In an earlier article, after John Durham’s indictment of Michael Sussmann was filed, I noted that the millions of Pentagon-held IP addresses that were turned over in January 2021 to an obscure company in Florida had reverted to Pentagon stewardship the week before news of the indictment came out.
The Sussmann indictment’s filing date with the federal court for the District of Columbia was 16 September 2021. The true-bill signature date for the grand jury foreman was also 16 September 2021. DOJ prosecutors would have presented their information to the grand jury on or before that date. (The 16th was a Thursday.)
On 10 September 2021, the Washington Post reported that the IP addresses had been turned back over to the Department of Defense on 7 September. That was the Tuesday of the week before the Sussmann indictment.
The Post cited a brief notice from DOD on the matter, which was of interest given that there was no contemporaneous Pentagon announcement back on 20 January 2021, when the IP addresses were transferred to Global Resource Systems, the company (seemingly a sole proprietorship) headquartered in Plantation, Florida. As a reminder, the 20 January 2021 transfer was, obviously, done on President Biden’s Inauguration Day, and took place a few seconds after 11:57 AM Eastern Standard Time, just under three minutes before Biden’s term officially began.
Outside of the most closely engaged in this arcane corner of the cyber-world, no one even knew about the transfer of IP addresses on 20 January. The transaction didn’t come to general public attention until April 2021.
At any rate, the timing of the two transfers looked like more than a mere curiosity, in light of the long association of Global Resource Systems’ proprietor, Raymond Saulino, with the man called “Tech Executive-1” in the Sussmann indictment, Rodney Joffe. Joffe, as outlined earlier, was a senior executive for years with the company Neustar. He was also a player in the indictment of Sussmann, which is for allegedly giving false information to the FBI as regards events related to Spygate.
Again, as a refresher, Sussmann was a lawyer with Perkins Coie who had previously worked at the DOJ as a U.S. attorney, and before that in computer crime and intellectual property. He was a central participant in Spygate working with the DNC and shopping information, particularly relating to the allegations about Alfa Bank and the Trump organization, to the FBI and DOJ. Sussmann was the Perkins Coie partner called in by the DNC for the alleged Russian cyber-intrusion at the end of April 2016.
Associates like Rodney Joffe, discussed in the Sussmann indictment, are not mentioned in that document because of any connection they had to Donald Trump. The persons mentioned in the Sussmann indictment were a set of anti-Trump characters.
That’s important to keep straight as we ponder why Raymond Saulino was given custody of the Pentagon’s IP addresses from 20 January to 7 September 2021. As discussed in my article from April, the funding for Saulino’s enterprise tracked in part to Chicago investors who ran in the same circles as Barack Obama and his associates. We also reviewed the Obama connections of the DOD entity that honchoed the IP address shift: the Defense Digital Service. (DDS was created by Obama in November 2015, and its leadership not only comes straight out of the Obama community-organizing playbook, but out of Rahm Emanuel’s Chicago city government.)
It’s safe to say the shift of the Pentagon IP addresses was not instigated by anyone in Trump’s orbit.
With that in mind, the ping. I ran across this in perusing the Substack series posted by “Patel Patriot,” whose “addenda” posts I had not seen until this past weekend. As a brief note before continuing, let me acknowledge that I’ve received a number of queries on what I think about the series. I’m not going to speak about it in detail (that’s a general statement; there will be no forthcoming reviews), but will say that I think the work has been done with laudable care. As long-term readers know, I’ve written at length about some of the topics covered by Patel Patriot.
I don’t endorse all the conclusions. At a level different from engaging on specifics, I would make this comment: it’s one of what I call Dyer’s Axioms (cobbled together from intelligence work over the years) that if you can imagine it, someone is trying to do it. Very little is too outlandish for anyone to be attempting. So I don’t dismiss Patel Patriot’s basic thesis out of hand.
Neither do I subscribe to it. We are where we are, and must navigate by what we can see.
That prelude is more philosophical than operational. Here’s the ping. In his Addendum Part 2, posted on 25 August 2021, Patel Patriot includes this information pertaining to the Trump executive order, 13848, discussed several times in my previous articles at the end of 2020 and in early 2021 (see, e.g., here, here, here, here, and here).
“EO 13848 was indeed extended for one year,” Patel Patriot points out. “The original EO was issued on September 12, 2018 and was effective until September 12, 2020. The 1 year continuation is effective from September 12th, 2020 through September 12th, 2021.”
When he refers to an extension, Patel Patriot is talking about the emergency declared by Trump under E.O. 13848, which has to do with responding to evidence of foreign election interference.
A worthwhile comment at this point is that Trump, at least, thought he was doing something real with his executive order. Again, I’ve presented thoughts on that before. So it would be wrong to not take the substance or timeline of the E.O. seriously. Trump did.
Now let’s look at a few other dates. We’ll take them in order.
8 September 2020 – Global Resource Systems, LLC, with Raymond Saulino as the company principal, was incorporated in Delaware. The company would then register to operate at an address in Florida, as a Delaware-incorporated business, on 13 October 2020.
10 September 2020 – The Federal Register notice of the emergency extension under Trump’s E.O. 13848 was filed, with an effective filing date of 11 September 2020. The emergency was extended from an expiration date of 12 September 2020 to a new date of 12 September 2021.
20 January 2021 – The first and only transaction involving Global Resource Systems, LLC occurred. The Pentagon IP addresses were shifted to GRS’s custody, less than three minutes before Biden constitutionally became the president.
7 September 2021 – The Pentagon IP addresses shifted back to the Pentagon.
12 September 2021 – The state of emergency under E.O. 13848 expired. 12 September was a Sunday; the last working day prior to it was Friday, 10 September.
16 September 2021 – The Sussmann indictment was filed. Observers have assessed this was to ensure it beat the toll on the statute of limitations for Sussmann’s false statement charge. The alleged false statement in question was given on 19 September 2016.
It would be fruitless to speculate without more information about whether Durham’s timing is related in any way to the expiration of the 13848 emergency. Let us, for now, honor Occam’s Razor and assume the driver was the statute of limitations.
But that’s not all there is to say. One thing we could construct out of this is the postulate that people inside the federal executive were aware in September 2020 that Trump would extend his 13848 emergency. I don’t pretend to know what they thought he (or someone) might do with it, but it’s certainly conceivable that Global Resource Systems was created, once knowledge of the extension was certain, for the purpose of transferring those Pentagon IP addresses if Biden took over in January. (The 2020 general election hadn’t been held yet.)
Accepting that transfer of IP addresses is the only thing GRS has done since it was created on 8 September 2020. The closely timed and efficient transfer, just before Biden’s statutory term began, is a good indicator that the only thing GRS was created for was that IP address transfer.
It might be productive to root around for other factors that may have driven the timing of GRS’s creation.
A larger context
But I’ll close with what seems to me to be an illuminating metanarrative observation. Consider all of that very particular history. Now consider something else Patel Patriot highlighted from the end of Obama’s second term: the 17 January 2017 posting of a document called Federal Continuity Directive 1 (FCD-1), in which FEMA fleshed out guidance for “continuity of government” based on Obama’s latest presidential policy directive on that topic, PPD-40.
Obama’s PPD-40, dated 15 July 2016, revoked and replaced a similar document on continuity of government (COG) signed by George W. Bush in 2007. Most readers probably understand that “COG,” dating to the Eisenhower administration, is a set of policies for ensuring government can continue to function in a state of emergency, including catastrophic emergency in which normal operating spaces – buildings, power, equipment – have been lost. Senior personnel may have been lost as well.
Obama’s PPD-40 is classified and has not been seen by the public. I didn’t think a great deal about it when the FEMA document was published three days before Obama left office.
But in retrospect, after four years of the federal executive fighting Trump tooth and nail on policy issues, and after Trump published E.O. 13961 – “Federal Mission Resilience” – on 7 December 2020, which revoked and replaced portions of PPD-40 and a prior Obama E.O. (see below), the thought could not but occur that these updates on continuity of government may have been live maneuvers rather than mere bureaucratic grass-mowing. (Patel Patriot has more on E.O. 13961 and its base document, the Federal Mission Resilience Strategy.)
Bolstering this thought was a basically incontrovertible point about Obama’s last-minute alterations to E.O. 12333, the Reagan E.O. that, with its revisions, still governs the handling of sensitive national intelligence that may (among other things) involve the identities of Americans. The changes to 12333, signed out surreptitiously by subordinates (Clapper and Lynch) on 3 January 2017 and largely gutting accountability for sensitive-data handling, were timed to institutionalize what the Obama agencies had been doing to spy on Americans throughout 2016. (And indeed, going by collateral clues, for years prior to that.)
It would be in-pattern, across the board, for the Obama administration to update federal guidance documents during the transition period, in order to institutionalize such advantageous agency practices. It probably wasn’t necessary to put that FEMA FCD out three days before Obama left office, when the Obama administration wouldn’t be there to execute it. But the Obama administration, prioritizing it, may have seen it as advantageous; i.e., as getting a jump on the incoming administration.
And when the Trump administration undid some of the key provisions from PPD-40 – after the 2020 election and as the presidential transition appeared increasingly inevitable – well, that action is harder to attribute to mere policy-neutral concerns than to a revulsion against whatever Obama’s apparent intent with PPD-40 was. The latter seems more likely.
The same might be said of Obama’s decision to completely replace Bush 43’s continuity policy from 2007. Three presidents in a row have now substantially revised the COG policy of their immediate predecessors. And in the last two cases, they have taken related actions during the transition period before the new administration came in.
That’s an awfully big topic on which to keep revising policy as if there’s some pressing tactical necessity for it. At least, it’s awfully big if all other things are equal. Maybe all other things aren’t.
On the same theme, once Biden had been elected, it would not be surprising to see people who had worked for Biden’s election and hailed his advent with enthusiasm continue the shadow play with fresh moves.
The refocus with the Trump “mission resilience” update
Is that what the IP address shift was part of, on 20 January 2021? I’m not necessarily convinced one way or the other. But there’s a clue in Patel Patriot’s “Part 13,” and its discussion of another Obama order on COG: E.O. 13618 from 6 July 2012.
That order was about communications during a national emergency. Certainly read Patel Patriot’s treatment; here is what jumps out at me.
The Obama E.O., 13618, named the president’s homeland security and counterterrorism advisor and the director of the White House Office of Science and Technology Policy as the very small team that would “make recommendations to the president” and monitor the execution of national communications authorities – in particular, those relating to secure communications for the federal government – in the event of an emergency/COG situation. The homeland security advisor would effectively be at the summit, just under POTUS.
Within agencies, there would then be representatives for communications issues. As Patel Patriot notes, it was basically all federal agencies that would sit at the table and dicker over national government comms concerns.
Trump’s 13961 created an executive committee for federal mission resilience comprising the following officers:
Secretary of Defense
Secretary of Homeland Security
Director of National Intelligence
Assistant to the President for National Security Affairs (APNSA) – Also known as National Security Advisor
Assistant to the President and Deputy Chief of Staff for Operations
Director of the Office of Management and Budget
Director of the Office of Science and Technology Policy
The executive committee (EC) is vested with the communications responsibilities assigned in Obama’s E.O. 13618 to the homeland security advisor and the OSTP director. But the EC in 13961 also sits for the various other federal agencies.
Under the Trump E.O., during emergency execution, the OSTP director is the conduit to the president, rather than the homeland security advisor, who is not in the picture. In its planning functions, meanwhile, the EC isn’t stratified or shaped into a funnel in terms of reporting to POTUS.
As a passing point, it’s not a bad use of time to recall who was in the two positions designated by the Obama E.O. when it was promulgated in July 2012. Those individuals were, respectively, John Brennan, and John Holdren (OSTP).
As Patel Patriot notes, the OSTP director is reflected in the EC formed by E.O. 13961. The incumbent in December 2020 was Kevin Droegemier. You’re unlikely to have ever heard of him.
Moreover, the homeland security advisor, as mentioned, is not an EC member, and is not assigned a specific communications “resilience” role in 13961. The national security advisor – who in December 2020 was Robert O’Brien – is on the EC, and mirrors his traditional NSC role, founded in the 1947 National Security Act, of convening the EC and coordinating its activities.
The national security advisor is also designated the “National Continuity Coordinator” in the Trump E.O., a particular that is stated to be a revision to Obama’s PPD-40, and refers to a more general coordinating role; i.e., beyond the specific matter of communications. This reinforces the traditional centrality of the national security advisor.
It’s quite important that the president’s homeland security advisor isn’t on the executive committee. In the Obama arrangement, one of the two amigos snuggled directly under the president had an inherently political policy portfolio. He was also John Brennan when the E.O. was signed – never a meaningless point – and even more significantly, he was the president’s advisor for counterterrorism as well as homeland security.
That seemingly minor detail is a major clue to Trump’s intent with E.O. 13961. Obama’s 2012 order was written as if terrorism was likely to be at the heart of an emergency/COG situation. Trump’s 2020 order was not.
That matters because of what we’ll see below.
Correlation of forces in continuity of government
The upshot of all this is as follows (my analysis, based on seeing the federal executive at work):
Under E.O. 13961, the conduit to POTUS during emergency execution is an official (Director OSTP) who is traditionally more apolitical and comes from a background of scientific expertise. (John Holdren, well known to hold progressive-left ideological views, was something of an exception.) This would tend to relieve concerns about overpoliticization of a critical function in emergency situations. It’s characteristic of Trump to prefer such an arrangement.
E.O. 13961 also levels the playing field for interagency resilience planning. The role of a homeland security and counterterrorism advocate in national communications resilience is downgraded from the special position it had under Obama’s 13618. The national security advisor plays his customary role on the NSC. No unique interagency power centers are created.
In both modes – emergency execution and planning – the arrangement under 13961 favors POTUS retaining effective control of major decisions. The OSTP director is not an official who comes in with a formidable, lobby-able political base; he or she is likely to simply execute as required, and in any case is easier for the White House chief of staff to keep an eye on.
On the EC, run on the same basis as the NSC, the national security advisor will coordinate planning activities relating to communications, as well as to the other aspects of mission resilience.
We can’t be sure, given the scattered and secretive nature of what we get from the Biden White House, how much E.O. 13961 is being adhered to today. It’s present on the Homeland Security website as a currently-effective guidance document, along with the Federal Mission Resilience Strategy, but that may or may not be meaningful.
That said, here’s the specific way it matters to the Pentagon IP addresses. I see no evidence that the distribution of national comms responsibilities has changed since the revisions under Bush 43, when Homeland Security was created. The Defense Department is responsible for national command and federal government comms; Homeland Security coordinates with industry on continuity/resilience for private-sector communications (i.e., your Internet and cell phone, which are part of “critical infrastructure”), and with the state, local, tribal, and territorial governments on their comms requirements. (See the breakout in Bush’s 2007 order and Obama’s from 2012.)
But under Obama’s E.O. 13618, homeland security got wedged in between POTUS and DOD, for what were effectively both planning and execution responsibilities for national command and federal government communications.
Under 13961, there’s no wedge. The homeland security advisor, with his counterterrorism role, can’t function as a form of higher authority vis-à-vis DOD’s national comms portfolio. Through the executive committee, DOD answers directly to the president for its planning, and need expect little if any politicized brokerage working with, or through, the OSTP director during emergency execution.
That’s how Trump set it up with his December 2020 order. Under Obama, while DHS per se wasn’t put in a privileged position, the homeland security advisor was. Maybe that was just a holdover from the 9/11 mindset. Maybe.
But given the perspective of the Obama administration on the nature of “domestic terrorism” – a perspective from which the Biden administration now operates – that’s a lot of freighted political privilege wedged between POTUS and DOD. (Remember: NSA is a component of DOD, as is the joint four-star Cyber Command: key elements of mission resilience for national government communications. The Space Service, with its role in space-based national comms, is another key participant. A homeland security and counterterrorism nexus with a stovepipe into the White House, viewing half the American public as “domestic terrorists” and wedged in a notch above DOD for any government resilience purpose, is an accident to Americans’ constitutional rights just waiting to happen. The same is true, for some resilience matters, of homeland security being wedged in above the Justice or Treasury Departments.)
With 13961, Trump effectively removed the wedge as a drag on managing DOD’s communications role in COG situations.
It makes for an interesting perspective on the IP addresses shift on 20 January 2021, which I assume to have been done by actors loyal to the incoming Biden administration. Food for thought.
Feature image: Trump boards Marine One on his way out of Washington, D.C. on 20 January 2021. AIR.TV video