From Russian Interference to Revisionist Innuendo: What the Gabbard Files Actually Say

Director of National Intelligence Tulsi Gabbard has recently released a series of declassified documents she claims expose a “treasonous conspiracy” by former President Barack Obama and his top intelligence officials to sabotage Donald Trump. Gabbard’s performance—part of an ongoing effort by the Trump administration to retcon “Russiagate”—led to an announcement yesterday by Attorney General Pam Bondi assigning an as-yet-unknown federal prosecutor to convene a grand jury investigation into President Obama and others.

Before diving into the barrage of documents Gabbard declassified, and the allegations they don’t substantiate, we thought it would be useful to briefly cover the history she’s trying to rewrite. Because one of the clearest refutations of her claim that President Obama engaged in an “years-long coup” against Trump is simple: linear time. 

Revisiting the History of 2016 Russian Interference and Its Aftermath

Russia interfered in the 2016 election in three distinct ways: First, the Internet Research Agency (IRA), also known as the “troll factory,” ran a disinformation campaign using fake social media accounts with content that reached more than 100 million people. The propaganda content surrounding the election aimed to depress the Black and liberal vote on the left, while promoting Trump on the right. During the Republican primary, following a brief effort to boost Rand Paul, they pivoted to Trump, denigrating primary opponents such as Sens. Marco Rubio and Ted Cruz. Contrary to the talking point that it was just “$150k in Facebook ads,” the IRA’s broader influence campaign cost around $10 million per year. It ultimately became the subject of a Department of Justice indictment  against the IRA, its parent company, and individual operatives.

Second, throughout 2015 and 2016, the Russian military intelligence agency the GRU hacked targets including the Democratic National Committee (DNC), the Clinton campaign, Open Society Foundations, the Carnegie Endowment for International Peace, and other think tanks seen as promoting liberal internationalism. Russian military intelligence then selectively leaked the hacked material, usually with the intent of embarrassing the target at a strategic time. For example, the first tranche of thousands of Clinton campaign manager John Podesta’s documents were dumped by WikiLeaks approximately an hour after the release of the Access Hollywood “Grab ‘Em By the Pussy” tape on Oct. 7, 2016. (Roger Stone was apparently in contact with the hackers’ Guccifer persona about the releases.) The Podesta emails had staying power; they would become the foundation of the Pizzagate conspiracy theory.

Third, Russian cyber actors, likely also the GRU, targeted election infrastructure by attempting to hack machines and databases concerned with voter rolls in states and jurisdictions across the United States (some reports say all 50 states were targeted). No votes were changed and no voter information was altered. 

These activities were summarized in the Jan. 6, 2017, Intelligence Community Assessment (ICA), which described the interference as a multifaceted influence campaign ordered by Russian President Vladimir Putin to undermine faith in the democratic process and damage Clinton’s candidacy. The assessment noted that Putin and the Russian government developed a “clear preference for President-elect Trump.” It made these assessments with high confidence. It also assessed that Russia had “aspired to help” Trump’s chances at victory. The CIA and FBI had high confidence in that assessment; the National Security Agency had moderate confidence.

A few days after the ICA, on Jan. 10, 2017, BuzzFeed News published the Steele dossier—a raw intelligence document filled with salacious, unverified, and false allegations (among them, that there was a “pee tape” of Trump with prostitutes). It quickly became a topic of public fascination. It did not, however, figure prominently in the assessment, which relegated it to a two-page description in an annex in a highly classified version of the ICA; it had no bearing on establishing interference.

This is important: Neither the ICA nor the Steele dossier launched the investigation into collusion. Interference relates to how Russia meddled; collusion relates to whether the Trump campaign solicited or coordinated with the effort. Crucially, the collusion investigation had begun six months earlier, in July 2016, after Australian intelligence tipped off the FBI that Trump aide George Papadopoulos had bragged of knowledge that Moscow possessed damaging emails about Hillary Clinton.

The interference, and the collusion theory, sparked multiple investigations:

• Crossfire Hurricane, the FBI counterintelligence investigation to assess whether Trump campaign affiliates coordinated with the Russian effort, launched on July 31, 2016.

• The Mueller investigation, led by Special Counsel Robert Mueller, examined both interference and possible collusion. In addition to a comprehensive 2019 report, Mueller’s team issued 34 indictments, including of 13 Russians linked to the IRA and 12 GRU officers for hacking the DNC and the Clinton campaign, as well as several Trump associates for crimes including lying to investigators and obstruction. The investigation found numerous contacts between Trump officials and Russians but did not establish a criminal conspiracy.

• The Senate Select Committee on Intelligence (SSCI) also conducted an investigation, which examined the multipronged interference effort, potential links between Russian agents and the Trump campaign, hacking threats to U.S. election infrastructure, and the data turned over by social media platforms documenting the IRA’s disinformation campaign. This bipartisan effort involved outside research teams and resulted in a five-volume report.

Russian interference in the 2016 election was not a matter of dispute—until recently. Republicans readily acknowledged it; then-Sen. Rubio chaired the SSCI during portions of the Senate report release. The controversy centered more on “collusion”—because, while the popular press glommed on to the term, it is not actually a word with a legal meaning. Several individuals affiliated with the Trump campaign and early administration were charged with offenses stemming from unreported or obfuscated contacts with Russian officials, or Russian nationals connected to the nation’s intelligence services (some pleaded guilty; some were convicted).

However, Republican concerns about alleged partisanship, and allegations of reliance on the Steele dossier, led to three meta-investigations of the collusion investigations:

• Trump’s attorney general, William Barr, tasked out an effort to the U.S. attorney for Utah in 2018 to look into Clinton and Russia, which found “nothing of consequence.”

• The Department of Justice Office of the Inspector General conducted a more robust and credible review, culminating in a December 2019 report. It criticized the FBI’s handling of Foreign Intelligence Surveillance Act (FISA) applications in Crossfire Hurricane (including for reliance on the Steele dossier), citing significant procedural errors and omissions, but also concluded that the FBI had sufficient legal and factual basis to open the investigation and had not done so out of political bias. In other words, the launch of the probe was justified, even if aspects of the surveillance process were flawed.

• The Durham special counsel investigation was launched in 2019 by Barr and led by U.S. Attorney John Durham. It investigated whether Crossfire Hurricane had been improperly or even corruptly motivated. Durham’s final report ultimately argued that the FBI should not have opened a full investigation yet was justified in opening a preliminary investigation; he wrote that agents showed “confirmation bias” and relied on “raw, uncorroborated information,” including the Steele dossier. He did not find any broad anti-Trump conspiracy or significant wrongdoing. His probe produced two prosecutions, both of which ended in acquittals, and one plea deal for an FBI lawyer who altered an email in the FISA process.

The Gabbard Revisionism

Over the past month, we have seen several document dumps relitigating all of this—interference as well as collusion—from CIA Director John Ratcliffe and Gabbard, beginning with Ratcliff’s June 26 reassessment of the January 2017 ICA. As I covered in the first Retconning Russia installment for Lawfare, this tradecraft review quibbled with the specific assessment that Russia had “aspired to help” Trump win, ultimately taking the confidence level down from “high” to “moderate.”

It also took umbrage with the incorporation of the Steele dossier into the assessment via the two-page annex, despite a disclaimer stating it was not used to reach the analytic conclusions. The tradecraft review noted that by referencing the annex in a supporting bullet for the “aspired” judgment, it implicitly elevated an unsubstantiated claim, undermining its credibility. However, the review did not change any findings related to the overall interference claim. 

Ratcliffe nonetheless spun this as prior CIA Director John Brennan, FBI Director James Comey, and Director of National Intelligence James Clapper “manipulating intelligence.” This accusation seems quaint now, in light of the “treasonous conspiracy” allegations and Justice Department referrals that Gabbard has attempted to support via three subsequent batches of document releases, along with a bonus release via FBI Director Kash Patel, who alleges he found scandalous papers in a “secret room” full of “burn bags” while wandering FBI headquarters.

Let’s go through the claims made, and the documents released.

Gabbard Drop 1: It Depends What the Meaning of the Word “Hacking” Is 

TL;DR: Gabbard claims Obama “manipulated” the January 2017 ICA even though he knew Russia didn’t hack the election. But that’s a bait-and-switch: She’s confusing (or conflating) hacking voting machines with the other forms of interference, such as propaganda and the hack-and-leak efforts, that the later ICA focused on.

On July 18, Gabbard entered the conversation with a sinister-looking flowchart meme, a press release, a memo, and a first batch of declassified documents she claimed revealed a treasonous plot. She focused on a line from an August 2016 intelligence assessment that Russia was “probably not … trying to influence the election by using cyber means.”

In the primary source documents Gabbard released, that sentence doesn’t end there. It continues: “probably not … trying to influence the election by using cyber means to manipulate computer-enabled election infrastructure” (emphasis added). It references Russia’s capacity to hack voting machines—one line of effort among the various forms of interference.

Other emails in the thread discuss the matter more explicitly: “The thrust of the analysis is that there is no indication of a Russian threat to directly manipulate the actual vote count through cyber means.”

Ironically, in the full assessment of Russian cyber operations that this debate informs, there is then another line that she does not quote: “We judge Russia has conducted cyber and intelligence operations that suggest that it has potential interest in disrupting the US presidential election”—alluding to the DNC and campaign hacks. 

Rather than acknowledge the preexisting awareness of multiple forms of interference, Gabbard tries to stitch together a conspiracy. She notes that, on Dec. 7, 2016, Obama administration officials were preparing talking points to reassure the public that no votes had been changed by Russian interference, including statements such as, “Foreign adversaries did not use cyberattacks on election infrastructure to alter the US Presidential election outcome.”

This is a demonstrably true statement. Russia did not alter the U.S. presidential election outcome via cyberattacks—or, arguably, at all. Interfering is not the same as changing the outcome.

But here is where the red string, tacks, and bulletin board come out: On Dec. 9, 2016, Obama subsequently met with his national security principals to discuss Russian interference and asked for a comprehensive overview. Clapper followed up from the meeting with a request that the intelligence community detail all the means by which Russia attempted to interfere in the 2016 election. These documents are in the declassified dump, toward the bottom in the chronologically ordered release (search “principals”). They do not mention Trump or his campaign at all. They are focused wholly on pulling together an account of the multiple forms of interference that Moscow pursued. That’s it.

Gabbard’s conspiracy theory alleges that what she calls “Deep State officials” began to leak “false intelligence”—by which she means quotes such as, “Russia has attempted through cyber means to interfere in, if not actively influence, the outcome of an election”—in an article discussing the hack-and-leak operation. Not voting machines.

But Gabbard uses this, along with the January 2017 ICA, as evidence sufficient to allege that Obama orchestrated a treasonous conspiracy. In a press conference, she called on the Justice Department to investigate and potentially refer Obama and others for criminal prosecution.

This entire claim hinges on the public not understanding the difference between hacking voting systems and interfering in an election through propaganda and leaks. The documents Gabbard released actually illustrate that the intelligence community understood and made this distinction. And none of them support her claim that Obama tried to frame Trump—there are no indications that Obama mentioned him.

These documents don’t negate “interference” in any way, and the Crossfire Hurricane “collusion” investigation had already been active for six months. Either Gabbard is acting in bad faith, or she can’t comprehend the meaning of her own documents. 

In short: This first go at a treasonous-conspiracy theory collapses under the weight of its own misunderstandings.

Gabbard Drop 2: “Russia really wanted Hillary to Win”

TL;DR: Gabbard’s second big reveal is the declassification of a 2020 Republican staff report from the House Intelligence Committee—led at the time by Rep. Devin Nunes (R-Calif.), now the CEO of Trump’s social media company Truth Social, and worked on by Kash Patel, now FBI director—that critiques the 2017 ICA for claiming Putin preferred Trump, and argues that Russia may have really wanted Clinton to win, because they didn’t dump as much dirt on her as they potentially could have. Gabbard spins this into “irrefutable evidence” that Obama and top intelligence officials fabricated the Russia interference narrative. The document does not support that claim.

On July 23, Gabbard released another declassified document that she claimed supported her ongoing allegation that Obama, Brennan, and others had fabricated a hoax and committed treason. This time the crux of the claim was that people in this vast conspiracy had “suppress[ed] evidence showing Putin was preparing for a Clinton victory.”

To be clear: Almost everyone in November 2016 had expected a Clinton victory, including American pundits. Trump’s surprise victory sparked months of thinkpieces on how out-of-touch elites, media, and pollsters could have missed the signs. But specific to Russia, data from the troll factory backs the expectation that Trump would lose; the trolls were posting insinuations that the 2016 election would be stolen from Trump leading into the evening of Election Day. That they were “preparing for a Clinton victory” is not a rebuttal to the claim that they preferred Trump.

Nonetheless, Gabbard argues that the HPSCI report shows that “Putin’s principal interests relating to the 2016 election were to undermine faith in the US democratic process, not showing any preference of a certain candidate,” and that “Putin chose not to leak the most damaging and compromising material on Hillary Clinton prior to the election; instead planning to release it after the election to weaken what Moscow viewed would be an inevitable Clinton presidency. If Russia wanted to help Donald Trump get elected, they would have released this material prior to the election to harm the Clinton campaign.” Gabbard also claims that the material about Hilliary Clinton that Putin chose not to release before the election included possible criminal acts, such as quid pro quo promises of financial support in exchange for political support, offered by “State Department representatives”; and “DNC emails detailing that Hillary Clinton suffered from “psycho-emotional problems,” “uncontrolled fits of anger, aggression, and cheerfulness.” Clinton was allegedly on a daily regimen of “heavy tranquilizers,” and while she was afraid of losing, she remained “obsessed with a thirst for power.”

Gabbard additionally points to HPSCI report interviews of some of the analysts who worked on the January 2017 ICA, alleging that there was disagreement with the assessment that “Putin preferred Trump” among some analysts, who wanted stronger evidence, or viewed existing evidence in different ways. The Senate report and the other investigations-of-the-investigations, however, also interviewed these authors, finding that there was no political pressure to fall into line, and that the disagreements had been fairly standard.

The HPSCI document is most worth understanding in the context of the SVR (Sluzhba Vneshney Razvedki) hack claims, discussed on page 17 in the declassified annex. The SVR is another Russian agency, focused on foreign intelligence, that had also previously hacked American think tanks. A list of documents that were never released, and which have never been proven to exist, appears to be the main evidence that despite the hack-and-leak efforts, and the IRA propaganda efforts, Russia didn’t really “attack” Clinton as hard as they could have.

The purported emails about heavy tranquilizers and the rest were reportedly obtained by the SVR. Supposedly the emails discussed Hillary’s collapsing health—that she was diabetic, had heart disease, pulmonary disease, was on heavy tranquilizers, suffering from heavy psycho-emotional problems, anger, aggression, among other accusations. The SVR supposedly also obtained an email about a plan Clinton had approved to link Putin and Russian hackers to then-candidate Trump in order to distract the public from her email server scandal. (A discussion of this allegation appears in the next section; that email appears to have been observed in the Durham investigation.) 

It is possible that the scandalous emails about health and pay-for-play that were purportedly “held back” were never released because they do not exist. Clinton’s health seems to be fine, a decade after the campaign during which she was supposedly constantly dying. It may have been that no such emails were ever written. No disgruntled Democrats have come forward with their copies. No investigations into the servers of the hacked entities, or the State Department, have led to any copies being declassified.

There’s no independent evidence these materials ever existed, and the claims themselves are a greatest-hits compilation of far-right fever dreams (Clinton on tranquilizers, “psycho-emotional problems,” pay-for-play State Department favors). The irony here is that Gabbard is accusing the U.S. intelligence community of using bad sources in the ICA—while citing unverified Russian spy memos as proof.

The majority of the HPSCI report critiques the nitty-gritty of analysis methodology but ironically relies on “trust us” hand-waving to a greater extent than what it critiques. For example, the reader is informed that “15 new HUMINT reports were provided” to help justify the claim that Russia preferred Trump (so, it was not just the Steele dossier), and that some agency employees found three of the 15 “odd.” The report tells us that those three were the most important but provides no specifics to back that up.

The HPSCI report reads as far more politicized than the other numerous investigations and meta-investigations into the interference and collusion allegations. Yet, even as it quibbles heavily with the “aspired to help Trump” assessment and spends dozens of pages arguing about whether Russia preferred Trump, or was enthusiastic about Trump, or had no preference because neither candidate would align with Russian interests—it does not dispute that the interference happened. In fact, the same report flatly states: “Vladimir Putin launched conventional and cyber operations—notably by leaking politically sensitive emails obtained from computer intrusions—during the 2016 election.”

This is, ironically, a point that many of the biggest “Russiagate interference hoax” retconners—like Matt Taibbi, or Tucker Carlson, or Mike Benz—have frequently dismissed or denied (some going so far as to allege that Seth Rich, the murdered DNC staffer, had really leaked them). Additionally, the HPSCI report, when still classified, was previously covered during the 2024 presidential campaign, by Michael Shellenberger and Taibbi, who framed it as “Russia really wanted Hillary Clinton to win.” 

This take contradicts Putin, who said in 2018 that he’d preferred Trump.

But again, it’s unclear why the HPSCI document is being presented to the American public as a smoking gun. It doesn’t negate the interference. It doesn’t relate to the launch of the collusion investigation. And it offers no evidence that Obama demanded a cover-up, which is how Gabbard is attempting to use it. 

Fittingly, just as the HPSCI report leans on alleged SVR-sourced claims about Clinton’s health and corruption, the next chapter in this retcon effort also hinges on dubious Russian intelligence—this time in the form of emails so suspect that John Durham himself declined to include them in his final report.

Grassley and Patel: Secret Rooms, Burn Bags, and Faked Emails

TL;DR: A newly declassified “Durham Annex,” hyped as explosive evidence of a Clinton plot to trigger an FBI investigation into Trump, contains dubious Russian-sourced emails already assessed as likely forgeries—which Durham himself left out of his final report.

By far the most bizarre chapter in this saga comes courtesy of Sen. Chuck Grassley (R-Iowa) and Patel, who jointly released what’s now being called the “Durham Annex.” The rollout was pure political theater: Patel claimed that he found the annex stashed inside “burn bags” within a “secret room” he discovered at the bureau, and delivered it to Grassley, who posted it on his Senate website as “newly declassified” material.

The implication? That these were suppressed documents of vital importance. The reality? These are plainly part of the Durham investigation, authored by Durham and marked with his classification authority. Electronic copies obviously exist. If this material was as sordid or meaningful as Patel and Gabbard claim, Durham could have included it in his final report. He didn’t.

So what is in this annex?

It centers on communications from a source—referred to as T1—who provided the FBI with two memos and a set of emails. The memos appear to be Russian-written summaries of U.S. political events, one from January 2016, and another from March, that include commentary on Clinton campaign oppo research into Trump (likely the Fusion GPS work). These include claims that Obama was using “all administrative levers” to shield Clinton from an email investigation. They allege that emails from Clinton’s servers were successfully deleted, among other supposed scandals. There are two emails purportedly written by Leonard Bernardo, then the regional director for Eurasia at the Open Society Foundations, that appear to be discussing a “long-term affair to demonize Putin and Trump[.]” (The emails are on pages 9-11 in the annex.)

The FBI assessed these materials in 2016 and again in 2020. They concluded the memos were likely not credible. Page 5 of the annex gives four reasons why: hearsay, exaggeration, editorialization, and translation issues. The emails were additionally perceived as suspect. Durham notes that as he progressed through his investigation, there were disagreements about their authenticity among intelligence analysts who read them—some thought the emails might be real; others flagged inconsistencies. But, as the investigation continued, as the annex relates, the case for forgery grew stronger. The evidence offered includes multiple versions of the same emails with different wording and sentences in different places; phrases lifted verbatim from unrelated emails from hacked think tanks (verified by server data), written by entirely different authors, that have been cobbled together into emails purportedly written by Bernardo; idiomatically anomalous language such as “Later the FBI will put more oil into the fire”; denials from the supposed authors—and no corroborating evidence.

Page 17 of the annex states it plainly: “The July 25th and July 27th emails … were ultimately a composite of several emails that were obtained through Russian intelligence hacking of U.S.-based think tanks, including the Open Society Foundations, the Carnegie Endowment, and others.”

Durham was a partisan actor; it’s unclear why he wouldn’t have raised the “Clinton Plan” to tie Trump to Russia in the court of public opinion if there was enough evidence for it.

It’s also not clear what the Durham Annex offers evidence of in Gabbard’s red-string conspiracy theory. The FBI’s launch of Crossfire Hurricane began because of a tip from Australian intelligence, not a Clinton email chain. The Durham Annex has nothing to do with interference or the 2017 ICA.

The only real purpose this drop seems to serve is to conjure a little spy-movie mystique: burn bags, hidden rooms, Russian intrigue.

In keeping with giving the audience a cinematic universe to follow, Gabbard’s final drop offers another movie trope: the whistleblower agent.

Gabbard Drop 3: The Whistleblower Claims

TL;DR: Gabbard’s final reveal leans on a “Russia hoax whistleblower” who spent years convinced the Steele dossier wasn’t part of the 2017 ICA—only to later discover it was included as an annex. He felt misled, got a bad performance review, and was removed from an email distro. There’s no new evidence here, just vibes—along with a baffling argument about not including friendly media in the ICA.

The Durham Annex gave us spy-movie aesthetics—secret rooms, burn bags, Russians in the walls. Gabbard’s CIA “whistleblower” drop is more “Office Space” than “Tinker Tailor Soldier Spy.” The analyst in question claims he spent six years trying to “expose the collusion hoax” after learning—when he was asked to help with a Freedom of Information Act request—that the Steele dossier was, in fact, included as an annex to the 2017 ICA.

He says this came as a surprise: He had always been told the dossier had no analytic weight. He believed it was considered unreliable by Clapper and others, and no one ever mentioned it had been attached to the ICA. When he raised concerns, he says, he was removed from an internal email list and received a bad performance review.

He attempted to flag this to Durham and others—but, by his own account, no one responded. Durham, meanwhile, did independently examine the dossier and determined that it was not central to the ICA’s conclusions.

Besides the personal angle, the broader complaint once again seems to be that the ICA overstated Russian intent. To that effect, the whistleblower gripes that it should have contextualized Moscow’s media attacks on Clinton by noting that media in other countries, including NATO allies, were critical of Trump. He writes:

Either, the IC must note the presence of an online competition for US hearts and minds, in which Moscow might or might not be the most-active-player, or, establish a threshold for “normal” foreign media influence efforts directed at US voters which would be excluded from the IC’s high-priority threat analysis …. Applied to the 2017 ICA, this suggested either acknowledging the presence of media content that had denigrated (to varying degree) both leading US Presidential candidates, including denigrations within media based in allies like the United Kingdom, or, reach an IC judgment that some Russian media denigration of then- candidate Clinton fell within de-facto international norms.

But Russia didn’t just denigrate Clinton in its state media. It hacked the DNC, selectively leaked internal emails, and ran a massive social media influence campaign. The United Kingdom, to put it mildly, did not.

And while the analyst raises questions about analytic scope and tradecraft, once again, nothing in his testimony supports Gabbard’s overarching claim of a treasonous conspiracy to frame Trump. There is no new allegation of misconduct. There’s no hidden intelligence trove.

In the end, this drop is less a bombshell than a bureaucratic grudge. There’s no substance that calls into question the ICA’s core conclusions or the overwhelming evidence of Russian interference.

Mostly, this drop is valuable as a headline: “CIA Whistleblower.” What’s underneath doesn’t really matter.

So What?

It is, candidly, very difficult to understand what the point of all of this is. It’s a bit of a DDOS by scanned document—flooding the zone with memos and annexes most people on X will never read, relying instead on influencers and partisan media to shape the narrative for them. The usual suspects are obliging with solemn pronouncements about how very serious this all is. But the fact is, there’s no there here. The Gabbard Files are hanging the awfully serious allegation of a “treasonous coup” on nothing of substance.

Russia interfered. That’s not in dispute. We can quibble about the 2017 ICA, but it wasn’t material to the launch of the collusion investigation, which began six months prior.

The effort here isn’t to uncover new facts. It’s to recast old ones—to erode the baseline consensus that interference happened at all, and to muddy the waters with revisionist innuendo.

– Renée DiResta is an Associate Research Professor at the McCourt School of Public Policy at Georgetown. She is a contributing editor at Lawfare. Published courtesy of Lawfare.