications channel "didn't ring true at all."
Special Counsel John Durham last year charged Sussmann with lying to the FBI when he allegedly told then-FBI general counsel James Baker that he was not working on behalf of any client while providing him with since-debunked collusion allegations.
Sussmann is pleading not guilty to the charge. If convicted, he faces up to five years in prison.
Hellman, the prosecution's second witness, examined the data on the thumb drives that Sussmann had given to Baker in their meeting weeks before the presidential election. One of the FBI agents whose signature was required for a chain of custody form for the drives was former FBI official Peter Strzok.
Strzok worked on Robert Mueller's Special Counsel investigation into possible collusion between Donald Trump's presidential campaign and the Russian government. Mueller removed Strzok from the investigation after learning about criticisms of Trump and his supporters in personal text messages with then-FBI lawyer Lisa Page, with whom he was having an extra-marital affair.
Hellman also said that he was frustrated that he didn't know the source of the data, and added during cross-examination that he would've included the source in his summary analysis.
Hellman said he disagreed with the white paper regarding the data on the thumb drive that explained the Domain Name System data as being a secret communications channel between the Trump Organization and Alfa Bank. He said that he felt that whoever wrote the white paper jumped to conclusions not supported by the technical data and that the methodology of their analysis was questionable.
The FBI agent also said the overall conclusion of the connection between Trump and Russia from the data didn't make any sense because a presidential candidate would not likely put their own name in a domain name that was easily connected to their organization and Russia if it's supposedly for secret communication.
"Didn't ring true at all," Hellman said. He said the analysis of the data was done "inside of a day," then given for further analysis to the FBI Chicago division, which later agreed with his assessment.
Hellman added that he found it "conveniently coincidental" that someone was looking for suspicious activity between the Trump and Russian servers and found it just three weeks after it began.
The 14-year FBI veteran said the authors of the white paper for the DNS server data were not objective in their conclusions. Their assumption regarding the data "was so far-reaching, it just didn't make sense," he said.
He explained that there are three levels of investigations in the FBI: assessments, preliminary investigations and full investigations. Each level has different investigative tools at its disposal as the higher levels require more information and evidence.
Hellman said during cross-examination that in a message he sent to his supervisor at the time he analyzed the data from the thumb drives, he believed whoever drafted the white paper was "a little 51/50 ish," meaning suffering from some mental disability.
In redirect examination by the prosecution, Hellman explained he was "very skeptical" of the data he received and would've been even more so had he known from where it came.
The prosecution's third witness was Neustar Security Services employee Steve DeJong, who pulled the data regarding the Trump email server and Alfa Bank for Joffe at his request.
The request from Joffe came through Georgia Tech researcher Manos Antonakakis,which DeJong said was a little uncommon.
While DeJong said he eventually became curious as to why he was told by Joffe to search for DNS data regarding Trump and Alfa Bank, he never asked nor was given a reason.
FBI Special Agent David Martin, an expert in cybersecurity and DNS data analysis, was the prosecution's first witness.
Martin said DNS data is essentially maps of names of servers on the internet to numeric IP addresses — like a phonebook mapping someone's name to a phone number.
Martin also described Passive DNS, which is capturing a copy of DNS queries (or lookups) on the internet. DNS queries or lookups are what someone looks up, when, and where. He added that visibility is what a Passive DNS server can see.
In cross-examination by the defense, Martin said that a lookup is a connection but doesn't show what the substance of that connection is. To get information as to what the DNS data is showing, a court order, subpoena or search warrant would be required to obtain that information.
In opening statements Tuesday, Special Counsel John Durham's team alleged Sussmann used the FBI as "a political tool" to create an "October surprise" against then-candidate Donald Trump.
The prosecution team said Sussman, a former federal prosecutor, tried to "manipulate" the FBI in his September 2016 talk with the agency, weeks before the 2016 presidential election, by pitching a Trump-Russia collusion narrative.
The trial proceedings in the U.S. District Court for the District of Columbia follow jury selection Monday and begin Durham's first trial in his probe into the origins of the now-discredited collusion narrative.
Durham says Sussmann was working at the time on behalf of two clients, the Clinton campaign and then-Neustar tech firm executive Rodney Joffe.
Durham, appointed by Trump administration Attorney General William Barr to look into the origins of the narrative, intends to show that Sussmann told Congress the truth about working for the Clinton campaign after he lied to the FBI.
Judge Christopher Cooper, appointed to the bench by former President Barack Obama, is presiding over the trial.
The proceeding started with the prosecution and the defense each giving their opening statements, followed by the government calling its witnesses to testify.
Deborah Brittain Shaw gave the prosecution's opening statement, framing Sussmann's relationship with the FBI as one of privilege, arguing that he believed the normal rules didn't apply to him and that he could use the bureau as a political tool and lie to them without suffering the consequences.
She also said Sussmann brought the information to the FBI not as a concerned citizen, but for his own ends and to serve the agenda of his clients.
Sussmann met with Baker, whom he knew from previously working together, giving him the information he had received from Joffe. The FBI found that the supposed connection between the Trump Organization and Alfa Bank was a spam email server sending marketing emails, not crime or a threat to national security.
Shaw argued that Sussmann leaked the allegations to the New York Times, expecting the story to be run. However, when the story wasn't published immediately, Sussmann went to the FBI with the information, claiming he wasn't representing a client so that they would meet with him right away, as they knew he worked with the Democratic Party.
When Sussmann testified before Congress, he admitted to carrying out both meetings on behalf of Joffe. However, Shaw alleged that Sussmann hid from Congress that he had billed the Clinton campaign for his meeting with the FBI. Sussmann also worked with Fusion GPS to plant the story about Trump in the media.
Shaw argued that Sussmann's lie to the FBI mattered as evidenced by the resources it took to investigate what ended up being a spam email server.
Witnesses that Shaw said would be brought to the stand include Baker and other FBI agents involved in the investigation, employees of Joffe's company, an employee of Fusion GPS and an employee of Sussmann's former law firm to explain their billing records.
One of Sussmann's lawyers, Michael Bosworth, then gave his opening statement, arguing that Sussmann wouldn't lie to the FBI since he would have gained nothing from it and lost everything if he did.
Bosworth argued that the FBI was aware of Sussmann's clients, the Democratic National Committee and the Clinton campaign.
He said that Sussmann took the information given to him by Joffe to the media because he trusted his longtime client and took him seriously, wanting the American public to see it for themselves and make a decision.
Sussmann purportedly wanted to warn the FBI that the story was coming so it wouldn't be caught by surprise.
Bosworth said that Sussmann wasn't directed to speak with the FBI about the data Joffe gave him and that meeting with the bureau was the opposite of what the Clinton campaign would have wanted since it asked the New York Times to hold the story.
The defense argued that the prosecution has four questions to answer regarding Sussmann: What did he actually say to Baker? Is what he said false? Did he intend to say something false? Did it matter?
Bosworth added that if the Clinton campaign wanted to conceal its connection to Sussmann when he went to the FBI, he would be the worst person to send since the FBI knew they were his client.
While the FBI is now saying that Sussmann's motivations matter for meeting with Baker regarding the Trump allegations, Bosworth claims that at the time, they knew who his clients were and it didn't matter.
Top Democrat election lawyer Marc Elias is set to testify Wednesday.
Elias and Sussmann were partners together at the law firm Perkins Coie, which represented Clinton's 2016 presidential campaign.
Elias headed the firm's political group and served as general counsel for the Clinton campaign. He testified during a House Intelligence Committee investigation in 2017 and recently during Durham's investigation that he was the one who hired the opposition research firm Fusion GPS to dig up dirt on Trump.
The FBI, CIA, Mueller and others have debunked the collusion claim.
A key piece of evidence in the special counsel's case is a text message in which Sussmann tells Baker he wasn't representing any clients.
Durham also alleges Sussmann "repeatedly billed the Clinton campaign for his work" on the Alfa Bank allegations and that he admitted to approaching the FBI at the instruction of a client in his testimony to Congress.
Durham has so far indicted three people in his probe — Sussmann, Igor Danchenko and ex-FBI attorney Kevin Clinesmith.
Danchenko, who contributed to opposition research on then-presidential candidate Donald Trump, is set for an Oct. 11 trial in Virginia.
Clinesmith pleaded guilty last year to altering an email during the Russia investigation that was used to justify the surveillance of former Trump campaign adviser Carter Page and was sentenced to one year of probation.