Horowitz 25-010 and the Codename Leak Investigations

In December 2024, Horowitz released a little noticed report (25-010 link), entitled “A Review of the Department of Justice’s Issuance of Compulsory Process to Obtain Records of Members of Congress, Congressional Staffers, and Members of the News Media | U.S. Department of Justice Office of the Inspector General”, which included a review of subpoenas of communications involving members of congress and congressional staff in connection with four leak investigations related to articles published by CNN, Washington Post and New York Times in April-July 2017.

It seems more or less certain that the Washington Post and New York Times investigations connect somehow to the codename leak investigations of reporting in Washington Post and/or New York Times in the same period (i.e. Arctic Haze Solomon less redacted, Sirens Lure, Foggy Falls: see Federalist link; Solomon link). While we know the articles that were subjects of the codename investigations, Horowitz 25-010 didn’t identify the articles which were subjects of the four investigations under his review.

In this article, I will deduce the subject articles of the leak investigations of Horowitz 25-010, which do indeed overlap with the codenamed investigations, and from these identifications, provide some fresh commentary on the leaks and the leak investigations.

Washington Post 1 Investigation

The “Washington Post 1” investigation concerned the disclosure of the existence of the FISA surveillance of Carter Page.

Horowitz observed that this “classified information … originated with the FBI”. This is relevant to leak investigation procedures. According to the documents released this summer on the codename investigations, it appears that it was up to the agency to which the information “belonged” to initiate a leak investigation by filing a crime report with DOJ National Security Division.

The article in question is clearly the April 12, 2017 Washington Post article by Nakashima, Barrett and Entous entitled “FBI Obtained FISA Warrant to Monitor Trump Adviser Carter Page” (link; archive), which was the subject of the Foggy Falls codename investigation opened on May 10, 2017. Unlike the other codename investigations, the ODNI documents do not mention the originating Crime Report for the Foggy Falls investigation, but one presumes that there was an FBI report to DOJ NSD prior to its opening.

There are somewhat differing details between the Foggy Falls documents and the Horowitz 25-010 reporting that I will try to address in a future article. One relevant detail from Horowitz: this particular classified information “belonged” to the FBI and it was up to the FBI to initiate a leak investigation by filing the appropriate crime report with DOJ National Security Division: while the date of such crime reports is reported in ODNI documents for other codename investigations, there is no discussion of this underlying crime report in respect to the Foggy Falls (Carter Page FISA) leak investigation.

As a quick comment: the primary contribution of the Carter Page FISA leak was to lend undeserved credibility to the overall Russia collusion investigation, which, at that time, was primarily dependent on Steele dossier allegations, the provenance of which had been “collapsed” by January 2017 evidence from Steele’s Primary Sub-source - evidence that was concealed by FBI in their operation to announce Russia collusion investigation to the public. The FISA warrant didn’t yield anything relevant to the Russia collusion investigation and, by April 2017, was known to be irrelevant. But the leak made it seem as though there was something “there”.

New York Times and Washington Post 2 Investigations

Horowitz 25-010 reported that the New York Times, Washington Post 2 and CNN investigations were all opened in August 2017.

The Arctic Haze and Sirens Lure codename investigations were both opened on August 14, 2017, based on two letters from DOJ National Security Division (Jay Bratt ?) to Paul Haertel, FBI Counterintelligence Division on August 1, 2017, each of which cited articles listed in a [CIA] Crime Report dated June 23, 2017.

Horowitz 25-010 also noted that other new media outlets “published some of the same classified information” and that these stories had also been referenced in the originating Crime Reports from [CIA], but DOJ had “decided to focus” on the leaks to New Yotk Times and Washington Post.

Arctic Haze ~ New York Times Investigation

With these clues in hand, the Arctic Haze codename investigation is almost certainly equivalent to the New York Times (sensu Horowitz) investigation.

The DOJ NSD letter to FBI for the Arctic Haze codename investigation listed four articles (1,2,3 and 6 from the CIA Crime Report of June 23, 2017) as shown below:

These same four articles were listed in a Letterhead Memorandum dated Sept 15, 2017. But the Arctic Haze Closing Letterhead Memorandum, dated September 8, 2021, cited only one of the four articles: the April 22, 2017 New York Times article by Apuzzo et al.

This is the article that is of concern in the Comey Indictment.

The classified information of concern to the CIA in the April 22, 2017 New York Times article was its disclosure of CIA’s possession of the “Rentaria memo”, which had been acquired by CIA. The “Rentaria memo” was also discussed in two other Arctic Haze subject articles (Demirjan and Barrett, May 24, 2017 and Jenkins, May 27, 2017) , but, as noted by Horowitz - see above, the

Horowitz 25-010 reported that, on January 5, 2021 (during the final days of Trump 45 administration), DOJ obtained a 2703(d) order for non-content communications of the four New York Times reporters listed in the April 22, 2017 article, together with a 2705(b) sealing order. This order was immediately litigated by Google. Under the incoming Biden administration, the sealing order was quickly modified so that New York Times lawyers were notified. Soon thereafter, the Biden administration abandoned the subpoena and sealing order and shut down the leak investigation,

There are two dockets on Courtlistener related to these pleadings. The first docket. APPLICATION OF USA FOR 2703(d) ORDER FOR SIX EMAIL ACCOUNTS SERVICED BY GOOGLE FOR INVESTIGATION OF VIOLATION OF 18 U.S.C. §§ 641 AND 793, 1:20-sc-03361, (D.D.C.), (link) began on December 22, 2020. The original 2703(d) application was unsealed in December 2021 (link). It was heavily redacted, but shows the April 22, 2017 date in paragraph 23.

On June 8, 2021, New York Times filed an unsealing motion (1:21-mc-00091-ZMF Courtlistener link), reported on by Charlie Savage at NYT on June 8, 2021 (archive). The closing decision was issued by J Boasberg in December 2021 (link).

The Arctic Haze closing letterhead memorandum doesn’t contain any unredacted discussion of the attempted subpoena of New York Times reporters that was belatedly initiated in closing days of Trump administration and abandoned under Biden administration. But it does contain several redacted pages which may relate to these proceedings.

The Arctic Haze investigation was closed in early stages of Biden administration. Its Closing Letterhead Memorandum was issued on Sept 8, 2021. The investigation accomplished nothing.

Sirens Lure ~ Washington Post 2 Investigation

The Sirens Lure codename investigation is related to the Washington Post 2 (sensu Horowitz) investigation, but the relationship is more complicated.

The August 1, 2017 DOJ NSD letter to FBI for the Sirens Lure codename investigation listed three articles (4,5 and 7 from the CIA Crime Report of June 23, 2017) as shown below:

All three articles disclose information obtained by CIA through “intercepts” of reports to Moscow by Russian ambassador Kislyak about his meeting with Jared Kushner in December 2016. (The eighth article listed in the June 23, 2017 CIA Crime Report remains unknown, but it almost certainly is connected to the CNN Investigation, the subject article of which is also presently unknown. The date of the article is between June 2, 2017 and June 22, 2017. Walkafyre and I have discussed candidate articles which I will write up separately.)

Horowitz 25-010 also reports that DOJ similarly sought 2703(d) subpoena for three Washington Post reporters (together with 2705(d) sealing order).

The pleadings related to the 2703(d) order are located in DC court records here (h/t to US Press Freedom Tracker link). The 2703(d) application, filed on December 22, 2020 is here. It listed three articles by Nakashima (Reporter A), Entous (Reporter B) and Miller (Reporter C) - one of which (and only one) overlapped the Sirens Lure list. (The June 23, 2017 and July 22, 2017 articles were both subsequent to the June 23, 2017 CIA Crime Report which originated the Sirens Lure codename investigation.)

As noted above, the May 26, 2017 article disclosed that US intelligence agencies had hacked (“intercepted”) ambassador Kislyak’s report to Moscow about his December 2016 meeting with Jared Kushner.

The second article in the Washington Post 2 Investigation was the seminal June 23, 2017 article entitled “Obama’s secret struggle to punish Russia for Putin’s election assault” (link; archive). See brief discussion in footnote¹

The third article in the Washington Post 2 investigation was a July 22, 2017 article by Entous, Nakashima and Miller was entitled “Sessions discussed Trump campaign-related matters with Russian ambassador, U.S. intelligence intercepts show” (archive). It disclosed that US intelligence agencies were in possession of Kislyak reports on meetings/encounters with Sessions in April 2016 and July 2016.

The July 22, 2017 article observed that the “intelligence on Sessions … is based on Kislyak’s accounts and not corroborated by other sources”:

Readers may recall that Sessions’ recusal was instigated by a March 1, 2017 article by the same three Washington Post reporters entitled “Sessions met with Russian envoy twice last year, encounters he later did not disclose” (archive). Given that the July 22, 2017 article was based on US intercepts of Kislyak reporting (the existence of which was highly classified), it seems highly likely that the March 1, 2017 reporting was similarly prompted by the same US intercepts of Kislyak reporting. “Prompted” in the sense that the March 1, 2017 article attributed the information to Justice Department officials, but, re-reading, the March 1, 2017 article smells of parallel construction. It is implausible that Justice Department officials volunteered information about Kislyak-Sessions encounters, as opposed to being questioned about such encounters by Washington Post reporters who were already in possession of the information through a leak. Recall that an FBI document dated March 7, 2017 listed “discussion related to the FBI’s input into the AG’s recusal decision” as a “redline re Crossfire Hurricane Cases”. Why was this a redline? Did the FBI leak information to the Washington Post reporters about the Sessions-Kislyak encounters that it had obtained from the highly classified CIA intercepts? Does this connect to Comey indictment?

As in the New York Times investigation, the FBI applied for a 2703(d) subpoena for non-content communications related to three Washington Post reporters (together with a 2705(b) sealing order) in the waning days of the Trump administration (on December 22, 2022. The order was granted on January 5, 2021.

The request for emails was sent to Proofpoint who promptly replied (January 15, 2021) that they didn’t have the emails. The Biden administration arrived a few days later and did not renew efforts to obtain the emails.

On May 11, 2021, in early days of Biden administration, WFO filed a Closing Letterhead Memorandum to close the Sirens Lure investigation. This memorandum discussed information from “a former HPSCI staffer” (the Whistleblower in recent ODNI documents), as a result of which the FBI interviewed a “former HPSCI Staff Director, a main person of interest” (identifiable as Michael Bahar) in May 2020, who “denied leaking any classified information”.

The closing letterhead memorandum noted that FBI subsequently attempted to interview “another former staffer from HPSCI” but were blocked by HPSCI counsel. As a result of this resistance, the FBI gave up further investigative efforts involving congressional members or staffers.

There is no mention of any attempt to subpoena (2703(d)) non-content contacts of the Washington Post reporters in the unredacted portions of the Sirens Lure closing memorandum.

On May 24, 2021, the FBI filed an EC closing the Sirens Lure investigation.

On June 10, 2021, a couple of days after the New York Times order on June 8, 2021, the DOJ filed a motion to unseal and withdraw the corresponding 2703(d) and 2705(d) orders related to Washington Post. These orders were issued in early July 2021 (see docket).

Conclusion

The Arctic Haze and Sirens Lure investigations were total failures. The primary investigative tool appears to have been the examination of official government email and telephone records even though, based on prior experience - see SA Jett affidavit - there was negligible prospect of identifying the leaker from government records. No attempt was made to examine reporter records until the very last days of the Trump 45 administration. Needless to say, these efforts were quickly shut down by the incoming Biden administration and the files closed.

The Arctic Haze/New York Times investigation, such as it was, connects directly to the Comey Indictment: both are connected to the April 22, 2017 New York Times article. So we are going to hear more about this.

The Washington Post 2 investigation (which overlaps the Sirens Lure codename investigation) may have an intriguing - and previously unnoticed - connection to the Sessions’ recusal and the intriguing FBI redline against discussion of the FBI role in the recusal. This is a topic that I plan to address in more detail.

1. This article described or purported to describe a “CIA breakthrough” containing “intelligence on Putin [that] was extraordinary on multiple levels, including as a fear of intelligence”.

Ever since the publication of this article in June 2017, there have been questions about exactly what Brennan’s secret intelligence was. The recently released HPSCI Majority Report provides a possible answer- an answer which casts serious doubt on the validity of Brennan’s secret intelligence and the process by which it was elevated.