Está en la página 1de 299
FEDERAL BUREAU OF INVESTIGATION POI/EA DELETED PAGE INFORMATION SHEET FOI/Pag 1253814-0 Total Deleted Page(s) = 286 Page 5 ~ Referral /Consult; Page 6 ~ Referral /Consult; Page 7 ~ Referral/Consult; Page 8 ~ Referral/Consult; Page 9 ~ Referral/Consult; Page 10 ~ Referral/Consult; Page 11 ~ Referral/Consult; Page 12 ~ Referral/Consult; Page 13 = Referral/Consult; Page 14 ~ Referral/Consult; Page 15 ~ Referral /Consult; Page 36 ~ Duplicate; Page 37 ~ Duplicate: Page 38 ~ Duplicates Page 38 ~ Duplicate; Page 53 ~ Referral/Consult; Page 54 ~ Referral /Consult; Page 55 = Referral/Consult; Page 56 ~ Referral/Consult; Page 57 ~ Referral/Consult; Page 58 ~ Referral/Consult; Page 59 ~ Referral /Consult, Page 60 ~ Referral/Consult; Page 61 ~ Referral/Consult; Page 62 ~ Referral/Consult; Page 63 ~ Referral/consult; Page 64 ~ Referral/consult; Page 68 ~ Referral /Consult; Page 66 ~ Referral/Consult; Page 67 ~ Referral/Consult, Page 68 ~ Referral /Consult, Page 68 ~ Referral/Consult; Page 70 ~ Referral/Consult; Page 71 ~ Referral/Consult; Page 72 ~ Referral/consult; Page 73 ~ Referral/consult; Page 74 ~ Referral /Consult; Page 78 ~ Referral /Consult; Page 76 ~ Referral/Consult; Page 77 » Referral/Consult; Page 78 ~ Referral/Consult; Page 78 ~ Referral/Consult; Page 80 ~ Referral/Consult; Page 81 ~ Referral/consult; Page 82 ~ Referral/consult; Page 83 ~ Referral /Consult; Page 84 ~ Referral /Consult; Page 85 ~ Referral/Consult; Page: Page Page Page Page Page Page Page Page: Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Referral /Consult; Referral /Consult; Referral/Consult; Referral /Consult; Referral /Consult; ~ Referral/Consult; Referral/Consult; Referral /Consult; Reforral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; Referral/Consult; Referral /Consult Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; Referral/Consult; Referral /Consult Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral /Consult; Referral /Consult; Referral/Consult; ~ Duplicate; ~ Duplicate; XNA HOH NAMEN X peleted Pageis] — % X No Duplication Fee x X Por this Page x RNKXXREREXHKXNAXEHRRRNRE, FO-1057 (Rev 5-410) a FEDERAL BUREAU OF INVESTIGATION Eloctranto Communica: Title: (U//#¥e) Opening of Full Investigation on ' pate: 07/10/2015 a Sensitive Investigative Matter (SIM) cc ra taro bs ow comnunnerentrenies BECLASeEFY ow. azcnte Contacts [ approved By: bre TERANE CARES H 2 A/an0 David W Azchey pratted By: Sora\ 5 case #:[ Neus be OISAANOTINS OF CIRSTTF 129; 8 UNKNONN SUBJECT OR COUNTRY? SENSITIVE INVESTIGATIVE MATTER (SIM) DOCUMENT RESTRICTED TO CASE PARTICIPANTS This document contains information that is vestricted to case participants. synopsis: "!-gyett) FBrHG, Countecespionage Section, is opening a full investigation based on specitic articulated facts provided by an 811 referral fron the Inspector General of the Tneelligence communicy, deted July 6, 2015 regarding the potential conpeonise of classified information. Pull Investigation Initiated: 07/10/2015 SRG / /noronee HRC-348 e 6 SBeKRT/ /erent Title: (U//FOUD Opening of Full Investigation on a Sensitive Investigative Matter (SIM) Ret 97/10/2015 bs : BIE Enclosure(s): Enclosed are the following items: 1. (U//Pe8e) Referral documents received from ICTG Details: WU! (gpmme) PSTHQ, Counterespionage Section, is opening a full investi gation based on specific articulated facts provided by an B11 referral from the Inspector General of the Intelligence Community (TcTs), dated July €, 2015 regarding the potential compromise of classitied information. (U//#6¥0) The purpose of this investigation is to detect, obtain information about, and protect against federal crimes or threats to the national security. The initiation of this Full Investigation is based, as per AGG-Dom I1.B.3 and DIOS Section 7.5, on activity constituting-a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur and the investigation may obtain information relating te the activity or the involvement or role of an individual, group, or organization in such activity. 3) DRAPE the ICIS referral provided 4 sample unclassified e-ail that allegedly contains information et a classified and SOt level. According to the ICIG, this e-mail was part of a larger trove of other Unclassified e-nails they were reviewing daring their ovn anvestigation. Tl dept the following documentation was provided by the ICIG and will be kept in the 1A section of the case file. 1) €11 referral letter from the ICIG dated July 6, 2015 regarding Potential Compromise of Classified Information, 2) Letter from the ICIG dated June 19, 2015 regarding Update to IC IG support to State Department IG. 3) Letter from the ICIG dated June 25, 2019 regarding Classified Material on Personal Storage Devices. 4) E-mail dated April 10, 2011 with example of potential inclusion Bee moron 2 HRC-349 @ e “Berkey rover title: (U//Pe¥6) Opening of Full Investigation on @ Sensitive Investigative Matter (STM) Re 07/10/2015 b3 BIE of classified information contained in an unclassified e-mail. 5} Letter from Williams 4 Connolly LIP dated June 24, 2015 regarding preservation efforts related to e-mails, Hy (SPSGF) Due to the extremely sensitive nature of this investigation and the damage its disclosure could cause, the case will be designated as @ prohibited investigation in accordance with the Counterintelligence Division Polacy Implementation Guide. Author requests Assistant Director concurrence to maintain the identified case as pronibites, ‘Ui (sPySe) mis investigation is alse designated a Sensitive Investigative Matter (SIM) due to a connection to a current public official, political appointee or candidate as defined in Section 10.1.2.2.2 of the DIOG. WO) SDs¥tuF) additionaliy, an Assistant Director exemption for uploading to Sentinel is requested. Since the TCIG referral alleges classified SCI material may have been compromised, all investigative work will be conducted on SCION. As documents to the case file are added, a placeholder will be entered inte Sentinel and a serial number assigned to the document. Slectronic copies of the case serials will be stored on SCION. The physical case file documents will be stored in a locked file cabinet located 11 2 currently certified SCIP. BIE ++ Bias oon HRC-350 be Ic HRC-362 SEC Department of Justice Federal Bureau of Lnvestigation In Reply, Please Refer to Washington DC, 20535 File No. July 13, 2015 (0) OPENING LHM FOR FULL INVESTIGATION ON USPER (U) Subject(s) Name: UNKNOWN SUBJECT CLASSIFIED BY: NSICG Ja7ZE5TIE w) Preliminary Investigation REASON. 14 (ch BeewasszeY cy 32-31-2060 (v) _x_- Full Investigation DATE” do-a7-20a8 _— Single subject Aut surOrwaT Ton contaniee HEREIN 13 UNCLASSTEIED BECEDT _X_ multi-sunject WeERe stoke OTMERKISE enterprise Foreign intelligence collection (0) Investigation initiated by: _ Field Office or x FBIHQ (0) FBIHQ/DOT notice via LHM required (if yes to any below): A, full on USPER B. SIM (PI or full) C. enterprise investigation < D. foreign intelligence case (U) I. Purpose of the Investigation: Check the appropriate purpose for which the investigation is being initiated, as per AGG-Dom 1.8.1 and DIOG ''6.2 and 7.2: Classifil Derived From: Declassi: 390 NSIC dated 20130301 Page 1 of 4 ‘This document contains neither recommendations nox conclusions of the £81. It is the Property of the FbIvand is loaned tp your agency: it and 4ts contents are not to be distributed outside your agency. SECRI HRC-363 SECRET) FORN ba 8 UNKNOWN SDBIECT OR COUNTR' SENSITIVE INVESTIGATIVE MATTER bs BIE A. To detect, obtain information about, or prevent or protect against federal crimes or threats to the national security. B. To collect foreign intelligence. (Full investigations only} (U) II. Predication for the Investigation: Appropriate circumstances: Check the appropriate circumstance (s} on which the initiation of the Preliminary Investigation or Full Investigation is based, as per AGG-Dom II.B.3 and DIOG Sections 6.5 and 7.5: _X_A. (u) An activity constituting a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur and the investigation may obtain information relating to the activity or the involvement or role of an individual, group, or organization in such activity? __. 3. (U) An individual, group, organization, entity, information, property, oz activity is or may be a target of attack, victimization, acquisition, infiltration, or recruitment in connection with criminal activity in violation of federal law or a threat to the national security and the investigation may obtain information that would help to protect against such activity or threat. (0) The investigation may obtain foreign intelligence that is responsive to a Positive Foreign Intelligence Requirement, as defined in D10G Section 7.4.C. [Full investigations only] ‘U) GeAIE} FRIHQ, Counterespionage Section, is opening a full investigation based on specific articulated facts provided by an €11 referral from the Inspector General of the Intelligence Community (CIG), dated July 6, 2015 regarding the potential compromise of classified information. (0/ (#086) The purpose of this investigation is te detect, obtain information about, and protect against federal crimes or threats to the national security. The initiation of this Full Investigation is based, as per AGG-Dom 11.2.3 and D10G Section 7.5, on activity constituting a federal crime or a threat to the national security has vage 2 of 4 “SEGRED7oncONPNGEGEN HRC-364 SECK RN et . BIE WISHANDLING OF CLASSIFTE! UNKNOWN SUBJECT OR COUNTRY; INVESTIGATIVE MATTER Bo bre or may have cccurred, is or may be occurring, or will or may occur and the investigation may obtain information relating to the activity or the involvement or role of an individual, group, or organization in such activity. Ul Da@wie) ‘the 1¢16 referral provided # sample unclassified e-mail that allegediy contains infomation at a classified and SC! level. According to the ICIG, this e-mail was part of a larger trove of other unclassified e-maila they were reviewing during their own investigation. ‘Ul PSG4H} the following documentation were provided by the ICIG and willbe kept in the 18 section of the case file. 1) 811 referral letter from the ICIG dated July 6, 2015 regarding Potential Compromise of Classified Information. 2) Letter from the ICIG dated June 19, 2015 regarding Update te IC 1G support-to State Department 1G. 3) Letter from the ICIG dated June 25, 2015 regarding Classified Material on Personal Storage Devices. 4) E-mail dated April 10, 2011 with example of potential inclusion of classified information contained in an unclassified e-mail. 5) Letter from Williams & Connolly LLP dated June 24, 2015 regarding preservation efforts related to e-mails. bi 3 SEC ‘ORN HRC-365 =e aa ba is) et WESHANDEING OF CLassrr ie ere OxkNoW SoBJECT_OB COUNTR’ SETS [ese MATTER bo bre bi 3 (WU) IV. Certification: The case agent and all approving personnel certify that: XA. An authorized purpose and adequate predication exist for initiating the preliminary or full investigations; The investigation is not based solely on the exercise of First Amendment activities or race, religion, national origin or ethnicity of the subject; and The investigation is an appropriate use of personnel and financial resources. (0//#686) The point of con nvestigation is be Assistant Section Chief telephone number| Pe Page 4 of @ _SECRETZIORCON/AOFORN HRC-366 [leas spl bé BIC HRC-267 ule TEORBATTON conTAIEE “Baki moron cuss SREIN TS UNCLASSITIEG EXCEPT REASON. 14 BECUASE IRE. SHCDA OTRERWISE se DME: 30 17-2036 US. Department of Justice Federal Bureau of Investigation 8 1 Reply, Pease Refer to Fie No. 21 July 2015 To: Sally Quillian Yates Deputy Attorney General Department of Justice From: Mark F. Giuliano Deputy Director Federal Bureau of Investigation Subject: MISHANDLING of CLASSIFIED? UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) S: prsH on 13 duly 2015 and 20 Juty 2015, T verbally advised you of a Section 811(c) referral from the Inspector General of the Intelligence Community received by the FBI on 06 July 2015. The referral addressed the mishandling of classified information on the personal e-mail account and electronic media of a former high-level US Government , the PBT initiated a full investigation, n response to the referral. Two copies of the opening letterhead memorandum for the investigation are attached for the information of the Department of Justice. (0//#686) The point of contact for this investigation is Assistant Director Randall C. Coleman, Counterintelligence Division, telephone number| Mark F. Giuliano FBI, Deputy Director Derived FF fie sources Decl, y 6 91231 Seer / Aeron 1 cu: az-s1-2080 HRC-368 BD EY: NSICG s9TJESTS bl BIE bi BIE b6 b7c ALL TITORIATION CONTAINED EREIN 13 UNCLASSIFIED 07/21/2015 FATE 1o-O7=201¢ BY JE72AST98 WSICE be [please have the DD sign these two documents. One will be provided the DAG/DOJ and the other ee copy will be placed in our records here at FBIHQ, Thar Moa. dehuieed \o “phe ‘oD & WD Colerse- 7(238 HRC-369 | L_Astes whys Ie HRC-374 * BEREIN TS UNCLASSIFIED e ALL TUTORIATTON CONTAINED by Le BY o37985T9a WSICG 2 10) U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0002 July 27, 2018 Re: — Request for Preservation of Records | Pursuant to Title 18, United States Code Section 2703({), this letter is a formal request for the preservation of all records and other evidence in your possession regarding be] ending You are hereby requested to pr ects possession, including records stored o record, and records that may come in request until receipt of a legal court or ™ Yi of this cequest to the subscriber or any 0° request, as the FBI's investigation may! of disclosure. You are also requested not to close the account of t sted to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as 10 your actions to preserve the referenced files and records, please contact Special Agent las soon as possible and before taking any such actions, This preservation request applies to the following records and evidence: d below currently in your that includes the complete date of acknowledgment of this -d not to disclose the existence is necessary to comply with this, A All stored electronic communications and other files reflecting communications to ‘or from the requested account. B. All records and other evidence relating to the subscriber(s). customer(s), account holdex(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying HRC-375 be be bE bs bic be bre bE 6 bre Ifyou Special Agent information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of comection (e.g., telnet, ftp, http); Data transfer volume; ‘User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers 10 which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. veepe ne Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. regarding this request, please direct all inquiries to yho can be reached at Sincerely, fle ‘Charles H. Kable [V Section Chief Counterintelligence Division HRC-376 bs bre be sale BIC gyal HRC-377 | MERETN TS (nICLASSTFIEC ous BY e ALL INFORMATION cOMTAINED CATE 206 yiosprsa nei0g U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 28, 2015 bTE Re: Reguest for Preservation of Records Dear Sir or Madam: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for BIE the preservation of all records and other evidence in your possession regarding th [-_]pending further legal process. b6 1 BIC 2 b7E 3 4 8 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure, You arc also requested not to close the account of the subscriber, unless requested to do so by the subscriber. Uf compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and records, please contact Special Agent las soon as possible and before taking any such actions. ve ‘This preservation request applies to the following records and evidence: ‘A. Allstored electronic communications and other files reflecting communications to or from the requested account HRG378 Ifyou have any questions regarding this request, please direct all inquiries to Special Agentf Yoho can be reached at v6 All records and other evidence relating to the subseriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in clectronic or other form; and ‘All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (eg, telnet, ftp, http); Data transfer volume; ‘User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; 6 Telephone caller idemtification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, inethod of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP cr its subsidiaries, peerr Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person oF entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. Sincerely, Yin $_. Charles H. Kable IV Section Chief Counterintelligence Division HRC-379 a anand Bae 8 ay HRC-380 ae nrronsarras canaries ‘Siu ve urcuserrina jaanoa meres U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 27, 2015 Re: — Request for Preservation of Records Dear| Pursuant to Title 18, United States Code Section 2703({, this letter is a formal request for the preservation ofall records and other evidence in your possession regarding the pending further legal process. ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legat court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure, You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. Uf compliance with this request may result in a permanent or temporary termination of service 10 the accounts described below, or otherwise alert the subscriber or user of these accounts as 10 your actions to preserve the referenced files and records, please contact Special Agent Jas soon as possible and before taking any such actions. ‘This preservation request applies to the following records and evidence: A. All stored electronic communications and other files reflecting communications to or from the requested account. B. All records and other evidence relating to the subseriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of bs 7c BIE 26 BIC b6 7c TE be 7c HRC-381 services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time: Method of connection (e.g. telnet, ftp, http): Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. weeNe me Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form, have any questions regarding this request, please direct all inquiries to (eo foto can e reached Me Sincerely, YY Charles H. Kable IV Section Chief Counterintelligence Division HRC-382 mere i> oa 4 out bs prc HRC-383 * © seston sarc Magne ae aS 2016 SY 557085798 WSICG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 27, 2015 Re: Request for Preservation of Records Dea] Pursuant to Title 18, United States Code Section 2703({), this letter is a formal sees for the preservation of all records and other evidence in your possession regatding th You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not o close the account of the subscriber, unless requested to do so by the subscriber, Uf compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and records, please contact Special Agent as soon as possible and before taking any such actions. ‘This preservation request applies to the following records and evidence: A. Allstored electronic communications and other files reflecting communications to or from the requested account. B. All records and other evidence relating to the subseriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of HRC-384 be BIC BIE bs bre BIE be bre Ifyou Special Agent ® e services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: 1. Conneetion date and time; 2. Disconnect date and time; 3. Method of connection (e.g., telnet, ftp, http); 4. Data transfer volume; 5. User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; - 6 Telephone caller idemtification records; and 7, Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the ‘connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form, have any questions regarding this request, please direct all inquiries to {oho cam be reached a »6 bre Sincerely, ‘Charles H. Kable IV Section Chief Counterintelligence Division HRC-385 be ss pre Ll \\ & HRC-A24 ALL SBE INFORMATION CONTAINED HEREIN TS ONCLASSTFIEC TATE 10-31-2016 BY 97025794 WSICG cee ee United States Senate SESE com on eso SASHNETON DE ArEtOZTS July 24, 2015 VIA ELECTRONIC TRANSMISSION ‘The Honorable James B. Comey, Jr. Director Federal Bureau of Investigation 935 Pennsylvania Avenue, NW Washington, D.C. 20535 Dear Director Comey: The Inspector General of the Intelligence Community (IC) and the Inspector General of the State Department (State OIG) recently notified the FBI and several Intelligence Community agencies of a compromise of national security information in connection with Hillary Clinton's use ofa non-governmental email server while Secretary of State. Specifically, in a sample of 40 of Secretary Clinton’s emails IC identified four containing classified IC-derived information, ‘These recent revelations raise important questions about the role the Federal Bureau of Investigation (FBI) has taken and will continue to take in this matter. In addition, a notification from the IC indicates that these classified emails existed on a thumb drive and may exist on @ server. According to a briefing provided today by the IC and State O1Gs, former Secretary Clinton's personal attorney, David Kendall, was in possession of the thumb drive at the time of the notice to the FBI and other IC components. This raises very serious questions and concerns ‘fa private citizen is somehow retaining classified information, Accordingly, please explain whether Mr. Kendall had the requisite security clearance and, authorization to be the custodian of classified national security information, If not, please explain what steps the FBI has taken of plans to take to secure and prevent further dissemination of the classified information contained on the thumb drive. In addition, what steps are being taken to hold anyone in this matter accountable for unauthorized possession of classified material? Ifyou have any questions, contact Josh Flynn-Brown of my Committee Staff at (202) 224- 5225. Sincerely. Charles E. Grassley ‘Chairman ‘Committee on the Judiciary HRC-425 We ask that this be an unclassified report, and that a classified annex be provided if necessary. Thank you for your time, and we look forward to working with you on this important matter of national security. Sincerely, | ‘Chairman Bob Corker Chairman Richard Burr Senate Foreign Relations Committee Senate Select Committee on Intelligence Governmental Affairs Committee HRC-426 6 Bre HRC-427 ALL PRT THFORUATION commamMen BERSIN £5 UNCLASSIFIED CATE ip-aa~roie BY c27JeeT94 USTCE TREY Gowny, SOUTH cAROURA wine, comuncs. anyeano Sra F ‘emote Money Congress of the Gnited States ont ctannsay sog se, wasrncron ‘LYNN WESTMORELAND, GEORGIA it iF i JM JORDAN, oko. House of Representatives NDA T SANTEE GAtroMN A Tae ora LLNS Select Committee on Benghazi TTaRiMY DUCRWORFH LU S MARTHA ROBY. ALABAMA, 1096 Longworth House Office Bullding 112" congress: Susan Bro iba Wothington .¢ 2st s 080 re 4, 120) 228-7100 SUSAINESACISUA SOS. marr oiseron http:benghazi.house.gov Stare Oaecros July 22, 2015 ‘The Honorable James B. Comey Director Federal Bureau of Investigation 935 Pennsylvania Avenue, NW Washington, DC 20535 Dear Director Comey: The House of Representatives charged and empowered the Select Committee on : Benghazi to review the events before, ducing, and after the 2012 attacks in Benghazi, Libya and Specified related matters. During the pendency of our investigation, the Committee has discovered facts suggesting the existence of issues of significant legislative and oversight concern. Inow understand 2 formal referral has been made to the Federal Bureau of Investigation by impartial officials within the Executive Branch regarding potential investigative issues flowing from some of these facts. While the Committee’s work will continue for legislative, oversight, and reform Punposes, itis important the Bureau also immediately consider whether a thorough, independent, and nonpartisan review of the matters referred to it, as well as issues attendant thereto, is Warranted. This is necessary to ensure the laws are enforced fairly, evenly, and impartially wherever the relevant facts may lead. The Bureau is in the best and most appropriate position to evaluate the complete range of counterintelligence and publie integrity equities that may be ‘implicated. Only the Bureau can accomplish this in a way that ensures public confidence in a fair, imely, and exhaustive investigation of these matters, And the Bureau is uniquely well suited to ensure this is accomplished free of any extemal factors save the facts applied assiduously to the law and devoid of either real or perceived political influence. ‘The principles at bar are particularly important with respect to counterintelligence ‘equities and the handling, retention, and ‘storage of classified information. The Department of Justice has recently epplied a consistent standard of aggressive and evenhanded investigation in cases ranging from Edward Snowden to David Petracus in order to unambiguously deter future: mishandling and disclosure. I understand significant concerns have been: referred to the Bureau in this area based on the objective assessment of an interagency review that included consultation with the officials responsible for determining what information is classified. The facts underlying this referral potentially implicate the same important interests the Department has steadfastly sought to protect in the past. . HRC-428 Similarly, the Departement has thoroughly investigated matters relating to the handling of, evidence relevant to potential or ongoing investigations and the accuracy of representations made ‘o Congress even in sensitive national security cases. While T expect the Committee will continue to explore relevant facts and issues within its charter, the Committee is willing to Provide access to any information curently obiained during the course of our investigation that ‘may inform and instruct matters raised in the refecral. You have spoken in the past about “the reservoir of credibility and trust that is the Department of Justice” and you have stated “I am a huge believer in the rute of law, but I also believe that no one in this country is beyond the taw.” I could not agree with you more, Your ‘work is ultimately judged, as mine once was, by the blindfolded woman holding nothing but a set of scales and a sword, The evenhanded application of the law and the dogged, impartial pursuit of the facts are the hallmarks of justice. Lhope you will carefully consider these matters. They are outside the purview of what our Committee has been asked to do, but clearly within the four comers of what you have been asked to do. Sinoggely, Ley, rowdy Chairman cc; The Honorable John Boehner Speaker of the House ‘The Honorable Elijah Cummings Ranking Member HRC-429 bie uRc-azo*" : ALL INFORIATICH CONTAINED HEREIN Ts UNCLASSIFIEE DATE 10-s1-2015 BY sa7eSTS4 NETCC U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 27, 2015 Steve Linick Inspector General U.S. Department of State Room 8100, $A-3 2201 C Street, N.W. ‘Washington, DC 20520-0308 Re: — Request for Preservation of Records Pursuant to Title 18, United States Code Section 2703((, this letter is a formal request for the preservation of all records and other evidence in your possession regarding the domain account @elintonemail.com and the @state.gov email accounts associated with the following US. Department of State employees, pending further legal process. be Ic TE eee epee pHa PE ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this, request until receipt of a legal court order. You are also requested not to disclose the existence HRC-431 of this request, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. This preservation request applies to the following records and evidence: A Ifyou Special Agen All stored electronic communications and other files reflecting communications to ‘or from the requested account. ‘The conients of any communication or file stored by or for the accounts and any associated accounts, and any information associated with those communications or files, such as the source and destination emails addresses and IP addresses. All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g,, telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Intemet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. yeene res Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. have any questions regarding this reques| i Il inquiries to {en Pho canbe reached at oe Sincerely, fee Charles H. Kable IV Section Chief Counterintelligence Division HRC-432 gre ws 6 Bre HRC-433. e ALL TFOResTrOM conta DEE nM TS ORCLASSTPIED 10-31-2016 BY J37I88T94 NSTCG U.S. Department of Justice Federal Bureau of Inves' Washington, D.C. 20535-0001 July 31, 2015 David Kendall, Esq Katherine Turner, Esq. Law Offices of Williams & Connolly LLP ‘725 Twelfth Street, N.W. Washington, D.C. 20005 Re: Request for Preservation of Records ‘This letter is a formal request for the preservation of all records and other evidence in ‘your possession, or in the possession of your client, Hillary Clinton, regarding the domain account @elintonemail.com, pending further legal process. You are hereby requested to preserve the records described below currently in your possession, or in the possession of your client, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. ‘This preservation request applies to the following records and evidence: AL All stored electronic communications and other files reflecting communications to or from the requested domain account. B. All servers, computers, thumbdrives, hard drives, smartphones, or any other Aigital storage devices in your possession or in the possession of your client, ‘which may contain communications to or from the requested domain account, C. All business records and other evidence relating to the establishment of the domain referenced above, including subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of secvice and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and HRC-434 Ifyou Special Agen All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g., telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the > {l be pre (u) sessed ore they who mointotejstice, HRC-472 DECLASSIFIED ey: NSICG 997985794 RMD) (FBI) MICHELLE A (RMD)(FBI), NEAGLE, LOUISE M(RMO)(FED) Subject: RE: State Department Emails --FOIA Coordination ~-SEGREF Importance: High SentinelCaseld: TRANSITORY RECORD Classification: Classified By: 323396132 Derived From: FBI NSIC, dated 20120629 Declassify on: 21 TRANSITORY RECORD Just received a cal from State. They want to argue about the bi portion. We'll need to discuss, are you free at 2:00? | suspect they may call AD Steinbach, Thanks, From} (RMD} (FBI) Sent TRay-ARITS, 2015 11:22 AM — cro) (eat ss Rnb) (FBI croy anf }oroyrs| ‘Subject: RE: State Department Emails - FOIA Coordination ----SEGREE Classification: Classified By: J23 Derived From: FBI Declassify On TRANSITORY RECORD dated 20120629 Forwarded to State. Thankstt! |(CTD) (FBI) 2015 10:35 AM 10) (FBT) (RM) (Fe) heron crore | t From! ur HRC-473 bs bac b7E be BIC bé BIC TE 6 BIC BIE wstes sa7se5798 be RMD) (FBI) ee “Faw (F1) Ei (08) (Fal) Imation Review ~ Segment H-3 -- SEGRETINOEORN- Importance: High SentinelCaseld: TRANSITORY RECORD Classification: Classified By: J23091 Derived From: FBI NST ted 20130301 Declassify On. be bre AK Subject: FW: Coordination Review - Segment H-3 --- SEERERYNOFERN: Importance: High Classification: Onn Classified By: 32339) Derived From dated 20120629 Declassify On be prc You're about to get drug into an issue on classification of the Clinton emails. They are contesting CTO’s classification decision and would tke to discuss it with you. (Forum shopping | believe.) 'lcallyou and glve you some info, then they've asked if you could calll_ last name t think] Co (RMD) (FT) be rsday, April 09, 2015 11:19 AM ere i KF) : (RMD (FBI); NEAGLE, LOUISE M (RMD)(FBI) ‘Subject: FW: Coordination Review - Segment H-3 -~ SEGRESHMOFOAN- Importance: High HRC-474 RMD) (FBI To: LC . Subject: FW: State Deparment Emails -FOIA Coordination ---SGRET Importance: High SentinelCasela: TRANSITORY RECORD Classification? Derived From Declassify On: TRANSITORY RECORD = »s I've called the State’s Legal Advisor's Office a number of times and haven't connected. As they seemed to be wanting to resolve this quickly, I'm surprised. | wonder if they gave up on me and went higher. Have you heard anything about: ‘pproschesto your AD? Tm aso checking withOGE to see they went Sect to them RMD) (FET) 6 216 PM Ie (CTD) (ret) be RMD} (cry Fey [croxesn); (OGC) (FBI); JUPINA, MICHELLE A (RMD)(FBI), NEAGLE, LOUISE m (RMO)(FBL) ‘Subject: Re: State Department Emails FOIA Coordination SEGRE Importance: High Classification \ SECRET Classified ay: J223g6132 Derived From: FBI Declassify On: TRANSITORY RECORD CJ 2 BIc dated 20120629 Just received a call from State. They want to argue about the bi portion. We'll need to discuss, are you free at 2:00? | suspect they may call AD Steinbach. “Thanks, HRC-A75 CRCLASSIFIEC BY: HS: ON 13-07-2016 RMD) (FBI) ES (357) a EMeScaMane ) (FBI) \ Siate Deparment Emails FOIA Coordination ~-GEGREF ‘SentinelCaseld: ‘TRANSITORY RECORD Classification: Classified By: Derived Frot Declassity On TRANSITORY RECORD wu (U}t've not heard anything about approaches to my AD, but I'll have my UC double-check at the 4pm close-out meeting with exec management. (U) usta an FYI, I've also not heard anything back yet from the LEGAT. wf From: RMD) (FBI) a 29, 2015 1:36 PM. To! \¢cTD) (FB1) Subject: FW: State Department Emails -FOIA Coordination SECRET Importance: High Classification: Classified By: J23 Derived From: FBT Declassify on TRANSITORY RECORD dated 20120629 Co ''ve called the State's Legal Advisor's Office a number of times and haven't connected. As they seemed to be wanting to resolve this quickly, 'm surprised. | wonder if they gave up on me and went higher. Have you heard anything about approaches to your AD? I'm also checking with OGC to see if they went directly to them. HRC-476 e agTaasTs4 bs Bic bé BIC Bé Ic 6 Ic TECLASSIFIES BY: NSTOG 237996794 Gu ti-or-zoie 26 (RMD) (FBI) ee From: Sent: q To: CL Tic 10) F6) Subject: RE: State Department Emails -FOIA Coordination + SEGREF SentinerCaseld: TRANSITORY RECORD Classification: sk¢RET Classified ay: J2359Kt32 Derived From: FBI dated 20120629 Declassify On: TRANSITORY RECORD ‘Thanks! | don't see any urgency at this point. From] [cTO) (Fe) bé 19M bre ‘Sent: Wednesday, Apri 29, 2015 ToL__ |(RMO) (FBI) ‘Subject: RE State Department Emails --FOIA Coordination —- SEEREF— Classification Classified By: Derived From TRANSITORY RECORD uJ vs bre {U) F've not heard anything about approaches to my AD, but Ill have my UC double-check at the 4pm close-out meeting with exec management, (U} Just as an FY1, I've also not heard anything back yet from the LEGAT. | Fromi (RMD) (FBI) BS Sent: Wednesday, April 29, 2015 1:36 PM bre Te (CTD) (Fa) ‘Subject: FW: State Department Emails --FOIA Coordination —SEEREF— Importance: High Classification: secher HRC-477 138894 RMD) (FBI) be bic From: Sent: . To: Lt ‘Subject: RE: Stale Department Emails ~FOIA Coordination SECRET Sentine\Caseld: TRANSITORY RECORD Classification: Sacre: Classified By: g23syér32 Derived From: FBI NSXC, dated 20120629 Declassify On; 20481241 TRANSITORY RECORD 6 bic | beteve the fst document reviewed was part ofthis batch-bu am nat entirely sue. State Department Provides New Benghazi Documents To House Panel. Chris Walace reported on Fox News! ‘Special Report (4/90, 1.53M) that the State Department's Benghazi Accountabiity Review Board “tumed over more than 4,000 pages of documents and roles to the House Solect Commitlee on Benghazi Commitice Chairman Trey Govaly said the ocuments “were recently subpoenaed a second fime after the intial request two years ago,” adding that he “is stil waling forthe Department to produce other records that have alzo been requested or subpoenaed.” Poltico (4/30, French, 1.11M) reper that the documents “were not reviewed by the other halécozen committees that investigated ihe 2012 attacks.” Gowidy sai, "Contrary to those who said al had been asked and answered, the Benghazi Commitee has shown there is more stl for Congress % consider.” The Washinaton Times (5/1, Sherfinski, 641K) reports that Democrats “on the committee have said a handful of investigations into the attack have already been done and say Republicans are using the Committge a8 a way to attack’ Hilary Clio, USA Today (5/1, Page, 5.01M) reports that Goudy also “says he might be wilng to aocept assurances under oath from Hilary CGinion that she has provided all her relevant emails o the panel — dropping requests for an independent examination of her computer server’ He told "Capitol Download,” “f she were, under some theory, able 0 say, ‘yes, Ican promise you under penalty of petury you have every single document you'e ented to, that would probably shut ff hat ine of inguiry.Ifshe can, then wil be a short conversion” (CTO) (FBI) v6 prt 28, 2015 2:19 PM bre To: kro) (ret) Subj ‘Department Emails --FOIA Coordination —- SEEREF- Classification: SSCRET Classified By: F4sMs7x Derived From: FBI nszt, dated 20120629 1 HRC-478 8 @ ALL INPORTION CONTAINED bé BIC From: Sent: To: ce: JUPINA, MICHELLE A (RMD)(FBI, NEAGLE, LOUISE M(RMO)(FB!) Subject: HRC Email —- UNCLASSIFIED/BQUE SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED//foUe TRANSITORY RECORD bé Ic Just ahead’s up. I gota call fron JOD, concerning the classified HRC email. He received a call from State asking if we would revisit the issue. [directed him to CTDas the ultimate SME on harm and the classification decision. (1 did tell him as an OCA | concurred in the markings.) UNCLASSIFIED//FOUG HRC-479 ALL THFORMaTIoN cowrATED EUW 15 WNCLASSIE IEE we ere Be Jeta6s194 NsIce RMD) (FBI) bre From: Sent: To: (RMD) (FBI ] Co: NEAGLE, LOUISE M (RMO)(FBI) ‘Subject: RE: TRIM Document : 15/00/1703 : Letter from Patrick F, Kennedy, Department of State {DOS), advising of the receipt of 55.000 pages of e-mails from former Secretary of State Hillary Clinton and requesting @ senior FB! official to coordinate the FBI's revi ‘SentineiCaseld: NON-RECORD Classification: UNCLASSIFIED Boss just sent an enail tof] saying 1°11 be the official. Be (RMD) (FBI) TE, 2025 2:27 om : avo) (F82);[—____] (@N0) ¢ex);[______] (rwo)¢Fex) Ce: NEAGLE, LOUISE M (RMD)(FEI) Subject: RE: TRIM Document : 15/00/1703 : Letter from Patrick F. Kennedy, Department of state (00S), advising of the receipt of 55.000 pages of e-mails from former Secretary of State hillary Clinton and requesting @ senior FOI official to coordinate the FBI's revi Classification: UNCLASSIFIED No From: (RMD) (FBI) bn Sent: Monday, May 38, 2015 2:26 PM prc To: ] ¢RmD) (Fer) ;[ Jamo) (Fer);| (RO) (FBT) Cci NEAGLE, LOUISE M (RMD)(FBI) Subject: RE: TRIM Docunent : 25/00/1703 ; Letter from Patrick F. Kennedy, Department of State (00S), advising of the receipt of 55.002 pages of e-mails from former Secretary of State Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi Classification: UNCLASSIFIED sue POC wi ve has anyone suggested to you that our POC will be anyone other than[__ bre Ct --+--Opiginal Message: Free: (R00) (FBI) bs sent: FORAY, Fay 18> 2015 2:04 pw bac To: (ND) (FBX) (RMD) (FBI); (amo) 81) ce: NEAGLE, COUISE #4 (RMD) (FOI) Subject: Fi: TRIM Document : 15/00/1703 : Letter from Patrick F. Kennedy, Department of State (005), advising of the receipt of 55.000 pages of e-mails from former Secretary of State Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi HRC-480 Classification: UNCLASSIFIED Good afternoon, please note the short deadline (tomorrow!!) for response to the Department of state. Original hessagi From: ExecSec (D0)(FBI) Sent: Monday, May 18, 2015 1:55 PM To: (RMO) (FBI); JUPINA, MICHELLE A (RMO)(FBI);| RMD) (FBI); b6 NEAGLE, LOUISE FL ot (RMD) (FBI); (RMD) (FBI); Bie RMD) (FBI) te (osc) (Fax); [06 cer), (osc) (FBI (D0) (OGA) ; JOHNSON, GORDON 6, (D0) (FBI); PERKINS, KEVIN L, (DO) (FBI); (00) (FBI); (0) (FBI); (DO)(FBI); GIULIANO, MARK F (DO) (FBI); (CTD) (FBL) 5} (D0) (00)(OGA) Subjects TRIM Document : 35/00/1703 : Letter from Patrick F. Kennedy, Department of State (00S), advising of the receipt of 55.000 pages of e-mails from former Secretary of State Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revie -- Classification: UNCLASSIFIED NOTE TO RMD: This TRIM document has a short deadline of 5/19/15. ACTION OFFICE: RAD The above division, designated as the action office, is assigned the attached Director's Office correspondence for preparation of a response over the signature of YOUR APPROPRIATE DIVISION OFFICIAL by the OUE DATE indicated below. The original will be forwarded to the action office’s point of contact. INFORMATION ONLY electronic copies’ are being sent to O6C, Chief of Staff, Associate Deputy Director, Oeputy Director and Special Counsel to the Director. IMPORTANT NOTE: Jf you, represent an FBI Field Division and are receiving this e-mail, you are being provides © coy sf correspondence which has cone to the attention of the Director, for other FBI executive. You are not being tasked with any action in this regard by the 81's Office of the Executive Secretariat. You are being provided a courtesy copy only. Responses handled vtrougt other means, such as via telephone contact, e-mails, etc., should be forwarded to the ExecSec via e-mail, and mst include the Trim 00# and sufficient relevant data, such as date, contact, and disposition, to allow ExecSec to close the pending action. Hf this matter needs to be reassigned to another entity, the FSI ExecSec should be advised immediately (within 2 days of e-mail receipt). The ExecSec will need to know to whom the request should be reassigned, together with a point of contact (if known), and the original correspondence will need to be returned to ExecSec, Room 6147. ACTION OFFICE INSTRUCTIONS: (Failure to comply with the following instructions will delay the closing of pending action and will result in the correspondence appearing on the overdue report) A. Response Preparation: HRC-481 -One UNDATED letterhead copy, -An envelope or mailing label, -A blocked yellow UNDATED file copy, attaching the original incoming correspondence to the yellow file copy, and 2 copy of the incoming to each designated “courtesy copy” (cc), as appropriate. The yellow copy mail room block must be checked and initialed, and cha TRIN number noted on the yellow (can be handwritten). : 1. Prepare the following: 2. At a minimum, the copy count must include the following copy designation: Trim Xx/D0/2200 1 - (Your confirmation white copy, if desired) B. Routing of the Final Response Package: 1. Route your final response package to the FBI ExecSec, Roon 6147. The FBI ExecSec will forward the completed package to the mailroom for delivery. < TRIM Record Information >-— Record number 35/00/1763 Date Due =: ~—s Tuesday, May 19, 2015 Addressee: AD-Records Management (Addressee) Current Action PREPARE RESPONSE PER INSTRUCTIONS (Responsibility of: Executive Secretariat, Due 5/19/2015 at 1:43 PM (14 hours, 55 minutes)) All Contacts: AD-Records Management (Addressee) Office of General Counsel (Other) Chief of staff (Other) Associate Deputy Director (other) Deputy Director (Other) Special Counsel to the Director (Other) ‘Access DB or Workflow = From KENNEDY, PATRICK F. Constituent: Title (Free Text part) : Letter from Patrick F. Kennedy, Department of State (005), advising of the receipt of $5.00@ pages of e-mails from former Secretary of State Hillary Clinton and requesting @ senor FBI official to coordinate. the FBI's review with their FOIA team. Notes : RHO advised during electronic routing that there is a short deadline for this TRIP record. ‘Monday, May 18, 2015 at 1:44:58 PH (GHT-e4:08) " bs bie r e Communication : ‘Thursday, May 14, 2015 teiateu Records Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIED HRC-482 Classification: UNCLASSIFIED Classification: UNCLASSIFIED HRC-483 a) e¢ -= e RMD) (FB ae FBI INPO : JUPINA, MICHELLE A (RMD)(FB)) GLASEIFEEE ws neice ss7o9sr94 Subject: HRC Emails -- UNCLASSIFIED/FOUO Tecuasstry of 2-33-2040 Importance: High CATE: 12-07-2026 SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED//FOUO TRANSITORY RECORD Michelle, Just returned from the meeting at State hosted by USS Kennedy concerning HRC emails, After discussing the logistics of ‘any consultations ssa the 55,000 pages in order to meet a court-ordered Jan 2016 deadline, Secretary Kennedy request oW/O1P, and me to stay behind to discuss the FBI determination of classified material in an initial batch of 296 emails dealing with Benghazi. These emails were processed in response to a request by the House Select Committee on Benghazi, they were processed using FOIA guidelines. State Department referred the document to us for our review. | passed the email to CTD who reviewed and marked the document with FBI equities. Included was one line marked with the with classification "SECRET." Attached is the email In question with markings. AS an OCA, this marking was entirely consistent with the thousands of FBI documents I've reviewed over the years. State OLC contacted me initially objecting to the classification. Later Secretary Kennedy contacted] |i 100, who then contacted me. |'ve notified CTO Exec Sec in each instance of the contact. ‘The redaction lists “interference with foreign relations” as the rationale. The crux of States argument is they know better what will impact foreign relations and there is no longer a government in place. The more appropriate rationale is sources and methads, While the email does not name the particular official, this might be deduced and, given the ‘threat of violence in this region, any surmise could be fatal for whoever cooperated with us. State will say no one will know ifit is redacted, but that is not how classification works, This all said, CTO is ultimate decider as to the level of harm contained in the information. | told Secretary Kennedy this and he said he would be calling AD Steinbach, “Here is our response. | recommend you go ahead and classify the forwarding email to us in the future in case we determine there is classified information. This marking was approved by the CTD serps eg bracket starts ‘with, "Apparently..”, the second bracket starts with, “The A/RSO...", the third bracket is SECRET//NOFORN.” ZB 105739808 - Work + CTO Redact. [The bi marking HRC-484 bs bac 6 Ie Be pic be BIG bi BS ALL THFORMATION coMTAINED HEREDI 16 UUCLASSITIEC RMD) (FBI pare 3 Se ee JUPINA, MICHELLE A (RMO\FBI[________]RMo) Subject: SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED TRANSITORY RECORD all Lust spoke to Pat Kennedy at DoS reference a State gov email dated November 18, 2014 07:01PM from[___] bs [Jara in which the FBI was requested to review a pending FOIA request bic | advised him independent and objective reviews by both RO and CTD previously determined two portions needed to be redacted based on exemption (b)(1) — "specifically authorized under criteria established by an Executive order to be kept secretin the interest of national defense or foreign policy.” We spoke earlier today and in the conversation requested that, as the Assistant Director CTD, 1 review the content and revise the determination and redact based on ‘exemption (b}(7)(0) only- “could reasonably be expected to disclose the identity of confidential source, including 3 State, local, or foreign agency or authority...” After discussions with RMD and CTD today, | explained to Mr. Kennedy to only exempt for (b}(7)(0) was not appropriate a the information in the two portions in question was classified at the Secret/NOFORN level and exemption (b)(1) was ‘needed in addition to exemption (b)(7(D). Therefore, I would not change the original determination made by the FB} ‘Michae! 8. Steinbach Assistant Director Be bic Classification: UNCLASSIFIED HRC-485 ALL INFORMATION COUTAINED BEREIN TS UNCLASSIFIEC RMD) (FBI) a From: JUPINA, MICHELLE A (RMD)(FBI ‘Sent: Thur 21, 2015 4:16 PM. To: {RMD) (FBI) Subject: Tale email FOIA --- UNCLASSIFIED. SentinelCaseld: TRANSITORY RECORD, be BIC UNCLASSIFIED Classification TRANSITORY RECORD From: JUPINA, MICHELLE A (RMO)Fa)) Sent: To: RYBICKI, JAMES E (DO)(OGA); GIULIANO, MARK F (00) (FB); GIACALONE, JOHN (D0)(FBI); STEINBACH, MICHAEL 8, (CTO) (FBI); BAKER, JAMES A (OGC)(FBI) Subject: RE; State email FOIA ~- UNCLASSIFIED Classification: UNCLASSIFIED TRANSITORY RECORD is an OCA and he can classify the information, unless CTO would prefer to classify i. Be bic From: A JAMES E (BO)OGA) Sent: re ‘To: GIULIANO, MARK F (00) (FBI); GIACALONE, JOHN (D0)(FBI); STEINBACH, MICHAEL B. (CTD) (FBI); JUPINA, MICHELLE A (RMD)(FBI); BAKER, JAMES A (OGC)(FBI) ‘Subject: FW: State email FOIA --- UNCLASSIFIED, Classification: UNCLASSIFIED TRANSTTORY RECORD State Department COS Jonathan Finer called this aftemoon reference this matter. He provided the background on the review process, stated that he was not attempting change the AD’s classification decision, and said that he just wanted to make sure that FB! leadership was aware of the decision and the procedural process and media attention it would likely trigger. | spoke to AD Steinbach who provided the background on the decision and | relayed back to the State Department that leadership is aware of the review process and decision. Mr. Finer asked whether it would be possible for the FB! to Records Management Division provided the enclosed internal FBI >7¢ communications, classified SECRET//NOFORN, referencing three (3) documents passed to the FBI by the State Department on or about April 28, 2015. Insofar as the State Department had identified FBI equities contained in these documents, they were sent to the FBI for classification review. The first email, dated September 16, 2015 was found to contain no classified information and released in full without redactions. The second email, dated October 17 and 18, 2012 was redacted and released in part using the B7(A) and B7(C) FOTA exemptions. The third email, dated October 3, 2012, was redacted and released in part based on the Bl FOIA exemption insofar as it contained non-FBI classified information The enclosure to this record is classified SECRET//NOFORN. owor015 ingion D.C be Investigation on 0807201 8___Washingon, = bIE Filey Date dietated__NiA be CA By sof poe \ oe “This document contains nether recommendations nor eanclusions ofthe FBI. It isthe propery ofthe PBI and is loanod to your agency: and is contents are noo be distributed ourside your agency. FISD BY: NSICS s370e5T96 036 pe INF)(FEY om From: (RMD) (FBI) Sent: “Thursde [5 3:23 PM ‘ To: Ney Fe); [Tay ly ‘Subject: [Documents#2 —-- SECRETHNOFORTT SentinolCaseld: lap ago Classificatio} 7 Classified Byl Derived From: 29130301 Declassify ia TRANSITORY RECORD Please see attached. [Joc per b6 Bie Classification: BpeRil//sorone HRC-518 ye NSIGG 797088794 (RMD) (FBI) BE bre . (amo) (F80| [OGC) (Fet)] (CTD \FBI), JUPINA, Te MD) SLE, LOUIS HRC emai, FOIA case F-2016-04841 — SECRETHROFORN TRANSITORY RECORD SECRET//NOFORN Classified By: J23J! 32 Derived From: FBI Ni , dated 20120629 Declassify On: 204 TRANSITORY RECORD bs Bre ‘Attached are three new emails from State. The review on these three documents has not been finalized by State, so the ‘markings reflect the status at this time. Thanks! 2 ft DB C05739708paf €05739758paf C05739635 pat Classification: SECRETAA@FoRN HRC-519 DECLASSIFIED BY NSICG oS786794 Eerie (RMD) (FBI) [Jamo ra be Le a o_o ms (coy F SI] |(RMO) (FBI) Subject: 'RE-HRC emails, FOIA case F-2075-04841 -—-SECRETHNOFORN: ‘SentinelCaseld: TRANSITORY RECORD Classification: Classified By: 32309 Derived From: FBI Wi} Deciassify On: 20) dated 20120629 TRANSITORY RECORD Yes, and understand internally at State there was some who agreed with our marking. From: [(CTD) (Fet) 6 Sent Wednesday, April 29, 2015 6:07 PM Be ‘Tos (RMD) (FBI) cel (cToy(Fe1);[—_______ (am) (raf (060) (F815 (CTD)(FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) ‘Subject: RE: HRC emails, FOIA case F-2015-04841 --- SEGREFNOFORN- Classification: SEORET//NOFORN Classified By: F4aKs7! Derived From: FBI NS, Declassify On: 204 ted 20120629 TRANSITORY RECORD wl be bre (U} Thanks, we'l take alook at these and get a response back. In glancing at the third e-mai | notice it’s been marked by OS as containing classified information. That might in part explain why they've backed off some of their early resistance to use invoking the b2 exemption. a (RM) (Fat) bs 9, 2015 5:40 PM bre |(CTD) (FBI) (CTO FB!) ro) (Feny,[____oc) (Fa); (CTD)(FBI); JUPINA, MICHELLE A (RMD)(F8I); NEAGLE, LOUISE M (RMO)(FBI) ‘Subject: HRC emails, FOIA case F-2015-04841 --- SEEREHHNORORM HRC-525 DECLASSIFIED BY: NSICG J97985794 RMD) (FBI be bre C____}amo) (Fe) ‘Wednesday. Way 06,2015 12:56 PM (CTO) (F BH (C- Fk) (FB I) [CTO }FBI), JUPINA, MICHELLE A (RMD) (FBI), NEAGLE, LOUISE M(RWD)(FBI) Sunject: RE: HRC emals, FOIA case F-2015-0464t —-SEERETHNOFERN- ‘SentinelCaseld: TRANSITORY RECORD Classification: Classified By: J2309 Derived From: dated 20120629 Declassify on TRANSITORY RECOR! be bre Do you have the status? | need to appease State Thanks Co From: ]RHD) (Fe) Pe ‘Sent: Wednesday, April 29, 2015 5:40 PM BIC or (an Cex (CTD) Ft} (Rm) (Fat (GC) (FBI); [(CTD\F81); JUPINA, MICHELLE A (RMD)(FBL); NEAGLE, LOUISE M (RMD}(FB) Subject: HRC emals, FOIA case F-2015-04841 --- SEERETYNOFGRN Classification: Classified 8: Derived From: PBI NSPG, dated 20120629 Declassify On: 204 TRANSITORY RECORI Co 6 Bic Attached are three new emails from State. The review on these three documents has not been finalized by State, so the markings reflect the status at this time. Thanks! £< File: COS739708.pdf >> << File: C0S739758.pdf >> << File: CO5739635.pdf >> HRC-526 DECLASSIFIED BY. usreG saToBDTSA (RMD) (FBI bé bre From: (RMD) (Fen Sent: ft 015 11:26 AM To: \cTD) (FB) ce: L ]iRmo) Bh; y JETD\FBI), JUPINA, TAIGHELLE A(RMO) (FBI, NEAGLE, LOUISE M1 (RMDKFED Subject: RE-HRC emaiis, FOIA case F-2015-04841 —-SECRETHNOFORN SentineICaseld: TRANSITORY RECORD TRANSITORY RECORD ‘Thank you very much, hope you're feeling better. From[ TCT) (Fa) be 05, 2015 10:02 AM BIG 10) (FBI) croyeany (RMD) cFB1);| (Osc) (FBI); [CTD)(FBI}; JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(F8I) SEERETHNGFORN, Derived From: Declassify On: TRANSITORY RECORD vw (U) Sorry for the delay in getting back to you, 've been out sick the last couple days. be BIC (U) CTD is fine with the redactions which DOS recommends and has no requests for further redactions. UI (0) Blessed are they who mointainestice, HRC-527 Cee y xo" as be BIC HRC-528 e ® U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 ALL INECRMATION CONTAINED ESEIN TS UUGLASSTFIED uarz 3-0 Be g57985T94 NsICS July 27, 2015 Custodian of Records Platte River Networks 5700 Washington Street Denver, CO 80216 Re: — Request for Preservation of Records Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all records and other evidence in your possession regarding the domain account @elintonemail.com, pending further legal process, You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete recond, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service 10 the accounts described below, or otherwise alert the subscriber or user of these accounts as 0 your actions to preserve the referenced files and records, please contact Special Agent Jas soon as possible and before taking any such actions, This preservation request applies to the following records and evidence: A All stored electronic communications and other files reflecting communications to or from the requested account. B. The contents of any communication or file stored by or for the account and any associated accounts, and any information associated with those communications or files, such as the source and destination emai’ ddrest sorIF- °° s. C. Allrecords and other evidence relating to the st criber(s), cuflomer,.,, account holder(s), of other entity(ies) associated with the r 2 ing, without limitation, subscriber names, user names, narues| |centities, mailing addresses, residential addresses, busine + a e ses and x Jor other contact information, telephone numbers 0 of identity, billing records, information about the length of HRC-529 Be bic Ifyou have any questions regarding this request, bless direct all inquiries to Special Agent! services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and times Disconnect date and time; ‘Method of connection (e. Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. telnet, ftp, http); yeeye nS ‘Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. who ean be reached at bs Bre Sincerely, Charles Hf. Kable IV Section Chief Counterintelligence Division HRC-530 uw Qyats a e be Ic HRC-534« e ALL TMFORMATIC CONTATNED HEREIN Is UNCLASSLETEC FATE 11-07-2025 SY S97c987S¢ NSICC U.S. Department of Justice Federal Bureau of Investigat Washington, D.C. 20535-0001 July 31, 2015 Joseph P. Claney Director United States Secret Service 950 H Street., NW Washington, D.C. 20223 Re: — Request for Preservation of Records Dear Director Claney: This letter is a formal request for the preservation of all records and other evidence in your possession, or in the possession of Hillary Clinton, former Secretary of State, regarding the domain account @elintonemail.com, pending further legal process. ‘You are hereby.requested to preserve the records described below currently in your possession, or in the possession of Hillary Clinton, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request, other than as necessary to comply with this, request, as the FBI's investigation may be jeopardized by this type of disclosure. This preservation request applies to the following records and evidence: AL All stored electronic communications and other files reflecting communications to ct from the requested domain account. B. _Allservers, computers, thumbdrives, hard drives, smartphones, or any other digital storage devices in your possession or in the possession of your client, which may contain commiunications to or from the requested domain account. C. All business records and other evidence relating to the establishment of the domain referenced above, including subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of (HRC-532 haye any questions regarding this request, please direct all inquiries to Special Agent Yoho ean reached | be services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time; 3. Method of connection (e.g., telnet, ftp, http); 4. Data transfer volume; 5. User name associated with the connection and other connection information, including the Intemet Protocol address of the souree of the connection; Telephone caller identification records; and Connection information for other computers to' which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. Any other business records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced. account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. prc Sincerely, Mw Charles H. Kable 1V Section Chief Counterintelligence Division HRC-533 6 Bic HRC-534 ALL SBE INZORMATION CONYAINED HEREIN TS ONCLASSIFIED TATE 11-07-2016 EY [97085794 WSICG cae coos Ynited States Senate Sosa Satie ee ee ORNATE OW THE RUOIGAEY WASHMGTOR, 96 2060-6775 August 5, 2015 VIA ELECTRONIC TRANSMISSION ‘The Honorable James B. Comey, Jr. Director Federal Bureau of Investigation 935 Pennsylvania Avenuc, NW Washington, D.C, 20535 Dear Mr. Comey: The Judiciary Committee has learned that the Office of Inspector General for the Department of State (State O1G) opened an investigation involving potential criminal conduct by Ms. Huma Abedin while she worked for the Department of State under then-Secretary Clinton, Specifically, the investigation examined the circumstances of Ms, Abedin’s work arrangements, leave status, and conversion from a full-time Department of State employee to a Spe Government Employee (SGE) and Senior Advisor to former Secretary Clinton. During the course of its investigation into this matter, the Committee has learned that the State OIG transmitted a letter, notice, or other similar communication (“letter”) to the FBI in October 2013 placing it on notice that State OIG’s investigation was no longer a preliminary matter but a fullfledged criminal investigation into Ms, Abedin, However, there have been public denials that the information provided to the Committee is accurate.' In order for the Committee to assess the veracity of the information provided in this matter, please provide @ copy of the October 2013 letter from State OIG by no later August 12, 2015. If no such letter exists, please advise the Committee immediately. Ifyou have any questions, contact Josh Flynn-Brown of my Committee Staff at (202) 224- 5225, Thank you for your cooperation, Sincerely, Chk ny Charles B. Grassley Chaieman Committee on the Judiciary S.A. Mills, “Hillery Clinton side Hums Abedin emerges as potential fsbilty for 2016 bid,” WastmsoTON Ties (August $, 15). Accessible at hte washingtonsimes comic ¥s/201 Siayp/ilary-clintonaice-huma-abedimemergesas poten "Ther i no eximieal investigation, and tnete never has beva, To say otherwise i patcely false and grossly inesponsibc, [Ms Abedin’satoeney, Karen L. Duna] said”) HRC-535 ALL DIEORUATION CONTAINED SERED) 1S UNCLASSIEZEC a DATE 11-07-g026 2Y Je7eer9 WSICG FEDERAL BUREAU OF INVESTIGATION FD 3029 (Rev. 19-6-95) Date of transcription _O7S12015. bs On 07/31/2015, at approximately 12:45 p.m., Special Agent served a preservation 7° letter addressed to Joseph P. Clancy, Director, U.S. Secret Service to LS. Secret Service. The preservation letter was served at U.S. Secret Service's office located at 950 H. Street, NW, be rovided his contact information as phone: bre Washington, DC 2022: 3 Investigation on 0791204 whi bre rier [] se » bé Ne A By sal pre Of ~ollll “This doeumesteoatias nliberreeramendatons nor opety ofthe FBI and is loaned o your agency; oO als 4nd its contens are not to be distibured ouside your azeney. be Ic HRC-544 -~ Aut EMORATICU CONTAINED MEREDI 7S UNCLASSTFIEC DATE L1-O7-2026 BY Je7se2T=¢ wEICC U.S. Department of Justice Federal Bureau of Investigation Washington, D.C, 20535-0001 Date: August 4, 2015 To: Steve A. Linick Inspector General Department of State From: Charles H. Kable Section Chief Counterespionage Section Counterintelligence Division Subject: Request for copies of ereserved[7 OSOC™~SCSCSY bre On July 6, 2015, the FBI received a Section 81l(c) Referral from the Inspector General of the Intelligence Community regarding the potential compromise of classified information. Pursuant to this referral, FBI respectfully requests for the following be pI TE ‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is ioaned to your agency; it and its contents are not to be distributed outside your agency. HRC-545 be 20 bre a, bre 2 Bi You are also requested not to disclose the existence of this request , other than as necessary to comply ‘with this request, as the FBI's investigation may be jeopardized by this type of disclosure. Ifyou have any questions regar please direct all inquiries to Special Agent |who can be reached a be bre Sincerely, Charles H. Kable IV Section Chief Counterintelligence Division o” ‘This document contains neither recommendations nor conclusions of the FBI. Its the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. HRC-546 pron © To: cD-4 Far NFO. Re: Date: 08/05/2015 SIFTED By. wsres sarsesres PS REASOM: 1.4 (0) BIE BECLASSEFY c 12-s¢-2040 ATE: 1a-09-z018 Precedence: ROUTINE Date: 08/05/2015 To: CD-4, Counterespionage Section From: CD-4, Counterespionage Section Contact: A/ASC be bre Approved By: eds Drafted By: Case ID #: {U) Fas. bt . Bs mine: isvf | oe Synopsis: (U//reve} To document meeting with the US Secret Service on 07/28/2015. j2W53B30 I NSIC dated 20130301 01231, Enclesure(s): (U//F686) One original copy of notes taken by Counterespionage Section (CD-4) Section Chief Charles Kable IV; iginal copy of notes taken by CD-4 A/ASC| b6 a) one_original business card from US Secret Service (USSS) IC Tapeeter pe Detail: (U/ APRS} On 06/28/2015, CD-4 SC Kable and A/ASC| met with the USSs 3, Acting Special ef Grace, mnepectes sha pepety Sgectan gene in Charge, Inspector] at USSS Headquarters, 950 H St. NW, Washington, Dc 20203. U) Spe) Jana were admonished 6 regarding their obligation to not further discuss the FBI's b7c investigation and voluntarily executed sensitive case briefin acknowledgement forms. CD-4 requested| and assistance in obtaining USSS information related € location, operation, and USSS involvement with the $i pl personal’ e-mail network/server. CD-4 also requeste: Besa) (norone L BIE HRC-547 3} “Bey oto To: CD-4 From: CD-4 Re: (U}[ sate: 08/05/2015 * assistance in identifying § personnel to be \ interviewed as part of the Tnvestigation. T @Gr) Jacknowleaged that he understood the FBI's request, but advised that he would need to confer with his managemey that the request dealt with the USSS protectee miostons Lo Jadvised he would only genesa ly infore ais menagenent of the type of information the FS! was seeking and would not iden nagement the specific subject or Seeaiie of she avert gations boo ese the meeting to confer with unidentified USSS managers and indicated he would return to the meeting room with a response. ‘D (Spe) approximately 20 minutes lates, returned to~the“meeting ro: vised that he had conferred with his management chain. advised that his management told him that any FBI request for information or assistance related to this matter would need to come via written request from the Department of Justice to the Department of Homeland Security, which would then forward the request to the USSS. When shea, [+ zeruses to iden: spegifi anager (s] fo ehoTEPOke. Cos savisest———] and 2 the only two USSS officials read-in to the| investigation, they were not permitted to ence ef the FBI's investigation with anyone. [_—___Jana| indicated they understood their obligation Eo protect the investigation. rey HRC-548 b3 TE bi BIE bi b3 b6 pI bi 3 be bre oot ae 6 ioe be bye HRC-549° - ALL TNROMATION CONTAINED FD-202a (Rev. 10-695) HEREIN TS UNCLASSTPIED ce uate 21-07-2016 ev as7985794 uszcc FEDERAL BUREAU OF INVESTIGATION Date of transcription _og/14/2015 08/14/2015, Special Agent] rovided (1) Disc containing 30, $42 email Be records tof Jifice of the Inspector General of the Intelligence Community. ‘as also provided a letter signed on 08/13/2015 from Randall C. Coleman, Assistant Director to. Charles McCullough II which outlined the guidelines for the release of the Disc. Jnvestigation on_ 814/201 st_ Washington, DC ba BIE rice [__] Date dicteed_NIA By sl — bs “This dotament contains nether recommendations nor conclusions of the FBI. Its the property of the FBI and is loaned to your agency: it, © BTS and its contents are not to be distributed outside your agency. HRC-550 FOA087 (Rev 58.10) FEDERAL BUREAU OF INVESTIGATION isi Event Title Speak) wroron Collected Hem Log [| Drafted By: cave 1 [LY sae bl ba MISHANDETNG OF ED; bie UNKNONN SUBJECT 08 COUNTRY; Full Investigation Initiated: Collected From: Receipt Given?: Holding Office: Details Item Type 1s General SENSITIVE INVESTIGATIVE MATTER 07/10/2015 (0) KATHERINE TURNER, ESQ WILLIAMS & CONNOLLY, LLP 325 12H STREET, Mi WASHINGTON, District Of Columbia No WASHINGTON FIELD No Details Provided Description (U) BOX OF EMAIL PAPER DOCUMENTS BOX 2 Collected On: 08/08/2015 Seizing Individual: ba bs BIE 08/14/2018 6 BI (sng cLassrrTEn By: EASON: 1.4 tC) Tare: 11-07-2036 ners sa7vasT9a ALL INPORIATION CONTAINED SEREIN TS IRCLASSIFYED EXCEPT WHERE SHOM CTHERWISE bé Collected By: Location Area: NA Specific Location: NA Se 7c “This document cotaos gir recomsreraatons or Goelusns of i FI is he ope of the FB and is oaned to your gery; ands cone ae nto be dibs ove your ag HRC-551 mete] Re: TE7TA/2015 1B General 18 General 18 General AB General 1B General (0) BOx OF EMATL PABER DOCUMENTS, BOX 4 Collected on: 08/06/2015 Seizing Indivi Collected By: Location Area: WE Specific Location: NA (0) BOX OF EMATL PAPER DOCUMENTS BOX § Collected on: 08/06/2015 Seizing Individual: Collected By: Location Area: WA Specific Location: NA (0) BOX OF EMATL PAPER DOCUMENTS. Box 7 Collected on: 08/06/2015 Seizing Individual Collected By: Location Area: 0% Specific Location: NA (0) BOX OF EMAIL PAPER DOCUMENTS. BOK 9 Collected On: 08/06/2015 Seizing Individua collected By: Location Area: NA Specific Location: NA (0) BOX OF MATL BAER DOCUMENTS BOX 10 Collected on: 08/06/2015 Seizing Individual: collected B: Location Area: WE Specific Location: NA “Tape nono 2 ba 3 bre. b6 Ic 6 pyc b6 bre b6 pyc 6 Ic HRC-552 Sopa srorons 2 Title: BIE 16 1B 1B + 08/24/2015 General General General (0) BOX OF EMAIL PAPER DOCUMENTS. BOX It Collected On: 08/06/2015 Seizing Individual: bs Collected By: 7c nocation Area: NR Specific Location: NA {U) BOX OF EMAIL PAPER DOCUMENTS. BOX 16 Collected On: 08/06/2025 Seizing Individual: bs Collected By: Ie Location Area: A Specific Location: NA (0) BOX OF EMAIL PAPER DOCUMENTS. BOX 20 Collected on: 08/06/2015 Seizing Individual: bé collected By: bye Location Area: A Specific Location: NA HRC-553 FEDERAL BUREAU OF INVESTIGATION POI/EA DELETED PAGE INFORMATION SHEET FOI/Pag 1253814-0 Total Deleted Page(s) = 20 Page 3 ~ Referral /Consult; Page 4 ~ Referral /Consult; Page 11 ~ Referral/Consult; Page 12 ~ Referral/Consult; Page 24 ~ Referral /Consult; Page 25 ~ Referral /Consult; Page 27 = Referral/Consult; Page 45 ~ Referral/Consult; Page 46 ~ Referral/Consult; Page 136 ~ Referral/Consult Page 137 ~ Reterral/Consult Page 138 ~ Referral/Consult; Page 139 ~ Referral/Consult; Page 140 ~ Referral/Consult; Page 174 ~ Referral/Consult; Page 175 ~ Referral/Consult; Page 176 ~ Referral/Consult; Page 177 ~ Referral/Consult; Page 178 ~ Referral/Consult; Page 179 ~ Referral/Consult; YON KKH KNX KHANH X Deleted Page(s) x X No Duplication Fee x X For this Page x HAKKAR ENEARHR HK ALL THFORATICH couraArHED @ MEREIN 1s UNCLASSTELED EATE 11-05-2036 BY J7e21eTE0 NSIC FD-302a (Rev. 10-6.95) os FEDERAL BUREAU OF INVESTIGATION Dave of wanseription _oR/O5201 8 oa august, 3, 202s, [decors Fe ° Bre Nanagement Division, Records Information and Dissemination Section, Winchester, Virginia provided the enclosed internal email communications referencing the FBI's classification of a November 18, 2012 State Department email. The enclosure was provided by in support of statements made during a July 30, 2015 FBI interview and documents items discussed at that time. The enclosure has an overall classification of / HOPORIE. »3 Tavesipmion on _o082015__at_ Washington D. bre ries [—__} 94 Date ditaed NVA. be by pre ae This docurrent contains neliber Feeommendations nor conclusions f'the FBI. It isthe property ofthe PBI and is foaned to your agency’ i and its contents are not tobe distrbted outside Your agency. HRC-554 ALL TRFORATION CONTAINED e ELUTE PD-3028 (Rev. 1946-95) ale FEDERAL BUREAU OF INVESTIGATION Date of transcription _O7SL2018 on July 31, 209 receptionist at williams and id Connelly LLP, accepted a preservation letter on behalf of Kathleen pre Turner to preserve records and electronic media related to the @clintonemail.com email server. 3 bE Investigation on 0781/2015 at __Washington, DC Fite > Date dicated ve ays Jo bre icdeoee satire meme omia e Fhe peyote Fd hentnyan ena Soka aga ater HRC-557 Srl 52 REASCH: 1.4 (0) HEREIN TS UNCLASSIFIED EXCEET EECLASSIFY ON: 22-s1-2040 WRERE SHOW OTHERWISE PATE: 11-05-2016 FD-108 (Rev $610) J ARORORN FEDERAL BUREAU OF INVESTIGATION Collected tem Log bi . e CLASSIFIZD BY: NSICG a7s018780 qq ALL TuFORATION CONTAINED Bre pratted case 10 sime)| bo erGHMODTNS OF CSSTF 0: 2 Uniaow sUBsEor oR Comite; SoNSTTIWE TWVESTTCATSVE NATZaR (StI) Full Investigation Initiated: 07/10/2018 Coltected From: (0) Katherine Tuene:, esq miltiene & Connelly, LEP m8 10h Stree, te Wechington, Disceiee Of Columbia Receipt Given?: to Holding office: unsamuston F2829 Details: No Dotaiis Provided teen type Description 1p Gonerat (0) Sow of Peper Documents ~ eet ~ pox 19 Goitected on: 98/08/2025 bs Seizing Indiv: Collected By. Location Area: NE Specific Location: Na “Bei erorer ‘This docamercomias eter ecommendons or eas Oke Fhe propery ofthe FB andi asst vr ageey tari soars re notte tbe aus You ene. HRC-558 ritte: DX Re: 18 General 1B General 1B Genezal 1B General 1B Genezal 1B Genezal, e e Poles 08/14/2015 (0} Box of Paper Documents - Email - Box Box 3 Collected on: 08/06/2015 Seizing Individual: collected By: hocation Area: WA Specific Location: NA (0) Box of Paper Documents - Email - Box 18 Collected on: 08/06/2 Seizing Individua collected ay: Location Area Specific Location: NA (0) Box of Paper Documents - Email - Box 22 Collected on: 08/06/2015 Seizing Individua, Collected 8y: Location Area: NA Specific Location: NA (0) Box of Paper Documents ~ Email - Box 14 Collected on: 08/06/2015 Seizing Individua, Collected By: Location Area: NR Specific Location: NA (U} Box of Paper Documents - Email - Box 21 Collected on: 08/06/2015 Seizing Individual: Collected By. Location Area: NF Specific Location: NA (v) Box of Paper Documents - Email - Box 1 Collected On: 08/06/2015 Seizing Individual: Collected By: Location Area: NR Specific Location: NA “Spore srorenn. 2 HRC-559 bt 23 BIE b6 7c b6 b7c b6 pre bé bie b6 BIC 6 bye Title . Re: Ta/201s 1B General 1B General 1B General 1B General 18 General e e Bap prorore (0) Box of Paper Documents - Email - Box Collected on: 08/06/2015 Seizing Individua Collected By: Location Area: —™ Specific Location: NA (J) Box of Paper Documents - Email - Box Collected On: 08/06/2015 Seizing Individual: [————___] collected By: Location Area: NA Specific Location: NA (U} Box of Paper Documents ~ Email - Box Collected On: 08/96/2015 Seizing Individual: collected sy: Location Area: NE Specific Location: NA (D) Box of Paper Documents - Smail ~ Box Collected on: 08/06/2015 Seizing Individual: Collected ay: Location Area: Specific Location: NA (0) Box of Paper Documents = Email ~ Box Collected on: 03/06/2019 Seizing Indivi Collected By: Location Araa: WE Specific Location: NA a 12 wv 6 a5 HRC-560 bt b3 BIE 26 Ie b6 Ie bé bie 6 bye 7c ® ® “Bask prorons bt Title g 3 Re: 08/14/2015 BIE 1B General (0) Box of Paper Documents ~ Email - Box 13 Collected on: 98/06/2015 Seizing Individual bs Collected By: bie Location Are: Specific Location: NA o HRC-561 hue nytotanroon eommanime e say retonerre comae D-302a (Rev. 1046.95) DATE 11-09-2016 BY JT6aLeTEO NICS ae FEDERAL BUREAU OF INVESTIGATION Date of transcription _ 08/13/2015 On August 12, 2015, of Platte River Networks, >& 5700 Washington St, Denver, CO 60216, met with Agents of the FBI at >7¢ the Equinix facility located at 800 Secaucus Road, Secaucus, NJ 07094, to turn over to the FBI a computer server used to host the email system for former Secretary of State Hillary Clinton's @clintonemail.com Internet domain. at spproximtety s:00m4, [—] ez agents, and one cant 2, Forensic Examiner at the parking lot of Equinix (the collocation facility where the server was physically located and operated from} and transferred one (1) Dell Poweredge server to the FBI’s possession described in detail below and on the enclosed FD-941, Consent to Search Computers, and FD-597, Receipt for Property. Item 1: Dell Poweredge 2990, gray color, S/N Ge42PCl Prior to departing,[______] signed the enclosed FD-941, Consent to Search Computers, and FD-557, Receipt for Property. The original 6 was kept by the FBI and copies were made wood for his records. ®7¢ Subsequent to the FBI’s collection of the above, Item 1 was entered into evidence, and given a 1B number by the Washington Field Office, and then transported to the FBI's Forensic Analysis Unit in Quantico, Virginia for storage and evaluation. Copies of the intake sheets and FD-1004 are enclosed with this communication. bs Invesigtion on omnis et_sacauus bre Fie# a Datedvated__1VA bs ass bre “his docamio sonnei evommentions or coniwsons fhe FB. isthe propery fie FB an is foanedo your ag and is cntens ae not be distited ouside your agency. shi HRC-564 “a $6 TATE: 11-09-2036 “Separate forms are mandatory for evidence seized on different dates at different locations, by different individuals, for different types of evidence. ‘Type of Evidence being submitted: ‘Warning - special handling Ci General Evidence O Firearms C1 Body Fluids CO other Gi Vatuable Evidence Weapons 0 Whole Blood Evidence Purchase Money) Other DC nazmat D Drug Evidence Cras CO Refrigeration CO Enviro. carr SECRET CLASSIFIED BY: NSICG e@ @ wae a7es18T 80 FEDERAL BUREAU OF INVESTIGATION =. zurcriarion comrarsec EVIDENCE DATA-LOADING FORM = #8518 is usclassirien excert HERE SHOW OTBERKISE 1 iS} : Person, fing Evidences Date Acquired: Fime Acquired: » eM) froze Weta bi Dé BIC DIE Source from which evidence acquired T [Person's nametjob ttlelcompany adress) Peart vec eriwkes/ Ebswrx boo Sehbter Feb Anticipated Disposition: ~] Forfeiture Potential” Bis Ono SanIoy net rane] Winco HY pit wane] Estimated Dollar Value: + Total Drug Package Weight: Complete onal Dee Fowecebae TE TORT BE TET ata Tong Toran OMG, ECT W Oy SGRRa EHS For WHER THe ToMArTON COMEATEN HETEAN Tiss BEN centered into Evidence Data Base, HRC-565 7c ert * NART 5490168 oe Description: Submitted) ottectd On: Recalpt tem CATSIDH, setae Corts abandonment: 5/22/2015 04:30 none None None Digital Information Type: compute® Sefal umber GB422C attees Chargec: 9 omer Cotected: 1 Colecins by CART: NO Discovery Location sieegnenine (2) seals None Asticipated Disposition long on Rone ‘Storage Information NoldngOfRee: WASHINGTON FIELD cc Five’ By: Location: ercode: 28490198 ‘cain of custody shipeing | Wanster 09 seer aeston Evert OA ‘equation Event Collected From: 7E electronic communications aré Found. You are requested not to disclose the existence of this inquiry, other than as necéssary for compliance, insofar as doing so may jeopardize the confidential nature of the FBI's investigation. If you have ap questiong_regarding this request, please direct bre Sincerely, a Charles 3. Kable IV Section Chief Counterintelligence Division o UNCLASSIFIED//FOe I heither recommendations nor conclusions of the FBI. It is the property of the FEi/and is loaned to your agency; it and ite contents are not to be distributed outside your agency. | HRC-585 i This document contains e Ee Bry mosom wear te TECLASSIFY OM: 42-21-2040 PATE: 1i-os-z016 To: cD-4 From: CD-4 Re: (U) Date: 07/24/2015 3 bTE Precedence: ROUTINE Date: 08/04/2015 To: CD-4, Counterespionage Section From: CD-4 Contact: IA bs Bre Approved By: Drafted By: Case ID #: (U) -P B 7 Ba bre Title: (S/ ANE) Synopsis: (U//O86} To document background research of Platte River Networks. ed 20130301 Sify On: 20401231 Details: {U//#0¥0) A 24 June 2015 lestter from Williams & Connolly LLP to the U.S. Department of State (USDS) Office of Inspector General identified that the server equipment which hosted former Secretary of State Clinton’s @clintonemail.com account during her tenure as Secretary of State is in the custody of Platte River Networks (PRN). The server is allegedly maintained at an unidentified secure data center and is allegedly no longer active. Williams & Connolly believes the server no longer contains data from former Secretary Clinton’s @clintonemail.com account. (u//#986) CD conducted open source and FBT database checks of PRN and associated persons. Results are as follows: (U) ADDRESSES (u//Fe¥e) According to the PRN website (www platteriver.com), PRN recently moved to a new 12,000 ft. office space at 5700 Washington Street, Denver Colorado 80216 Bypakr/ Morons 1 HRC-586 e e ‘BBpxGi/ Aeron To: cD-4 From: CD-4 re: (0) [7 _spate: 07/24/2015 b3 Ie According to LexisNexis searches, the following additional addresses are also associated with PRN: . bs bre * 11900 B Cornell Ave Aurora, CO 20014 * 5550 Britton Pkwy Hilliard, O 43026 . bs bic (u/ Ov) The LexisNexis search identified the 11900 E Cornell Ave, Aurora, CO 20014 as a property owned by Platte River Networks for the purposes of “EQUIPMENT FURNITURE ETC.” b6 bre (U) Open source information indicated lis a private residence. uy, xian records indicate Be is listed as a residential address for| bic of PRN. {U) PHONE, FAX, & EMAIL (U/ ewe} The search of LexisNexis also identified PRN’s phone re =255-1941 and taxpayer identification number (TIN) asL_] . \e number is also associated in Experian with bre a former employee of PRN. (U) PRN’s email was identified through open source as crc@platteriver.com and the fax number was listed as 303-474- 3942. “Byer /wovone HRC-587 To: Re: (v) (u} e e SBonGq/ /worone cp-4 From: ¢D-4 (u) [7 ates 07/24/2015 b3 bre PRN BUSINESS SCOPE Open source information indicates PRN has approximately 25 employees. According to the PRN website, PRN provides the following services: (U) Managed IT Services - Intuition: Intuition appears to be a business technology associated with network infrastructure (including servers, storage area networks, firewalls, switches, and workstations) which is monitored by PRN’s Intuition Operations Center. Intuition provides network security delivered on premise and through the cloud, including endpoint security for servers and devices, next generatibn firewalls, unified threat protection, monitoring, mobile protection, web and email security. Intuition also provides remote management of mobile devices including remote monitoring, setup, security and vendor management. (J) Technology: According to the PRN website, PRN offers consultations for technology projects, technology procurements, and continuity of business assessments and solutions. PRN has over 25 full-time engineers specializing in integration, virtualization, security, remote access, wireless, mobility, cloud, exchange, server, desktop, firewall, switching, system administration, storage, disaster recovery, business continuity, endpoint protection, archiving, data recovery, power, migration, Office 365, cabling, VoIP, encryption, ISP, voite/data bandwidth, active directory, group policy, and DNS. (J) Cloud: PRN provides cloud computing with expertise in hybrid, public, and private cloud infrastructure. PRN offers desktop virtualization to provide a flexible and secure desktop delivery. PRN’s cloud services provide storage, backup, and disaster recovery, ensuring their clients’ data is always available and protected. PRN maintains cloud security solutions provide up-to-date protection by utilizing the ability to push critical real time updates to all devices on the networks, PRN offers Microsoft's Office 365 to clients, enabling cloud-based Microsoft Office application usage (U) Telecom: PRN claims so represent the top 25 bandwidth providers and provides on-site cabling assessments to BBeRRL/ ‘norent 3 HRC-588 Ty e e BaexET/ Atoren To: cD-4 From: CD-4 Re: (U) Date: 07/24/2015 3 BIE determine if clients are equipped with sufficient CAT 5/6 cabling for network, voice and data to perform at top speeds. PRN also offers conference call and web meeting solutions, including hardware, software, and manage services. PRN‘s website advertises business mobility by stating: “Your business must be mobile, including your company workforce. You need to access your company data from all devices, anywhere and anytime. We represent the top carriers from across the country and can procure, monitor and manage all of your mobile devices including laptops, tablets, and smartphones - iPhones, iPads, Droids, and Windows.” (0) FBI OBSERVED COMPROMISES OF PRN CLIENTS (0) In duly 2015, on behalf of FBI San Diezo, FBI Denver cited PRN as providing contract IT services for 2 non-profit business in Denver that was the potential victim of. a! computer intrusion | PRN Dizecter of Consuiting bre Services at Platte River Networks provided log and system files for the victim company’s website to FBI Denver circa 10 July 2025. (S/F) FBI Denver cited PRN as providing contract IT services for a law firm in Denver that was the victim of a computer intrusion in March 2010. The Denver law firm terminated their contract with PRN shortly thereafter. According to the case file, FBI Denver did not contact PRN regarding the computer intrusion. (0) TIMELINE {D) The following is a timeline of key PRN events provided on the PRN website: * (0) 2002: PRN founded * (U) 2004: PRN founding partners hired the first employee * (0) 2005: PRN began offering cloud services * (0) 2008: PRN launched Intuition Bpex/ proven 4 HRC-589 “BRON /NezeRn e To: cD-4 From: CD-4 Re: (U) Date: 07/24/2015 bs BIE © (0) 2009: PRN offered full Managed Services * {U) 2010: PRN launched Telecom Division * {U) 2012: PRN launched the Intuition Operations Center and associated Help Desk (U) PRN EXECUTIVE MANAGEMENT (U) PRN’s website identified PRN executive management and provided additional information for each person. (uy OxAME [ POSITION ADDITIONAL INFORMATION bs bre Speaker / A1oFORN HRC-590 ° ‘SEDNEY/ /NoFOR e To: cp-4 op-4 Re: (U) Date: 07/24/2015 bs bIE b6 bye 2) 2 aca 6 7c b6 bie HRC-59L e e Bagel serorr bs To: cD-4 From: CD-4 BIE Re: (U) Date: 07/24/2015 v6 bre esi soem BI (U) CORPORATE PARTNERS (U) According to their website, PRN maintains hardware partnerships with Dell, Fortinet, Allworx, Datto, CISCO, ADTRAN, HP, EQUALLOGIC, BATON, PowerADVANTAGE, and Synology. (U} PRN’s software partners include Microsoft, Office365, mimecast, WEBROOT, vmware, Dell, Autotask, LabTech, Datto, SkyKick, STORAGECRAFT, VEEAM, and Worldox. (U) PRN’s service partners are Windstrean Communications, CenturyLink, PanTerra, Comcast, Integra, RingCentral, TW Telecom, AT&T, MobileWare, and MHO. (U) PRN’s strategic partners include INGRAM Micro, CUSN, and ‘Trust Alliance. re BEpat/Aroronn HRC-592 6 Nye vo 26 bre HRC-595 ALL THEORNATION CONTATHED HEREIN 15 UNCLASSITIED DATE 11-08-2018 By J7BI18TSO USTOS U.S. Department of Justice Federal Bureau of Investigation ‘Washington, D.C. 20535-0001 August 18, 2015 bie Re: — Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. bé Ic BIE weavavewne 10 a 2 3 4 15 16 17 18 19 20 a 2 HRC-596 23 24 25 26 7 28 29 30 a1 32 33 34 35 36 37 38 39 40 a a2 a3 4a 45 45 a7 48 49 50 1 52 53 54 55 56 ‘You are hereby requested to preserve the records described below currently in your ‘possession, including records stored on backup media, in a form that includes the complete record, ‘and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first, This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request, Youre also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disctosure, You are also requested not to close the account of the ‘subscriber, unless requested to do so by the subscriber. {f compliance with this request may result HRC-597 bé pIe BIE in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and records, please contact Special Agent| as soon as possible bs and before taking any such actions. bic This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. _Allreconds and other evidence relating to the subseriber(s), customen(s), account holder(s), or other entity(ies) associated with the requested account including, without Jimitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subseriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in eleetronic or other form; and C. All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time; 3. Method of connection (c.g, telnet, ftp, tp); 4, Data transfer volume; 5. User name associated with the connection and other connection information, ineluding - the Internet Protocol address of the source of the connection; 6. Telephone caller identification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information refates, and all other information related to the connection from ISP or its - subsidiaries. 8, Means and source of payment for such serviee (:ncluding any credit card or bank account number) and billing records. D. Any other records and other evidence relating to.de requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person. or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. HRC-598 any questions regarding this request, please direct all inquiries to Special Agent hho can be reached at] lo eee Sincerely, Mim —— Charles H. Kable IV Section Chief Counterintelligence Division HRC-599 cae ay oe? Ww? 6 pie HRC-600. U.S. Department of Justice Federal Bureau of Investigation Washington, D.C, 20535-0001 Re: ALL INECRETYON conTAnEE . @ BEREIN IS UNCLESSIEIED DATE 31-09-2016 By 76219780 NSToS August 18, 2018 Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(f), this leter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process, weyvackuns 10 1 12 13 4 15 16 7 18 19 HRC-601 be 7c be Bre BIE 24 2 23 24 25 26 27 28 29 30 a 32 33, 34 35 36 7 ESSSB a2 aa as a7 49 54 52 53 5a 55 56 37 58 59 61 62 63 64 65 66 HRC-602 b6 p7c BIE 67 68 69 70 mn 72 3 74 ry 76 7 78 79 al 82 BSSRGRRes 92 93 95 88Rees x 101 102 108 104 105 106 107 108 109 110 a 112 HRC-603 b6 BIC BIE 113 a4 115 116 uy 118 9 120 yaa 12 123 124 125 126 127 128 129 130 131, 132 133 134 135 136 137 138 139 140 342 142 143 144 145 146 347 143, 149 150 152 152 153 154 155 156 157 158 HRC-604 be 7c BIE 159 160 161 162 163 164 165, 166 167 168 169 170 a7 172 173 174 175 176 7 178 179 180 181 182 183 185 186 187 188 189 190 191 192 193 194 195 196 197 199 200 201 202 203 204 HRC-605 b6 7c IE 205, 206 207 208 209 210 21 212 213, 214 215 216 27 218, 219 220 221 222 223 224 225, 226 227 228 228 230 231 232 233 234 235 236 237 238 239 240 2a1 242 243 244 245 246 207 248, 249 250 HRC-606 be 7c BIE 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 a 272 273 274 275 276 27 278 279 280 281 282 283 284 285 286 287 288, 289 290 291 292 293 294 295 296 HRC-607 b6 Ic BIE 297 298 299 300 301 302 303 305 307 308 309 310 Bul 312 313 314 315, 316 317 318 319 320 321 322 323 324 325, 326 327 328 328 330 331 332 333 334 335 336 337 338 339 340 341 342, HRC-608 b6 BIC BIE 343 345 346 347 348 349 351 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 HRC-609 b6 BIC BIE 389 390 392 392 393 398 395, 396 397 308 399 400 401 402 403 404 405 406 407 408 409 410 an 42 413 aia ais 416 a7 418 419 420 42a 422 You ave hereby requested to preserve the records described below currently in your possession, including records stored on backup media, ina form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or unti receipt of « legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new formation that arises after. the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to clase the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise HRC-610 b6 BIC BIE alert the subscriber or user of these accounts as to your actions fo preserve the referenced files and records, please contact Special Agent Jes soon as possibie be and before taking any such actions. ‘This preservation request applies to the following records and evidence: A The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or'files, such as the source and destination email address or IP address. All records and other evidence relating to the subscriber(s), customer(s), account hholder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (¢.g., telnet, ftp, http); Data transfer volume; User name associated with the conneetion and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the idemities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. xe Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person. ot entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. HRC-611 Ifyou have any questions regarding this request, please direct all inquiries to Special Agent }rho can be reached at orf be Sincerely, Mw Charles H. Kable 1V Section Chit ‘Counterintelligence Di HRC-612 ees 6 7c HRC-613 ALL INFORKATION comTaTNED HERETH 13 UNCLASSIFIEC TATE 21-09-2015 BY sTesLeTeD HSTCG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 1@, 2015 BIE Re: Request for Preservation of Records _ Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703({, this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. bs bre DIE weorvaneune 10 a 2 B 14 15, 16 v7 18 19 20 2 2 HRC-614 23 bs 4 pyc 3 BIE 26 a 28 29 30 You are hereby requested to preserve the records deseribed below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days., or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. ‘You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to vour actions t the referenced files and records, please contact Special Agent| 15 soon as possible 2 _ and before taking any such actions, This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any informat associated with those communications or files, such as the source and destination email address or IP address. B. All: records and other evidence relating to the subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including Connection date and time; Disconnect date and time; Method of connection (e.g., telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and veer 2 HRC-615 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8 Means and source of payment for such service (including any credit card or bank account number) and billing records. D. Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, ‘whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this request, please direct all inquiries to Special Agent ea Sincerely, Min Charles H. Kable 1V Section Chief Counterintelligence Division HRC-616 Ic bé bre HRC-617 _ ALL INEOR@TICN CCHTAINED . @ BREIN 13 INCLASST wos DATE 11-08-2016 U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 18, 2015 IE Re: — Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703({), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process, b6 bre BIE wavausune 10 a . 2 2B 14 15 16 7 18 19 20 2 22 HRC-618 23 24 25 26 a 28 29 30 a1 32 33, 34 35, 36 a7 38 39 40 al 42 43 45 46 a7 49 50 st 82 33 54 55 56 7 58 59 60 61 62 63 65, 67 HRC-619 be 7c BIE 6 70 n n az} 14 75 76 W 78 79 80 a1 82 83 85 86 87 88 89 a1 92 93 95 96 97 98 99 100 101 102 103 104 105 106 107 108 208 110 aa 112 113 14 HRC-620 be 7c BIE 115 bé us Ie iw TE 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135, 136 137 138 139 140 241 142 143 144 145 146 147 148, ag 150 151 152 153 154 155 156 157 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, HRC-621 and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary 10 comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to pres referenced files a record pleas conte Spec gen ne ee posible ms. and before taking any such actions. ‘This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without Jimitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g. telnet, fip, http); Data transfer volume: User name associated with the connection and other connection information, including the Intemet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or emtity to which such connection information relates, and all other information related to the connection from ISP or its subsidiacies. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. whepe te D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or HRC-622 relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this ss please direct all inquiries to segs Agent who can be reached a] or| Charles H. Kable IV Section Chief Counterintelligence Division. HRC-623 bye 6 Ic HRC-624 ALL TNPOREATION e BERET TS UNCLASSI DATE 11-08-2016 BY o769L9780 SIC U.S. Department of Justice Federal Bureau of Investigation ‘Washington, D.C. 20535-0001 August 18, 2015 Re: — Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. wCovaueenn 10 n 2 B 14 15 16 7 18 19 BIE bé b7e IE. HRC-625 20 2 2 23 24 25, 26 a 28 29 30 31 32 33 34 35 36 37 38 39 a a2 43 45 46 a7 48 49 SI 82 53 55 56 37 58 59 61 62 63 65 HRC-626 be 7c BIE seers 7 nm B 4 75 76 7 78 81 82 83 8s, 86 a7 2888 92 93 94 9s 96 7 98 99 100 101 102 103 104 108 106 107 108 109 110 ut HRC-627 b6 7c TE 12 113 a4 115 116 7 118 nig 120 121 122 123 124 125 126 Ww 128 128 1230 131 132 133 134 135 136 137 138 1239 140 a 142 143, 144 145, 146 147 148, 149 150 151, 152 153 184 155 156 157 HRC-628 b6 yc BIE ws . = me 160 162 164 165, 168 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may reswlt in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as 10 your actions to preserve the referenced files and records, please contact Special Agent as soon as possible bs and before taking any such actions. bic ‘This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscriber(s), customer(s), account holders), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time; HRC-629 3. Method of connection (e.g,, telnet, ftp, http); 4. Data transfer volume; 5. User name associated with the connection and other connection information, including, the Intemet Protocol address of the source of the connection; 6. Telephone caller jdentification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this request, please direct all inquiries to Special Agent pho can be reached [pel be te Sincerely, Charles H. Kable IV Section Chief Counterintelligence Division HRC-630 (ao KN Ce bé pic HRC-631 * ALL TEE IMDORIATION comTarHED BEREUN Is UNCLASSIEIEC TATE 11-05-2026 ‘veveo NsTeG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 18, 2015 John Kerry Secretary of State USS. State Department 201 C Street, NW ‘Washington, DC 20520 Re: Request for Preservation of Records Dear Secretary Kerry: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. 10 be bre bE HRC-632 23 24 25, 26 a 28 29 31 32 34 35 36 7 38 39 a1 az 43 45 45 a7 49 50 51 52 53, 54 55, 87 58 59 60 61 62 63 64 65 66 o7 68 6 bs bye BIE HRC-633 70 mn 2 2B 74 br 76 8 79 SRRESREs 88 89 90 on 92 93 95 96 7 98 100 102 102 103 104 105 106 107 108 109 110 11 12 13 14 15, b6 BIC BIE HRC-634 116 17 118 119 120 121 122 123 124 125, 126 127 128 129 130 131 132 133 134 135 236 137 138 139 140 41 142 103 144 145 146 147 148 149 150 151 152 153 154 155, 156 157 158 159 160 161 HRC-635 b6 b7c BIE 162 163 164 165 166 167 168 169 170 a7 172 173 174 175 176 17 178 179 180 181 182 183 184 185, 186 187 188 189 190 192 192 193 194 195 196 197 198 199 201 202 203 205 206 207 b6 BIC BIE HRC-636 208 209 210 211 212 23 214 215 226 27 218 219 220 221 222 223, 224 25 226 227 228, 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243, 244 245, 246 2a7 249, 250 251 252 253 254 b6 BIC BIE HRC-637 255, 256 257 259 260 261 262 263 264 265 266 267 268 269 270 am 272 273 274 275 276 27 278 279 280 2a 282 283 284 285, 286 287 288 289 290 291 292 293 294 295, 296 297 298 299 300 HRC-638 b6 Ic BIE 301 302 303 304 305 306 307 308 309 310 au 312 313 314 315, 316 37 318, 319, 320 321, 322 323 324 325 326 327 328 329 330 331 332, 333 334 335 336 337 338 339 340 341 342, 343 344 345 346 HRC-639 be 7c BIE 347 349) 350 351 352 353 354 355, 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375, 376 377 378 379 380 382 382 383 384 Bese 389 391 392 HRC-640 b6 b7c BIE 393 394, 395 396 397 SESEERS 405 406 407 408 409 410 au. a 413 aa as 416 a7 aig, 419 420 a2 422 423, 424 425 426 427 428, 429 430 431 432 433 434 435, 436 437 438 HRC-641, b6 b7c BIE 439 440 at 442 443 44s 447 449 450 451 452 453 434 455 456 437 458 439 460 461 462 463 464° 465 486 487 468 469 470 ana an 473 a7a 475 476 a7 478 479 480 481, 482 483, 484 HRC-642 b6 BIC BIE 485 486 497 488 439 490 491 492 493 494 495, 496 497 498 499 500 502, 502 503 504 505 506 507 508 509) 510 si. 512 513 514 515, 516 817 518 519 520 521, 522 523 524 525 526 27 528 529 530 HRC-643 bs bic BIE 331 532, 533 534 535 536 537 538 539 540 541, 542 543, 5a 545, 546, 547 548, 549, 550 581 552 553 555 556 387 558 559 560 561 562 363 565, 567 568 569 570 S71 572 573 574 575 576 HRC-644 b6 pyc BIE 7 578 879 580 sat, 582 584 585 586 587 588 589 590 591 592 593 594 595 596 597 | 598 599 601 BaSa8 607 610 611 612 613 614 615, 616 617 618 619 620 621 622 623 HRC-645 be 7c BIE 624 625, 626 627 628 629 630 631, 632 633 635 636 637 638 639 641 642 643 645 646 6a7 64g 650 651 652 653 654 655 656 67 658 659 660 661 662 663 664 665, 666 667 668 669 HRC-646 bé pic BIE 670 ert 672 673 674 675, 676 677 678 679 680 681 682 683, 685, 686 687 688 689 690 son 692 693 694 695 696 607 698 699 700 701 702 703 704 708 706 707 708 709 710 van 712 73 714 715 HRC-647 b6 yc BIE 716 m7 718 719 720 721 722 723 724 725, 726 72 728 723 730 731 732 733 734 735 736 BT 738 739 740 7at 7an 743 744 745 746 747 748 749 750 751 752 753 754 735 756 787 758 759 760 761 HRC-648 bs bic BIE 762 763 764 765 766 767 768 769 770 ™m ™m 773 774 775 716 ™ 778 7793 780 782 783 784 785 786 787 788 789 790 791 792 793, 794 795 796 797 798 799 800 801 802 803 805, 807 HRC-649 b6 BIC BIE 809 810 811 812 813 aia 815, 816 817 818 a9 820 821 822 823 824 825, 826 827 228, 829 830 831 832 833, 834 835, 836 337 838 839 840 a1 842 843 845, 846 847 248, 349 aso 851 852 853 854 HRC-650 be 7c BIE ass, 856 857 858, 859 860 861 862 863 64 865 866 3867 868 369 870 371, 872 873 874 875, 876 377 378 879 880 881 882 883 884 885 886 887 888 389 890 aor 892 893 394 395 896 997 398 399 HRC-651 be 7c BIE za Be 902 BIE 903 904 * 906 907 908, 909 910 912 ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for aperiod of 90 days, or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these acco eferenced files cy ee and before taking any such actions, This preservation request applies to the following records and evidence: A. The conteuts of my communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and ether evidence relating to the subscribers), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subseriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subseriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: Connection date and time: Disconnect date and time; Method of connection (e.g., telnet, ftp, http); Data transfer volume; eee HRC-652 ® a User name associated with the connection and other connecti the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. information, including a D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, ‘whether such records or other evidence are in electronic or other form. Ifyou have any questions regardins m pase acet all inauicisa Sngial Agent Co whe can be reached at| or bé pyc Sincerely, a ‘Charles H. Kable IV Section Chief Counterintelligence Division | ! HRC-653 | bE bic HRC-654 » US. Federal Bureau of Investigation Washi: 3BXEIN IS UNCLASSIFIED uy moranrran eoeraner Department of Justice ington, D.C. 20535-0001 August 18, 2015 Re: — Request for Preservation of Records _ p=] : Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation ofall stored communications, records and other evidence in your possession regarding, the following e-mail accounts, pending further legal process. wevausune 10 a 2 13 14 15 ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, ina form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for HRC-655 BIE BIE bé Ie DE a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. ‘You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close thé account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files tind records please contact Special gen Jas soon as possible bs and before taking any such actions. bie This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscribers), customer(8), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing re¢ords, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All. connection logs and records of user activity for the requested account, including: 1, Connection date and time; 2. Disconnect date and time; 3. . Method of connection (e.g,, telnet, ftp, http); 4. Data transfer volume; 5. Username associated with the connection and other connectior the Internet Eretoco} address of the source of the connection; 6. Telephone eailey identification records; and 7. Connection: formation for other computers to which the user of the above-referenced accounts opanezizé, by any means, during the connection period, including the destination I? address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. _ Means and source of payment for such service (including any credit card or bank account number) and billing records. formation, including D. Any other records and other evidence relating to the requested account. Such records and other lence include, without limitation, correspondence and other records of contact by any person. HRC-656 or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronie or other form. Ifyou have any questions regarding this request, please direct all inquiries to Special Agent Sincerely, Mie Charles H. Kable IV Section Chief Counterintelligence Division HRC-657 Al 6 4 Bre Ww © a 54 HRC-658 U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 Re: — Request for Preservation of Records Dear Custodian of Records: ALL INFORMATION cowranres BEREIN IS UNCLASSIFIED ERIE 11-09-2016 BY JTeaeTe0 NSICS August 18, 2015 TE Pursuant to Title 18, United States Code Section 2703({), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. eorveaursene 10 u 2 13 14 15 16 wv 18 6 bic BIE ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for HRC-659 a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the ‘subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and ecors, please contact Special Agen pesto ag possible be and before taking any such actions. ‘This preservation request applies to the following records and evidence: A, The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B, All records and other evidence relating to the subseribex(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form: and C. _Allconnection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g,, telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subseriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from [SP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. peer me D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection lags associated with or . HRC-660 relating to postings, communications and any other activities to or through the requested account, whether such records oF other evidence are in electronic or other form, Ifyou have any questions regarding this request, p] i inauiri ial Agent }who can be reached at| jor be Sincerely, Min Charles H. Kable IV. Section Chief Counterintelligence Division HRC-651 Kay “we oe be Bre HRC-662 U.S, Department of Justice Federal Bureau of investigation Washington, D.C. 20535-0001 HEREIN TS UNCLASSIFIZC e ALL INEORATZEN CONTAINED DATE 11-05-2015 orecxaTeo NSTC. August 18, 2015 BIE Re: Request for Preservation of Records ‘Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(8, this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding ‘he following e-mail accounts, pending further legal process. wave Vrone 10 11 2 23 14 15 16 7 18 19 20 21 22 bE bre BIE HRC-653 23 24 25 26 7 28 29 30 a1 32 33 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 96 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises affer the date of this request. ‘You are alse ‘requesiett not to disclose the existence of this request to the subscriber or any other person, other thax: aa poessary to comply with this request, as the FBI's investigation may be jeopardized by this Af Hlisclosure. ‘You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in @ permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to. serve the referenced files and records, please comact Speci Agen ‘fat soon as paste and before taking any such actions, This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address, B. All records and other evidence relating to the subscriber(s), customer(s), account hotder(s), or other entity(ies) associated with the requested account including, without imitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time; 3. Method of connection (e.g., telnet, ftp, http); HRC-664 b6 BIC BIE 6 bye 4. Data transfer volume; 5. User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; 6. Telephone caller identification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. D. Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this request, please dit inauicis ial Agent rho ean De reached {en Tor bs bre Sincerely, Min-—~ Charles H. Kable IV Section Chief Counterintelligence Division HRC-655 HRC-666 bé Ie @ suk throtaarron comrarice samen SSIFIED ue By a7E218780 WETCE U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 18, 2015 bre Re: Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(0, this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process bs bre bre You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure, You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. Jf compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accor referenced files and before taking any such actions, This preservation request applies to the following records and evidence: HRC-657 A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. _All'connection jogs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (¢-g., telnet, ftp, http); Data transfer volurne; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. veer ne D. Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form, Ifyou have any questions regarding this request, please direct all inquiries to Special Agent Co io cam be reached a or| y 7c Sincerely, Miu Charles H. Kable IV Section Chief Counterintelligence Division HRC-668 be Ie HRC-669 ALL INPORATION CCHTAINED @ SEREIN 13 MCLASS U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 18, 2025 BIE Re: Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Sectio= 2707(f), this letter is a formal request for the preservation of all stored communications, recotds ot oft, evideree in your possession regarding the following e-mail accounts, pending further legal proces, bs bIe TE. eorvaueune 10 1 12 B 4 15 16 7 18 HRC-670 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for aperiod of 90 days , or until receipt of a legal court order, whichever occurs first, This request applies only retrospectively. It does not in any way obligate you fo capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. [f compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these acco\ referenced files ceri er hs ypc acta ochre yy and before taking any such actions. This preservation request applies to the following records and eviden: A. Thecontents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. _Allrecords and other evidence relating to the subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subseriber or customer utilized, and any otter identifying information, whether such records or other evidence are in electronic or other form; and C._Allconnection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (¢.g., telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; 6, Telephone caller identification records; and 7. Connection information for other computers to which the user of the above-referenced accourits connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank: account number) and billing records. weepe HRC-671 D. Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person of entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, ‘whether such records or other evidence are in ele¢trarie or other form, If vou have any questions regarding this \seeu direct all inquiries to Special Agent who can be reached at| jer] be bic Sincerely, a Charles H. Kable IV Section Chief Counterintelligence Division HRC-672 Rev, 05-01-2008) BE INO. REASON: 24 (G) PECLASSITY OM. 12-22-2040 FEDERAL BUREAU OF INVESTIGATION Precedence; BOCUTINE Date: 08/25/2015 To: Washington Field From: Washington Field cre b6 yc Centac:: sii Approved By: cue 4 OL = Title: (3) ia CLASSIFIED; UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) Synopsis: (U//F6UG} Deputy Assistant Director (DAD) Counterintelligence Division (CD), a Declassification Authority of FBI information, declassifies the following information for release as appropriate By: He3g83T44 Derived From: dated 20130301 Declassi Details: (U//e¥e) This communication declassifies the existence of the captioned matter with the signature of the Deputy Assistant Director (DAD) Counterintelligence Division (CD), a Declassification Authority of FBT information. Verbal authorization to declassify this information was previously provided by Assistant Director (AD) Randall Coleman, Counterintelligence Division (cD), an Original Classification Authority of FBI information, on August 21, 2015. (u//TeHe) The DAD authorizes the declassification of the following information: “Bpen/ /woromn HRC-673 e e Beet prorome FEDERAL BUREAU OF INVESTIGATION (Rev. 05-01-2008), (u//PeHo) In duly 2015, the FBI initiated the captioned investigation based on an 811 referral from the Inspector General for the Intelligence Community (ICIG) regarding the possible compromise of classified national security information. (u//reee} The potential compromise was identified when, as part of a Freedom of Information Act (FOIA) request, the U.S. Department of State (DoS) Office of Inspector General and the ICIG were reviewing electronic mail communications from a private server previously used by a State Department official during their tenure at DoS. an initial review of this material identified several emails containing classified national security information some of which was Top Secret. (u/APe86) NSLB concurs that the declassification of the existence of this investigation is necessary. {U) In an attempt to acquire authority to reveal certain information as part of future criminal proceedings, FBI WFO certifies the following: 1. (0) No previously unknown sources or informants were revealed in the identified material; 2. (U) No sensitive sources or methods were disclosed; 3. (U) No information will be disclosed which will negatively impact other case equities; and 4. (U) No classified information from any other agency or foreign government will be disclosed. oe “pti rons HRC-674 Fer iro CLASSIFIED BY: NSCS stes40TeO (hn 0.012009 ane an Ene si oo-zoxe FEDERAL BUREAU OF INVESTIGATION Precedence: ROUTINE Date: 08/27/2015 To: Washington Field From: Washington Field CI-13 Contact: SA BE bic Approved By: Drafted By: Case ID #: (U) —1 bl fr (U) ‘BO B Title: (S/ ANF) BIE synopsis: [| )8{H#) Attaches records provided by Department of State. dated 20130301 fy On: 20401231 Details: (U//Feve) On August 13, 2015, in response to an FBI records request dated August 11, 2015, the U.S. Department of State (DoS), provided employee profiles for 14 of the 15 requested individuals. (U/ eve} Additionally, DoS was able to locate signed copies of Classified Information Nondisclosure Agreements (Standard Form 312) for 9 of the 15 individuals. (U//FO¥) These documents are attached to the file in a physical iA. er Beer woron HRC-680 ~ FD-1004 Rei, 4-7-2015) ® FEDERAL BUREAU OF INV! @. ALL INECREATION CONTAINED) EVIDENCE CHAIN OF CUSTODY HEREIN TS UNCLASSIFIED OTE 11-09-2016 BY 7E18T90 UEICG Tridente Type DS Generate TD ireamsapon Digit BD votes DB Fiveamnner ‘Special Handing Istewttns Receipt bs Tinacmar Oise. Ora Signature of Seine nad { be 1D Rea. Charging 1 trecte 1 retigente [Pred NemerAgeney] Vai D1 bivnaard Reason Inia Cullexion Done _. cate iy Af }si Agency Reliaguished Cuatody Date and | Assepied Conoly Time Signature ahofes | St Be Painted NamTAnoy | 435i) Potted Newham Carer | EA Reason: hana ar vo Gases Reason: CART Expr, Ralinguished Custody Date aad } Accepted Custody Tie Saat Siemture Printed Name/ Agency: Printed Name!Agency; i Reason Reason Relinguiabed Custody “Accepted Custody Dac ime | ‘Sienna: Sianawe i Printed Name’ Agsney Frinted Name Agency ean Remo Relinguisbed Cantody Date aud | Accepted Custody Sienaare Signature Painted Neme/Apency: Pine NameiAgency. Reason Reson Retioguinbed Custody Dasma | Acted Cody ate and ire Time ‘Signewre ‘ ‘Signature: | Prine Name Agency Painted Name’ Agency — oe | Relinguished Custody Date nnd | Accepted Custody Date and, Tine Tine Signare Signate Printed Nanwiagency ni Name’ Agency ess Reason ‘irearm ( ertiiction by (PFVSWAT) | Explosive Material Certifention by (SABT): Printed Name ne Signatur: Date ‘ALE trace Foon Complete] — |] xe tb B Barcode: ALL TNFORLATION COUTAINED: HEREIN IS UNCLASSIEIEC CATE 11-09-2016 BY J7es18TAO NSTC ® FEDERAL BUREAU OF INV| el GATION ev 47-201 EVIDENCE CHAIN OF CUSTODY, Bvidence Type [SP General Cie Dy Hisar Weapon Bigiat Bi vatusbies ED ritcamsioxrer Special Handling nailing Tia Receipt Date __| time HAZMAT Latent, ror Signature of Seizing Individusl, b ve Q Criasey 5 “ tail] top| pre keg. charing Diver ED Retire [rina Naeeageney [fei DD moma Renn: nial Colleon estan Dore - [ Comeeaiis Details: The mail.clintonemail.com domain was registered on 01/13/2009 by Perfect Privacy, LLC-* Justin Cooper registered with Network Solutions the first secure socket layer (SSL) certificate for the mail.clintonemail.com domain on 03/30/2009, allowing encryption for web- based applications. A second SSL certificate was registered on 02/05/2012 with Network Solutions, but no individual was listed on the registration, The third, and current, SSL certificate was registered on 09/13/2013 with GoDaddy without an individual listed on the registration.” (LU) Justin Cooper serves as an advisor to former President Bill Clinton. Cooper's responsibilities include managing President Clinton’s personel and professional relationships, and assisting with political, business and personal finance issues. Cooper served many roles while President Clinton, ‘was in office, including Senior Advisor and The President's Aide. He has participated in extensive intemational travel with President Clinton and helped the President author three books. Cooper was involved in the establishment of the Clinton Foundation and continues to suppor it along with the Global Clinton Initiative and the yper holds an email address tied to President Clinton’s domaii ee (U) Cooper is listed as the point of contact for Calle Mayor, LLC. The corporation’s address is ‘the same as the Clinton residence in Chappaqua, New York, Calle Mayor, LLC owns the ee we (U) Cooper has participated in advisory engagements outside of his role with President Clinton. Cooper is the founder and CEO of Foxcroft Strategy Group, LLC. In this capacity, Cooper ‘Analysis conducted by Venafi TrusiNet, “Digital Certificate Forensics: What Vena TrustNet Tells Us about the Clinton Email Server" (08/11/2013) Cooper Biogapty on Decision Sciences Corporation website “Whois com * Department of State Consolidated Consular Database information © New York Times, "Roger Clinton is Wary, Chay and Sill Occasionally Auracting Atention” (07/08/2015) SSEERET/NOFORNE HRC-699 43 wT w) D SBORETNOFORN: © provides diverse consulting services to agencies in the government, non-profit and private sectors,’ Foxeroft Strategy Group, LLC was incorporated in Delaware on 11/12/2013." Cooper is also currently a Senior Advisor for Decision Sciences Corporation, a technology company that utilizes cargo scanning technology to detect weapons of mass destruction (WMD) proliferation, as well as explosives and contraband smuggling, Decision Sciences Corporation utilizes an advisory board of diverse backgrounds, including scientists, business leaders and government officials to improve their business capabilities.® Finally, Cooper previously served as @ Senior Advisor to Teneo Holdings. Teneo Holdings is a consulting firm co-founded by Doug Band, a prior aide to President Clinton. Cooper is not currently listed on the website of Teneo Holdings.” (VRPT Cooper served as the B1/B2 non-immigrant visa (NIV) sponsor f (Dos ‘on NIV applications dated 10/23/2012 and 07/08/2015 bre (U) Cooper received his Juris Doctorate from Fordham University and a Bachelor of Arts from American University? O/H) Presence iz emails provided to the FL om 98/06/2015 }S/AET) Cooper is associated with approximately 60 emails that were provided to the FBI on 08/06/2015. Cooper's email activity indicates he and_______] were the principal conduit to bs provide information to President Clinton, as President Clinton did not appear to utilize a direct BTC email address, The Clinton Foundation’s Haiti relief effort in 2010 was the most frequent topic of conversation by Cooper, encompassing approximately ten emails. bs (U) Author: SO’ Ge af is bre @Approvai: asc Vix ssa| sf4lis Sacre{ ©? State of Detaware Division of Corporations, File mumber 5431135 2 Decision Siences Corporation webste “Teneo & The Clinton Machine” (04/30/2015) be bre SEERET/NOFORNT HRC-700 A v7c HRC791 FD-3028 (Rev. 106.95) ALL FBI INFORMATION CONTAINED BEREIN TS UUCLASSTFIEC CATE 11-08-2016 BY FEDERAL BUREAU OF INVESTIGATION Court Sec September 1, 2015, Special Agent]! helephonically spoke wi stant United States Attorney, Eastem District of Virginia (EDVA) an ity Officer, United States Department of Justice (DOJ), to coordinate the transfer of digital media from the Federal Bureau of Investigation (FBI) to DOJ. Date of tanseripcion _O9/012015. land Sa physically provided a Folk ussion, Sal DvDt ecurity Specialist, DOJ. The DVD was provided by the Operational ‘Technology Williams and Connolly on August 6" 2015. ‘on (OTD) and contained a copy of digital content previously given to the FBI by Investigation on _ 09/01/2015 at___Wsshingtos, DC File # AA Date dictated By sal sal x! This decurnent contains neither recommendations nor conetusions of the FBI. It isthe propery ofthe FBI and is loaned to your agency’ t and ats contents are not tobe distributed outside your agency. HRC-702 sres.eTeo wsz00 6 bre bE bre DIE be bre bs pre HRC-703 ss nmomursoa eninanies e ‘ean te mocacnsee D-302a (Rev. 1046-95} ol FEDERAL BUREAU OF INVESTIGATION Date of tanseription 08/28/2015 bs On 08/25/2015, Special Avent{—_______Ifixxed| be Phone -b7e 3A Feceived, bre b3 Investigation on 08257201 ot __washington,D¢ Pee File # ~Fo ‘Date dictated __N/A . 4] be » BIC “This document soins neler recommendations oe conclusions othe FB, 11s he propery ofthe FBI andi owed 0 your egy it acd is contents are not ob detbuted outside yor apes. HRC-704 be prc HRC-705 ALL INEORSATICN CONTAINED BESEIN IS UNCLASSIFIED DATE 11-09-2026 BY JTe21eTE0 NSIC FD-302a (Rev. 104695) - FEDERAL BUREAU OF INVESTIGATION Date of wanseription _0903/2015. On September 3, 2015, a Confidential Human Source (CHS) provided the FBIL___] On September 4, 2015| Investigation on _99/032015 at __ Washington, DC Filet | =% ate dicaied_W/A. of TI ‘This document contains neither recommendations nor conelusions of the FBI, Its the property ofthe FBI and is loaned to your agency: it and its contents are not 0 be distributed outside your agency. HRC-706 BID BIE 7D BIE bo BIE b6 Bye bé pyc HRC-707 ALL INFORMATION cONTAMMED e ‘REIN IS UNCLASSIFIED WATE 11-09-2016 BY I7ea1eTEO WSTCG UNCLASSIPIED//POS FD-302a Rev. 106-95) ol FEDERAL BUREAU OF INVESTIGATION Date of teansctiption 0909/2015 (u//reve)_on september 3, 2015, saL_____Ireceived a ee response fre eqarding a preservation request for the account Be The response is attached to this communication in an FD-340. Investigation on 0903/2015 at__Washington, DC TE File# =42 Date dictated 99/09/2015 hs / - bs by, sf af4 20's pie ‘This document contains neither recommendations nor conclusions ofthe FBI. [cis the propery afhe FBI and is loaned to your agency; i ‘and is contents are not to be distributed outside your ageney, UNCLASSIFIED//POue- HRC-708 FD-1097 Rey S10) 3 1 SLASSTPTED ay. WSTCE REASON: 2.4 (2) DECUASSIFY ow: 12-92-2040 DATE. 11-09-r016 eaenen ALL IOFORUATION COUTAINED HEREIN TS UNCLASSIFIED EXCEPT MERE SHOW OTHERWISE oe, FEDERAL BUREAU OF INVESTIGATION Bitie: (0) The Submission of FO-340 Date: 09/16/2015 a Prom: WASHINGTON FTEL9 26 we-cr13 : bre ee. aepeoved sy 82a] peatved 3y-[ case 1D #: #33 eo bt MISHAND. 20; ! b3 UNKNOWN SUBJECT OR COUNTRY; BIE SENSITIVE INVESTIGATIVE MATTER (STM) Synopsis: (U//F@8O) To document the submission of FO-340 (1A) to the 1A sub-file of the captioned case file. Full Investigation Tnitiated: 07/10/2015 Reference: serial 9 bs BIE Enclesyre(s): Enclosed are the following items: 1. QM Aer) original notes of FBI & ICIG meeting held on guly 22, 2018. Detail (//FOUC) This communication servers to document the submission of a FD-340 (1A} to the 1A sub-file of the captioned case file BaxG prorons HRC-709 Gro Re: 09/16/2015] b3 + BaGy moron HRC-710 CLASSIFIED BY: NSICG F76aueTeD —ALL_TNFORNATTON CONTAINED REASOH: 1.4 402 SEREIN IS UNCLASSIFIED RECLASEIFY ON 42-31-2040 SHON OTRERYTSE UATE” 13-09-2025 DAU Rew. $810) SBDREE/ /norort FEDERAL BUREAU OF INVESTIGATION Electronio Communication (U) The submission of FD-240 Date: 09/16/2015 ce: From: WASHINGTON FIELD WF-CT13 be Contact: bre Approved By: sal Drafted By: case 20 4: [ La si v1 MISHANDLING OF CLASSIFIED, bs UNKNOWN SUBIECT OR COUNTR: BTE SENSITIVE TNVESTIGATIVE MACTER (STM) Synopsis: (0//FOO) To document the submission of FD-340 (1A) to the 1A sub-file of the captioned case file. Derived Cipie Seurces Full Investigation Initiated: 07/10/2015, b3 bre atorence: [7 Jseesan 16 Enelesure(s): Enclosed are the following items: 1. _DS(AHE} Original preservation response sol bre on suly 31, 2018. Details: (U//e99) This communication serves to document the submission of FD-340 (1A) to the 1A sub-file of the captioned case file Bes moron HRC-711 e e “Bee pnorone Title: __{u) The submission of FD-340 Re: 09/16/2015 b3 BIE .” HRC-712 bE BIC HRC-713 ALL INFORATION COWTAINED e BEREIN 1g UNCLASSIEIEC CANE 12-09-2016 BY JpeszeTeo usrOS FD-302a (Rev, 10-695) Le FEDERAL BUREAU OF INVESTIGATION ate af wanscription 09/13/2018” On September 14, 2015, Patrick F. Kennedy, the Under Secretary of State for Management, U.S. Department of State, Washington, D.C., sent an LHM to FBI Director James B, Comey regarding the captioned investigation. ‘The LHM is enclosed in the attached 1A. BS Investigation on _09/15/2 at__Ww tiga a 7 ‘ashington, DC De rev [a8 ar itees__a By saf {_] be bic ‘This document contains neither recommendations nar conclusions ofthe FBI. It isthe property of the FBI and is loaned to your agency; t and its contents aze aot to be distbuted outside your agency. HRC-714 ‘cuasszerep ay: ustee sete0 ALL INPORUATION cowrarvED REASON: 1.4 (2 BEREIN 1S UNCLASSIFIED EXCEPT DECLASSISY OH: 12-92-2040 WHERE SAOhl? CTHESWISE BATE. 11-08-2016 DAO (Rey. 5.810) 5 Qs wu FEDERAL BUREAU OF INVESTIGATION Eleotrente Communtoation WASHINGTON FIELD WE-CI13, Contact: From: Approved By: ssa ed cove 9 46 oye J 2 MISHANDETNG OF CLASSIFIED? br UNKNOWN SUBJECT OR COUNTRY; B SENSITIVE INVESTIGATIVE MATTER (STM) Synopsis: (U//F086) To document the submission of FD-340 to the 1A sub-file of the captioned case file. Full Investigation Initiated: 07/10/2015 v3 Reference Serial 22 P7B Enclosure(s); Enclosed are the following items: 2. QQ/NS) Original notes re interview of on guly 30. bs 2015 bic Details: (U//BeN0} This communication servers to document the submission of a FD-340 (1A) to the 1A sub-£ile of the captioned case file. Bend/nerome HRC-715 an e e Boron Title: (U//Pete) The submission of FD-340 Re: 09/16/2015 bs BIE 7+ HRC-716 ze oe fen Senate Renee. PD IOH Ree 420) “Bere pvorone Ue CLASSIFIZE ay, NSrDE o7e2L9TeO ALL INFORIATION counADHED EASON. 1.4 () HEREIN TS UNCLASSIFIED EZCEDT DECLASSIFY ON: 12-32-2040 WERE SHOW OTHERWISE cage: 11-09-2016 FEDERAL BUREAU OF INVESTIGATION ‘Cemmunteation Title: (U//sea0) Submission of FD-240 Date: 09/16/2015 Cc b6 Ie From: WASHINGTON FIELO WE-CIL3 wees DO roosoved or: 334] a Case ID #: 47 (8 / eB) bi f cote 3 NISHANDSINS-OF UNKNOWN SUBJECT OR COUNTRY; bE Synopsis: (0//f686) To document the submission of a FD-340 to the 1a bers ‘classify On: 2040: puss investigation ndaiated: @uo/sois nesesenee: [—] ~ p Enclosure(s): Enclosed are } 1. Uses Oviginal notes R. Linick on August 04, 2015 Details (O//eeve) This communication servers to document the submission of a Fo-340 (1A) to the 1A sub-file of the captioned case file BepeE/prerom HRC-717 Titles e Boro (u//eete) Submission of FD~340 Re: 09/16/2015 of “Sp//norone HRC-718 b3 BIE z |PO-IOS? (Rev. $.8-30) “Spa orome ee cuassren Histe¢ a7eviere0 «ALL INECRNATION conTAINED REASON 1.8 (©) SERSIN TS UNCLASSIFIED EXCEPT CECLASSIFY on: A2-31-z040 WHERE SHOW OTHERWISE CAE: 11-09-2016, FEDERAL BUREAU OF INVESTIGATION Electronic Communieation (U//PeBe} Submission of D-349 Date: 09/16/2015 cc: From: WASHINGTON FIELD WF-CI13 oneacts (IJ Approved By: 35a| Drafted By-| case 30 #3 ee UNENOWN SUBJECT OR COUNTRY: SENSITIVE INVESTIGATIVE MATTER (STM) Synopsis: (U/A*eve) To document the submission of a FD-340 to the 1A sub-file of the captioned case file. Slassify on: 20 Full Investigation Initiated: 07/10/2015 reference: [_] seria: 29 Enclosure(s): Enclosed are the following items: 1. (3éfite) Original notes re interview of on August 07, 2015. Details (0//8@9@) This communication servers to document the submission of a FD-340 {1A) to the 1A sub-file of the captioned case file. “Span /woroms HRC-719 Hig i i He bé 7c pL bs BIE 3 BIE bé bic ® e Sie Moron Title:_(0//B988) Submission of FD-340 ne: DY 05/26/2035 bs Bre oe HRC-720 1057 Rey. $810) > &/ classretze BEASEN: 1. (6) PECLASSIFY OF: 12-31 RATE: 11-05-2026 wstca st6nereo 080 FEDERAL BUREAU OF INVE: Eleotrente Communteation Title: {U//#6¥6) Submission of FD-340 Date: 09/16/2015 b6 Ic ce: From: WASHINGTON FIELD WP-Cr13 Contact: esttes my: (J care 1D PAA s/t ba MISHANDLING OF CLASSIFIED; bs UNKNOWN SUBJECT OR COUNTRY; BIE SENSITIVE INVESTIGATIVE MATTER (S7N) Synepsie: (U//P086) To document the submission of 4 £0-340 to the 1A sub-file section of the captioned case file. Full Investigation tnitiated: 07/10/2015 bs bre Reference: [____—‘d seria 30 Enclosure (a): Enclosed are the following itens: 1, Q3MPY Original notes xe interview of on guly 31, be 268. bre Detail: (u//se8e) This communication servers to document the submission of a FD-240 (1A) to the 1A sub-file of the captioned case. Bei7 /wororer HRC-721 6 e “Besta worene Title: (U//fo80) Submission of FD-340 Re: 99/16/2015 bs BIE aay Da nome HRC-722 FEDERAL BUREAU OF INVESTIGATION POI/EA DELETED PAGE INFORMATION SHEET FOI/Pag 1253814-0 Total Deleted Page(s) = 105 Page 9 ~ b3; b6; b7C; BIE; Page 16 ~ Referral/Consult; Page 17 ~ Referral/Consult; Page 1€ ~ Referral/Consult; Page 18 ~ Referral /Consult; Page 20 ~ Referral /Consult; Page 21 = Referral/Consult; Page 23 = b6; b?C; B70; BIE; Page 29 ~ Referral/Consult; Page 30 ~ Referral/Consult; Page 31 ~ Referral/Consult; Page 32 ~ Referral/Consult; Page 33 ~ Referral/Consult; Page 34 ~ Referral/Consult; Page 35 ~ Referral /consult; Page 26 ~ Referral /Consult; Page 37 = Referral/Consult; Page 39 = b6; b?C; B70; BIE; Page 40 ~ b6; BIC; b7D; BIB; Page 41 ~ b6; B7C; BID; BIE Page 43 ~ b6; BYC: bID; BIE: Page 44 ~ b6; BIC; b7D; BIE; Page 46 ~ Referral/Consult; Page 47 ~ Referral/Consult; Page 48 ~ Referral/Consult; Page 49 ~ Referral/consult; Page 30 ~ Referral/consult; Page 51 ~ Referral /Consult; Page 52 ~ Referral/Consult; Page 58 ~ Referral /Consult, Page 59 ~ Referral /Consult, Page 60 ~ Referral/Consult; Page 61 ~ Referral/Consult; Page 62 ~ Referral/Consult; Page 63 ~ Referral/consult; Page 64 ~ Referral/consult; Page 68 ~ Referral /Consult; Page 66 ~ Referral /Consult; Page 67 » Referral/Consult; Page 68 ~ Referral/Consult; Page 69 ~ Referral/Consult; Page 70 ~ Referral/Consult; Page 71 ~ Referral/Consult; Page 72 ~ Referral/consult; Page 73 ~ Referral/consult; Page 74 ~ Referral /Consult; Page 78 ~ Referral /Consult; Page 76 ~ Referral/Consult; Page: Page Page Page Page Page Page Page Page: Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page 77 = Referral/Consult; 78 ~ Referral/Consult; 19 ~ Referral/Consult; 80 ~ Referral/Consult; 81 ~ Referral/Consult; 82 ~ Referral/Consult; 83 ~ Referral /Consult; B4 ~ Referral/Consult; 85 ~ Referral/Consult; 86 ~ Referral/Consult; 8? ~ Referral/Consult; e@ ~ Referral/Consult; 86 ~ Referral/Consult; 90 ~ Referral/Cconsult; 81 ~ Referral/Consult; 92 ~ Referral /Consult; 93 ~ Referral /Consult; 94 ~ Referral/Consult; 95 ~ Referral/Consult; 286 ~ Referral /consult; 27 ~ Referral/Consult; 8@ ~ Referral/Consult; 96 ~ Referral/Consult; 109) 101, 102 103 104 105 108 107 108, 103 110 un 2 113, na 115 1s 7 1g 119 120 qr 122 123 1a 125 126 127 131 132 133 ~ Referral/Consult; ~ Referral /Consult; ~ Referral /Consult ~ Referral/Consult; ~ Referral/Consult; ~ Referral/Cconsult; » Referral/consult; » Referral/Consult; ~ Referral/consult; ~ Referral/consult; + Referral/Consult; ~ Referral /Consult; ~ Referral/Consult; ~ Referral/Consult; ~ Referral/Cconsult; » Referral/consult; » Referral/Consult; ~ Referral/consult; ~ Referral/consult; ~ Referral/Consult; + Referral /Consult; ~ Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; ~ Referral/Cconsult; » Referral/Consult; ~ Referral/consult; ~ Referral/consult; ~ Referral/Consult; + Referral /Consult; ~ Referral/Consult; Page 134 ~ Referral/Consult; Page 135 ~ Referral/Consult; Page 136 ~ Referral/Consult; HARIHARAN X Deleted Pageis) — % X No Duplication Fee X X Por this Page g YOUXKME EMH ANAK MEHR, CLASSIFIED BY: MSrce 27 #:[_____ Het sae al br HrnANo £0; be ONRNOWN SUBIECD OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) Derived Nsrs¢os assify On: 202 Full Investigation Initiated: 07/10/2015 Collected From: (0) TE Receipt Given?: No Holding Office: WASHINGTON FIELD Details: No Details Provided tem Type Description 1B Digital (0) DRY 22 GR USB 30 Collected On: 09/29/2015 Seizing Individua, Collected By: Location Area: N/A Specitic Location: W/A Device Type: USB Micro Storage Device (thumb drive) Number of Devices Collected: 1 Dé BIC “Beri rororer ‘This document contin eter commendations nor cnshsoas othe FB isthe propery ofthe Fl ands ated to your agenoy and is cones not be bute tae Your ae. HRC-727 e e “Bp /norone rite: (uy reo ex sy[— b3 Rez [09/29/2015 bre or BapG/ noron HRC-728 (apie Be Bre HRC-729 wi SUASSIFIED BY) NSICG s76s19T0O ALL INFORMATION CONTAINED REASON. 14 HEREIN TS WNCLASSTSTED BUCEPT DECUSS: WHERE SHCA OTHERMISE UATE: 1 cn az 9-2015 2040 Ree) mowers FEDERAL BUREAU OF INVESTIGATION Collected ttem Log . bi b3 a > 7G LC pot iseae[ = vn sanETNS-GF-CERSSTE 10; BIE UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SDM) Full Investigation Initiated: 07/10/2019 OM partner Katherine Turner wslliens @ Connelly LLP Collected From: Receipt Given?: No Holding Office: WASHINGTON FIELD Details: No Detaiis Provided Tem Type Description in digital 1) QQ Seagate Desktop External Hard Deive 1000 68, S/N 2GHJO2Z6M/ Power Supply/USB Cable bE Collected On: 10/03/2015 BIC Seizing Individua: Collected By: Location Area: NB Specific Location: NA Device Type: Hard Drive Serial Number: 2GHJ0264 Number of Devices Collected: 1 ‘Dem woven ‘This document contains athe commrandations tor coclsins of he FBI is he rapes of the FB and sean o your pee, as canans emote dete ted ove ago) HRC-731 18 pigital ili 1B Digital 1B Digital oy n e e “apa Aeron Title Re /2018 (Bf Datto Server Supermicro 2V Server, Model 52000, S/N 002590AFDEBE, Invoice 482547 collected on: 10/03/2015 Seizing Individua’ collected ay: Location Area: Ni Specific Location: NA nevice Type: Hard Drive Serial Number: 002590AFDEBE Munber of Devices Collected: 1 XX) peli Power Edge 1950 (Sezvice ag S¥SKWAT) (Express Service Code 12988372429) Physical Blackberry enterprise Service (SES) Collected on: 10/03; Seizing Individua Collected By: Location Area Specific Location: xa Device Type: Hard Drive Nonber of Devices Collected: 1 OM 9 NAP Network Attached Storage (NAS) Device Model 78-1079 Pro, Serial #Q-11AT10175, 21.76 78 Total Capacity containing 178 Data Loaded from PRN Servers & Equipment Collected On: 10/03/2015 Seizing Indivi collected By: Location area: NA Specific Location: 8A Device Type: Hard Drive Number of Devices Collected: 1 kee bi bo BIE 6 Ie b6 Ie 6 Ie HRC-732 CLAsSIFtE ay: ustce 37es.ee0 REASON: 2.4 (CY TATE) 11-05-2016 109 (Rey. 5.2510) Sones FEDERAL BUREAU OF INVESTIGATION ‘ALL TNFORUAT ION coarTRIMED HEREIN IS UNCLASSIFIED EXCEPT WERE SHOW OTHERWISE, ba Collected Htom Les 2 BE Event Title: (5) Date: 10/0$/2015 bs roproved py:[ bre Drafted By: Case ID #: 10S is//ae]] bi MISHANDLING OF CEASSIFIED; ba UNENOWN SUBJECT OR COUNTRY: BIE SENSITIVE INVESTIGATIVE MATTER (Sit) Derived 9 Nszsc-21 sity 0 231, Pull Investigation Initiated: 07/10/2015 'D|_ corrected rrom: }M} Wilmer Hale 1875 Pennsylvania Ave Nit Washington, District Of Columbia 20006 Receipt Given?: No Holding Office: WASHINGTON FIEZD Details: No Details Provided Item Type scription 18 Digital Jj Apple Mac Pro $/N #89336146644, Power Cord bs Collected on: 10/08/2018 bic Seizing Individual: | ——_] Collected By: Location Area: NA Specific Location: NA Device Type: Hard Drive Number of Devices Collected: 1 Been moron , ‘This documant conan eter commendations ot conclsins ofthe FBI isthe propeny of ie FB and iano you spesy; ands canes are not be dirt ove 9" 500, HRC-733 Tih Ret . Pe es) 10708/2035 Bee mozoner HRC-734 bt »3 BIE is ke et BS bre HRC741, be pI 6 A a HRC-743 . ALL TNEORMATTON CONTAINED HEREIN IS UNCLASSIFIED HATE 11-09-2016 Be O7691L87RO NSTC FD-302a (Rev. 106.95) - FEDERAL BUREAU OF INVESTIGATION Date of transcription _ 10/07/2015 b6 On October 6, 2015 [Attorney at Law, Day Piney LLP, 1100 New York Ave, eae NW Suite 300, Washington D.C. 20005, telepho jexternal counsel for Datto Inc., electronically mailed S; fo advise that Datto Ine., had received a letter from Chairman Johnson of the eourity & Government Affairs Committee regarding the captioned matter. A copy of the email and attached letter from Chairman Johnson are enclosed in a 1A. Investigation on _ 10/07/2015. ‘at__Washington, DC Fie =104 Date dictated _N/A, b6 Byss po Ie ‘This document contains neither recommendations nor conclusions ofthe FBI. Itis the property ofthe FBI and is loaned to your agency i and is conteats are not o be distruted outside your ageney bE HRC-744 HRC754~ Be Ic BIE 6 yc BIS HRC-758 Ct w oF “Speeer / Bre HRC-768 - @ EBLE issue “SBpstif/ preven Aut THFORATION conraRNED HERELY 18 UNCLASSIFIED EXCEPT FEDERAL BUREAU OF INVESTIGATION “OFS S#98) OFsEnizse Title: (U//FO¥S) Transcript of Congressional Testimony Date: 11/23/15 Yo: Washington Field From: Washington Field cr-12 Contact: sos bé Ic Approved By: SSA casei: Mm [tt Bo (s/ Ae} TE MISHANDLTI! UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) Synopsis: (U//Pe@¥e} Documentation of Congressional testimony transcript Enclosure(s)}: Enclosed are the following items: 1. (U//¥836) CD with digital copy of Congressional testimony tas : He3ge3T4. Derived From: dated 20130301 gify on: 20401231 Details: (U//#eWe) Former Secretary of State Hillary Clint testified before the United States House of Rep Committee on Benghazi on 10/22/15. FBI Attorney| accessed a transcript of the testimony via the Washington or about 10/22/1 to Staff Operat: Specialist (Sos) mn 10/23/15. A copy of the verbatim transcript of Clinton's testimony wil. maintained on a CD via the associated 1A. oe “pei moron HRC-769 v6 bre HRC-840 | (ey 05-01-2008) fare: 11-03-2035 LASSIFTED BY: uSTCG 276916760 e PEasCA 1.4 (c) SBpeGe/ pore ALL INFORIIATION CONTRI HEREIN IS WICLASSIEIED EXCEPT FEDERAL BUREAU OF INVESTIGATION ™*" S80°8 OTHESISE Precedence: ROUTINE Date: 1/5/2016 To: Washington Field From: Washington Field cI-13 Priesstap eas “ roved App: By lobe Drafted By: case 1p #: DX} 12 Title: (S) B CLASSIFIED; DIE UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) Synopsis: (M//#r} Provides FSI Washington Field Office (WFO) the conditional Suthority of Original Classifying Authority (OCA) B. W. Priestap, Assistant Director, Counterintelligence Division (CD), to show SIDNEY BLUMENTHAL, and his legal counsel, an email sent by BLUMENTHAL that has since been deemed to contain classified information. d By: H83g83T44 Derived Fron? ‘ted 20130301 Detail je) This communication. requests the conditional authority 6f Original Classifying Authority (OCA) E. W. Priestap, Assistant Director, Counterintelligence Division (CD), to show STDNEY BLUMENTHAL, and his legal counsel, an email sent by BLUMENTHAL that has since been deemed to contain Classified FBI information. ai eF) For background information, WFO will be conducting af Interview of BLUMENTHAL regarding his knowledge of matters relevant Bakr /pworonse HRC-B41 ‘Rex. 05-01-2008) @ i) a MN) pkey proons FEDERAL BUREAU OF INVESTIGATION to the captioned investigation. The interview will be conducted on 1/7/2016 and will also be attended by his legal counsel from Sidley Austin LLP and attorneys from the Department of Justice. OX//mE) During the course of the interview, WFO plans to show BLUMENTHAL and his counsel a copy of the attached email that he sent on April 23, 2010 to the former Secretary of State, Hillary Clinton. Showing the email to 3LUMENTHAL and his counsel will allow WFO to pursue a logical line of questions regarding the circumstances in which the email was sent. During a recent classification review the FBI deemed that portions of the email contain information classified at SECRET level. QX/AWS)) WFO confirms that showing the email will not result in previous unknown sources or informants being revealed, will not negatively impact other case equities, and will not disclose information from any other agency or foreign government. Yk/AMPAs a result, CD provides one-time OCA authority for FBI WFO to show BLUMENTHAL and his legal counsel the email above during its planned interview. DX/A#PY Prior to showing BLUMENTHAL, and his legal counsel the email, BLUMENTHAL and his legal counsel should execute a non-disclosure agreement. In addition, FBI.WPO should advise BLUMENTHAL of his past and present obligations to protect classified information including the contents of the email. °BI WFO will document these discussions in its FD-302. YS) any questions or concerns regarding this matter can be addressed to SA ees Brey moron HRC-842 be pre ba bis x HRC-849 BI INFO ELASSIFIED BY nsteo o76a.eT20 e REASGH: 1.4 (Cy EECLASSIEY cil: 22-33-7041 TATE” 11-09-2036 Orem Rvone ‘ous ey $10 (qj eee | sipakg/ roron Laer FEDERAL BUREAU OF INVESTIGATION bt Evidence Entry bs bre Bvent mite: (5) pate: 01/08/2016 a be bre ba case 1D # ise ba SISHRNDZING OF GEASSEErED; Bo UNKNOWN SUBJECT OR COUNTRY: SENSITIVE INVESTIGATIVE MATTER (SIM) Derived Nsrsc-205 Full Investigation Initiated: 07/10/2015 Collected By: Missing on Missing Collected From: Department of state Receipt Given?: No Holding office: ASHINGTON FIELD Item Type Reseription Ap Digatal {J]] QM 1 Thumb Drive with Green Unclassified sticker On Te Collected On: 01/07, Seizing Individual ve Located By: Location Area? NA Specific Location: Na Device Type: USB Micro Storage Device (thumb drive) Number of Devices Collected: 1 Bek oro HRC-850 e “Rp ecco Title: (3) Re: pi708/2016 1p Digital 7 4) P61 thumb deive with Red Seceet Stacker on It Collected On: 01/07, Seizing Indivigual hoceted By: Location Area? NA Specific Location: Na Device Type: USB Micro Storage Device (thumb drive) Number of Devices Collecte ‘SBpxG/ /wovons 1 HRC-B51 ba b3 bE be BIC