Tampering with Evidence: A Cost-Benefit Analysis

by emptywheel

Thus far, one of the most intriguing responses to my email tampering theory comes from Anonymous Liberal (who, I should emphasize, doesn't buy my theory). AL asks,

Does it really seem credible that Rove would go to all that trouble to create a document that is only marginally, if at all, helpful to him? I think not.

Great question, AL. How would Rove weigh the relative costs and benefits of tampering with the evidence involved in this case?

To answer that question, I'd like to consider the two pieces of evidence (that we know about) that Rove may have tampered with--the email and the phone log. I'd like to consider whether an evidence-tampering scenario benefits Rove sufficiently to make it worthwhile and if so, which benefits him the most.

Tampering Did Occur

Let me say right at the start that the evidence strongly suggests that some kind of evidence tampering occurred. We know that Fitzgerald had no idea Cooper and Karl spoke until Cooper testified he had had an earlier source than Libby, so we know he didn't get the Karl-Hadley email before August 2004. We know the email was responsive to at least one of the subpoenas and technically two; we know it would have been found on a search for Cooper's name. So at the very least, something happened to prevent the discovery of the email. Add in the implausibility of the White House not recording calls on the main switchboard, and it seems highly likely that evidence of the Rove-Cooper call was systematically suppressed, in some fashion. This is supposition, of course. But assuming that some evidence tampering occurred, which would be the best cost-benefit risk for Rove?

Tampering with Phone Logs

I haven't heard many theories on how Rove would alter the phone log, mostly because we know so little about White House procedures for logging calls. Presumably, there'd be a log of Cooper's call from the White House operator and, possibly, another log in Rove's office. If it were just within Rove's office, he could have simply said, "Susan, it's probably best not to log Cooper's call. Let's you and I pretend it never happened" (although this doesn't explain why he would, at the same time, send out an email--any email--to Hadley effectively recording the call). But since the call came in through the White House switchboard, that's the log that would have had to have been altered. And altered is probably the case, since a call would presumably be logged as soon as it was put through (that is, it wouldn't be so simple as asking the operator not to record the call, you'd have to go down there and ask him or her to eliminate its record). Now, there may be the same kind of daunting challenges to altering a phone log as there are to altering an email, depending on when the log was altered. Is the log electronic, or paper-based? Does it get copied? Frankly, I don't know. In most offices, altering the log would be as simple as altering a piece of paper--in which case it'd be easy to recreate the entire log page. But this is the White House, so things may be different.

In any case, it seems to me there are just two options here. Either Ralston's implausible story is correct, that the WH only logs some phone calls (and not those that come through the main switchboard). Or evidence of the call was suppressed. I think the cost-benefit analysis for tampering with the phone log may be the same for all scenarios. It might be fairly easy to do. You'd likely be relying on the incredibly corrupt reliable Susan Ralston. And for all scenarios, you'd be weighing the damage of revealing the call with Cooper against the possibility of having the tampering discovered.

Tampering with Emails

There are at least four ways the email--and its production--may have been altered. It's important to consider all four, because each method would have a different cost-benefit analysis. And because, by examining all four, you realize that it is highly likely one of these occurred, and all carry some risk of obstruction charges. The question is which carries the most risk of discovery, and which carries the greatest benefit for your Machiavellian Turdblossom. That is, all evidence suggests that Karl chose between these four alternatives, so the question is "which method did he choose," not "did he choose to risk exposure."

The first method is to conduct the search in response to the subpoenas in such a way as to guarantee you don't find this email. Now, our understanding of what is included in the email comes from Luskin, so we can't be sure of everything it includes. But I strongly suspect that, if an obviously identifiable Luskin leak claimed the email said things it didn't, then Fitzgerald would have moved quicker on obstruction charges. That is, Fitzgerald has a copy of the email as currently constituted. If the email Fitzgerald has says, "Cooper called to talk about Wilson" but Luskin claims it says "Cooper called to talk about welfare reform," you gotta believe Fitzgerald would get suspicious. Here's what we know the email to have said:

Matt Cooper called to give me a heads-up that he's got a welfare reform story coming, When he finished his brief heads-up he immediately launched into Niger. Isn't this damaging? Hasn't the president been hurt? I didn't take the bait, but I said if I were him I wouldn't get Time far out in front on this.

This was clearly responsive to the January subpoena and generally responsive to the first subpoena. Any search on Cooper's name or the word Niger would have produced this email. So to avoid finding this email, you'd have to make sure the search didn't look for Cooper's name or the word Niger, or used an AND statement that included Wilson or something like that.

This method would almost certainly include a few people besides Karl (unless we're to believe that he and Hadley searched their own email). It would carry the risk of exposure if investigators insisted on doing a search themselves. But it would offer the most plausible excuse. "Oh, I'm sorry. When you said you wanted records of contact with Matt Cooper, I didnt' imagine you wanted us to search on Cooper's name." The most plausible excuse, but still a pretty pathetic one (and, incidentally, the one Luskin is currently using). Now perhaps the investigators haven't been able to do their own search of the servers. But I'd assume after Luskin produced this email, Fitzgerald made sure to have them do their own search. In which case the improper search terms would be discovered.

The second method is to withhold the email, after it has been found. Just simply not turn it over after it had been returned on a fairly competent search. Again, this would probably involve more people than just Rove (and might involve ethical violations on the part of Luskin as well). But it would provide a much less plausible excuse; once Fitzgerald had his own search done, he would compare the results of the search terms the White House said it used with the results it should produce. You might not pinpoint who was responsible for the obstruction. But you could definitively prove that obstruction had occurred.

The third method is to alter the content of the email at least once, to create an email that fit the search terms you know to have used, while still spinning the story like you'd want. This method probably requires the help of more people (some crack IT people). And it risks the same danger of discovery as the first option (why wasn't this found on a Cooper search?), plus the discovery of the altered data. But it might shift the time when the first discovery might happen. That is, if the FBI didn't find this email on its search, then it would offer the WH search some cover."Well, the FBI didn't find it when they looked for Cooper's name either, so it's probably just something funky with the email."

The last method is to create an email after the fact. I think (but am not positive) that this would be even more difficult technically than option three. But otherwise, it would have the same advantages--you could match it to known search terms and tailor it to the excuses you were offering when you handed over the email.

The Alternative: Scooter Libby

Before I get into the cost-benefit analysis, I'd like to consider the alternative. Now, far be it for me to claim that Libby didn't obstruct or witness tamper (aspen-turning, anyone??). But I've long thought Libby had the biggest temptation to alter evidence, specifically his hand-written notes, because it was the easiest thing to alter and the pretty damned incriminating. All he'd have to do is replace the pages on which he had taken notes, and voila! the entire record of WHIG's activities is magically altered.

But it appears Libby didn't do that. If Libby had altered his notes, he almost certainly would have removed the tidbit that he learned of Plame's identity from Dick, and he almost certainly would have removed the tidbit that he and Dick discussed Plame strategy on July 12. (Unless of course he kept it in there as a little insurance policy.)

And, as a result, Libby had to tell a really ridiculous lie. Libby had to tell a lie that would (and was) be immediately refuted by the key witnesses to his story. And, Libby had to accept the role of fall-guy, to explain away Dick's involvement in this. Perhaps not a problem if you're a loyal neocon. But an inconvenience, certainly.

We don't know how many transparent lies Rove would have had to tell if all the evidence was out there (remember, we only know about his conversation with Cooper because Cooper also had a conversation with Libby; it's possible there are more journalist conversations we don't know about that he has similarly suppressed evidence of). I suppose he'd just have had to make up a pathetic story about learning of Plame's identity from Cooper (rather than telling Cooper of her identity), just as Libby did. The biggest difference, for Karl, is that he spoke to the two known recipients of the White House leak. Karl has said he didn't tell Novak about Plame's cover status, but Karl's also a big fat liar. Whereas with Libby, all the known leakees corroborate he didn't tell about Plame's covert status (he didn't tell Judy, if we can believe Judy), with Rove, only Cooper does (so far). In other words, if Rove told Novak Plame was covert, then he might have a much bigger reason to hide his tracks, particularly since everyone was worried about an IIPA violation, not just passing on classified information.

Cost Benefit Analysis, Option One

There are three possible base conditions from which we can do cost-benefit analysis. The first is that Karl, crafty guy that he is, sent the email in its current state to Hadley as a CYA. He feels uncomfortable that he just shared Plame's identity, so he writes this email to suggest that the call was not primarily about Wilson, and to obscure the fact that he had passed on Plame's identity. One tidbit suggesting this is wrong is a comment from Joe Wilson, which indicates Karl had no idea he was breaking the law at the time:

Apparently, according to two journalist sources of mine, when Rove learned that he might have violated the law, he turned on Cheney and Libby and made it clear that he held them responsible for the problem they had created for the administration. The protracted silence on this topic from the White House masks considerable tension between the Office of the President and the Office of the Vice President.

But it's not unreasonable to suggest that Rove is such a tricky guy that he CYA's all the time.

So Karl writes a CYA email to Hadley right after his conversation with him. It's a CYA, but apparently not a good enough CYA. Because when the FBI and later Fitzgerald subpoenas evidence, Karl realizes that this email still reveals too much. If he turns over the email, he would have to explain that he did have a role in the Wilson leak in Fall 2003 or Winter 2004. He would have to admit that he was the source for at least one journalist.

Perhaps this wouldn't be too bad. After all, the WH was proclaiming in Fall 2003 that no one had committed a crime--they had stopped claiming Rove et al weren't involved, they were simply implying that Plame wasn't covert or that they hadn't passed on news of her status. Rove--at least according to Cooper--didn't pass on that news. So releasing the email would be perfectly acceptable given the US spin at the time. I really think this would have been the best option, given Karl's ability to control the message. If Karl really could claim he hadn't broken the law (and if it's true that Karl never saw the INR memo, he may legitimately have claimed he didn't know this was classified), then he should have handed over the email. So maybe hiding the email covered up evidence of greater guilt, perhaps leaking to Novak.

Or perhaps Karl wanted to avoid any possibility he might have to step down. One year before the presidential election.

Now, there's a lot of other evidence that suggests Karl lied in Fall 2003 and Winter 2004 about his involvement (claiming, among other things, that he hadn't spoken to anyone before Novak's article). So hiding this email would be consistent with the lies he was giving in his testimony. Presumably, his goal was to only admit the truth that he knew had been testified to. Thus, his strategy of first admitting he did have conversations with reporters but didn't tell of Plame's identity, then admitting he did speak with reporters before Novak's article, then admitting he talked to Cooper, and finally (presumably in his most recent GJ appearance) admitting he told Cooper of Plame's identity but not her covert status. The strategy is thoroughly a strategy of postponement, not necessarily one designed to avoid indictment.

So, to support such a strategy of postponement, which would be a better approach, to withhold the email or to conduct an incomplete search? Neither works very well, frankly. Because if your strategy is one of postponement, then the most important thing is to be able to release evidence and testimony in response to the testimony of others, as slowly as it takes to subpoena and appeal journalists to testify. If you've withheld the email or if you've conducted an incomplete search, you're still going to have explain how you got that email at precisely the time Cooper's testimony revealed the Rove conversation (which is where Rove is at, frankly). So it doesn't permit you to avoid obstruction charges.

More importantly, if someone does a complete search on the servers, than you're going to be found out at an inopportune time, perhaps right before the election. If this strategy is all about controlling the timeline of revelations, it carries the distinct risk that you'll lose control of the timeline.

Cost Benefit Analysis, Option Two

The second option is that no email existed, but Rove needed to invent it to provide some kind of excuse for why he remembered Cooper's email. This option doesn't make any sense to me (technical considerations aside). Rove would be inventing this email--risking an obstruction charge--to prevent a perjury charge. It seems the obstruction charge is more damaging politically than the perjury charge, and almost certainly incriminates more people. So this option doesn't seem to make sense to me.

Cost Benefit Analysis, Option Three

The third option is that the original email was fairly incriminating, something along the lines of "I just spoke with Matt Cooper from Time about Wilson and Niger. I explained Wilson's wife's involvement in this. Cooper seemed pretty hostile about doing a story. Maybe Libby can call and convince him of our viewpoint." Why do I think this reasonable? Well, we know from Libby's indictment that on July 10 or 11 Libby and Karl spoke about Novak's story. Presumably, that conversation transpired before the Cooper-Rove conversation, or Rove would have mentioned his Cooper conversation as well as his Novak one (although, it is possible the conversation was after the Cooper conversation and Rove did mention it!). Assuming he hadn't already mentioned the Cooper conversation and Rove was really running out the door for vacation, he may not have had time for a conversation with Libby to fill him in. So, instead, he emailed Hadley to do precisely what he had done in that conversation, fill Hadley and Libby in on the status of the leak campaign so far. In which case, Rove would have wanted to be fairly accurate about what transpired with Cooper, and what needed to be done to ensure Cooper followed the WH spin.

Also, neither the Libby indictment nor Cooper's own story describe whether Libby called Cooper or vice versa. Neither tells us whether Cooper had actually called Libby before his July 12 trip on Air Force Two, at which point he strategized a response to Cooper (although the indictment does refer to Cooper's questions). It is possible (although we have no way of knowing) that Cooper hadn't called Libby directly before their July 12 conversation, the Cooper questions were passed on from Hadley or someone in OVP. It's also possible Rove directed Cooper to Libby. Or, that Cooper called Libby on his own, but that Libby had already heard from Rove about their conversation. I think the last possibility is the most likely, not least because Cooper's and Libby's on-the-record conversation had to do with Dick's role in sending Wilson. In any case, there's a distinct possibility that the strategizing Libby did with Dick was in response not just to Cooper's inquiries, but also to Rove's report of their July 11 call. Which would mean the content of the Cooper call would have had to have been reported back to Libby or Hadley in some fashion.

So assuming the original email was an accurate portrayal of the call and was intended to at least report back what Cooper knew, if not get Libby or Hadley to put more pressure on Cooper to accept the WH story. What are the cost-benefit analyses here? If the email originally existed and described the conversation accurately, then you're weighing having the email discovered in Fall 2003 or altering the email after the fact (Rove COULD have simply withheld it, but then he wouldn't have submitted a different email to Fitzgerald last Fall.) The problem with releasing this email in Fall 2003 is that it not only proves Rove's involvement, but it proves the conspiracy. If it were revealed in Fall 2003, you'd have proof of a crime that might take out Rove and Hadley (at the least), one year before elections.

But weight that against the high chance of obstruction charges. I agree that this option probably exposes more people to obstruction charges than the other options. In addition to the Rove/Ralston/IT guy exposed in the other options, this would expose still more IT guys. The additional people also increase the chances that someone will flip on you or otherwise reveal the game. It requires a lot more work, the correction of the backups every time you change the email content. It's not an easy or safe option, certainly.

But its benefit, it seems to me, is that you'd have more control over when the obstruction would be discovered. If, before each search of the servers, you adjusted the content of the email to avoid discovery of it, then there would never be a way to simply replicate a search and find the email. You'd have to get hold of the back-ups, and do a search more targeted to this email as it exists. That is, with email in hand, you'd search on Cooper and Niger, and find the existing backup copy. And then, assuming Rove's minions aren't better hackers than Fitzgerald's (which is probably a safe assumption), you'd examine the backup copy closely enough to expose the email as fradulent.

And the benefit in this case? It almost certainly gets you through the election, since you largely control when it will be revealed. It leaves you the most options open, based on which of the journalists Fitzgerald discovers (if indeed there are more journalists out there). It allows you to construct the best available excuse at the time when you are finally forced to turn over an email.

Obviously, I have no ideas which of these scenarios is correct. The least risky and most likely solution, assuming Rove did CYA when he first talked to Hadley, would have been to make sure the searches deliberately didn't return this email. But I think the option that provides you the most options--particularly getting you beyond the election--is the alteration strategy.

Comments

[meg]

EW's postponement theory just got a boost from what Jane says at Firedoglake - conversations http://firedoglake.blogspot.com/

"But on Saturday, December 3, the WaPo reported that "the conversation" took place before Rove's grand jury appearance in February 2004, and appears to be quite Viveca-centric in its sourcing.

It would appear that Mr. Luskin and Vivac may have spoken more than once on the topic. And it seems likely that when Luskin offered up his good friend Vivac in order to save his client, he told Fitzgerald that the relevant conversation (or conversations) happened a good while after Rove's testimony in February, 2004 where Rove presumably did not tell the grand jury about the Cooper conversation, because Fitzgerald's request for information starts in May 2004."

So, here's a proposition: Luskin throws a last minute Hail Mary pass saying his Vivac conversation can heal the 'lying to the grand jury about the Cooper conversation for Rove.' The problem is that Vivac's real story only makes matters much much worse for Rover, because the Vivac tip off to Luskin occurs in February not in the summer or early fall. Now, why would Luskin lie when Vivac's story can be easily discovered?

Does this seem like a regular modus operandi for Rove et al?

[John Lopresti]

LibbySosume--The young engineers and test techs in the back of the room pantomiming quiet guffaw as the president describes mainstream engineers' latest product which will Dominate the Market and push the competitor into second place for the full product cycle.
Speaking of marcom, today's WaPo has an appealing profile of Luskin five column pages of webfootprint.
LibbySoSume(2): There is a question of the parallism in the corporate metaphor; often it is more stagelike than incorporated in politics. There is so much live communication in this era bargaining chips are in storage, national political conventions are miniseries without politics. What if, as the original column at the top of the thread suggests, there is a QA supervisor with software used to verify the on-chip minifirewall still has its backdoor to the hex registers, you know, zero page; though I like very much the Moynihan thesis even though twenty years ago, that there is a cyberhalfacre over which duplicates are copied. There are real people involved here. When Manny was pirating emails of all the Judiciary Committee strategists from the minority party over a two-year time span, the people to whom he would distribute those purloined letters would have putatively compartmentalized knowledge that they had hacked the Democratic party firewall protected internal email server, and Manny's boss, Senator Hatch would have complete deniability. That needs an ethics investigation. What a pity: if the most atavistic proponent of senate principles could be implicated despite inartful compartmentalization. What a thin line between legitimate partisanry and egregious abuse; I still hear the Hatch excuses for Iran-Contra, it is difficult to separate what is fair political advocacy from what was simply coverup for the administration. Reagan and Moynihan: long ago times.
If the disgruntled QA supervisor with the hacker util can slide over and erase files on your computer's drive over a secure intranet, or maybe the net was not secured, say, if it was simply material on a home pc connected through the local cable DSL provider to the internet, sometimes https, but usually simple http + whatever safeguards you have on your pc.
These vignettes describe several contexts; a collage of fictions intercalated with snapshots that are real instances. But, less we wax too abstruse at blog, it deserves mention that the gist of the thread, above, seems well founded, that the c:b of that email is an interesting and quite revealing endeavor.
I, for one, offer no exculpation of any of these officials; is this Fitzgerald's X discussed: by an incredulous and disheartened hilzoy and executive director, Romero at a first amendment advocacy organization's site.
Let's use the marcom thesis, then look at the political side which is more diffuse. I wonder if the Secretary of State is taking notes of the promise-making ongoing in her current tour de EU on the latter two links' topic. I doubt it is all X's initiative unless X=OVP. I need to do the math on that.

[Libby Sosume]

"The young engineers and test techs in the back of the room pantomiming quiet guffaw as the president describes mainstream engineers' latest product which will Dominate the Market and push the competitor into second place for the full product cycle."

So true.

By the way, I don't mean to demonize engineers in general. In the ages-old war between marketing and R&D, both sides play games. But R&D can play political hardball with the best.

Years ago when I was a PM for a proprietary mail product, we in marketing wondered if engineering was even listening to us. Turns out they had patched out the return-receipt code on their copy of the email software, so that we'd never get receipts.

Years later when I was chief of staff for a business development SVP, who was supposedly well-liked by R&D cause he could "talk their walk," I discovered they were backstabbing him. They'd make promises they had no intentions of delivering on, while they did their best to build what THEY wanted and undo his strategy. I told him about it, even showed him the email evidence. He gave me a funny look and said, "Just play nice with these guys, we need them." I complained to the R&D VP to no avail; he denied everything.

But when I finally walked away from that life, it wasn't because of R&D. It was Marketing that nearly drove me postal.

[kim]

Hi EW,
I thought I'd send along this Rove-Novak2 tidbit FYI (from WayneMasden):

"December 10, 2005 -- Viveca Novak is not giving Karl Rove a free pass - she apparently told investigators that in early 2004 she was aware that Rove knew much more about the pre-disclosure identity of Valerie Plame Wilson than either he or his attorney, Robert Luskin, originally indicated to special prosecutor Patrick Fitzgerald. Informed sources have revealed that not only was Rove well aware of V.P. Wilson's covert identity before her name was disclosed in Robert Novak's column in July 2003 but Rove actively took part in the disclosure of her identity to the media, including Time's Matt Cooper."

Keep up the good work!

[Mr.Frank Dink.]

From: Mr.Frank Dink.
7th Floor, Kamkholo Bld
Cnr. Brown and Voortrekker Str.
Nelspruit 1200.Johannesburg
South Africa.
Email me back on this[dink1_20@yahoo.com]

{THIRTY SIX MILLION USD)
(RE: TRANSFER OF ($ 36,000,000.USD
{BUSINESS OPPORTUNITY/YOUR ASSISTANCE IS NEEDED}

My name is Mr.Frank Dink. and I work in the International operation department in a Local Bank here in South Africa. On a routine inspection I discovered a dormant domiciliary account with a BAL. Of 36,000,000 (Thirty Six Million USD) on further
discreet investigation, I also discovered that the account holder has long since passed away (dead) leaving no beneficiary to the account. The bank will approve this money to any foreigner because the former operator of the a/c is a foreigner and I am certainly sure that he is dead, and nobody will come again for the
claim of this money A foreigner can only claim this money with legal claims to the account Holder; therefore I need your cooperation in this transaction.
I will provide the necessary information needed in order to claim this money, But you will need to open an account where this can be transferred.
If interested send your private Telephone No. And Fax number including full details of the account to be used for the Deposit I wish for utmost confidentiality in handling this transaction as my job and the future of my family would be jeopardized if it were breached.

The informations will be as follows.......

Bank Name.........
Bank Address........
A/C Name.............
A/C Number..............
Swift Code No..............
Routing Number................

I want to assure you that the transaction is without risk if due process is followed accordingly. Finally I will give you 25% for your corporation.

I look forward to a favorable response from you.

Thank's for your maxinium co-operation and remain blessed.
Email me back on this[dink1_20@yahoo.com]

Best Regards,

Mr.Frank Dink