September 2021: One ping on the IP addresses of war

Shadow jousting?

In an earlier article, after John Durham’s indictment of Michael Sussmann was filed, I noted that the millions of Pentagon-held IP addresses that were turned over in January 2021 to an obscure company in Florida had reverted to Pentagon stewardship the week before news of the indictment came out.

The Sussmann indictment’s filing date with the federal court for the District of Columbia was 16 September 2021.  The true-bill signature date for the grand jury foreman was also 16 September 2021.  DOJ prosecutors would have presented their information to the grand jury on or before that date.  (The 16th was a Thursday.)

On 10 September 2021, the Washington Post reported that the IP addresses had been turned back over to the Department of Defense on 7 September.  That was the Tuesday of the week before the Sussmann indictment.

The Post cited a brief notice from DOD on the matter, which was of interest given that there was no contemporaneous Pentagon announcement back on 20 January 2021, when the IP addresses were transferred to Global Resource Systems, the company (seemingly a sole proprietorship) headquartered in Plantation, Florida.  As a reminder, the 20 January 2021 transfer was, obviously, done on President Biden’s Inauguration Day, and took place a few seconds after 11:57 AM Eastern Standard Time, just under three minutes before Biden’s term officially began.

Outside of the most closely engaged in this arcane corner of the cyber-world, no one even knew about the transfer of IP addresses on 20 January.  The transaction didn’t come to general public attention until April 2021.

At any rate, the timing of the two transfers looked like more than a mere curiosity, in light of the long association of Global Resource Systems’ proprietor, Raymond Saulino, with the man called “Tech Executive-1” in the Sussmann indictment, Rodney Joffe.  Joffe, as outlined earlier, was a senior executive for years with the company Neustar.  He was also a player in the indictment of Sussmann, which is for allegedly giving false information to the FBI as regards events related to Spygate.

Rodney Joffe (Video, YouTube)

Again, as a refresher, Sussmann was a lawyer with Perkins Coie who had previously worked at the DOJ as a U.S. attorney, and before that in computer crime and intellectual property.  He was a central participant in Spygate working with the DNC and shopping information, particularly relating to the allegations about Alfa Bank and the Trump organization, to the FBI and DOJ.  Sussmann was the Perkins Coie partner called in by the DNC for the alleged Russian cyber-intrusion at the end of April 2016.

Associates like Rodney Joffe, discussed in the Sussmann  indictment, are not mentioned in that document because of any connection they had to Donald Trump.  The persons mentioned in the Sussmann indictment were a set of anti-Trump characters.

That’s important to keep straight as we ponder why Raymond Saulino was given custody of the Pentagon’s IP addresses from 20 January to 7 September 2021.  As discussed in my article from April, the funding for Saulino’s enterprise tracked in part to Chicago investors who ran in the same circles as Barack Obama and his associates.  We also reviewed the Obama connections of the DOD entity that honchoed the IP address shift:  the Defense Digital Service.  (DDS was created by Obama in November 2015, and its leadership not only comes straight out of the Obama community-organizing playbook, but out of Rahm Emanuel’s Chicago city government.)

It’s safe to say the shift of the Pentagon IP addresses was not instigated by anyone in Trump’s orbit.

With that in mind, the ping.  I ran across this in perusing the Substack series posted by “Patel Patriot,” whose “addenda” posts I had not seen until this past weekend.  As a brief note before continuing, let me acknowledge that I’ve received a number of queries on what I think about the series.  I’m not going to speak about it in detail (that’s a general statement; there will be no forthcoming reviews), but will say that I think the work has been done with laudable care.  As long-term readers know, I’ve written at length about some of the topics covered by Patel Patriot.

I don’t endorse all the conclusions.  At a level different from engaging on specifics, I would make this comment:  it’s one of what I call Dyer’s Axioms (cobbled together from intelligence work over the years) that if you can imagine it, someone is trying to do it.  Very little is too outlandish for anyone to be attempting.  So I don’t dismiss Patel Patriot’s basic thesis out of hand.

Neither do I subscribe to it.  We are where we are, and must navigate by what we can see.

Ping One

That prelude is more philosophical than operational.  Here’s the ping.  In his Addendum Part 2, posted on 25 August 2021, Patel Patriot includes this information pertaining to the Trump executive order, 13848, discussed several times in my previous articles at the end of 2020 and in early 2021 (see, e.g., here, here, here, here, and here).

EO 13848 was indeed extended for one year,” Patel Patriot points out.  “The original EO was issued on September 12, 2018 and was effective until September 12, 2020. The 1 year continuation is effective from September 12th, 2020 through September 12th, 2021.”

When he refers to an extension, Patel Patriot is talking about the emergency declared by Trump under E.O. 13848, which has to do with responding to evidence of foreign election interference.

A worthwhile comment at this point is that Trump, at least, thought he was doing something real with his executive order.  Again, I’ve presented thoughts on that before.  So it would be wrong to not take the substance or timeline of the E.O. seriously.  Trump did.

Now let’s look at a few other dates.  We’ll take them in order.

8 September 2020 – Global Resource Systems, LLC, with Raymond Saulino as the company principal, was incorporated in Delaware.  The company would then register to operate at an address in Florida, as a Delaware-incorporated business, on 13 October 2020.

Screen cap 17 Nov 2021
Screen cap 17 Nov 2021

10 September 2020 – The Federal Register notice of the emergency extension under Trump’s E.O. 13848 was filed, with an effective filing date of 11 September 2020.  The emergency was extended from an expiration date of 12 September 2020 to a new date of 12 September 2021.

20 January 2021 – The first and only transaction involving Global Resource Systems, LLC occurred.  The Pentagon IP addresses were shifted to GRS’s custody, less than three minutes before Biden constitutionally became the president.

7 September 2021 – The Pentagon IP addresses shifted back to the Pentagon.

12 September 2021 – The state of emergency under E.O. 13848 expired.  12 September was a Sunday; the last working day prior to it was Friday, 10 September.

16 September 2021 – The Sussmann indictment was filed.  Observers have assessed this was to ensure it beat the toll on the statute of limitations for Sussmann’s false statement charge.  The alleged false statement in question was given on 19 September 2016.

It would be fruitless to speculate without more information about whether Durham’s timing is related in any way to the expiration of the 13848 emergency.  Let us, for now, honor Occam’s Razor and assume the driver was the statute of limitations.

But that’s not all there is to say.  One thing we could construct out of this is the postulate that people inside the federal executive were aware in September 2020 that Trump would extend his 13848 emergency.  I don’t pretend to know what they thought he (or someone) might do with it, but it’s certainly conceivable that Global Resource Systems was created, once knowledge of the extension was certain, for the purpose of transferring those Pentagon IP addresses if Biden took over in January.  (The 2020 general election hadn’t been held yet.)

Where a Global Resource Systems LLC keeps popping up. Plantation, FL. Google Street View

Accepting that transfer of IP addresses is the only thing GRS has done since it was created on 8 September 2020.  The closely timed and efficient transfer, just before Biden’s statutory term began, is a good indicator that the only thing GRS was created for was that IP address transfer.

It might be productive to root around for other factors that may have driven the timing of GRS’s creation.

A larger context

But I’ll close with what seems to me to be an illuminating metanarrative observation.  Consider all of that very particular history.  Now consider something else Patel Patriot highlighted from the end of Obama’s second term:  the 17 January 2017 posting of a document called Federal Continuity Directive 1 (FCD-1), in which FEMA fleshed out guidance for “continuity of government” based on Obama’s latest presidential policy directive on that topic, PPD-40.

Obama’s PPD-40, dated 15 July 2016, revoked and replaced a similar document on continuity of government (COG) signed by George W. Bush in 2007.  Most readers probably understand that “COG,” dating to the Eisenhower administration, is a set of policies for ensuring government can continue to function in a state of emergency, including catastrophic emergency in which normal operating spaces – buildings, power, equipment – have been lost.  Senior personnel may have been lost as well.

Obama’s PPD-40 is classified and has not been seen by the public.  I didn’t think a great deal about it when the FEMA document was published three days before Obama left office.

But in retrospect, after four years of the federal executive fighting Trump tooth and nail on policy issues, and after Trump published E.O. 13961 – “Federal Mission Resilience” – on 7 December 2020, which revoked and replaced portions of PPD-40 and a prior Obama E.O. (see below), the thought could not but occur that these updates on continuity of government may have been live maneuvers rather than mere bureaucratic grass-mowing.  (Patel Patriot has more on E.O. 13961 and its base document, the Federal Mission Resilience Strategy.)

Bolstering this thought was a basically incontrovertible point about Obama’s last-minute alterations to E.O. 12333, the Reagan E.O. that, with its revisions, still governs the handling of sensitive national intelligence that may (among other things) involve the identities of Americans.  The changes to 12333, signed out surreptitiously by subordinates (Clapper and Lynch) on 3 January 2017 and largely gutting accountability for sensitive-data handling, were timed to institutionalize what the Obama agencies had been doing to spy on Americans throughout 2016.  (And indeed, going by collateral clues, for years prior to that.)

It would be in-pattern, across the board, for the Obama administration to update federal guidance documents during the transition period, in order to institutionalize such advantageous agency practices.  It probably wasn’t necessary to put that FEMA FCD out three days before Obama left office, when the Obama administration wouldn’t be there to execute it.  But the Obama administration, prioritizing it, may have seen it as advantageous; i.e., as getting a jump on the incoming administration.

Pete Souza/The White House

And when the Trump administration undid some of the key provisions from PPD-40 – after the 2020 election and as the presidential transition appeared increasingly inevitable – well, that action is harder to attribute to mere policy-neutral concerns than to a revulsion against whatever Obama’s apparent intent with PPD-40 was.  The latter seems more likely.

The same might be said of Obama’s decision to completely replace Bush 43’s continuity policy from 2007.  Three presidents in a row have now substantially revised the COG policy of their immediate predecessors.  And in the last two cases, they have taken related actions during the transition period before the new administration came in.

That’s an awfully big topic on which to keep revising policy as if there’s some pressing tactical necessity for it.  At least, it’s awfully big if all other things are equal.  Maybe all other things aren’t.

On the same theme, once Biden had been elected, it would not be surprising to see people who had worked for Biden’s election and hailed his advent with enthusiasm continue the shadow play with fresh moves.

The refocus with the Trump “mission resilience” update

Is that what the IP address shift was part of, on 20 January 2021?  I’m not necessarily convinced one way or the other.  But there’s a clue in Patel Patriot’s “Part 13,” and its discussion of another Obama order on COG:  E.O. 13618 from 6 July 2012.

That order was about communications during a national emergency.  Certainly read Patel Patriot’s treatment; here is what jumps out at me.

The Obama E.O., 13618, named the president’s homeland security and counterterrorism advisor and the director of the White House Office of Science and Technology Policy as the very small team that would “make recommendations to the president” and monitor the execution of national communications authorities  – in particular, those relating to secure communications for the federal government –  in the event of an emergency/COG situation.  The homeland security advisor would effectively be at the summit, just under POTUS.

Within agencies, there would then be representatives for communications issues.  As Patel Patriot notes, it was basically all federal agencies that would sit at the table and dicker over national government comms concerns.

Trump’s 13961 created an executive committee for federal mission resilience comprising the following officers:

Secretary of Defense

Secretary of Homeland Security

Director of National Intelligence

Assistant to the President for National Security Affairs (APNSA) – Also known as National Security Advisor

Assistant to the President and Deputy Chief of Staff for Operations

Director of the Office of Management and Budget

Director of the Office of Science and Technology Policy

The executive committee (EC) is vested with the communications responsibilities assigned in Obama’s E.O. 13618 to the homeland security advisor and the OSTP director.  But the EC in 13961 also sits for the various other federal agencies.

AP video, YouTube

Under the Trump E.O., during emergency execution, the OSTP director is the conduit to the president, rather than the homeland security advisor, who is not in the picture.  In its planning functions, meanwhile, the EC isn’t stratified or shaped into a funnel in terms of reporting to POTUS.

As a passing point, it’s not a bad use of time to recall who was in the two positions designated by the Obama E.O. when it was promulgated in July 2012.  Those individuals were, respectively, John Brennan, and John Holdren (OSTP).

As Patel Patriot notes, the OSTP director is reflected in the EC formed by E.O. 13961.  The incumbent in December 2020 was Kevin Droegemier.  You’re unlikely to have ever heard of him.

Moreover, the homeland security advisor, as mentioned, is not an EC member, and is not assigned a specific communications “resilience” role in 13961.  The national security advisor – who in December 2020 was Robert O’Brien – is on the EC, and mirrors his traditional NSC role, founded in the 1947 National Security Act, of convening the EC and coordinating its activities.

The national security advisor is also designated the “National Continuity Coordinator” in the Trump E.O., a particular that is stated to be a revision to Obama’s PPD-40, and refers to a more general coordinating role; i.e., beyond the specific matter of communications.  This reinforces the traditional centrality of the national security advisor.

It’s quite important that the president’s homeland security advisor isn’t on the executive committee.  In the Obama arrangement, one of the two amigos snuggled directly under the president had an inherently political policy portfolio.  He was also John Brennan when the E.O. was signed – never a meaningless point – and even more significantly, he was the president’s advisor for counterterrorism as well as homeland security.

That seemingly minor detail is a major clue to Trump’s intent with E.O. 13961.  Obama’s 2012 order was written as if terrorism was likely to be at the heart of an emergency/COG situation.  Trump’s 2020 order was not.

That matters because of what we’ll see below.

Correlation of forces in continuity of government

The upshot of all this is as follows (my analysis, based on seeing the federal executive at work):

Under E.O. 13961, the conduit to POTUS during emergency execution is an official (Director OSTP) who is traditionally more apolitical and comes from a background of scientific expertise.  (John Holdren, well known to hold progressive-left ideological views, was something of an exception.)  This would tend to relieve concerns about overpoliticization of a critical function in emergency situations.  It’s characteristic of Trump to prefer such an arrangement.

E.O. 13961 also levels the playing field for interagency resilience planning.  The role of a homeland security and counterterrorism advocate in national communications resilience is downgraded from the special position it had under Obama’s 13618.  The national security advisor plays his customary role on the NSC.  No unique interagency power centers are created.

In both modes – emergency execution and planning – the arrangement under 13961 favors POTUS retaining effective control of major decisions.  The OSTP director is not an official who comes in with a formidable, lobby-able political base; he or she is likely to simply execute as required, and in any case is easier for the White House chief of staff to keep an eye on.

On the EC, run on the same basis as the NSC, the national security advisor will coordinate planning activities relating to communications, as well as to the other aspects of mission resilience.

We can’t be sure, given the scattered and secretive nature of what we get from the Biden White House, how much E.O. 13961 is being adhered to today.  It’s present on the Homeland Security website as a currently-effective guidance document, along with the Federal Mission Resilience Strategy, but that may or may not be meaningful.

That said, here’s the specific way it matters to the Pentagon IP addresses.  I see no evidence that the distribution of national comms responsibilities has changed since the revisions under Bush 43, when Homeland Security was created.  The Defense Department is responsible for national command and federal government comms; Homeland Security coordinates with industry on continuity/resilience for private-sector communications (i.e., your Internet and cell phone, which are part of “critical infrastructure”), and with the state, local, tribal, and territorial governments on their comms requirements.  (See the breakout in Bush’s 2007 order and Obama’s from 2012.)

But under Obama’s E.O. 13618, homeland security got wedged in between POTUS and DOD, for what were effectively both planning and execution responsibilities for national command and federal government communications.

Under 13961, there’s no wedge.  The homeland security advisor, with his counterterrorism role, can’t function as a form of higher authority vis-à-vis DOD’s national comms portfolio.  Through the executive committee, DOD answers directly to the president for its planning, and need expect little if any politicized brokerage working with, or through, the OSTP director during emergency execution.

That’s how Trump set it up with his December 2020 order.  Under Obama, while DHS per se wasn’t put in a privileged position, the homeland security advisor was.  Maybe that was just a holdover from the 9/11 mindset.  Maybe.

But given the perspective of the Obama administration on the nature of “domestic terrorism” – a perspective from which the Biden administration now operates – that’s a lot of freighted political privilege wedged between POTUS and DOD.  (Remember:  NSA is a component of DOD, as is the joint four-star Cyber Command:  key elements of mission resilience for national government communications.  The Space Service, with its role in space-based national comms, is another key participant.  A homeland security and counterterrorism nexus with a stovepipe into the White House, viewing half the American public as “domestic terrorists” and wedged in a notch above DOD for any government resilience purpose, is an accident to Americans’ constitutional rights just waiting to happen.  The same is true, for some resilience matters, of homeland security being wedged in above the Justice or Treasury Departments.)

With 13961, Trump effectively removed the wedge as a drag on managing DOD’s communications role in COG situations.

It makes for an interesting perspective on the IP addresses shift on 20 January 2021, which I assume to have been done by actors loyal to the incoming Biden administration.  Food for thought.

Feature image:  Trump boards Marine One on his way out of Washington, D.C. on 20 January 2021.  AIR.TV video

7 thoughts on “September 2021: One ping on the IP addresses of war”

  1. Thank you for your work. I greatly appreciate that you refrain from speculation and stick so closely to granularly detailed reporting.

    1. Welcome, Steven, and thanks for the kind words. I’ve seen how much speculation has surrounded policy decisions over the last 20 years – some of it just demented – and don’t want to have an environment of slinging rotten fruit at that level.

      I remember being astonished at how insanely Bush 43’s opponents speculated about him in the 2004 election campaign, and it has never gotten better since then. There was a fringe corner of the right speculating in the same way about Obama, and speculation about Trump was (still is) just off the charts — including by the supposed “mainstream” media, which actually sound even nuttier now than the nut-fringe elements that lobbed wild allegations about Bush 43 and Obama. We live in a weird time.

      Anyway, the one-time “approval” for your commenter profile is done, so feel free to stop by any time. Your comments should appear automatically now.

      1. I remember a recent article about how the Pentagon had people covertly involved in supporting the infamous Clinton Dossier, along with Perkins Coie lawyers (Sussman, et al), and thought it was odd how there was a connection. You have piqued my curiosity to dig further into yet another strange coincidence.

      2. It’s Nov 22, and, know you know this, and, without digging into my notes for exact dates in a not-searchable Word doc, the ‘B’ WH extended EO 13848 to 2022.
        And, EO 13848 cites it is an extension of O44 EO’s on foreign interference into elections.

        Is it interesting, or not, that DoJ indicted two “Iranian hackers”?

        PatelP’s Achilles heel is he does not know the best Durham sleuths, and, seems too convinced only China did foreign interference in 2020 election.
        I continue to believe Iran/Hezbo might prove to be key to the Pop-up Peaceful Protests™ .

    1. Welcome, Stano, and thanks for the links. I had indeed seen the blog post about AS8003 not too long after it came out. As a non-expert on matters IT, I try to limit inflicting my thoughts on such things on the public. But it’s a good link, well worth the time as food for thought.

      As mentioned to Steve, your commenter profile has now been “approved,” so don’t be a stranger. Your comments should appear automatically.

  2. Interesting. My one question would be: why not just veto/change Trump’s December 2020 Executive Order? Could Biden not do that? Why do everything off the books in Florida when the Biden NSC have access to US Persons Information legally? Preemptive apologies if I am just grossly misunderstanding things here.

Comments are closed.

%d bloggers like this: