FTR #930 The Trumpenkampfverbande, Part 9: Alfa Males, Part 3 (German Ostpolitik, Part 3)

With the (jus­ti­fi­able) out­rage swirling around FBI direc­tor (and Mitt Rom­ney backer) James Comey’s pub­lic dis­cus­sion of the dis­cov­ery of more of Hillary Clin­ton’s e‑mails hav­ing been dis­cov­ered, anoth­er elec­tion-relat­ed inves­ti­ga­tion has gone large­ly unex­am­ined. Indeed, the impor­tance of the inves­ti­ga­tion has been down­played.

Com­put­er experts dis­cov­ered a link between a serv­er reg­is­tered to the Trump orga­ni­za­tion and two servers reg­is­tered to the Alfa Bank in Moscow, a bank that is part of the Alfa con­glom­er­ate dis­cussed in FTR #‘s 530 and 573.

In the Foer piece, and in attempt­ed dis­cred­it­ing arti­cles of same, it is appar­ent that the inves­ti­ga­tors do not under­stand the nature of the enti­ty they are inves­ti­gat­ing. The jour­nal­is­tic “spin” put on Alfa in the cov­er­age is “Russia/Putin/Kremlin” new Cold War con­text. Alfa is very, very dif­fer­ent.

In FTR #‘s 530, 573 we examnined the nature of Alfa’s his­to­ry, oper­a­tions and insti­tu­tion­al and eco­nom­ic foun­da­tions. It is any­thing BUT “Kremlin/Putin/Russia.”

It appears to be Under­ground Reich, all the way, with evi­den­tiary trib­u­taries run­ning in the direc­tion of: the Iran-Con­tra scan­dal; the Iraq­gate scan­dal; the oil-for-food scam vis a vis Iraq; malfeasanace by a coterie of GOP big­wigs includ­ing Dick Cheney and oth­ers close to George W. Bush, and Haley Bar­bour; mon­ey-laun­der­ing by pow­er­ful inter­na­tion­al drug syn­di­cates; Chechen war­lords and drug-traf­fick­ing syn­di­cates; the Roy­al fam­i­ly of Liecht­en­stein; the Bank al-Taqwa (which helped finance al-Qae­da); the Marc Rich oper­a­tions; East­ern Euro­pean and Russ­ian asso­ciates of Wolf­gang Bohringer, one of Mohamed Atta’s close asso­ciates in South Flori­da; and the Carl Duis­berg Fel­low­ship, which brought Mohamed Atta to Ger­many from Egypt and may have helped him into the U.S.

The pro­gram high­lights major aspects of the inves­ti­ga­tion into the Alfa/Trump link:

The Trump/Alfa link was not a mal­ware attack, as some of the com­put­er sci­en­tists ini­tial­ly thought: ” . . . . The researchers quick­ly dis­missed their ini­tial fear that the logs rep­re­sent­ed a mal­ware attack. The com­mu­ni­ca­tion wasn’t the work of bots. The irreg­u­lar pat­tern of serv­er lookups actu­al­ly resem­bled the pat­tern of human conversation—conversations that began dur­ing office hours in New York and con­tin­ued dur­ing office hours in Moscow. It dawned on the researchers that this wasn’t an attack, but a sus­tained rela­tion­ship between a serv­er reg­is­tered to the Trump Orga­ni­za­tion and two servers reg­is­tered to an enti­ty called Alfa Bank. . . .”

The set-up was high­ly unusu­al: ” . . . . The researchers had ini­tial­ly stum­bled in their diag­no­sis because of the odd con­fig­u­ra­tion of Trump’s serv­er. ‘I’ve nev­er seen a serv­er set up like that,’ says Christo­pher Davis, who runs the cyber­se­cu­ri­ty firm HYAS InfoS­ec Inc. and won a FBI Direc­tor Award for Excel­lence for his work track­ing down the authors of one of the world’s nas­ti­est bot­net attacks. ‘It looked weird, and it didn’t pass the sniff test.’ The serv­er was first reg­is­tered to Trump’s busi­ness in 2009 and was set up to run con­sumer mar­ket­ing cam­paigns. It had a his­to­ry of send­ing mass emails on behalf of Trump-brand­ed prop­er­ties and prod­ucts. Researchers were ulti­mate­ly con­vinced that the serv­er indeed belonged to Trump. (Click here to see the server’s reg­is­tra­tion record.) But now this capa­cious serv­er han­dled a strange­ly small load of traf­fic, such a small load that it would be hard for a com­pa­ny to jus­ti­fy the expense and trou­ble it would take to main­tain it. ‘I get more mail in a day than the serv­er han­dled,’ Davis says. . . .”
The arti­cle details more unusu­al aspects of the link: ” . . . . That wasn’t the only odd­i­ty. When the researchers pinged the serv­er, they received error mes­sages. They con­clud­ed that the serv­er was set to accept only incom­ing com­mu­ni­ca­tion from a very small hand­ful of IP address­es. . . . Eighty-sev­en per­cent of the DNS lookups involved the two Alfa Bank servers. ‘It’s pret­ty clear that it’s not an open mail serv­er,’ Camp told me. ‘These orga­ni­za­tions are com­mu­ni­cat­ing in a way designed to block oth­er peo­ple out.’ . . . .”

Paul Vixie–one of the pre­mier experts in the field–felt the con­nec­tion was high­ly unusu­al: ” . . . . Ear­li­er this month, the group of com­put­er sci­en­tists passed the logs to Paul Vix­ie. In the world of DNS experts, there’s no high­er author­i­ty. Vix­ie wrote cen­tral strands of the DNS code that makes the inter­net work. After study­ing the logs, he con­clud­ed, ‘The par­ties were com­mu­ni­cat­ing in a secre­tive fash­ion. The oper­a­tive word is secre­tive. This is more akin to what crim­i­nal syn­di­cates do if they are putting togeth­er a project.’ Put dif­fer­ent­ly, the logs sug­gest­ed that Trump and Alfa had con­fig­ured some­thing like a dig­i­tal hot­line con­nect­ing the two enti­ties, shut­ting out the rest of the world, and designed to obscure its own exis­tence. . . .”

The avail­able evi­dence indi­cates that the hookup indi­cat­ed “human-lev­el com­mu­ni­ca­tion”: ” . . . I put the ques­tion of what kind of activ­i­ty the logs record­ed to the Uni­ver­si­ty of California’s Nicholas Weaver, anoth­er com­put­er sci­en­tist not involved in com­pil­ing the logs. ‘I can’t attest to the logs them­selves,’ he told me, ‘but assum­ing they are legit­i­mate they do indi­cate effec­tive­ly human-lev­el com­mu­ni­ca­tion.’ . . . ”

More about the nature of the com­mu­ni­ca­tion, from the sci­en­tist using the code-name “Tea Leaves”: ” . . . . Tea Leaves and his col­leagues plot­ted the data from the logs on a time­line. What it illus­trat­ed was sug­ges­tive: The con­ver­sa­tion between the Trump and Alfa servers appeared to fol­low the con­tours of polit­i­cal hap­pen­ings in the Unit­ed States. ‘At elec­tion-relat­ed moments, the traf­fic peaked,’ accord­ing to Camp. There were con­sid­er­ably more DNS lookups, for instance, dur­ing the two con­ven­tions. . . .”

The sci­en­tists attempt­ed to get the pub­lic to pay atten­tion to their inves­ti­ga­tion and New York Times writ­ers turned their atten­tion to the case: ” . . . In Sep­tem­ber, the sci­en­tists tried to get the pub­lic to pay atten­tion to their data. One of them post­ed a link to the logs in a Red­dit thread. Around the same time, the New York Times’ Eric Licht­blau and Steven Lee Myers began chas­ing the sto­ry.* (They are still pur­su­ing it.) Licht­blau met with a Wash­ing­ton rep­re­sen­ta­tive of Alfa Bank on Sept. 21, and the bank denied hav­ing any con­nec­tion to Trump. . . .”

Things got “inter­est­ing” after that. Accord­ing to the com­put­er sci­en­tists, the Trump Orga­ni­za­tion shut down the serv­er! As the bril­liant Berke­ley researcher Peter Dale Scott not­ed, in a dif­fer­ent con­text, “The cov­er-up obvi­ates the con­spir­a­cy. ” . . . . In Sep­tem­ber, the sci­en­tists tried to get the pub­lic to pay atten­tion to their data. One of them post­ed a link to the logs in a Red­dit thread. Around the same time, the New York Times’ Eric Licht­blau and Steven Lee Myers began chas­ing the sto­ry.* (They are still pur­su­ing it.) Licht­blau met with a Wash­ing­ton rep­re­sen­ta­tive of Alfa Bank on Sept. 21, and the bank denied hav­ing any con­nec­tion to Trump. . . . The com­put­er sci­en­tists believe there was one log­i­cal con­clu­sion to be drawn: The Trump Orga­ni­za­tion shut down the serv­er after Alfa was told that the Times might expose the con­nec­tion. Weaver told me the Trump domain was ‘very slop­pi­ly removed.’ Or as anoth­er of the researchers put it, it looked like ‘the knee was hit in Moscow, the leg kicked in New York.’. . . . Four days lat­er, on Sept. 27, the Trump Orga­ni­za­tion cre­at­ed a new host name, trump1.contact-client.com, which enabled com­mu­ni­ca­tion to the very same serv­er via a dif­fer­ent route. When a new host name is cre­at­ed, the first com­mu­ni­ca­tion with it is nev­er ran­dom. To reach the serv­er after the reset­ting of the host name, the sender of the first inbound mail has to first learn of the name some­how. It’s sim­ply impos­si­ble to ran­dom­ly reach a renamed serv­er. ‘That par­ty had to have some kind of out­bound mes­sage through SMS, phone, or some non­in­ter­net chan­nel they used to com­mu­ni­cate [the new con­fig­u­ra­tion],’ Paul Vix­ie told me. The first attempt to look up the revised host name came from Alfa Bank. ‘If this was a pub­lic serv­er, we would have seen oth­er traces,’ Vix­ie says. ‘The only look-ups came from this par­tic­u­lar source.‘According to Vix­ie and oth­ers, the new host name may have rep­re­sent­ed an attempt to estab­lish a new chan­nel of com­mu­ni­ca­tion. But media inquiries into the nature of Trump’s rela­tion­ship with Alfa Bank, which sug­gest­ed that their com­mu­ni­ca­tions were being mon­i­tored, may have deterred the par­ties from using it. Soon after the New York Times began to ask ques­tions, the traf­fic between the servers stopped cold. . . .”

Not sur­pris­ing­ly, the FBI has dis­missed the rel­e­vance of the com­put­er link.

This dis­missal comes against the back­ground of sev­er­al late-break­ing devel­op­ments:

The unsuc­cess­ful attempt by Alfa sub­sidiary Crown Resources to buy Marc Rich’s com­modi­ties firm: ” . . . A deal to sell the Swiss-based com­modi­ties oper­a­tion of for­mer U.S. fugi­tive financier Marc Rich to Rus­sia-owned ener­gy trad­ing group Crown Resources is off. . . . Crown is owned by the Alfa Group con­glom­er­ate. . . . .”

The sub­se­quent suc­cess­ful attempt by Alfa play­er Mikhail Frid­man to pur­chase the Marc Rich firm: ” . . . Mikhail Frid­man: ‘Defen­dant Mikhail Frid­man cur­rent­ly serves as Chair­man of the Board of Direc­tors of co-con­spir­a­tor Alfa Bank and as Chair­man of the Board of Direc­tors of Defen­dant Con­sor­tium Alfa Group. Frid­man fur­ther served on the Board of Vim­pel­Com, a NYSE com­pa­ny, and has con­trol over Gold­en Tele­com, a NASDAQ com­pa­ny ... pur­chased the Unit­ed States trad­ing firm owned by Amer­i­can, Mark Rich, the one time com­modi­ties baron par­doned by Pres­i­dent Clin­ton with much con­tro­ver­sy. . . .”

The FBI’s long-dor­mant Twit­ter account began tweet­ing files about Bill Clin­ton’s par­don of Marc Rich, short­ly after the offi­cial dis­missal of inves­ti­ga­tions into the Alfa/Trump link: ” . . . . Now, a new inter­a­gency mys­tery is rais­ing ques­tions about whether the F.B.I. has become politi­cized, just days before the pres­i­den­tial elec­tion. On Sun­day, a long-dor­mant F.B.I. Twit­ter account sud­den­ly sprung to life, blast­ing out a series of links to case files that cast the Clin­tons in a decid­ed­ly neg­a­tive light. . . . Then, on Tues­day, the “FBI Records Vault” account—which had not tweet­ed at all between Octo­ber 2015 and Sunday—published a link to records relat­ed to the 15-year-old, long-closed inves­ti­ga­tion into for­mer Pres­i­dent Bill Clinton’s par­don­ing of one­time com­modi­ties trad­er turned fugi­tive Marc Rich. The post, which was quick­ly retweet­ed thou­sands of times, links to a heav­i­ly redact­ed doc­u­ment that repeat­ed­ly ref­er­ences the agency’s “Pub­lic Cor­rup­tion” unit—less-than-ideal optics for Hillary Clin­ton, who has spent her entire cam­paign fight­ing her image as a cor­rupt politi­cian. . . .”

FBI Direc­tor James Comey was in charge of the orig­i­nal Marc Rich inves­ti­ga­tion and the par­don of Rich by Bill Clin­ton. Is there a con­nec­tion between the offi­cial dis­missal of the inves­ti­ga­tion into the Alfa/Trump link by the FBI, the tweet­ing by the FBI of the files on the Clin­ton par­don of Marc Rich and the fact that it was Comey who presided over the Marc Rich inves­ti­ga­tions? ” . . . . In 2002, Comey, then a fed­er­al pros­e­cu­tor, took over an inves­ti­ga­tion into Pres­i­dent Bill Clin­ton’s 2001 par­don of financier Marc Rich, who had been indict­ed on a laun­dry list of charges before flee­ing the coun­try. The deci­sion set off a polit­i­cal firestorm focused on accu­sa­tions that Rich’s ex-wife Denise made dona­tions to the Demo­c­ra­t­ic Par­ty, the Clin­ton Library and Hillary Clin­ton’s 2000 Sen­ate cam­paign as part of a plan to get Rich off the hook. Comey ulti­mate­ly decid­ed not to pur­sue the case. The kick­er: Comey him­self had over­seen Rich’s pros­e­cu­tion between 1987 and 1993. . . .”

Pro­gram High­lights Include: details of the Carl Duis­berg Soci­ety’s links to Atta and to major Ger­man cor­po­ra­tions; dis­cus­sion of the Alfa Fel­lowhip against the back­ground of Ger­man Ost­poli­tik dis­cussed in FTR #‘s 918 and 919; detailed analy­sis of Vik­tor Kozeny asso­ciates Frid­man and (Pyotr) Aven (Kozeny employed Bohringer as a pilot); a sum­ma­ry analy­sis of the major points in FTR #‘s 530 and 573.

FTR #656 The Obama File, Part III: Badjacketing Obama, Part 2, The Headscarf Incident

Exam­in­ing the “head­scarf inci­dent” and Mus­lim Broth­er­hood ele­ments in the Unit­ed States.