Michael Cohen enlisted some friends to help construct an alibi right at the time of the Wikileaks dump. Why?

When the Steele dossier broke in January, much of the initial public focus was on the salacious tales of prostitutes and peeing, and the possibility of blackmail based on videos of those titillating scenes. But one of the first responses from the Trump camp was a picture of a passport cover, with the caption “I have never been to Prague in my life.”

This was, of course, the well-known tweet by Michael Cohen, then an Executive VP in the Trump organization, and now the personal lawyer of Trump. Cohen tweeted it to disprove (in the Trump organization’s view) the claim in the Steele dossier that Cohen had met with Russian agents in Prague in late August or early September, to deal with issues related to hacking, hackers, payment, and cover-ups.

The Steele dossier contained, of course, many allegations beyond the scatological ones that received so much initial attention, and some of them are, as we now know, quite serious, and supported by information that has subsequently emerged. But after Buzzfeed’s controversial publication of the dossier, the alleged Prague meeting seemed to be first on the Trump team’s agenda, as the passport tweet came very shortly thereafter. And that tweet was then widely derided and parodied, because, of course, the cover of a passport doesn’t prove that you have, or haven’t, been anywhere. After the tweet, Cohen supposedly showed some pages of the passport to a Yahoo Reporter (over Skype,) took the passport on Hannity (but didn’t open it,) and even trotted it over to Trump Tower to show it to Bannon (who might not be fully objective,) who then told Trump that he saw no evidence that Cohen had been to Prague (because the word of Cohen, a loyal long-time employee, wasn’t good enough, apparently.)

None of this seemed especially convincing, of course. Moreover, it seemed notable that the Trump team was trying so hard to disprove this allegation–and especially this one allegation, out of all those in the dossier. And, to my eye, it all happened so fast, and felt so scripted, that I felt sure the entire charade had been pre-planned. This seems entirely possible, given what we subsequently became aware of, i.e., that the dossier had been known to many people in Washington for months. But why the focus on this particular allegation? Was it especially important to disprove? Or was it a good place to try to get ahead of the narrative, and distract from the other allegations? I still have no firm opinion about this issue.

Of course, most skeptics were no more convinced than I by the passport sleight of hand. So Cohen offered “incontrovertible” proof that he could not have gone to Prague–a picture in his daughter Samantha’s Instagram feed, of him out with her in Santa Monica around the time of his birthday in late August.

This was ostensibly taken during a trip he made to Los Angeles with his son to look at schools, and around the time he was alleged to be off in Prague paying Putin’s hackers; thus, he would have had us believe, he couldn’t have done what the dossier claimed. And, furthermore, the whole dossier was therefore “fake news.”

There were, of course, many problems with this. First, the dossier gave no specific date for the Prague meeting, only that it was in late August or early September—one photo hardly rules out that whole time period. Second, it was striking that Cohen had to rely on a chance post by his daughter, and did not point his accusers to his own social media—say, his Twitter feed, as he is a prolific tweeter, especially during the campaign. In addition, for most of the time in question, his tweets are geotagged, so would seem to be a great way to prove one’s whereabouts. He did not, however, direct people to them as evidence of his innocence. Noting this, many did start looking at his Twitter timeline, and noticed something striking—there were many gaps in it, and occasional brief periods where there was no geotagging. Examining his timeline made it clear why Cohen avoided pointing people to it—it raises many more questions than it provides answers. There were, people saw, multiple gaps in it throughout the months of August, September, and October, a number of which could accommodate a trip to the EU for some coordination with his “business” partners.

These revelations led to an intensive search, on the part of many (myself included,) for what plane or planes he may have taken for such a trip. That search has unfortunately produced nothing definitive, though I suspect there are FBI and CIA personnel who have that information in great detail. For the open-source investigators, however, the ability of private plane owners to block the data for their planes on public tracking sites has largely thwarted the search for the means of Cohen’s illicit peregrinations.

I was nonetheless so personally convinced of Cohen’s involvement in the dealings outlined in the Steele dossier—convinced especially by the machinations they undertook to disprove the allegations—that I was compelled to begin my own search for information that could shed light on the situation. In particular, I began combing through the Cohens’ social media, looking for clues that might prove that Cohen had visited the EU during the relevant period. Other than the aforementioned gaps in his Twitter feed, I found nothing—except for one small clue. Going through his daughter’s Instagram account, I found a picture she had posted from London on October 2, 2016, celebrating her birthday. Among the comments on that post is one from her father: “See you soon LuLu.”

I was immediately struck by two odd things about that comment. First, Cohen did not use his comment to wish his own daughter a happy birthday, even though she was (probably) on the other side of the Atlantic. But let’s suppose that he wished her one in some more direct and personal way. In that case, he was merely using her birthday post as an easy way to communicate with “Lulu,’ whoever she was, who he knew he would be seeing soon. But therein lay the second odd thing—there was no comment from any “Lulu” on the post. And it’s not especially effective to send a person a message via someone else’s Instagram post if they haven’t commented on it.

(One reader raised the possibility that “LuLu”—especially with the two capitalized L’s—is actually a term of endearment that Cohen could have been directing to his daughter. Fair enough, though I doubt it. I personally think the double capital relates to the fact that she is called both Lucella and Lucille, but obviously that is conjecture. Regardless, let us suppose it was an endearment directed at Samantha. Where was Samantha? London. So maybe he was headed to London; that would still be quite interesting, especially given who else is in London—Julian Assange, see below.)

Curious about whom “LuLu” was, I explored Samantha Cohen’s social media more. Her Facebook profile did indeed show two “Lulu”s. The first resides in London, and I am fairly certain does not figure in this story. She occasionally comments on Samantha’s Instagram posts, and those comments are there to see. If she had commented on the birthday post, I think it is safe to assume that comment would still be visible.

The second “Lulu” is Lulu Lucella Agapova—her friends and mother usually refer to her simply as “Lucille” in their social media. This Lulu’s mother is Oxana Agapova, a former model, and her father is Andre Agapov, the founder and chief executive of Rusoro Mining—he has also held numerous other executive positions. The Agapovs appear to split their time between Moscow and London, though are frequently traveling around the world, as one can see on their social media (Oxana’s Instagram was until recently public.) Lulu herself was recently a bridesmaid in the London wedding of Valery Kogan’s granddaughter (Elton John and Mariah Carey performed.) Oxana is apparently friends with the mother of the bride, Darina Lozovsky, Kogan’s daughter. Kogan is reported to be either tight with Putin, or on the outs with him, depending on the source, and there are suspicions that he is laundering large amounts of money out of Russia, possibly to Israel, where he recently built the largest private home in the Mideast (and is a neighbor of Netanyahu.) What is most clear about Valery Kogan’s business dealings, as well as the Agapov’s, is that there is nothing clear about them. (What is also clear is that Cohen’s assertions that he has no Russian connections seem suspect—but of course, it may only be Russia-leaning Ukrainians that he associates with.)

To go back to Cohen’s message to LuLu, and why I feel confident that he was messaging her: first, from older posts of Oxana’s, we can see that Lulu had an Instagram account, @lucilleagapova, which Oxana had linked to in some comments. Those links are now grayed out and inactive. Later we see she has a new account, @lucille, with only 27 posts, but 220 followers. In the gap between these accounts, at the end of 2016 and beginning of 2017, her mother merely tags her as #lucille, and another friend actually tags her as #lucillewithoutinstagram! It seems safe to assume that she deleted her old account (and it is, of course, interesting to speculate about why she may have done so,) and with it the comment on Samantha’s birthday post, and later started a new account. Michael Cohen had responded to the now-deleted comment from Lulu—which she had made from the old account—because he anticipated seeing her soon after October 2, 2016.

As it turns out, Cohen in fact has a lengthy gap in his Twitter timeline around then—he has two posts on October 4, and then none until October 12—one of the longest gaps in his timeline during the election. Given the message to Lulu, it seemed reasonable to assume that he had indeed gone to wherever she was in that gap. Though we do not know for sure where Lulu was, we know Oxana was in London during that time, at numerous art events, and that Lulu was with her at some point in October, and with her father at others, though where is unclear. Oxana did post one picture of father and daughter on October 17, which appears to be in an airport. During early October, the jet the Agapovs frequently use, VQ-BKI, basically flitted back and forth between Russia and Switzerland, and then to London.

Given the information I had, I assumed that Lulu was probably in the EU or Russia, and began to look for how Cohen might have gotten to where she was. I further assumed that he left shortly after his last post from New York on October 4. Eventually, my search led to some analysis of flight data of private planes leaving the New York area in that time frame and crossing the Atlantic. I did in fact identify a plane of interest. I will include information about it here—though I cannot have any confidence it was involved in Cohen’s movements, for reasons that will soon be explained—in part because it is still possible that the particular flight I identified was indeed how Cohen crossed the Atlantic, and in part because the timing of its movement pointed to other important information about Cohen and the timing of his travels, and, possibly, his attempts to hide them. That plane is a Bombardier BD-700, tail number N288DG, owned by Paulson and Company in New York, an investment company founded by John Paulson. Paulson is a major early supporter of Donald Trump’s presidential run, and a current advisor to Trump.

The ownership of the plane got my interest, needless to say, but there was one problem: the plane did indeed take off from Teterboro airport and fly to Hamburg, Germany, in early October (how Hamburg might be important I cannot say, though as will see, Berlin might be.) It then stayed less than 14 hours in Hamburg—presumable the crew had to sleep—before returning to Teterboro. (In general, one will not find data on the movement of this plane on popular tracking sites; it is listed as blocked by the owner. There are, however, other, more arduous systems, for tracking plane movements, which I will not go into here. Suffice it to say that there is indeed a picture of this plane in Hamburg on October 4 on the internet.) But here was the problem—it left Teterboro at 5:34 PM on October 3—the day before Cohen’s final tweets from New York City—thus seeming to rule it out. And there were no other planes in that time period which seemed likely candidates for taking someone across the Atlantic.

Being nevertheless convinced that Cohen had to have left New York to go to wherever Lulu was in early October, I started looking at Cohen’s tweets more carefully, and noticed something odd about his timeline in that period. First, though there are those two tweets on October 4, there are in fact no tweets before that for several days—the last ones before October 4 are several on September 30. Moreover, the tweets on October 4 are atypical—they show Cohen at a restaurant “soft opening” with several of his friends. If one goes through Cohen’s timeline, one will notice that he virtually never tweets anything about his personal life, or pictures of himself—in this time period, it is all cheerleading for his boss Trump, bashing Hillary, thanking supporters of Trump, or dismissing “trolls.”

Looking deeper at those two tweets, there was something else very striking: several people who commented on them asked Cohen if he was watching “the debate,” for that was, in fact, the night of the vice-presidential debate. And Cohen makes no comment about it, and does not respond to any of the people asking him about it. Looking at the social media of the friends in the pictures with him, none of them posted photos of that night. There did seem to be a soft opening at that restaurant on October 4–but also some event on October 3, that another chef posted a pic of food from. More puzzling is the lighting of the above photo–it was posted on Twitter at 7:20 PM, and is framed so that it shows the front windows of the restaurant in the background (as one can tell from other photos of the inside of the restaurant.) The sun set at 6:32 PM that night, and yet the windows are completely black–unusually dark for 48 minutes after sunset—though, to be fully objective, cameras can sometimes change the apparent brightness of things, depending on the relationship of the brightness of background to foreground. Maybe more interesting is the fact that there are no people in the background, though that is one of the major seating areas of the restaurant. And the gang are eating dessert, though other photos from the soft opening night show the chef busily plating desserts at 9:18 PM.

It dawned on me that these pictures could well be fake, perhaps taken at an event that happened at some other time, and posted on October 4 specifically to give Cohen an alibi for his whereabouts at that time. They include something very unusual for him to post—images of himself at a specific location—that would provide just such an alibi. Perhaps he took a night off from politics to hang out with some friends–but then not even a single comment later about the debate? If one browses through his Twitter timeline from that period, it just seems so very unlikely that he would behave that way.

And then, even more interestingly, I realized that he had also not commented, during the October gap in his timeline, on two other important events. One was the second presidential debate—again, it is difficult to believe he had nothing to say about his boss after a critical event like that (and, in fact, he had tweeted a picture of himself at the first debate.) And the second event he did not comment on was Julian Assange’s October 4 announcement, via video in Berlin, of the impending release of more hacked Democratic emails, and the subsequent October 7 release of Podesta’s emails by Wikileaks.

So we would have to believe that Cohen did not find any of these events—all major events in the campaign of his boss for president, including the email release, one of the most widely discussed events of the election—worth commenting on. I think this is so very, very unlikely. Wherever he was, he was unable to comment on the major political events of that week—clearly he had to be careful to not betray his location, as there is no other conceivable reason for him leaving such meaty political topics untouched. Perhaps he was even overseas because of the Wikileaks events, though that is speculation. But what seems likely is that the October 4 tweets were designed to provide an alibi for him for something. He must have left his phone with someone trustworthy to post those pictures at the agreed upon time—but then that person did not behave like him for the rest of the following week. No doubt it is good tradecraft to leave your phone—one of the primary ways people are tracked in the modern world—at home when on a secret mission. But someone like Cohen’s social media behavior is almost like a fingerprint, and here it doesn’t match.

In retrospect, one wonders if the Trump camp’s initial focus on the passport and Prague meeting was because there was a much more explosive issue that people might accidentally wander into—an issue that is one of the actual reasons for all the hacking and payoffs and cover-ups to begin with. And the passport charade was misdirection, keeping everyone focused on one small piece of the puzzle, so that they miss the bigger picture.

Now, it would still be nice to know how Cohen got to the EU. If we assume the October 4 tweets are deceptive, the time window is different. His last regular tweet is at 3:39 pm EDT on September 30. His message to Lulu is at 9:12 PM EDT on October 2. That message could have been sent from somewhere in the EU, of course, if he was already there and stayed up till the wee hours that evening, with a plan to move again soon to where Lulu was. And let us assume that he moved before the October 4 tweets. That gives us the time window for when he would have had to cross the Atlantic.

One last tidbit: the focus on Cohen has primarily been on the alleged trip to Prague in August or September, as that was the most specific piece of information in the dossier. But there was another brief mention of Cohen in the dossier page dated October 18:

And note that Cohen’s involvement was being referred to in the present tense as of mid-October.

Perhaps the crowd-sourced OSINT world will have contributions to make on these fronts. I am putting this information, and my theory, out in the public sphere to see what other data may be turned up by the many energized investigators that Trump has inspired. And let me stress: it is only a theory. I could be wrong about any or all of the assumptions I made above. I will leave the reader to make up their own mind about that, and investigators to dig into the details. And maybe new information will emerge that will prove that I am just another conspiracy nut in an America that is rife with them of late. Or not.

Addendum

Though I have felt quite convinced by Cohen’s timeline that he did not actually post those tweets from the soft opening on October 4th, and even more convinced by what I saw in the picture in the restaurant, there was not, of course, definitive proof that the tweets were faked.

So I kept looking—specifically, looking for evidence in the social media of the other people in the photos. And, lo, my search was rewarded.

Pictured below is the second picture that Cohen claims to have tweeted on the night of October 4, after the dinner photo shown above. It shows him and his friend Jason Hervey, in closely cropped portrait of the two, taken outside. They appear to be dressed as they were in the restaurant, though Hervey now has glasses. The second photo is from Hervey’s timeline, posted less than 37 hours later, of himself, presumably in a cab in Manhattan. Note the beard growth that is supposed to have happened in that 37 hours.

There seems to me to now be no doubt that the photos posted on October 4 were taken at least several days earlier. The implication is clear: they were created and posted with an intent to be deceptive.

Addendum #2

In my continuing state of fascination with Michael Cohen’s October tweets, I kept poking around, and found this puzzling tweet from Jason Hervey:

This was tweeted two days after the release of the Steele dossier, and, as one can see, Hervey is already alluding to the “second Michael Cohen” theory that was put forward to explain the dossier (though it was not at all clear what particular fact that theory was supposed to account for.) But what is fascinating is that Hervey tweeted this picture, ostensibly taken on October 4th, to address an accusation that Cohen was in Prague in late August or early September. I don’t know what to make of this. Did he get his alibi info a little confused, and forget that the October photo was part of an alibi for a later trip Cohen made? Or did he think somehow a photo of the two of them in New York was just supportive? If so, I have the distinct sense that his unconscious betrayed him, as there is absolutely nothing in anyone else’s mind that could make a logical connection between the Prague allegation, and a selfie taken over a month later. But maybe the connection was just Hervey’s knowledge of the part that photo played in an alibi. Who knows?

One more odd thing about Hervey–while on his (ostensible) trip to New York in October, he posted a few photos of himself. The bearded cab photo appears above, of course. But here are the others:

As an additional twist, the last photo is a crop of one published on someone else’s site the day before.

Personally, I can’t make sense in any way of his beard through this series of photos, or the fact that he seems to be wearing the same clothes on several different days, or just the fact that he looks like a different person in the pics in the classroom and bookstore. If anyone else has ideas, please share them!