You are on page 1of 100
ALL THEORMATION CONTATHEE FD-302a Rev. 10-6-95) a FEDERAL BUREAU OF INVESTIGATION Dats of transcription _09/21.2015. ») On September 14, 2015, Platte River Networks, date of birth social security numb. intervi bs of investigation (FBI) Special Agent (SA) jand SAI Also present | for the intervie ent of Justice (DON) Attome! attorney at the| being advised of the Weniity OF the imervTewing ageniS and the nature of the interview. rovided the following: (U/POGO) As| ii ldescribed his role at PRN as a general role with the client and not involved with technical details, Jrain concem is the general direction of the business. (U/POES) Platte River Networks (PRN) worked with an individual named] oO identify business opportunities. In early 201 Jbrought them a ctient opportunity who she claimed once worked as a public official. After submitting a bid to do the work, PRN became aware the contract, they were bidding on was for the management of an email server hosting doraains associated with BILL CLINTON, HILLARY CLINTON ane their aides. PRN won the bid for the contract and the account was under the name CESC. (ui PRN wanted to limait the employees working on the CESC server, so it was determi ho thal rly on theca, handled the server fvsite, would be the technical team doing most of the work that PRN picked up an old server from the CLINTON residence and delivered itto Equinix, @ datacenter in Secaucus, New Jersey. PRN ordered and installed new server hardware at Equinix and migrated all CESC email from their old server to the new PRN provided server. Ce aware that PRN maintained a back-up of the server known as a DATTO. The DATTO was located at Equinix and worked ots of the server and maintaining 1 0 days before it was deleted. ieferred, Qt specifi ras also aware of a BlackBerry Enverprise Server managed by PRN, but deferred to| fon the specifics. (U/FO8S) In or around March 2015[_____]was involved in conversations with CESC they requested to know what email they had, where it was, and how it was backed up. lan| handied this request and would know more details. CESC never asked Investignion on 08/1420 __at_Denver, Colorado File 2 + 2, Date dictated _W/A. by { ls Jofizppors ‘This document contains nether recommendations nor conclusions ofthe FBI, Jt isthe propery of the FBI andis loaned to your sgency; it and iss contents arent 1 be eistribuied outside your agency. Bs bre 6 Bre Be 7c bs Bye 6 BIC ba BIE be BIC BD-302a (Rev. 10-6-95) 6 bic Continuation of FD-302 of _Inierview of On 0723/2015, Page __2 for administrator rights to the PRN server or for physical access to the server at Equinix. eee believed CESC was still a PRN client and were operating under the same contract they originally signed, cuneate believe there was a successful intrusion attempt against the CESC email server ran by PRN s c ALL INFORMATION COUTAINED FD-302a (Rev. 10-695) MEREIW 12 WICLASSTSTED le DATE 10-O5-2016 EY Js7seDT94 NSICS FEDERAL BUREAU OF INVESTIGATION Date of transcription 05/26/2016 __ (Uh 2016, date of birth social pe security numbe interviewed by Federal Bureau of Investigation (FBI Special Agent < (SA) jand Sal at the offices of Platte River Revers Ph erat 5700 Washington Streei, Denver, Colorado 80216. Also present for the interview wes| and via speaker phone both attorneys at the| [After being advised of the identity of the interviewing agents and the nature of the interview] Jprovided the following information: (u/Feue) vas not aware of a laptop containing an archive of email belonging to be HILLARY CLINTON that was shipped to PRN around February 2014, lwas not aware bre ‘what became of the foregoing laptop. (weve], ily recently was made aware of a CLINTON email archive file being Bs i ii iv ‘ices Corporation (CESC) around July 2014 and September 2014 pre not aware of the request by CESC, or transmittal by fas not aware of what specifically was requested by CESC or exactly how] fulfilled the request, (U//FEBO)] ot aware of any support PRN provided the CESC client from Bel October 2014 to — Iwas not aware of any CESC request to delete, wipe or shred their email records. As af would not pay attention to technical details of any PRN client (U/POU@) AL this point in the interview, Agents displayed PRN provided records and email from the March 2015 timeframe provided the following information: eel (U/46¥8) In March 2015, when various media outlets reported a private email domain and ‘server was used by HILLARY CLINTON, PRN decided to cre; in “share drive” and control access to only the PRN employees working the CESC account, ited PRN did have back- Be ups of their own servers. PRN never deleted information pertaining to \C client and provided the BTC FBI all records they maintained pertaining to CESC. Investigation on 05232016 __at_ Denver, Colorado Bs bE Fite# oa ~ 46 Die dictated __ NA Bys _____________ bie ‘This document contains nether recommendations nor conclusions of the EBI. Itis the property ofthe FBI and is loaned to your agency; it ‘and its contents are not tobe distributed outside your agency. PD-3028 (Rev. 1046.95) ‘Continuation of FD-302 of. (U/Q40) In March 2015 content, to include where it existed. PRN employe data center in Secuacus, New Jersey where the CESC server equi was not a party iscussion involving CESC’: inye instructions] lid not recall what speci ~ kr equipment. (U/APOUE) After Agents displayed an emai! dated March MILLS discussed preservation of materials, Fould not recall entity to preserve CESC related data, (U/FORO) ‘no recollection of a conference call on March 25, 2015 or March 31, 2015 with CESC. ited CESC never r¢ ‘ir email content by deteted, wiped or shredded. Recently,] yas made aware that| jused Bleachbit software to shred .pst email files containing CESC email content that was transferred to CESC. As understood it] created a “vehicle” to transfer email files from the live mailboxes o| email accounts| then tater used Bleachbit software to shred the “vehicle” but the email ‘content still existed in the live email accounts. (U#PONO]_____ }was unaware of any PRN employee conducting manual deletions of the DATTO device used to back-up the CESC email server. cumexey |was unaware of any successful computer intrusion of the CESC server. (U/FEYE) Notes of the interview and documents displayed td [will be maintained in a FD340 envelope and filed with the captioned investigation. b6 pic Be bre Be bre bs BIC 6 Bre be bre be bre be bre we SQgfbl TNFCRIATION couranaes UNCLASSIFEED/ /O8O “eienei Gs uucunseovine DATE 10-08-2016 BY JS7288T94 NaICS FD-302a (Rev, 1046-95) -- FEDERAL BUREAU OF INVESTIGATION Date of transcription _94/192016 date of bith (DOB)|___] ana social security account nut wed by Federal Bureau of I ion, Agents (SA) at the law offices of located at ‘Washington DC 20005. Also present for the interview were Jattorneys| knd{ After being advised of the identity of the interviewing Agents, and the nature of the interview] provided the following information: (U/FOBQ) On April 19, 2016, is currently th fmet President WILLIAM CLINTO TINTON when he became an (the White House in the fall o After bis served in various positions in the CLINTON White House and continued to work for President CLINTON after his presidency. (U#FOLO) In the years after President CLINTON leit the White House, CLINTON’s staff managed certain details related to the information technology needs of CLINTON’s office. One of those needs required negotiating with an individual who owned several .com domains related to CLINTON’s name. Jrecalled these domains to be presidentelinton.com, clintonfoundation.com, and owjc.com. Ultimately, negotiations were successful and the domains were purchased from the individual. for the office of President CLINTON. COOPER ane had sevcral conversations about reliability isgues related to the previous outsourced server and decided it would be best to have a server under their physical control at the CLINTON’s residence in New York. COOPER handled the procurement and all ts -w accounts or any requests to move email. (UsFEHO) In 2006 or 2007, JUSTIN Santi a private email server (Apple Server) called a conversation wit LABEDIN and COOPER regarding the addition of HILLARY CLINTON to the Apple Server.| ___] thought it was a bad idea, but the issuc had been decided by that point in timé fo believed the addition of HILLARY CLINTON to the Apple Server occurred while she was in the’ jate. CLINTON used BlackBerry devices obtained by COOPER to access her emai not involved in the decision to move to a new server (Exchange Server), but recalled it was located, as was the Apple Server, in the basement of the CLINTON’s New York residence. Investigstion on__ 04/1929) ae hingrom Lt Fue# 2 To Date diciaed_ WIA, _ wel “This docoment contains neither rexormendations nor conclusions ofthe FBI Itis the propery afte Fl snd is Yeaned to your agency, it and is contents are not to be distributed eutside your agency. UNCLASSTFIED/ /PO6e be Bre bs bre be bre Be Ic ba BIE bs BIe “~~ oncnassieiep//poue FD-W2a (Rev. 10-6.95) CCootinustion of FD-302 of ___Intervew af usin Gregory Cooper fon ouppaoi6. Page 2 : . be (wis COOPER notifi {_ few times each year about attempted intrusions of the bre system, bul ould not recall any specie details. They shared a mutual e bad too much private information about the CLINTONS: and may have had access to some of thei ‘communications. (uiFETe) had no knowledge regarding the following topics: Poe © discussio . “o move - ge Server ‘personnel involved it to move to the Exchange Server * domains on 7 Exchange Server © userson + ae © dispositic ofthe Exchange Server after decommissioning classified information on Ap) er or Exchange Server conversations concerning a as it related to the Apple Server or Exchange Server backups of the Apple Server or Exchange Server . Sensitive Compartmented Information Facilities at the CLINTON’s New York or Washington, DC residences did recall Secure Telephone Units in New York and Washington, DC) b6 © Secure fax machines or secure computers at the New York or Washington, DC residences BIC UNCLASSIFIED/ /#O0e © rrcnscrrcsy naps We cnc re 0.3028 (Rey, 106-98) DAME iociscoie av s3Ts@sr3a NSTCG -l- _ “ “ “ FEDERAL BUREAU OF INVESTIGATION ‘Date of transcription _06/09/2016__ (UFOHO) (tune 6 2016 date | social security number| walinterviewed 6 Bureau of Investigation (FED) Special Agent (SA) land Sal lat the FBI Washington Field Office, 601 be 4" Street NW, Washington, DC 20535. Also present for the interview was FBI Intelligence Analyst bie Ati being advised of the identities of the interviewing agents and the purpose of the ilerview, |provided the following information: (UiBeHE) [works for| i of missile, space, and intelligence. In additx Js company focus i isition whic be as several products to i wel ‘Over 60 billion records i ossession, [Dark Horse Data, Inc. (DHD), a company owned by Former Deputy Under Secretary of Defense for Intelligence REGINALD HYDE. DHD works with foreign data, can contract directly with the government, and frequently embeds its personne! with clients. (U/POUO} In June or July 2015, States Senate Committee on the Judiciary, contacted] CLINTON’s email server might end up overseas. Specific: ‘was an intrusion i foreign power. a senior staff member of the United yf ms data from HILLARY ted to determine if there be ‘TON’s server and, if so, whether exfiltrated data fell into the hands of a ere concerned any exfiltrated data could endanger her three sons, who are ‘as a citizen and Senate Staff Member that this situation could occur. iis possible to determine if CLINTON’s server had been is stated Te would have to look for data that was genuine, authentic, and relevant. ejected i0se three terms as follows: ~ Genuine ~ data originating from CLINTON’s server - Authentic — data that had not been altered - Relevant — data from CLINTON’s server that was moved outside of the United States to a place where a foreign actof could access it (U/FOYS} Since] }iid not have funding for ject described above, in August or ®S September 2015 she met with NEWT GINGRICH and asked| brief GINGRICH on the project. 7° Be Imvesgnion on _ 061062016 __at_Washingtan, DC bre Filet sor 41. Date dictated __W/A By be ‘This document connns neither recommendations nor contusions ofthe FI. It isthe propery ofthe FBI andi loaned to your agency: it bre and its contents aze not be distributed euside your agency. UNCLASSIFIED/ /PO8e- UNCLASSTFIED//POe FD-302a (Rev. 1046-95) Continuation of FD-302 of _Interview of On 06/06/2016. Page [J ainenicn, ana were all bothered by the potential that data from CLINTON'S server had been compromised. wanted ers about the project and December 2015, recomm« yeak with| jat Judicial Watch. prietea the project as four phases tol The phases were to determine if: - Phase 1 -CLINTON’s server was directly or indirectly attacked - Phase 2-SIDNEY BLUMENTHAL!’s server was directly or indirectly attacked - Phase 3 —data was exfiltrated outside the United States Phase 4 — data was exposed to a foreign actor ag briefed the project, he raised the question of what the course of action would be if classified information was uncovered. The three discussed it and decided Judi Watch’s legal counsel should be. consulted Inever received an answer, but was of the opinion that if he uncovered data he ‘thought might be classified, he would be obligated to report it to the appropriate authorities. (U/FEHO) In January or February 2016, Judicial Watch’s legal counsel advised the project was feasible, but could not involve accessing any systems without authorization. The project could review open source data following the four phases described above. After these initial discussions with Judicial Watel Jconcluded the motivation of Judicial Watch's actions was not centered on the elections. (U/FE8O} Jadvised there are three potential funding streams for the types of projects his company undertakes. They can be funded by his company, a government contract, or a data arbitrageur. In this situation, the arbitrageur would invest in litigation on the prospect of a judge awarding the arbitrageur attorney’s fees. (U/PEBO} In February or March 2016[______ompany, as given $32,000 by Judicial Watch to proceed with Phase I. Judicial Watch awarded the contract ca confident he understood both the Deep Web and Dark Web. After receiving the contrac to determine the best place to obtain the necessary data for the project. Based on the terms outlined by Judicial Watch's INTO! HAL's respective servers were off limits, as were offshore servers. fumed a former executive at a cyber intelligence company which ingerts wm the Deep Web and Dark Web and, then, indexes the data, By leveragin, co ch the Deep Web and Dark Web without exposing his searches to the Inj ai [82,500 to have Jconduct searches based on search terms provided by se search Terms included, buf were not limited to, HILLARY CLINTON, BLUMENTAL, and an Internet Protocol (IP) address range obtained from an email y Judicial Watch. In retum, the results of those searches to which was the exclusive data source usé for this project. (umee[—_ feviewed the data provided by nd found files from BLUMENTHAL 's server on a server in Romania, believed BLUMENTHAL had a personal UNCLASSIFIED/ F686 be bre BS bre be Bre be bre bs bre be Bre be BIC UNCLASSIFTED//F68e FD-302a (Rey. 10-6-95) Continuation of FD-302 of __I B + On O6/06/2016., Page server because he found some of BLUMENTHALs files on the server in Romania, but not any of BLUMENTHAL’s emails. The Romanian server contained approximately 200 Microsoft Word, Excel, and other file types belonging to BLUMENTHAL. (U/EOBE) In re toaMay 22, ed intrusion of CLINTON’s server appearing in a draft version of a report project{ stated he could not recall where he learned of the hack or the specific date. peculated it was possibly from a public report, but he had looked for the source and could not find It. Therefore [planned to remove the reference from future iterations of the report. (WOO) Durind_____ review of the data obtained b 1 found one sensitive Excel file listing the names of Gown ot suspected jihadists in Libya, added that a portion ofthe file was in Russian, The file did not come from BLUMENTHAL?s server, But contained ay an IP address range that included the IP address of CLINTON’ server. Upon viewing this fle became con d found a classified document and stopped the project. This work completed Phase 1 and lanned to deliver the final report to Judicial Watch soon. (uiFeve) stated some o| were dat ut January 2012, which was the same timeframe wher [contacted] regarding the Libyan Rogue Nation Judgment Recovery Program (LRNIRP). Taimed he was hired ibyan opposition government to recover the assets of the MUAMMAR GADDAFI government. jalso met with TYLER DRUMHELLER regarding the same matter. speculated BLUMENTHAL, if involved in the LRNIRP, could have written the memos as a “shake and bake” tactic, (U/FOBE) A copy of the original interview notes and documents provided to the FBI by|___] during the interview are enclosed in a 1A envelope. UNCLASSIFIED//PEU@ be bre be Bre 7c be BIC BS pre ALL TNFORUATION ConPAnNER BEREIN IS UNCLASSIFIED #D-302a (Rev. 10-695) DATE 10-05-2018 BF 937986794 WSTCG ol FEDERAL BUREAU OF INVESTIGATION Date of transcription _op/2u2015___ On September 14, 201 ‘Networks (PRN), date of birth Fe -au of Investigation (FI) Special Also present for the interview wa ‘partment of Justice (DOJ) Attomey interviewing agents and the nature of the interview, Platte River by ised of the identity of the provided the following: On or about January 2o13f Jo contacted legarding potential busi ye profile former government client. had an existing e relationship with] cause she previously referred other clients from a family wealth asset management firm, The potential client's current email server architecture lost connectivj such as Hurricane Sandy, so they wanted better support than their existing a with the assistance of other PRN personnel, put together a proposal and submitted it lOnce PRN was chosen as one of the three finalists for the contract, PRN was notified the potential client was WILLIAM CLINTON and YY CLINTON, doing busi pany named CESC. on ler role fee primarily with te CESC wanted To Keep the number of individuals ‘WOrKIRg On The project small, so PRN identified three people as the only personnel allowed to work - directly on the CESC proj ivi signed in August 2013 ai s were identified j ent (SLA) ion design), roject mi [Chelp desk. ly 90% of the work for CESC and| imately 10% of the work. le was to help with on-site work at Equinix, whik handled everything else, was ultimately not needed to work on the project. Whi ked 10 revi i) he sent discussing a new émail address for HILLARY C 7 [state lcould not answer the question for attomey-client privilege reasons. A copy of the email is attached To Ths communication in an FD-340, PRN chose Equinix as the datacenter for CESC’s new email server (hereafter, PRN server) specific: it did not go down during Hurricane Sandy. This project was PRN’s first time using Equinix, ransported CESC’s existing equipment (hereafter, predecessor server) and transportea TTT Equinix, so the comtent of the predecessor server could be migrated to the new PRN server. Investigation on _OOMAROTS __st___Denv. Fuee | o_o Date dictwed__N/A. ws ya [_ |eeeus This document contains neither recommendations nor conclusions of the FBI. [Lis the property ofthe FBI and is loaned to your agency; it and its contents are not to be disteibuted outside your agency. be bre be bic bs BIC be bre bs BIE Bre FD-3025 (Rev. 10.6-95) On 0914/2015, Page __2 jstated PRN used an outside firm, MX Logic, for spam filtering, but referred other | filtering, data migration, archives‘backups, and Microsoft Exchange to or| had no knowledge of: + Email servers used by CESC prior to the one transported by PRN to Equinix. * The existence of classified information on either server. ‘© Discussions regarding federal records retention, + Intrusions to the PRN server. be Ic be bre bs pre ALL THEORUATION CoMTATIED e @ Bee seacsrne DATE 10-05-2036 BY 237989154 NSICD FD.302a (Rev. 1046-95) AL FEDERAL BUREAU OF INVESTIGATION Date of transcription 050672016 May 23,2016[ ___] ate of int ____]pocial scanty num was intervie ‘ederal Bureau of Investigation (FBI) Special Agent (SA) and S. at the offices of Platte River Networ t 5700 ‘Washington St do 80216, Also pr intervi eT via speaker een pot attomeys at th ng advised of the identity of the interviewing agents and the nature of the Interview rovided the following information: i had contact with PRN client CLINTON 01 ), His points of contact at CESC were CHERYL MILLS fan (U/FOGO) }was not aware of a laptop containin, il belonging to PS HILLARY CLINT ‘was Shipped to PRN around February 20141 vas not aware what became of the foregoing laptop. (UFORO] Jas not aware of a CLINTON email archive being transmitted to the Ps. (lamas services Corporation (CESC) around July 2014 and September 2014 byf | (UIFFOHE) of any support PRN provided the CESC client from oe October 2014 to January 2015. }was not aware of any CESC request to delete, wipe or shred their email records (U/@U2) At this noint in the interview, Agents displayed PRN provided records and email from the March 2015 timeframe] [provided the following information: oe (U/FOBO) In March 2015, when various media outlets reported a private email domain and server used by HILLARY CLINTON, i idea of hiring a thi yy S to conduct penetration test serve! recommends Bre from a company named| but the testing ultimately did not occur. ba Investigation on _0572372016 ___at_Denver, Colorado Bre File# 2 44 Date dictated _N Be By peo pre {Wis dosnent ens ede econendaon or consis ofthe PA, Ish prope of be PB ands aad you geo | and its contents are not o be distributed outside your agency. FD-302a (Rev, 1046.95) Continuation of F302 of Interior | ____. on o7as20ts. Page — (U/APOY®) In March 2015, recalled PRN employed travelled to the Equinix data center, but did not know the purpose of the trip. (U/POLO) After Agents displ i dated March 09, 2015 where CHERYL MILLS. discussed preservation of materi {could not recall any other request by any entity to preserve CESC related d alled receiving some guidance by PRN attomeys to preserve data, but could not recall specifically. (UeHe: ollection of a specific conference call on March 25, 2015 or March 31, 2015 wi id recall conference calls with CESC that were run by PRN’s attomey. stated CESC never requested their email content by deleted, wiped or shredded. (uiFSGe]__—__ vas unaware of any successful computer intrusion of the CESC server. (U/MO8O) Notes of the interview and documents displayed te ____] will be maintained in a FD340 envelope and filed with the captioned investigation, bé PIC be Bye be BIC be Bre be bre BS bre . ALU TUFDRRATION COUTASHED wy Sof SEREIN Ts (aCLASSTF TED UNCLASSIFIED//Fe0e TATE 10-08-2016 BY 137089794 NSICC FID-302a (Rev. 10-6-95)- oo FEDERAL BUREAU OF INVESTIGATION Date of wanseription 030372016 home addres . ‘was tnterviewed at the law offices of Bryan Cave LLP, 1155 F Washi; feral Bureau of Investigation (FBI) Special Agent ( bs id SAL Department of Justice attorney Jane bre counsel ‘ere also present for the interview. After being advised of the identity oF the interviewing agents and the nature of the intervie PS provizes the following: (Usreee)[__] first met President WILLIAM CLINTON and Hu CLINTON bed {cuINtoN) in 1997 when he was assigns lo The White House as| |At that time, e received a securit ‘ance after a single scope background investigation was conducted. He served in The White House] I (include traveling with the President, until 2001 when President President CLINTON’ EEG TIN TORS bat Keer Weeping an sie on him and would like him to join drove to their Chappaqua Fie then retumed to Chappaqua where but ended up with many more responsibilities. Te primarily focused on| (uiFexe) recalled an Apple server in thé basement of the CLINTON’s Chappaqua be es not remember when it was installed or by whom. It was a big box to the right of e7G ith no external devices attached. however, it had an internal capability to backup data, A ABEDIN| HILLARY CLINTON, JUSTIN COOPER, AND 1ad email accounts under the owje domain housed on the server. also used the Server as 2 workstation, (UsFeHe)| |did not know of plans to install the server constructed by BRYAN 2s 10 at the fime occurred. The server consisted of three thin black boxes mounted in a rack. Te fescribed himself as not technical and, therefore, could not speak to any details regarding this sever, ° bs Investigation on 02047016 _Washinguon. DC De Fit _| 2 ~ 0 Dae dictated _Né By sal pel : bs bre “This docuraent contains neither secommendatiors nor conclusions of the FBI, [tis the property of the FB! and is loaned to your agency, it and its contents are not toe distributed outside your agency UNCLASSIFIED//P686 \ onctasstetan//soue FD-302a (Rev. 10-6-95) Continuation of FD-302 of, ye On 02/04/2015 , Page 2 (uyPORe| fend nara Tecall escorting anyone from Platte River Networks in June 20:3 into the Chappaqua residence to remove the Server described above, (QFOUO) HILLARY CLINTON’ office was on the third floor of the Chappaqua residence. ‘After she became the Secretary of State, the State Department (State) converted it into a sensitive rnted information facility (SCIF). During the installation of the secure lines for the SCIF, tood at the door as an escort for the technicians. After that conversion, CLINTON was the only one whe had the combination to access the office until it was decommissioned one to two weeks after her departure from State. It contained approximately three phones installed by State. believed all secure phones and described them as a black STU phone, a yellow phone, and a white phone, lid not know the differences in the phones. The office al CLINTON’s non-secure desktop computer, a shredder, and a secure fax machine. initially stated he only entered the SCIF once or twice, when CLINTON was present, to remove trash. (umeve_____Jater recalled a procedure established by ABEDIN witl|____h the beginning INS tenure af State for situations when CLINTON needed assistance wih the secure fax. Whe ‘was notified by Stas personnel of an incoming secure fax, he would locate CLINTON, Tallow Fer to the SCIE, oni assist as needed with the incoming fax. He was never in the SCIF to teceive a fax without CLINTON present ard never physically picked up any of the documents received. Ifthe fax was not working, State Would sometimes send th documents or a diplomatic pouch to the Chappaqua residence, On those a escort the courier to the door and the courier would hand the documents or pouch directly to CLINTON. fio also toordinate the repair of the fax when broken. (U#POBO) ABEDIN or CHERYE MILLS would sometimes notifi the Presidential Daily Brief \d be coming via secure fax to the residence. As described above with other secure tee locate CLINTON ith the incoming secure fax. The PDB was also hand carried fo the residence on occasion a a escort the courier to CLINTON. (uie@4e[__lnesigdically ceceived emails from ABEDIN with attached documents intended for CLINTON] would print the documents and give them to CLINTON, but does not know what happened to the documents after CLINTON was finished with them. Last Name Unknown handled similar duties at CLINTON’s residence in Washington, DC. (W/POVE) CLINTON had sev erry devices over the course of time, When had issues with one of them| lwould ask COOPER for advice on how to fix it ieved CLINTON had a State BlackBerry, but did not recall a secure mobile phone. (UiFeB®) did not recall setting up an Apple ID or iPad for CLINTON. (uiteve) joa ‘ot recall a secure phone in CLINTON’s bedroom, UNCLASSIFIED/ /POB® bé bre be BIC be bre be bre bs BIe BS pre bs bre be BIC BS + BIe ALL INPORIATION OOUTAINED. HEREIN 18 ONCLASSLEIED TATE 10-08-2016 BY JS778n796 WSICG ED-302a (Rev, 1046-95) le FEDERAL BUREAU OF INVESTIGATION Date of wanseription _03/23/2016 ] caier Bx ee viewed ab Ais la nt, is and his email address is was advised that the FBI had identified 37 login attempts to the Al uD account of har22@cli mail.com, originating from three | owned IP addresses. was provided with the IP addresses that made the login attempts. After being advised of the identitie: interviewing Agents and the nature of the interview, Do feovrtsca the following information: ag_approximately| employees at their main headguarte iti in other ba locations. The} bs wovide pic has a large customer base Tneluding 7 components. bs rovided the Agents with a demonstration of th on_2 laptop in his oftice | 1 others. That data is then ve bre [[ “Jprovides theiz clients with two basic services: 1) their security platform can be uséd to link and or current social bs media information on the Internet; and 2) can provide on-going >7¢ social media monitoring for their clients explained that the >7E vs ‘investigation on 03/23/2016 al raeo _ Revere ~(Y _ pate dicted wa BS DIE By Sal ‘This document contains neither recommendations nor conclusions of the FBI. Itis the property of the FBI and is loaned.to your agency: it be and is contents are nol to be distributed outside your egency. bie Bé HD-302a (Rev. 106-95) Ie Continuation of 70-302 of _Inerview of ]____. on ppizavz0is. Page ___2 monitoring service rts for new social _media posts be relating to current Additionally, provides that bc same service for all United States Department of Commerce employees, P7E whether they are aware of it or not. Along with searching for ba b6 bre confirmed that two of the three IP addresses shown to him belong to stated that the third IP address may have bee i that it was no 2: be The is assiqned to be bre does not maint: their clients. be BIC then showed the Agents a screen on his laptop, where the username field was displayed without a corresponding password field. To the best of[__] recollectioi as not hired by pe HILLARY CLINTON or anyone on her behal£. etributed the login e to being ed by one of their clients, utilizing. the platform. left 2he interview for a brief moment in order to verify that was not conducting any continuous monitoring services for AM PTOI. "then he returned, confirmed that they are not. stated that he had a co-worker of his search for CLINTON’s nam atform. In order to protect the FBI’s inquiry at had the co-worker search for CLINTON’s name in the system, along with the names of two additional current Presidential candidates. The results were negative on all three searches. ED-302a Rev. 10-6.95) CCostinustion of FD-302 of _ Interview off 3 be bre was then informed that the hdr22@clintonemail.com email account was i in a NEW YORK TIMES article on March 02, 2015, fe the login attempts occurred on the following day. 6 tated that this made sense to hit. Given that information, he theorized that the login attempts were likely made by one of their bre “good guy” clients, possibly to conduct a damage assessment on the jal media footprint associated with that email adc ever, stated that he could not verify his theory, as had no tional data to corroborate it. is amenable to future contact with the FBI. bs BIC ALL INFORMATION OCUTAINED BEREIU 18 UNCLASSIF IEC ERIE 10-08-2036 3Y anne D-B022 (Rev. 1046-95) werce -l- FEDERAL BUREAU OF INVESTIGATION Date of anseription 04/14/2016 , Chief Executive Offic ai is place of employment, telephone number ant his email address is Rise present for this interview was FBI SA as advised bS ure of the interview was to determine whether or not bre had performed any penetration testing on the Glintonemail.com domain. after being advised of the identity of the {nterviewing Agents and the nature of the interview, [__] provided the following information: di perform any penetration testing for the 6 clintonemail.com domain. recalled that the clintonemail.com domain B76 was previously hosted at the PLATTE RIVER NETWORKS (PRN) Tnteryet i i wer, Colorado. is good friends with who is at PAN. Yecalled speaking with| aBOUE doing penetration testing on that domain, approximately six months prior the large media coverage of the private server. jprovided security recommendations for the system; however, actual penetration testing did not ultimately occur. maintains a working business relationship with 6 PRN. Tf a PRN customer wishes to have penetration testing performed on = »7¢ their network, PI that customer to Correspondingly, will refer their customers wish to harden theiz network systems subsequent to a [oo benceracion testing assessment. als: Jeverages technical resources at PRN for other projects, including incident handling and forensic analysis. The two companies compensate one another with commission checks. b6 b7c Investigation on _ 04/12 ce lo Filed be By sal bé “This document contains neither recommendations aor conclusions ofthe FBL. {2 is the propery ofthe FBI and is loaned t9 your agency: it and its contents ae not to be distributed outside your agency. bre D-S02a (Rev, 1046-95) Contination of FD-302 of _Inervicw o| On puI22016. Page __2. bs bie recalled sharing se’ emails with PRN employees regarding Be the clintonemail.com domain PS ositariy dealt end but, pre remembered thap_there were a couple of other PRN employees included on the exchanges. 1 is office and printed out several email between him ant Those printouts are enclosed for the file in a physical 1A envelope. never had access to the clintonemail.com domain, 6 nor do tl any of their company services on PRN networks. The pre extent of interactions with PRN employees, rélated penetration testing, and the clintonemail.com domain are documented in the email exchanges that| provided during this interview. While reviewing thé emails provided by sal ohgentitiea bs public news article, where an individual named bre had utilized a scanning tool called FIERCE to - Tdentify the addresses used for HILLARY CLINTON: - nal email server. provided that the referenced provided that ormerly wanaged an Internet blog where hé posted new h: Exploits on almost a daily basis. A few years ago, however] went dark and discenti publishing his fin D provided that goes by the name of i = hacking community- has known for sever, rs. The two of them share = PS a passion for music. Fecalled that a pre business that put on Targe- Oncerts, which would rival that of a Madonna-sized concert. the i bond. AddieionaTTy| recalled that a blimp company that provided aerial caverage over large public events. ecalled meetin: at a Colorado technical event, be which Téeferred to the event as a leads pre event, which was a technical expo in Colorado where information technology experts d exchange ideas and fork with one another. During that event, spoke_on_a panel with and a US SECRET SERVICE Agent, named During-THerodieticns with one jor to the event, ‘called USSS SA stating to that he had recently served a warrant at PRN. surmised that statement to relate to the on-going investigatio INTCN’ s: email server. Agent Note: A follow-up call to USSS SA identified FD-802a (Rev. 10-6-95) Continuation of FD-302 of Interview of Gn 08/12/2016, Page _3. warrant referenced in that conversation was served in support of different matter. as a “good guy”, who is caught in a bad situation Tas stated his frustrations t regarding the CLINTON email investigation. direct impact on PRN’s business, and that they have joney in legal fees related to the matter. is concerned over the negative publicity Teceived in the news media. Additionally, It has had a spent a large Primarily, that PRN has PRN has been asked to step stated that out of certain requests for proposals (RFP’s) as a result of the investigation. In addition tof 1. [Jas so had limited interactions with PRN" Last Name Unknown (LNU). However, has been primary point of contact at PRN. When asked whether or not utilizes ene social media cyber security product, ated that they do nO [fs amenable to future contact with the FBI. bs BIC bs Bre be Bre bs BIC bs BIC ALL INPORIATION CONTAINED HEREIN 13 UNCLASELTEC EME io-n8-2016 BY ca7sasT4 werce FD-302a (Rev, 106.95) Le FEDERAL BUREAU OK INVESTIGATION Date of transcription 24/2015 6 date of birth (DOB) } was Bre inti Bur i invest icar (FEI) Special agents (sn, and at the law offices of DAY, Tocated at One Canterbury Green, Stamfor: °. resent for the interview were DAY PITNEY attorneys and | After being advised of the identi Tviewing Agents, and the nature of the interview, provided the following information: BS ye is currently employed as at DATTO Tocated_at_ i101 Merritt 7, Norwalk, cT06l and osition for ior to that, was ee worked — ae the DATTO is a company that provides products and services to small businesses related to cloud storage and disaster recovery, DATTO had an established relationship with PLATTE RIVER NETWORKS (PRN) and provided them server back-up and recovery services for some time. DATTO’s relationship with PRN was already established in 2013 when PRN acquired a new contract to manage an email server with a client known to DATTO as CRSC. At the time, DATTO did not know who PRN’s client CESC was. When PRN reached out to DATTO in. May 2013 to provide back-up services for the CESC client server, PRN requested a slightly * different service from DATTO than they normally request. Typically, PRN would request that DATTO back-up remotely to DATTO’s secure cloud. For the CESC client server, PRN requested that the server be backed-up Investigation on 10492015 t__Samind, CF ‘sa ‘bs Pie 302 - 37 Date dictaed_N/a BIE be By ss sal 6 BIC ‘This document caniains neither recommendations nor conclusions ofthe PBL Is the propery ofthe FBI and is loaned to your ageney and ts contents are not to be distibuted outside your agency. PD-302a (Rev. 10-6-95) Contamina st7pst26f tassel] en ats. ae jecally and privately. At the time of this request, it was not only a new request for PRN, but a non-standard process for DATTO. In order to affect the private, local storage needs for PRN's CESC ¢lient, PRN ordered a SIRIS 2000 device from DATTO, but forgot, or did not know, to also order the private node that the data would be routed to and stored on. Because of this, the default on the DATTO configured STRIS 2000 sent the CESC server back-up data remotely to DATTO’s secure cloud and not to a local private node. This default configuration on the SIRIS 2000 has since been changed. be re stated that PRN must have known data was being logged in 2 cloud and not on a local private node. As evidence, stated the partner portal, that PRN had log-in credentials to, ature di! ing backed-up data and options to delete cloud of delete local stated PRN would have seen their back-ups under delete cloud, NdGvETOnally, Ties shown a document provided by b6 DATTO indicating email records were manually deleted from t) pie secure cloud back-ups of the PRN CES¢ server in March 2005 [| stated that it couldn’t have been a DATTO employce that deleted those email records, because there would have been a work ticket indicating as much. Con the IP address: sociated with the March 2015 ba eistions, | f thoughe was the DATTO relay server © ection and Was a local host connection. ee stetes PRN had log-in Credentials on the partner portal that tied to one employee, so he did not know who from PRN logged —ae sent to the DATTO cloud through Secure File Transfer jz2) from the local DATTO device purchased by the client. TO devices, for different. clients, are synced to one node data storage. Each DATTO device is segmented on’ that node tes to a directory paired. with the corresponding device. he servers is partially encrypted and a password would be cess remotely. The DATTO server farm is housed in Pennsylvania, multiple levels underground, in a secure facility. In order to access the facility, you must be a client there and process through security, which includes a biometrics scan. The cages that house the servers are also locked. FD-3028 Rev. 16-6-95) be re Continuation of FD-302 of _Imerviw off DATTO virtualizes systems locally on the DATTO appliance or remotely in the DATTO secure cloud. As part of this process, an automatic test is conducted te verify the virtualization where screenshots of the windows login screen are sent to DATTO clients. Many of DATTO’s clients, to include PRN, would déccasionally get “backup verigic: failure” notices showing their DATTO device was 6 unbostable | indicated this notice occurred very frequently and bre almost alwaYSWSS"an issue involving the virtual environment and not DATTO actually failing to maintain back-ups of the associated servers. This issue was usually resolved with a handful of solutions to include chenging drivers and controllers or lengthening windows for verification. On O8M2/2013. Page DATTO never altered or configured the retention settings vegerdirg the period of time or frequency that the PRN server was backed up. The retention settings are set by the client. On 08/13/2015, after the CESC client was known to DATTO and lawyers became involved regarding the retention, preservation and production of records regarding the CESC client, DATTO shipped a new SIRIS 2000 device to PRN. The impetus to the shipment was the realization that the SIRIS device originally purchased by PRN was not encrypted. The provision of the new SIRIS 4 as initiated by, be DATTO and brokered by their attorney,| DATTO provided the bie device to have increased security while also ensuring continuity of operation on the server, bs [J etatea the DATTO secure cloud is frequently scanned and Bre he has ng Knowledge of any intrusion or deep penetration of their systens. stated the best place to look for network intrusion is the sySteW Togs. be Teer | 20"2 discussed federal records retention or classified BIC info; ‘ith any representative of PRN or CSC. . ALL IRFORNATION CONTAINED PU GORS Rew. 10-698) HEREIN TS IRICLASSTFISD DAME 10-08-2016 BY J3TaBsTOs NSICG FEDERAL BUREAU OF INVESTIGATION Date of eansetiption PRION, Records Management Records Information and Diesemination Section, Winchester, was texviewed at Beadpiexters, Washingron, D.C, After being advised of the identities of the interviewing Agents and the nature of tha intescieus [| proviaed 4 informat iva: . 6 des at Be 2 5 been employed the Records Management Division fox the past Approximately 6 weeks ago, received an emaii fxon[__| of the Depart of State (SATE) Freedon of Information Ret ng (FOIA! saction. email enclosed copies of 5 email commmicabions pre from former Secreuary of State HILLARY CLINTON’s private email account which STATE believed may contain “FBI equities.” STATE requested the FRI conduct an appropriate clasoificatic jew of the smalls pric: to theiy scheduled FOIA public release —- sed these § oma: were tranenit Rin on a clacaified email syecem but were aarked unclassified. recognized that at least 1 of the emails appeared classified and fo the Gounbert 23 bs pre yelayed thase findings bo STATE as par protocol. bs Appre tely i waek later, STATE’s Office of Legai Counsel onc) »7¢ coul@ HOt recall the name of the caller, According to ouc,[ ] 3 does not have an official government and therefore it believed the =I could not classify a document based on the PG caveat. OLC also advised that they, uot the FBI, are the judge of potential harm to welgn governments and therefore the PSE did iat 2 riche classiiy a document based on those conditions. b3 BS pre as guch remained classified at the BECRET//NOFORN level, Eieely sn BIE ‘This Seg PODS Taher rosorammendavians ner conclusions of the FBI, 1Lis he propesty ofthe FDI wade Found i» gous aad i conan are nat to be dsb guts bre PBs (Rew, 1A) Cinna of POD of tog onan fae 2 bre believed, based on IE GREIRIGHGGS an Original Clasaification Authority {CCA}, that the email vas classified properly and accurate. s eatuer, received a call tro of the International cpetations Division (i0b) of the FBI, sug “pressured” Him to change the classified ema! to unclasai indicated he had been contacked by PATRICI oe KENNEDY, Undernecxetary of State, who had asked his assistance in altering the omail’s classification in exchange for a ‘quid pro gua. at, in exchange for marking the email unclassified, STATE would reciprocate by allowing the FSI to place more Agente in countries where they ave presently forbidden Follewing the above exchange, [7] was summoned to an “all agency” ma at STATE to @isctsas matters perta: i elasgification review of pending CLINTON FOIA materials. eEficial fxom STATE, along with representatives £70 es and other government agencies were present, PATRICK KENNEDY over the meeting. During the conversation, a parvici asked whether any of the emails in question were seit aye contact with KENNEDY remarked, “Well, we’}1 believed this was reference to the FBI‘s categorization of SECRET//NOFORN email which KENNEDY was attempting. to influence. In a privat, ing with KENNEDY following the ail agency meeting, KRNNSDY asked whether the FRY “seo their way to marking the email unclassified?” According to KENNEDY spent the next 15 minutes debating the classification oF the ema, \i. attempting fluence the FBI Le change ite markings. Since Ca continued to assert that the email was appropriately marked sud NOFORN, XEBNWEDY asked who ise in the FBE he could epesk with on the matter xeferre! KENNEDY to MICHAEL STEINBACH, Assistant Director of CTD. [EJ was chen present during a conference call involving KENNEI and STEINBACH in which KENNEDY continued to presgure the FBI to change the classified markings om the email to unclassified. STBINBACH be refused to do so. Prior to ending the conversation, KENNEDY asked 7c whether the BI ox STATE would conduct the public stacements on che STRINBACK adviced KENNEDY that the FBI would not comment cly on the matter. The conference call ended and, according to the Associated Dregs {AP} published the stcry within the nex Secretary of State CLINTON appeared in fronts of the pri P-3UBs (Ra 10-695) Continuation of P32 of __ tse shortly thereafe private email server, ae, a to deny having sent classified emails on her believes STATZ has an agenda which involves mini classified nature of the CLINTON emails in erder to prote interests and those of CLINTON. Sisc @ above incidents, received approximately 8 ox 9 wore emails from STATE involving FBZ equities, 1 of which he believes way be clagsified seCRET//NOFORN. bs BIC 6 pre ALL INZORUATIGN CONTAINED eo sma tten 18.98 BERET Tf UNCLASSTSTEE FO-HR6 Re, 1-95} UATE 10-09-2018 BY S37988T94 NSICS “1 FEDERAL BUREAU OF INVESTIGATION Date of rameeription 0995205. (UiPORO) “oderal Bureau of hwestigation (1 re International Operations Division (OD), who is current Siiemeat onf was interviewed in person Is i vial Aus “Agent (S | at 4 tocated at er AL ao ivised of the a OF tie interviewing Agents and the nature of the Tateriew] |provided the following information: bs (UPR) As Jinteracied with PATRICK EB. KENNEDY, US. ee Department of State (DoS) Under Secretary oF State for Management. land KENNEDY’s relationship was professional. The nwo got along, but did not agree on Many manters related to the FHE's role and authority overseas. (UFORO) In late Ma wv fune| Found a note on his desk indicating eo NEDY contacted him. ae SEprINod, as both his Assistant Director (AD) JOHN $ and Executive Assistant Director (EAD) RORERT ANDERSON, bad both been trying to contect KENNEDY Sor months without response. CHEETE) Whea| fcturned KENNEDY’s call, KENNEDY askeal Be assivance ic changing @ claseilicalion of PDI ioformation contained in an ezmail CE provid swith the e-mail, however, he told eeu or FBY's Records Management Division (RMD) as the oné That told KENNEDY the dccument was classified, (Ui/PO80) KENNEDY told that the PBI's cinssification of the e-mail in question Be caused problems for KENNEDY and RENNDDY wanted to classify the document as “B9.”, KENNEDY farther stated that the “9” classification wonid allow him to archive the document in th basement of DoS never to be seen again. waa nat sure of what KENNEDY meant by a “BO” ification [Note; B9 may bea reference tora FOIA exemption). (LUFPOEE) Not yet knowing the e-muil’s content, told KENNEDY ke would look bs inyto she e-mail matter if KENNEDY would provide authority conceming the FBPs request to increase its pre personnel in frag vosigion ORAS ot_ Waist DE bo tig LP a eee Date tated bie ‘Tais dacemom contsins nether secommendaions nar coachasions oF tie EBL. tis the propeny oft and is contents are not tobe distrib guide vouraueney. UNCLASSIIED eS KD 302 (Rev, 1046-98) On gSAOSENS. Page (UFOHE) Followin, uversation with KENNEDY lcontacted| tc discuss the e-mail of concer, oid fhe e-rnail of KENNEDY’ concerns was classified by the FBE Counterterrorism Division (CTD) ‘ks on the US. Consulate in Benghazi. Following his conversation wi yatacted KENNEDY sind infoned him that there was no way he could assist EDY with declassllying the information contained in the e-mail. WH old ANDERSON and BOLES about KENNEDY'S declassify the e-mail and| esponse denying the ability to do so, nowever a] did not discuss the content of the e-mail with them. (UPOHErA gent notes are maintained ina TA envelope. 6 bic 6 pre Bs BTe FD-302a (Rev. 10-6-95) Sol_niromarten covets 4. WEREIU Ts UNCLASSIFIEC DATE 20-05-2026 BY J27285T94 NSICG FEDERAL BUREAU OF INVESTIGATION Date of wanscription 1/19/2016 weau of Investigation (FB) Special Agent ( VFOVO) On December 16, 2015| Owner and Chief ae Also present for the interview was| attomey] ing advised of the identity of the interviewing agents and the nature OF The interview Provided the following: (ur jounsel ale ving in Chicago and currently has a family of approximate Tployees comprised oF Full and part-time employees, as well as subcontractors. In early 2013) a business associate of contacted her about 4 client who needed a new email server. Atte] lexprs interest in the project and understood the clients » were HILLARY AND WILLIAM CLINTON, ut her in contact with CHERYL, A few othe: rsonnel assisted with invoTeing and Technical aspects of the contract, we Na most of the work Herself primary contacts were MILLS and BRYAN PAGLIANO; MILLS helped prodj posal and PAGLIANO assisted in developing the requirements for the server architecture. started the discussion by providing a range of options from low-cost Gmail to a more sophisticated private server. She understood the client’s impetus for the project to be teliability/uptime and security in the wake of a siniation where the client's private server housed in their residence experienced one we ywntime because of a storm, The client selected the private server options provided by Backup systems were planned for Phase 2 of the project, but was not involved in those decisions. (U/FO8O) As part of the initial conversations with PAGLIANO and MI oe at cone point the domains and number of email accounts on the server, but could not recall hose details Additionally Ina xno knowledge of email servers owned or operated by the client prior to the ‘equipment mamntamed by PAGLIANO. (U/FOBO) After the client selected a private serve contacted two firms she had prior experience with: GRAVITAS, a large Information Technoloy nd PLATTE RIVER NETWORKS @ is After the client selected PRN| worked with MILLS, PAGLIANO, and| fo develop the details of the project ]was onty involved in one or wo metas elieved he was curious about the process, PAGLIANO handled the technical Jnvolvement gradually faded out. The client occasionally reached out for assistance an Ip where she could. Payment for her services was billed for the entize task, not houzly, so did not charge any fee for this assistance on project and MILLS handled strategic concerns. As PRN took over day-to-day mat Would hal Investigation on —_12/1672015 at___New York, NY nics [Jno = 4 Date dcuted__ NIA wad fb fron, ‘his document contains neither recommendations nor conclusions of the FBI, Is the property ofthe PH and is logned to your agency: it and its contents are no! to be distributed outside your agency, bs BIe bé bie bs BIC pyc b3 BIE BS pre FD-302a (Rev. 106-95) Continuation of 0-302 of __tnerview of On ABAB201S, Page 2 (UiPFOHOL____ pelicved a Cloudacket-type security device was patt of the project design, so when it wasn't part OF the Initial instalt, she pushed for the implementation of it after the migration fromh the PAGLIANO server to the PRN server. During the migration, she was not in the weeds, but knew enough to know it was done correctly from a security standpoint. was not aware of any security intrusions or compromises while she was involved in the day-to-day opetations of the transition, nor was she brought back in aft ‘on any security issues. 1 addition to the CloudJacket, as part of the security considerations, discussed transitioning from BlackBerries to the iPhone with the client, as, ‘well as blocking internaffonal access to the server. Ultimately, the client chose to stay with BlackBerries and international blocking was declined because the elient frequently traveled intemationally VFECO) Since press reports of] lassociation with PRN and the CLINTON’s went public d some parmers contractey ‘ecurity to conduct Vulnerability Threat Assessments Tor some of their shared clients, was not aware of any such assessment conducted on the CLINTON’s server. currexe)| had no knowledge of the fotiowing topics as they relate to the PAGLIANO or PRN servers: ‘# moving emails to anew domain ‘© laptop backups © temporary backups classified information federal records bs Bye bs Bre be BIC be bre e . ee ED-302a (Rev, 1046.95) Wi ATOR CONMALLIED IN 1S. UNCLASSIFIED Lb DATE 10-05-2016 BY 937985794 NST FEDERAL BUREAU OF INVESTIGATION Date of transcription _ 95/26/2016 (U/A#OU@) On May 23, 2016, date of bi 1 by Federal Bureau of Investigation (FBI) Special Agents (SA) lands. at the offices of Platte River Networks (P! ‘Washington Street, D; 80216. Also present for the interview ad land via speaker phone, both attorneys at thel Afler being advised of the identity of the interviewing agents and the nature of the interview [provided the following information: (wrexel }was-given PRN administrator credenti: le cel ‘ould not recall logging in sto were in charge of handling ecalled be assisted with the CESC client less than five times, He recalled he o1 CESC in updating their operating system, talked tof Last Ni CESC most times. (U/FERO)| was not aware of a laptop containing 1g 10. HILLARY CLINTON that was shipped to PRN around February 2 re what became of the foregoing laptop. (U/FOHO) not aware of any support PRN provided the CESC client from October 201410, 0 ]was not aware of any CESC request to delete, wipe of shred their email records. was not aware of any email content being transmitted to CESC. (U/FOBO) At this interview, Agents displayed PRN provided records and email from the March 2015 timeframe. vided the following information: revel as not aware of a trip made by PRN employee| 0 the Equinix data center in Secuacus, New Jersey. (W/O) After Agents ‘email dated March 09, 2015 where CHERYL MILLS discussed preservation of materials, dd no knowledge of the email or any request by any entity to preserve CESC related data, ‘nvestigation on 05322016 at 7 File# json - 44. Date dictated _N/A nysal po ‘This document contains nether recommendations nor conclusions ofthe FBI. Its the property ofthe FBI and is loaned to your agency; it and its contents aze not tobe distributed outside your agency. bs pre be bre be BIC be BIC be bre be Bye be BIC bs bE be bre FD-302a (Rev, 106-95) Continuation of FD-302 of yeriew of] on oreaavaais Pegs 2 i Jhas no recollection of a conference call on March 25, 2015 or March 31, 2015 with CESC| [stated CESC never requested their email content by deleted, wiped or shredded, (uiEve) ]was unaware of any PRN employee conducting manual deletions of the DATTO device used to back-up the CESC email server. wuirexe] }was unaware of any successful computer intrusion of the CESC server. (U/FOUO) Notes of the interview and documents displayed to will be maintained ina FD340 envelope and filed with the captioned investigation. be bre be bre bs Bre bs BIC bs BIG wv we ALL THFORMATTON CONTATNED D-302a (Rev. 1046-95) REREIN 15 UNCLASSIFIED Ae DATE 10-08-2016 BY J37J86794 WSICG FEDERAL BUREAU OF INVESTIGATION Date of tamseription 6729/2016. (LUPEHE On lune 29, 2016] |Assistant to President William J. | | was interviewed ielephonically by Feder: investigation Special Age and also present for the call, was partment of Justice (DoJ) Counterintelligence and Export Control Section also participated in the call. After being advised of the identities of the interviewing agents, and the purpose of the interview [provided the following information: ‘as not familiar with Tor, which enables anonymous communication, nor di er use Tor| described herself as a “very low tech person.” (Hove used various communication devices and computer to remotely sign into her @presidentelintOacom-email account. These devices included an iPhone, BlackBerry, and on rare occasions, a laptop. 0 accessed her @presidentclinton.com email account from her desktop computer at the Clinton Foundatio desktop computer operated off of Windows, but she ‘was not sure of the specific version. further stated that she used an Apple Mac on occasion to sign onto her email. (UFOS) }iid not recall experiencing any unusual spam or phishing email activity related to her @presidentchnton.com emai] account in January, 2013, Jwas in New York on January 5, 2013. (U/POYO) A copy of the original interview notes are attached ina 1A envelope. 29016 at subinowan.2.C. rice [ Jon ~ PB ate diowtea_ va ‘This document contains neither recommendations nor conclusions of the FBI. It isthe property of the FB] and is loaned to your agency; it and its contents are not a be distributed outside your agency. bs BIC be BIC be BIC be BIC bs BIE BS Bre ALL INFORMATION CONTAINED #D-302a Rev, 10-6-95) EREIN 15 UNCLASSIFIED 4 DATE 10-06-2016 EY 337288753 NSIC FEDERAL BUREAU OF INVESTIGATION Dit of anscriton _ 0912015, On September 14, 20151 Platte River Networks, date of birt bre social security numbed Bureau of Investigation (FIN Special A Also present for the intervi : lind Department of Iustice (DON) Attomes_—_ emg advised of the identity of the interviewing agents and the nature of the interview, vided the following: In February or March 2013, fias informed by| be at Platte River Networks (P potential contract managing email for a high |THE client, Bat di ot know who the client vss ]was not involved in the proposal or technical any anyone representing, jand| \dled those matters. ‘eventually Teamed the client was WILLIAM CLINTON and HILLARY CLINTON (CLINTON), doing business through a company named CESC. At some point during the process, CESC conducted background chee nl rt for the contract. Those individuals eel (ecsietic eka san not know why CESC condueted the background GREGES, Bur assumed it was because they were a high profile client. Onorabout March 2015[ first leaned about concems regarding CLINTON’s use of a Be private email server when it was Teported by the media, Due to this increased attention, PRN decided to place Intemet Prot untry blocks and took other additional steps to secure the CESC server. In the same timeframe] participated in a conference call with C Ps counsel, Williams and ae ‘LINTON’ email was stored. While| jas on the call, 4 Tetter from the Unite: handled most of the questions. Subsequently, PRN received a preservation counsel on board to assist with these requests ates Senate and a preservation request fiom the FBI. PRN brought their own After receiving the FBI's preservation request, PRN received a letter from Williams and Connally instructing, ihe FBI the CESC server used prior fo migrating email to PI be recuinment.| traveled to New Jersey and turned over the server to the FB! ated bre fi HOT power up the server before providing it to the FBI ‘The CESC email server architecture also involved a DATTO backup appliance. The DATTO was configured to store backup data locally, however, due to a glitch, DATTO backed up data to their cloud fora period of time. On or about August 24, 2013, DATO sent PRN a letter stating they would stop Investigation on _ 09/14/2015. at __Dgnver, Colorado. bs Flew Jso2_ ~*°3 Dave dictated _ Nu TE sh /os sl s nfilory. bs Bre his document contains neither recommendstions nor conclusions ofthe FBI, Is the property ofthe FB and is loaned to your agency: It and is contents ae aot to be distributed outside your azeney. FD3024 (Rev. 10-6-95) 6 of Be Continuation of FD-302 oP__Iat { J}_______.6n oariwas, page 2 bre backing up to their cloud and preserve what was in their possession. The DATTO has a 60 day purge cycle, therefore, DATTO should have data from 60 days prior to August 24, 2015. bs tated] |would have specific details regarding the CESC bre land email server project ents ‘anyone related to the CESC project discuss the existence of classified information on the server. FD-302a (Rey, 10-6-95) ALL INFORMATION CONTATNED L BEREIN 15 UNCLASSIFIED ERIE 10-08-2016 BY 037288794 NSICe FEDERAL BUREAU OF INVESTIGATION Date of transcription _05/262016 (U//FOUQ) On May 23, a date of bi by Federal Bureau of Investigation (FBT) Special Agents (SA) at the offices of Platte River Networks (PI 10 Washington Street, 80216. Also present for the interview ee via speaker i | both attomeys at the After being advised of the identity of the interviewing agents and the nature of the intervit [provided the following information: (urmeuey] vas ‘not aware of a laptop containing an archi ail belonging to HILLARY CLINTON that was shipped to PRN around February 2014, | was not aware what became of the foregoing laptop. (uimeve[___Jonly recently was made aware of a CLINTON email archive file being eServices Corporation (CESC) around July 2014 and b as not aware of the request by CESC, or transmittal as twas aS sf what specifically was requested by CESC or exactly how a the reque: lnever spoke with anyone at CESC. (UiFORO) |was not aware of any support PRN provided the CESC client from October 2014 to January 20 ]was not aware of any CESC request to delete, wipe or shred their email records. (U//FOGS) At this point in the interview, Agents displayed PRN provided records and email from ‘the March 2015 timeframe| vided the following information: (U//OUS) In March 2015, when various media outlets reported a private email domain and server was used by HILLARY CLINTON, PRN decided to create an internal “share drive” and control access to only the PRN employees working the CESC account. PRN never deleted information pertaining to the CESC client and provided the FBI all records they maintained pertaining to CESC. (U/FEBE) In March 2015, stated PRN employee| jravelled to the Equinix data center to check the security of the servers and to ensure they were “Tooked tight.” After the media reports, PRN was even more concemed about the security of the server. Investigation on 052372016 ___at. 7 Filed jz - 40 Date dictated __NiA. ‘This document contains nether rovommendations nor conclusions of the FBI. It isthe property ofthe FBI and is loaned to your agency; It and its contents are not tobe distributed outside your agency. be Bre be BIC be bre be bre FD.302a (Rev, 10-6-95) Continuation of FO-3020f___Inceviewof! =| On 30015. Page 2 (U/PQLO) After Agents displayed an email dated March 09, 2015 where CHERYL MILLS. discussed preservati terials could not recall any other request by any entity to preserve CESC related dat heceived guidance torneys and understood CESC client information and records should not be teamed pan the preservation request applied more to CESC records and not necessarily email content| clicved the preservation request to be @ request from the government. cul zo specific recollection of a conference call on March 25, 2015 or March 31, 2015 wi Jstated CESC never requested their email content by deleted, wiped or shelf fad ‘a memory of a request by ‘confirm their server back-ups were still working, BUT Could not recall the specific request, lwas aware CESC wanted their email retention policy changed to 60 days. cueve] ]was unaware of any successful computer intrusion of the CESC server. (U/POBO) Notes of the interview and documents displayed to |will be maintained in a FD340 envelope and filed with the captioned investigation. be BIG be Bre bs BIC bs BIC be bre D-202s Rev. 106.95) ALL EBL INFORMATION eCHTALNEE A. WESEIN Ts UNCLASSIFIED UATE 10-13-2015 By g37s95r94 wa1cc FEDERAL BUREAU OF INVESTIGATION Dave of transcription _ 08/17/2015. On August 17, 2015, KATHERINE M. TURNER, Partner at the law offices of Williams & Connolly LLP, 725 12™ Street, N.W. Washington, D.C, met at her place of employment with Agents of the FBI to discuss voluntarily turning over six (6) laptop computers in her possession known Secret classified information. Also in atte: of the FBI's Office of General Counsel, Trial Attorney for the Counterespionage section at the Department of Jus! an attorney with Williams & Connelly LLP, and| counsel for CHERYL MILLS, from the law offices of Paul, Weiss, Rifkind, Wharton & Garrison LLP. Prior arrangements had been made to meet at this time and place to discuss an agreement through which Williams & Connelly would voluntarily turn over to the FBI six (6) laptops computers used by the firm to view email communications from the private server of former Secretary of State HILLARY CLINTON. TURNER acknowledged that these laptops contain Top Secret email communications and attorney/client privileged communications. TURNER sought to turn over the laptops as soon as possible but wished to ensure that privileged communications on the laptops would remain confidential. TURNER declined to provide consent to search the laptops and wished to arrange for secure storage of them in a manner agreeable to both the FBI and the attorneys. The FBI agreed to provide TURNER with a draft letter outlining the proposed conditions of storage as soon as possible. be bre Contrary to statements made on August 6, 2015, TURNER advised that only five of the six laptops are in the possessi: i Connelly, the sixth being in the possession of Be counsel for CHERYL MILLS, former Chief of Staff for CLINTON. pie admitted that the computer in hie possession has been connected to the Internet on numerous occasions subsequent to being loaded with the classified email communications of HILLARY CLINTON. This laptop was possessed by CHERYL MILLS but utilized by HEATHER SAMUELSON, an attorney on her staff, to conduct a review of approximately 60,000 emails originally contained on CLINTON’s private email server. According to SAMUELSON deleted CLINTON‘’s personal emails Investigation on _ 08/17/2015. ‘at__Weshington. D.C. Sile# BL Date dictetod __N/A ‘This document contains neither recommendatioiS nor conclusions of te FBI, Iti the property ofthe PBI ands loaned to your agency. 1 and its contents are not to be distributed outside your agency. FD-302a (Rev. 1946-95) Continuation of FD-392 af __Inverview of Kathering M, Tumer On $R/6/2015. Page _2. from the original 60,00 turned over to the FBI. resultii g in the 30,490 emails eventually claimed the other emails had been deleted from the laptop but was unable to specify whether they had been forensically wiped to an unrecoverable state. Both and TURNER admitted that the emails contained on these laptops Had been viewed by attorneys who did not have a security clearance at the time they reviewed the material. TURNER said the emails did not contain classification markers and thus they were not aware that they were classified at the time. bs Bre be BIC FD-302a (Rev. 106-95) ol FEDERAL BUREAU OF INVESTIGATION ALL YEE INFORMATION cONTAIHED ogres HSCS. Date of transcription 12/1U2015 (U/POLO) On December 10,2015[________]date of bint{______Jof the Be Office of the Legal Adviser, Finaneiat Disclosure Divjsi nt of State was Interviewed by Federal Bur zation (FBI) Special Agents r Al ‘Trial Attomey, Public Integrity Section, U.S. Department of Justice and| Aitomey Adviser, U.S, Department of a advised of the identities of the interviewing agents, and the purpose of the interview,| rovided the following information: (U/F888) In 2009[__] worked as an Ethics Analyst for the U.S. Department of State. She was responsible for reviewing the Financial Disclosure Forms (SF-278) of new and current employees to assess if their investments, or outside i created a conflict of interest with be their position at the U.S. Department of State. Wher id questions about the filer’s SF-278 pre she would contact them directly, either telephonically or via email, to clarify the filet’s responses. ‘ould then amend the SF-278 to reflect any corrections or clarifying information provided by the filer. She would then send a copy of the updated SF-278 to the filer for their personal records. Once the SF-278 was finalized an assessment was made on whether the filer’s investments, or interests, jal conflict of interest. The assessment was then signed off on seni onan cony Upon completing the review a physical file containing the SF-278 and supporting documents were maintained for a finite period of time before it was destroyed. be Ie (UiFOBE)[__]was shown copies of the following documents «© New Entrant SF-278 submitted by BRYAN PAGLIANO on April 15, 2009 © Email fon{___]to PAGLIANO dated August 25,2009, with the subject “Ethics B6 Clearance... (Reply Requested)” pre New Entrant SF-278 submitted by BRYAN PAGLIANO on April 15, 2009, with handwritten updates ‘© Incumbent SP-278 submitted by PAGLIANO on April 4, 2010 (U/PORO) After reviewing the documents[____fontirmed that she had sent the above b6 referenced email to PAGLIANO to clarify some of his responses on his original | bie provided that the email contained her original message to PAGLIANO and did not appear to have been: 1 i220 /sshington, D.C Ps investigation on a is 11/201 at om Fact Js02_~ 34 Date cicared WA By sal JP 6 bre ‘This document contains ncther recommendations not conclusions of the FBK, Iti the property ofthe FBI and is loaned to your agency: and is conten are not to be distributed outside your agency. D302 (Rev. 10-6-95) Continuation of FD-302 of. Interview o On 124112013, Page altered in any way. jalso confirmed that it was her handwriting on the updated New Entrant SF-278 form and that response to her email fen notes reflected additional information provided by PAGLIANO in |couid not recall eny additional information about her exchange with PAGLIANO, aside from what she had written on the updated SF-271 jieved that because she purged her emails when she changed positions at the U.S. Department of Stat PAGLIANO had provided the updated information to her via email but she no fonger had pay re. further noted that the physical file could not be found and had likely been destroyed. (UiHORO) she did not conduct the review of that d reviewed the Inct 78 form filed by PAGLIANO and noted that pointed out the checkmarks on the form and ier handwriting, iid not know who reviewed the form but stated that they were not he lshould be able to identify the reviewer based on internal computer records, (UOBS) With respect to the Incumbent SF-278 form filed for 2009] stated that all income and compensation from 2009 should have been captured in Schedule A- This includes any in the calendar year, even if it was received prior to his start date with the U.S. Goverment. ted that the only exception to this would be if the income was from another govemment cnality, However, income from a political action committee or another campaign related organization ‘would not qualify as other Cuipove)| noted that in 2009 the filer would he government employment. vi instructions on how to correctly and accurately complete the form, i an electronic ‘copy of the instructions to the interviewing agents (U/FOHO) A copy of the above referenced documents and the original interview notes are attached ina 1A envelope. ded with several pages of bé BIC bs BIC Bé BIC 6 Ie Pe bre FD-302a (Rey. 10-6-95), FEDERAL BUREAU OF INVESTIGATION ALL PEE INFORUATION coWrastED BERET! 18 TNCLASSTSTED GATE 19-13-2018 BY 127988794 NSICG Date of tanscription 09/02/2015 On September 2, 2015, a Special Agent with Homeland Security Investigations (HSI), Department of Homeland »§ Security (DHS), Norfolk Virginia, was interviewed at the Federal »7° Bureau of Investigation (PBI). After being advised of the identity of the interviewing Agent and the nature of the interview, tf 1] provided the following information: was previously an agent with the U.S. Department of State, Bureat ipl As rity {| eft DS in be approximately spouse, was also a bye prior DS agent who, from 2007-2009, served as an Assistant shift Leader on former Secretary of State CONDOLEEZZA RICE’s and HILLARY CLINTON’s protective details served briefly on former Secretary CLINTON’s protective detail in 2009, From her ow ‘e, and information obtained through and other agents, described a “stark difference” between RTI and CLINTON with Fegard to obedience to security and diplomatic protocols. RICE observed strict adherence to State Department security and diplomatic protocols while CLINTON frequently and “blatantly” disregarded them. For example, it is standard security and diplomatic protocol for the Secretary of State to ride in the armored limousine with the local U.S. ambassador when traveling in countries abroad. It is seen as diplomatic protocol for the Secretary of State to arrive at foreign diplomatic functions with the local ambassador; however, CLINTON refused to do so, instead choosing to be accompanied in the limousine by her Chief of Staff, HUMA ABEDIN. This frequently resulted in complaints by ambassadors who were insulted and embarrassed by this breach of protocol. [| explained that CLINTON’s protocol breaches were well knowi throughout Diplomatic Security and were “abundant.” bs Bie explained that ABEDIN possessed “much mére power” over CLINTON’s staff and schedule than other former chiefs of staff. believed that ABEDIN herself was often responsible for overviding security and diplomatic protocols on behalf of CLINTON. ba lnvestigation on _ 097022201 st ___Chssapcake. Vs bE eet Se = we ce) ws By poe This do ‘ommendations nor eonelusions ofthe FBIL I sche property ofthe FBT and is loaned to your agency; it and its contents aze not tobe distributed ousice your agency FD-302a (Rev, 10-6-98) Continuation of FD-302 of _fmterview o On gpin2/20;5, Page _2 on a trip to Jakarta, Indonesia, early 2009, CLINTON requested to visit an area of Jakarta that presented security and safety challenges. This visit was reportedly for a photo opportunity xegarding CLINTON’s “clean cooking stoves" initiative. The DS advance team recommended against traveling to this area because the route could not be secured and was lined with dangerous circumstances and individuals. As such, the DS advance team recommended in writing that this excursion be stricken from the schedule but were told by DS management that it was going to happen because “she wanted it.” Ds agents felt this excursion into potentially hostile areas placed CLINTON, her staff, the media, and her security detail in unnecessary danger in oxder to conduct a photo opportunity for “her election campaign.” DS agents had the perception that CLINTON was using her position as Secretary of state to campaign for President of the United States. DS agents felt CLINTON traveled with hand-picked media who would present her in favorable light in order to garner political support. It was also believed that CLINTON disregarded security and diplomatic protocols, occasionally without: regard for the safety of her staff and protection detail, in‘order to gain favorable press. CLINTON traveled in an armored vehicle whose passenger windows do not open. This is a design feature for the protection of the occupants. However, the driver’s window does open slightly. on one occasion while traveling _to Pal CLINTON ordered the limousine driver, believed to a to open the window while in “occupied territory”, x Zdangerous area of the West Bank. initially declined to respond to CLINTON’s request; however, SSEET demands by CLINTON forced him to open his window despite the danger to himself and the occupants. explained that security and diplomatic breaches were oftey communicated from the foreign post back to the Department of State via cables from the Regional Security Officer (RsO: cables often described incidents like those described above. recommended interviewing current and former RSOs from foreign posts visited by CLINTON during her tenure for more detail into these and similar events. Early in CLINTON’s tenure as Secretary of state, she and her staff were observed removing lamps and furniture from the state Department which were transported to her residence in Washington, D.¢. be bre be bre be bre FD-302a(Rev. 10-6.95) Continuation of 9-302 of _inenvies.af On 0022015. Page 3 does not know whether ese items were ever returned to the government upon CLINTON’s departure from the State Department. Despite having her own DS security detail, CLINTON continued to utilize a Secret Service security detail while at her residence in Chappaqua, New York. DS security would meet Secret service security at the airport in New York and turn over protection to them. This practice was unknown to DS prior to CLINTON’s tenure and often presented logistical problems to both services. explained that CLINTON’s treatment of Ds agents on her protective detail was so contemptuous that many of them sought reassignment or employment elsewhere. Prior to CLINTON’s tenure, being an agent on the Secretary of State’s protective detail was seen as an honor and privilege xeserved for senior agents. However, by the end of CLINTON’s tenure, it was staffed largely with new agents bec s difficult to find senior agents willing to work for her. laimed to have had at least one conversation with secret Service agents who experienced the same poor treatment. Inside CLINTON’s office at the Department of State there is a security checkpoint known as “Post 1.” Post 1 is staffed by a uniformed DS officer and a DS agent and provides security to CLINTON’s inner office. CLINTON’s office is a Sensitive Compartmented Information Facility (SCEF) and Post 1 is located within that SCIF. By DS security policy, no cell phones are allowed inside the SCiF and DS agents, officers, and staff are required to leave their cell phones outside the door in secure lockers. CLINTON refused to abide to this security requirement and brought her cell phone, believed to be a Blackberry, inside the SCIF where a DS agent assignéd to Post 1 was required to guard it. Ds agents were indignant that they were required to follow security policy but CLINTON made herself exempt from the same regulations. Bs Bre be BIC bs Bie ALU Fer mugorarion conrarmec | ~ BEEEIN TS INCLASSTFTED DATE 10-13-2025 BY JyTs89T94 WSIS FD-302a (Rev. 1046.95) ok FEDERAL BUREAU OF INVESTIGATION Date of transcription _2/11/2016 (U/FOBE) On February 10, 2016 Federal Bureau of Investigation (FBI) Special Agent offices of Latham & Watkins LLP, 885 3" Ave, New York Cily, NY. Also present wel jof Latham & Watkins. After being advised of the identities of the interviewing agents, and the purpose of the interview, provided the following information: Ui js currently and d lat Tie was formerly7 . (the Department of Defense ( froma Prior fo the DoD| fas National Security Councit (NSC) from] til Daring that ti i ror fo fs fa af from[__Jantil early nd ther (uiFe8e) Jprovided that there were typically three to five Deputy Committee (DC) meetings a week, up To Tour Principal Committee (PC) meetings a week, and NSC meetings with the President as needed, Additionally, there was a weekly lunch between Secretary Security Advisory DONILON and Secretary CLINTON| provided tha the DoS representative tor DC meetings and Secretary CLINTON was the Dos representative for PC and NSC meetings. (U/BEBO) While at the nsc[_]oas responsible for working with the meeting participants, to include the Department of State (DoS), to coordinate and plan for each upcoming meeting More specifically.|___ would review memorandums, prepare meeting packages and control the flow of infor en the agencies, These interactions occurred through both formal and informal channels| ovided that with respect to DoS matters he primarily worked with JAKE SULLIVAN aad JOE MACMANUS. ; (Ui#O8®) Prior to each DC and PC meeting the NSC would notify the participants of the upcoming meeting and ask that they subsnit their mecting packages in advance so that they could be distributed as read ahead material. stated that he routinely worked with SULLIVAN to ensure endas, talking points, and formal documents were received in advance of each meeting. pie that he would sometime provide relevant documents, such as ODNI assessments, to DoS Investigation on 270910016. at__New York, NV File # 2-55 Date dictated NIA By sa Tis document contains neither recommendations nor conclusions ofthe FBI I. is the property af the FBI end i loaned to your aeney it and its contents are not to be distribused outside your agency. Be pre be bre be BIC BS bie Be bre ba BIE be BIC FD-302a (Rev. 19-6:95) ‘Continuation of FD-302 of _"_Interview of On 202016, Page 2 for their use as they prepared their meeting packaged ___| stated that the classification level ofthe packages was dependent on the content and could be unclassified, classified or a mix. Documents and meeting packages were typically transmitted between agencies via the appropriate email system, secure fax (ie., Washfix) or courier service (U/FELO) Following each meeting an NSC staffer would take notes and then prepare a Summary of Conclusions (SOC) that summarized the issue discussed, supporting and dissenting opinions, the final outcome and any necessary action items. The SOC would then be approved by the NSC executive staff before being distributed to the meeting participants, (UIFOBE) Snot aware of how or where the NSC archived the SOC and related documents for a specific DC of PC meeting. (uirote) Jwas shown several emails that were sent in preparation f 2009 PC meeting regarding the US. strategy in Pakistan. However, after reviewing the em: stated that while he remembered the topic in general he could notrecall the specific, Tn question. He noted that at that time there were numerous meeting on the subject sould not recall the details of any of the documents teferenced in the emails. Whil ‘Ould not comment on the specifies of the emails he did note that the emails were representative of the communications that were exchanged between NSC and DoS as they were preparing for a PC meeting, (WimrOve| ]was shown an email that was semt in preparation for a Tune 2011 PC meeting. However] Jcould not recall any specifics regarding the PC meeting in question given the limited content of the email. (U/PPOS) A copy of the original interview notes and the referenced emails are attached in 1A envelope bs bre bé bye bre 6 BIC be BIC Dpextfinerean FD-30Ra (Rev. 1046-95) FEDERAL BUREAU OF INVESTIGATION ALL BT INFOQWETICN cOWTAINED BEREIN 18 UNCLASSIFIED CATE 10-13-2016 BY 237289794 HSTCS Dave of ranseription 102672015. Speci Federal Buj ssan| [was Interviewed In person by’ oe lin FBI Headquarters advised of the identity of The ie Hature of the renin ced the following information: (usreve] -gan working for Department of State’s (DoS) Diplomat vi in| Where he was assigned to the DSS Los Angeles Field Office. a selected for an assignment with the Secretary of State’s security detail. served on the Secretary's detail until when he joined the FBI as an SA and atten new agent training, (UiFOHO) Wh stint on the Secretary's detail, CONDOLEEZZA RICE, was the Secretary of State. Jdctail assignment carried over to HILLARY CLINTON, when she was appointed Secretary of State in 2009. (U/POBB) On 1 iogtion (F nd S. Tmterviewing Agents ani (UHFELG3 DSS covered the majority of CLINTON's protection while she was in the Washington, DC, area, However, when her husband was in town, United States Secret Service (USSS) would cover the bulk of the protection detail responsibilities when she was with her husband ot in the residence, (U/POHE) USSS would provide security for CLINTON’s 3067 Whitehaven Street NW. Washington, DC, address during the day and DSS wouid cover the ovemight detail Iwas never inside the CLINTON’s Whitehaven residence, as DSS usually posted in a vehicle outside. CLINTON had a secure telephone inher Whitehaven residence and sumed it was in a secure room (U/FOCS) CLINTON usually traveled to her home in Chappaqua, NY, via a US Airways shuttle from Reagan Nationa! Airport (DCA) to Westchester County Airport in White Plains, NY. USSS would handle CLINTON'S, ae in NY, and DSS would have a smal! presence to meintain CLINTON'S communications. |was never inside CLINTON's Chappaqua residence, was kn 1 S Chappaqua “house guy/scheduler.” The security detail would ol contact |to determine the Secretary's departure time. This document ovis weer ommend communion oe FDL, Wis the propery ofthe MBL and is ened to your aensy i and ts coments eat to be dsuibute ihe your ancy. SBeRELINOFORN bs bre Be ye bé 7c be pre bre 3 bIE Be wre Spaimoron ¥o.3o2a ev, 10695) Conia ofF03R29f tats} enaesans, re 2 »s (U/PELB) The Secretary’s security detail chain of command was as follows 1 Special Agent in Charge (SAC) 4 Assistant Special Agents in Charge (ASAC) 3 Shift Leads (SSA) Approximately 45 $A’s assigned directly to detail shifts Bs was the SAC during CLINTON'S tenure as oe [were two ASAC’s during the same time SSA, and both| agents assigned with| to CLINTON’s detail] and] re all still employed with DSS (possibly in the Washington Field Office) (U/FOX®) CLINTON’s office was located on the 7" floor of DoS Headquarters. The entire Secretary's suite was a Sensitive Compartmented Information Facility (SCIF). The DSS security detachment maintained a Post directly outside the Secretary's office. The DSS space was known as Post One (1). DSS personnel were not authorized to bring their mobile phones into Post |, as it was located within the SCIF. CLINTON did keep a mobile phone inside a desk drawer inside Post |, but when she ‘would remove the phone from the desk, she would take it to a non-SCIF space to make calls or use the phone. (U/FEHO) HUMA ABEDIN and CHERYL MILLS were among CLINTON’s staff members " flapr Secretary's SCIP. In addition to ABEDIN and MILLS, and JAKE SULLIVAN, were part of CLINTON’s main not accompany CLINTON on many overseas trips. be Bre “traveling crew.” MILLS di (urPreve______Jeould not recall the specifies surroundin, levies used by CLINTON’s executive Saif, buthe assumed they were BlackBerry devices did not interact with CLINTON nor MILLS via email, but sometimes he would receive a forwarded emall with their accounts listed in the chain, bered receiving email chains that contains bs Clintonfoundation.org accounts Jalso thought he recalled seeing ernaiis i pre originating from a Gmail account, fe was not entirely sure. jowever, (U/FOHO) In addition to the Secretary's DSS security detail, CLINTON also traveled with a team of Security Engineers who were specifically assigned to her staff. These Security Engineers would travel overseas with CLINTON for the specific purpose of setting up and maintaining her Communications while on travel. The Security Engineer eam generally set up a secure communication post inside the Embassy, or a hotel toom adjacent to where the Secretary would stay. ‘The communication post would be manned 24 hours a day. aC FD-302e (Rev. 10.6 b6 Continuation of 0.202 of __infersiew off . 3 pre bi per Dos bs to the preparation and transport for overseas Wave bre (U/PELO) When traveling overseas in advance of, or with, the Secretary, the Regional Security Officer (RSO) would usually provide CLINTON’s security detail a letter, prior to, or on arrival. The letter provided guidance on what to expect from a security standpoint while in a particular country. Jwas not sure if'a similar letter from the RSO was provided to the Secretary and/or her be executive staff. ere (UfPEBE) The Secretary's security detail would “hotwash” afler an overseas trip, to compare the advance team's preparation to what actual lace during the Secretary's travel. The RSO was not a part of these after action discussions, lieved an RSO wouid send a cable to the RSO. 6 assigned to the Executive Office at DoS Headquarters if there were any security issues concerning BIC CLINTON andior her staff. (UPOUG) Agent notes are maintained in a 1A envelope, F308 (Ree, 10-695} ae ALU FBI INFORMATION CONTAINED 2 3 BEREIN Tf URCLASSIEIED FEDERAL BUREAU OF INVESTIGATION DATE 10-23-2016 BY J27/88T94 NEICO Date of wansoription _9R 6/2015 6 bre United States De; ent of State (STATE). 515 22 Sireet NW, Washington, one, QO | ible telephone (202) email fisiaic.sov, was interviewed on his mobile telephone by ial Agen ATler being advised of the identity of the interviewing Agent and the nature of th provided the Zolewing information: D.C. 20037, The Information Programs and Services (IPS), Burean of Administration oversaw the program for Congressional inquiries and Freedom of Information Act (FOIA) requests. The House Select Commitee on Benghazi requested emails to or from fornier Secretary of State Hillary CLINTON related to Benghazi. Ic was determined there were 296 emails related to the Benghazi request, After IPS officials performed their review of the 296 emails, they referred emails for classification determination to four autside agencies, specifically the: 1) FBI; 2) CIA; 3) Department of Defense (DoD); and 4) National Security Council (NSC). IPS officials have regular points of contact (POCs) at all ageneies and STATE bureans that the IPS would send classification determination referrals to in response to Congressional or FOLA requests. The regular POCs at the agencies listed above were as follows: — aot infbemation provide. -C1A] tno contact formation provided 38 was SIA‘s FOUA branch similar to STATE'S TPS team, lerail vas cja.goy bs ~ Dob] Oflice of the Seoretary of Defense (OSD)~—n0 contact information bre provided. 4 resred ngaa but seth BOC cari ing the Benghazi request NSCs current lephone 20 email sos a wp, cs [believed] friehe inform] Jand [Legislative Affains, Feontacted by the FBI. 6 pie Before IPS conducted their review of the Benghazi request Attomey, Office al Adviser performed their own, independent review of the 296 Benghazi related emails. rev} used different POCs at other agencies to review the 296 emails for a classification determination did not know way: Lf team did a review, as that was tovesipaion on__g8462015___ot_ Washinton, BC Fes =A Dae demed ae * —~ os Bs Bre “This document comains neither recommendasfons nor conclusions ofthe F © propery ef the FRI end is loaned to your agents it and its contents are net to be disiibuted autside your agency. BIE Ma Rev, 16-93 ‘Conticwation of FD-302 of, Jowrviow: af > (mG 262015 Page 2. TES" purview; 2) wy] esau 2 than the regular POCs IPS. review criteria and/or parameten peam used during their review, and 4) of reviewed and produced the 296 emails 1s The House Commaitiee prior to IPS conducting thelr Fonmal review. sam used reviewers from the following agencies: 1) Department of Justiee (DON; 2) Cla; 3) DoD; and 4) White House Counsel (WHC). jeans POCs were as follows -DO! phone 202] - C1A: When asked diteatly who the CLA Teviewer was| Jand her team stated they dict coordinate through the CIA but, to dato, hed not given a Tipo their CIA reviewer wes. telephone “of email selephone 20] Jemuail dshovunsey. did not know eam used @ POC at the DOP instead of the FBI and @ POC at the WAC instead of the NSC. H to provide his thoughts on why he thought they used the wong POCs.L__] tated thar] am made a “rookie mistake” when they used the WHC instead of the NSC. Jsummed up the issue with the different ope aa again pointed out that IPS referred the 296 emails to the NSC, FBI, C14 and Dol) wh team referred the 296 emafis to the WHE. SiA and DoD), und none of the referents were known to be the same between IPS” team a cam. 6 Tc bé b7e 6 pTc bs bre Pe Bre Rev. E495} be DLL PEE INEORIATION cCHTAINEE SERZTN TS UNCLASSTETED FEDERAL BUREAU OF INVESTIGATION DATE Lo-g-2018 BY JaTZsOTSA MSICG Das of vescrinion OURO THIET SM OT SNS STATE) os ae Ree NW, Washington, D.C. DOUBT, office teleph e202] motile telephone @02_ ‘i ipecY, Lg we of birch wes interviewed i person by FBI Special Agent land bre Jat F BY Headquarters, 935 Pennsylvania Avenue Northwest, Washmgton, D.C 30535, After Deingadvised of the identities of the interviewing Agents and the nature of the intercon previded ie following information: tarted working at STATE i Land sind peas ihe| for Margaret "Poguy” GRAPELD. Deputy Assistant Secretary, who was responsible for THERESE 400-300 employees who work on matters relmed to the Freedom of information Act (FOIA), the Privacy Act, and information managenient for STATE. A/GIS was the office that provided guidance, ssutly through memorandums, that oversaw records compliance for all STATE employees. A/GIS also we oversaw the coordination, production and maintenance of SL i bre choush A/GIS was not responsible for the FAMs content, GRAFELD s boss and ammediately suborinate to Under Setetary for Management Patrick KENNEDY. In or uround August 2014, in Legislative affairs oa tee on Bonghia STATE’s Legistuive Afiaire, it was around that time th Tarn about records production and the FOIA process. Around the same time, ad at Be telephone call from Agamey Office af the Legal Adviser, who askad| there were any CLINTON-related emails ia vhe| at fie tha pad fs Fious FOIA request. finswered hat there were CLINTON-telated ernails i | psi file ‘the Information Programs and Services (IPS), Bureau of Administration oversaw the FOLA program. Inor around November or December 2014, in response to a FOIA request, IPS officials were notified they would pick-up 14 banker boxes of emails at former Secretary of State Hillary CLINTON’. office related (o CLINTON’s use of personal emai! to conduct official STATE business, Later Be snaton, BC ba Washing RE, sn os BIE Bysd — ee . cB "Ris doce! aoa nether eSTETTERETTORE TODO the FM, (ete propane the and is aed oyu gona sod fs counts are tot to be distrib puts voor agency DRa (Rev, 12695) be bic Coptinustion oF HD.302 of Interv one 2. so pick-up only 1? boxes at Williams & Connelly, LLP. On or around December 4, 2014, icked-up 12 hoxes at Williams & Connolly. and IPS bE officiels wore unanre what happened to the other two boxes, The items in the boxes were sacked with na P7E folders of known method of organization. ‘iobal Publishing Solutions, who used classified copiers and made two-sided copies Fall received materials for a copy for officials in STATE Executive ee Scoretaria: (S/ES), und a vouple of copies for IPS officials to use for their FOIA review, The original emails were shrink-wapped and placed in a sensitive compartmented information facility in Ne Virginia, 201s heard of iswes with the CLINTON-telated FOIA process. [_] fhe FOLA program. ‘The normal FOLA process would be where IPS received a FOIA request, then IPS forwarded that request on STATE forms via email to the person who the FOLA request pertained to, ‘The pertinent party would then SU out the form and provide the IPS offtc the requested items, which the [PS office then reviewed prior to a release of the information back te the initial requestor. In the CLINTON-related FOTA case, IPS received an unprecedented amount of emails: in hard copy form, as there were 52,485 work-related pages to review. Ina letter hand-delivered to KENNEDY by Chery] MILLS, or MILLS* attomey, it was stated, “in an abundance of caution, they overproduced.” Bs © bre Separate fiom the CLINTON-relatod FOLA request, there was a Congressional request for CLINTON-cclated emails related to the Benghazi incident from the lonse Select Committes on Benghuzi. A review was conducted of 296 emails, probably by pe: work ¢ Barean of fthe Legal Advis stared nal would know wwhy and how those 336 specitie emails were picked and why and how they conducted their own review, separate from any review the IPS unit conducted. Previously, IPS had always been in charge of Congressional document production; tated atiomeys from Legislative Affairs and Office of the Legal Adviser would normally only weigh in on the legality and scope of requests, but IPS would actually ‘conduet the review and production. hs fated they coordinated the properzeview nf tus material with STATE bureaus and other agencies, Afr their own review was finished, an Jproduced the requested material for the House Committee, prior and independent to the IPS This Formal review, 7¢ hinted those involved at [PS feit the 7" floor, or leading STATE officials, had their own ideas on howto formally review the 296 emails. KTINNEDY's initial idea for how to review the 296 ‘email was as follows: 1) the IPS officials conduct a reviews 2) IPS officials referred items to other STATE be bureaus and inter-agency partners for their review; 3) IDS officials received the referral detemsinations 87 and sebmitted to the House Committee. ‘The review process that was floadly decided upon was a3 follows: 1) the IPS oificials conduct a review; 2) IPS officials referred items to other STATE bureaus and inter-agency porters for their review: is received the telerval determinations and submitted DSO (Ren, 1046093 6 Bre Conttevation of 2-302 of ___ Inserviw of On ORONO, Page vw the Office of the Legal Adviser, 4) after the Office of the Legal Advisers review, thes it would be submitted to the House Committee, officials conducted theie formal review of the 296 omails on their classified network, aka “CLASSNET? using their Freedoms System, aka “F2" IPS felt immense pressure 9 complete the review quickly and to not label anythiny as classified. in IPS" initial review, they did not use 4 B(1) exemption on any of the emails, ‘The B()) exemption was used to exclude the public release of classified information or matters related to national security. IPS officials were told ‘there was nothing classified in the 296 emaifs, so they shouldn't use the 8(1) exemption, An mid-March 2013, However, from the formal review of the 296 emails, in total,| |thought there were four or dive STATE boroans, such as Afficon Affaire Bureau and the Near Bastem Affairs (NEA) Thurese, snd five non-STATE agencies, specifically the FBI, CIA, Department of Defense, National Security Council and Whitt House Counsel, that were sent referrals (tems/emsails) to conduct their own formal be classification review. The NRA responded that in the material they received there were four or five BG) p7¢ redactions thal needed to be made, Afterhe heard this____] was frustrated and asked I the desk officer from Maghreb" by using the B(1) exempt edit? We'll nead to explain classification to le. aed amuitiple th atready cpordinged with other agencies ari as previous experience with doaament production.” [sated “NEA ‘will change thelr B(1)s to B(S}s because they (NEA) didn’t understitid bow to classify Gems.” A 1(5) exemption was not used for classified data, wubsather for privileged communications, such as executive- or altorey-related privileges. jor false stated, “it's not classified until se upgrade it.” ‘The review officials that jine{___}usea fue evi fe 23 ry she same normal review officials that the TPS teara use on a remitar basis, For exarsple, did not use the IPS’ normal point of contact for the FBI inst Someone HOA g the Department of Fostice to count as the FMI reviewer. ‘The nammey ln stated they used BS or White G d the Department of Defense were also Wor The regular reviewers the IPS teat used. and ‘upon being asked directly, would not give a name of who they coordinated reviews with at the CIA, roughout the process, tated iffan emaii“item should have # B(1) exemption, then IPS would use a B) exemption, Degas that at the end of the refeereal process, IPS was told to run thing by Legisiative Affairs and IPS officials felt intimidated when they used or suggested be on any of the 296 emails. In addition & nl JKENNEDY —b7e 8 were named as some of the STATE officials pho pressured IPS employees to not label anyihing a5 classified, In late April 2015S, iPS officials completed the forma! review of the Benghazi-related Congressional inquizy. All meterials were ready for release at thattime. The CIA provided redactions, BBMRe dev. 1.695) otnsaios of TD-302 of _ Invi |... engenenis, Page A but none were deemed a B(1) exemption, Most of the ikem with CLA redactions were emails font Sidney BLUMENTHAL. One item was ified a 2 FBI and KENNEDY held # closed door maceti by the FBI" fina} amon: In that meeting, KENNEDY Sel change the FETs BCI) upgrade Classinoation, Sa ‘not change the FBI's stance, On May 22, it was decided by the IPS teaun they would keep the upgrade of flu one FBL-celated email axel the IPS oificials sent David KENDALL, Attomey, Williams & Connolly, LLG, 8 letter informing hie of the results. There was a powerful group of very high-ranking STATE officials that some referred to as “The 7 Flos Group” or “The Shadow Government.” This group met every Wednesday afternoon te discuss the FOIA process, Congressioual records, and everything CLINTON related to FOIA/Congressional inquiries, The known regular attendees incladed Jonathan FINER, Chie! of Staff far Seoretary of State Join KERRY, Jennifer STOUT, Depuy Chief of Steff, Heather HIGGINBOTTOM, Deput 7 State icp Manasement aud Resausoss KENNEY Julia FRIFEELD Sf fie Legal Ae Office of the Legal Adviser oversesing STATE | such us with the CLINTON-related FOIA request, IPS would schedule a rolling rolesse---that meant every fow wesks or mont reviewed and approved material would be made public. However| Floor Group argued the release should be done all at once in January 2016, for coordination purposes. While 1PS officiais did not have control of the release process of the 296 emails related to the House Select Committee on. Benghazi’s request, they did have contro! for the release process for the approximately 30,000 emails, ot 52.485 pages related to the CLINTON FOIA request, and it was decided to be a rolling release. Normally, with larger FOIA requests On July 15, 2015, LPS on-boarded Intelligence Commeunity Inspector General (ICIG) reviewers to ip with the overwhelming review process. The ICIG reviewers were trained up and had been inteurated into the FOIA review process to help ensure IPS can meet fated release of all non-exempt/non- redacted ematis by the Jaraury 15, 2016 deadline. To date. vas aware of approximately 305 ferrals already sent gut for classification determination. rated S/8S are the Custodian of Records for all Secretaries of State and Deputy Secretaries OF State, As such, ES received all taskers from the IPS team related to FOIA requests that involve Secretaries of State or Deputy Secretaries of State. S/ES should also have answers regardin STATE's procedures that dealt with information technology, including, hardware and software fur § wplovers* emails and telephones. Joseph MACMANUS, Executive Secretary and Anshassader, and| SIES, ox someone tw the S/ES Information Resoureg ment (STES/ARM) unit should know specific details about CLINTON’s at-home server set-up taied STATE servers Were jocated at the Enterprise Server Operations Center (USOC) and ManagemenvIRM (M/IRM) would be knowledgeable about servers. 6 BIC prc 6 Bre bre BS Ic EDe8O2u (Rev. 1046.95) se High-ranking STATE officials, described as some Assistant Secretaries and all Under Secretaries and higher, used @ separate network for emails and record-keeping called the Principal Oiicer Eléctronic Management System (POEMS). ‘The vast majority of STATE employees were not on POEMS. bé stated ine heard third-hand the National Security Agency (NSA) set-up a computer for bs rc CLINTON and the FBI should talk to S/ES about the specifies. Additionally, FBI should ask S/E8 about Jeke SULLIVAN’s email being hacked, as maybe thet had sormething to do with CLINTON’s emails or why the NSA set-up her computer. ALU INEORO@ TION CONTAIIED HEREIN TS IMCLASSIT1ZD HD.Si2a Rev, 10-4.95) DATE 10-04-2015 BY 337285194 WSICG FEDERAL BUREAU OF INV! HIGATION Date of tanseription 07312 cate River Networks, 3700 Washington Street. Denver, be Colorado, 80216, telephone emalj feplatteriver.cam. was contacted in person by Federal Bureau of Investigation Spqpal Ace Aner| eas advised of the identity of the aaentd dentified himselt a Platte River Networks and stated that he had contacted the company's [egal counsel about the scheduled meetiny with the FBI on July 29, 2018. Counsel had advised ot to answer questions from the FBI without counsel present, 8. tol fe interview would be necessary: however, § }ceded to BS provid E document with instructions for Plaue River Networks, fisted both SAs prs lan 0 an empty conference room, sf provided a copy of a FBI preservation jeter dated uly 27, 2015, signed by Charles H. be Kable IV. Section Chief. Counterintelligence Division Pe commented company afliciats had »7e wondered how long it would take for thent to be contacted about the named account. shel for latification about the preservation letier and the responsibilities of their company. SA] hen read 40 a portion of the preservation letter and explained the FBI was not asking for any wformation al this time, but that the letter was served in anticipation of Future legal process. Tie letier requested that Plate River Networks preserve any records io date which were identified in the aforementioned preservation letter. Agents also explained the request for non-disclosure is concem about Platte River Networks becoming a target if this matter ever Be became public. Jprovide(_—__Jwith her contuct information st BE Denver. was alyo provided FBI Strategic Partnership Coordinator (SPC) brochures that have BS information about Counterimelligence security awareness. Agents also discussed the FBI's Infragard. bre program. tovestigmion on _ 2-20 & 29-201; bs Files BIE By v bs a bTC “This document contains nether reommenrdations nor conclusions of the PIAL Ht isis propenty of the PBI ase i loaned to your agence it ‘aad Rs cootents ae ot 0 he distributed oweside cent agency. ALL INFORMATION CONTAINED -3024 (Rov, 1066.98) HRREIN 18 UNCLASSIPIS0 ao PATE 19-06-2015 AY 537786794 NSICG FEDERAL BUREAU OF INVESTIGATION : Pate of srserintion 08.2018 on August 6, 2015, KATHERINE M, TURNER, Partner at the law offices of Williame & Connolly LLP, 725 12"* Street, N.W. Washington, D.C. met at her place of employment with Agents of the FBI pursuant to an agreement veached by correspondence between the Department of Justice and Williams & Connolly. This agreement (enclosed), reached on August 6, 2015, provided that Williams & Connolly voluntarily turn over to the FBI three (3) thumb drives containing 30,490 emails from former Secretary of State Hillary Clinton’s eclintonemail.com account as well as hard copy printouts of the emails and a laptop computer containing a duplicate electronic copy At approximately 2:30PM, TURNER met Agents at the loading dock of her firm and txansferred 22 legal boxes of documents to the FBI's possession along with a laptop computer and three (3) thumb drives described in detail below and on the enclosed FD-941, Consent to Search Computers, and FD-597, Receipt for Property. Item 1: Lenovo Thinkpad 1420, S/N PB-¥C912 12/03 Item 2: Lexar Micro 16GB thumb drive, black and silver in color, S/N LEDTT26GB-000-1001DA (original! item 3: Lexar Micro 8GB thumb drive, qreen and white in color, S/N LTDTTSGB-990-117A0 Item ‘ingston 8GB thumb drive, silver in color, S/N DTSE9 Item 5-27: 22 legal boxes containing paper copies of the above described 36,490 email communications TURNER explained that the original thumb drive, Item 2, was obtained from Platte River Networks but did not describe how it was collected or under what circumstances. TURNER described the other two humb drives as identical to the original though one of the drives contained two complete copies of the email set. The laptop computer was previously used by the firm for unrelated matters but yas believed i on _ 862088 Mashiawio 2.0. Pate diciared NA. "his document conta neither recommendations not oF and ts eoateats ane noi te he disibned naiside your agency fons ofthe PBL tis the propery of the FRY and s loaned 16 your agence: & b3 BIE bs BIC S024 Rey 10-695), sinstion OF O30 OF a altgev ie aK UNS MTU ee nen PERS. Page to have been cleaned of privileged material prior to use and storage of the 30,490 emails. This laptop has not been connected te the internet since being loaded with an electronic copy of the emails. The user name for the laptop is “.\internetonly’ and the password is “Internetonly!!" TURNER explained that the firm maintains six (6) additional laptop computers, each of which contain identical digital copies of the 30,490 emails, ut also contain attorney/client privileged communications and as such are not being turned over to the FBI at this tine. TURNER advised her firm ig in negotiations with the Department of Justice over the disposition of these laptops. Prior to departing, TURNER signed the enclosed #D-941, Consent to Search Computers, and FD-597, Receipt for Property, The original was kept by the FBI and copies were made by TURNER for her records. Subsequent to the FBI's collection of the above, Items 1-27 were transported to the Washington Field Office cf the FSI where they were entered into evidence, and given 18 numbers. Copies of the intake sheets and FD-1004 are enclosed this communication. Items 1-4 were then transported by members of the FBI‘s Forensic Analysis unit to Quantico, Virginia for storage and evaluation. Items 5-27 are sently stored in evidence control at the Washington Field Office. ALL FAL INFORO@TICH & HEREIN TS ONCLASSIFIZE DATE 19-12-7016 BY J37285T94 USICG Dekiineroan a FEDERAL BUREAU OF INVESTIGATION FOAM (Rey 106.955 bate of eacription A205 (UiOVO) On December 18, 2015, 2S [executive Secretariat ~ information Reso Mobile Communication, pre MC), at the U.S. Department of State, email adi Wi was interviewed by Federal Bureau of Investigation special Agents| fier being advised of the identities of the interviewing agents, and the purpose of the inter} Iprovided the following information: (uirexe] as worked at the Department of State since[____Jnd has held a a sarety of 26 IT related positions that Include mobile computing, network oning pre (UHPOEE) The MC team is responsible for establishing secure mobile votce and data communications for the Secretary of State (Secretary) and his team when they are traveling domestically and internationally. Prior to a trip by the Secretary and his team, the MC team assembles kits of networking equipment at their lab in Springfield, VA. The kits include networking components such as switches, routers, enerypters, laptops and VOIP phones and are customized based on threat stream information provided by the local Regional Security Officer. The equipment is then tested to ensure that it is working properly and thet it hasn't been compromised before eing sealed in a diplomatic pouch and sent to the U.S, diplomatic establishment at their destination. Upon arriving onsite, the team collects the pouch and checks that the seais haven’t been tampered with. rovided that there are nine kits Bs of networking equipment and that multiple kits are deployed when the Secretary is traveling fo multiple BIC locations on a single trip. (Ci) bi per Dos ~ bs bre Pet —s Due diated N8 - By) es be ‘This document soatins neither ecamnnewdasions cor conshusions ofthe EBL. Iss the propery ofthe FBI en is Joned to your agent; Bye aba ts coments are not ta be distributed ouside your agency SesRe[/MOPORN PDSOEe er. 19.6-98) Condinusting of FD-302 of _ {U/OL6) The communication networks established by the MC team provide the Secretary and his staff with secure data and voice connections, so that they can connect back to the Department of State network 10 secarely conduct official business. Although the networks established by the MC tear create encrypted, 1s, users are still required to use a fob to access their Department of State email accounts, — that the MC team continuously monitors the network encrypters to watch for any signs, or other compromise of the system. Tatras (uiFave) provided that the Secretary and his team typically do not use the SBU network established by the MC team for personal matters. LHe noted that they are free to use the standard internet service in their own room, as any other hotel guest would. isiavel —_ ‘Tassie GSCUMGNS, OF TAOTRNTICE, BFS SCAT Tor The NOGTGTAFy Uo FOVIGW They Gro WmaMy CORVEREA to the MC team by the local U.S. diplomatic establishment, The MC team then eviews the classification markings and page count before providing the document to the recipient. Once the review is complete the MC team collects the document, counts the pages and then enters the event into a log. (UMPOUE) If'an urgent message arrives at the mobile command post for the Secretary or his team the MC tzam will alert the recipient that a message has artived and that the recipient should retuen to the command center. Depending on the Secretary's location, this might mean sending a message to one of his Line Assistants or knocking on his door if it is afer hours. tated that the Secsetary does nat have 8 secure cell phone and that he is typically notified to rehura To We mobile command center even though there are usually secure communications in his car. (UFOS) ited that the MC team’s poticies and procedures are the sarme for domestic travel as for international travel. However, in the case of domestic trave) the communication kits are sent via Diplomatic Security instead of via the local U.S. diplomatic establishment. be Ic bl per Dos bl per Dos bé BIC Bs p7c bl per Dos B7e bé Bic Derkynovonn FDa0za (ev. 106-98), (Coptiaunon of FD-202 of ___Imerview ¢ (LFORS) The MC team is typically statfed by two to four MC team members, depending on the Oo JRRUROIS, Page 3 site. All of the MC team members hold a TS/SCI clearance and receive extensive training on the equipment end security procedures before their first deployment. The MC team members are from various components within the Department of State and may be contractors, Foreign Service members, or cureer civil servants. The average team member is on the tear for {thin the Department of State, However, ss been on the MC team for approximatel (ui {as not in a position to comment on how the MC: poticies and procedures had changed between 2009 and today but he noted that they are constantly we issn that will achieve their mission of providing secure and reliable communications. iad no co! iv or a a able to provide more Insight on how the MC team operated between 2009 and (W/PBHO) A copy of the original interview notes are attached in a 1A envelope. 1g to apply faster and be Ic BS Te bs BIC ALL ZBI INFORUATION COMTAIHEE Hiei 13 UNCLASSIFIED bt Dare losiz-2o1e BY S3TOBST04 SY bt Fosaties 16g 1D) Doge on une bS per cra yo v6 bre ing savises OF the Mente OF he iotovwiowing agoaieanl bg pee IA, vided the Tullow bi per cra bs ba per ora Ba bi per cra BB pi per cia 23 jeeeitipaeios: om MARE IAN es BS ~ - bIE « seoomamendons nor conttosnasat he BAL (rh a ge aide ye ae >> Sis b3 per CIA bl per CTA ba bi per cra BB bl per CIA fixers Bnewiuden af a8 bi per CTA fl os hove an hans fst BS olficialy wie bi per CIA swe dtodd Tested BB bi per CIA BB fan Tae anol Ti wa conan hia hao De saath sf reveal GUERS Poet acl b3 per CIA 1p 90016 age 3 viewed another enaull dated ant in joxpressed conomas aver the dei comitined bi per CIA ip the nat] ic, b3 TRONIE Hever ave beso an apmlon bi per CTA bs aad sith stale Tis Gig noi have conceras over The bi per Cra ont tke BB enail, Jrcivieed hetieved fie Goan was “probleann bxpics bl per CIA sanatul Ba {UIEDIE) A copy of che ais eve bi bs ALL FAD THHORUATTOW CONTAINED HEREIN IS UNCLASSIPtEC DATE 19-12-2015 ay Ja7sa6T94 HS oh FEDERAL BUREAU OF & b3 per CIA T) BG on May 17, 2015] , i ve bre a Aga SA) Tismiies OF The psier owing agent 3 per CIA ‘Sed ho pNpOse OF the MET pic vided the tallawing, Jofonaation bl per CIA bao: bi per CIA bl per CIA bs othe Ya, - 3 BIE Ent atte bs bic so FEL onde fob mh 5) Me ><[{___ s ri of FRA, es the oop PD ime HEH ba per CIA ot. ot a bl per CIA Ba bi per CIA bs. bi per CIA ba had no knowles carding ee info aa ack te Sine Hendogurcne Sue HQ). Havicwes, ai the COM tod Supe pF eapgunent available. part advised State to. z over sccute ofsmaals, but had concerns the CFE bl per CIA = Reve: dhsensiy sail this nae af sanaiwaniciniy Bs sh the bi per CTA cal Beeb ad sande of the [ Ades review pastil svith thes Tat basket of 8 locatic: the email wag einaike CR en cinil be handled bl per CIA 3 bL bs. ba per CTA VEN Pe . ~ she bi per cra subject Thi sisted We comarmunication bs woald uly BOAT TAA rated he pecalied Te a bi per CTA ba SAEED A copy af dis enipinal imersiow nntes and refbeenead docanents is celosed bn a FA, bt 3 ALL FAT INFORMATION coNTATNES UNCLASSIFIED O8O BEREIN 15 UNCLASSITIEE FATE 10-12-2018 BY CO728ST4 NETCE FD-302a (Rev. 10-6495) a FEDERAL BUREAU OF INVESTIGATION Date oF veription 6/21/2016, (U/POBO) On June 21, 2016] Date of as interviewed bs by Feder: FBI) Special Agents Ey ac his BIE residence, VA. After being advised of the identities of Iie mmterviewmng agents, and the purpose of the interview] __ Jprovided the following information. _b6 BIC uy at the 1S Department of State (DOS) for approximately| _ Jyears before leaving i telecommunications specialist under the Executive Secretariat (S/ES) at DOS during HILLARY CLINTON’s tenure as the Secretary of State| ted that his daily duties remained the same during this period despite several reorganizations whiGhr moved his position to different departments, He was responsible for supporting the installation and operation of secure communication equipment at DOS. Thi ded secure video, secure voice, the Washfax, as well as regular telephone and facsimile men fs not responsible for email support, which was the fantagement (S/ES-IRM)| ported to| i if S/ES ~ information Resourse be Jwho was the /BS-IRM under JOHN L. (v/#e¢0)[__supported CLINTON'S transition to DOS and was responsible for establishing 6 secure communications in her office, vehicles and residences. He initially conducted a survey at each bre residence to identify where the commercially provided telecom service entered the residence (i.e., the “point of presence”) and to assess what equipment needed to be installed. Thereafter] connected a1 1 and ran lines to the locations in the residences,where the equipment would be imstalied. Although installed the equipment it was sometimes maintained by other departments within DOS. For example maintained the Defense Red Switch telephones (i.e, red phones) once they had been installed by pine point of presence in the Whitehaven residence was in the basement ang ran lines from There to closet in the third floor SCIF. He then dropped additional lines to the second Tloor office area so that an additional STE and red phone cpuld be installed. Similarly, the point of presence at the Chappaqua residence was also in the basement caffe ¥ines to a small luggage closet and then to the final equipment locations within the cesidence. lwas also tasked to research the feasibility of obtaining a be bre (UsPOLO) During the transit secure BlackBerry for CLINTON, 7 directed to do this by a combination of the following people: DAN SMITH (Executive Secretary), LEWIS LUKENS (Deputy Assistant Secretary), JO (S/ES-IRM Director), and the Operations Center Director who was eith or Investigation on 222203 | vi bs Fite# Lp ~ 02 ite dictated __NU/ BTE ws” BIC be bic, By: “This document contains neither secomoendations nor conclssions oF the FBI. Iisthe property of the FBI and i foamed to your agency i and ifs contents are not ti be ditibuted ouside your agency. UNCLASSIFIED/FOGO UNCLASSIFIED FOHO FD-302a Rev. 19-6.95) 9 BOUDOG. Page 2 Continuation of FPD-302 of __Interview of {the time. DOS wanted to assess the feasibility of using secure BlackBerry phones because CLINTON and her staff were BlackBerry users so DOS wanted to provide them with resources that they were familiar with. However, after conducting his assessment und that the secure BlackBerry phones would require an entirely new infrastructure, which was cost prohibitive, and the actual devices were to0 thick, currove__}vas shown an email with the subject “State Department Telephone Services at Secretary Clinton's Residence” that he sent to LUKENS and ABEDIN on January 27, 2009, The email summarized the telecom equipment that was installed at the Whitehaven residence. After reviewing the emai jplained that “CMS VoIP” line referred to the direct phone line to the White House and that the “ISTRed Switch” was a red phone that was installed as a backup to the CMS VoIP line. The “Business Lines” and “Ops Dedicated Drop” were standard phone lines. tated that not all of the led equipment belonged to DOS and noted that the CMS VoIP system belonged to the White House. pte he did this in an effort to give the Secretary the most reliable equipment but this approach caused some strife within DOS. wrrevell from S/ES-IRM, was responsible for installing and managing CLINTON’s computer systems at the residences] ___Foordinated his instaljation activities with $/PS-IRM and typically did not conduct his work when They were on site in effort to avoid flooding the residence with people. (uupevel__]was show ubject Residential Installation ash” that he sent fo BENTEL, an Jon March 17, 2008. sxplained that a hot mducted T develop a solution Tor any Technical problems they had or complaints that they ‘eoenedl frated that they had significant issues with the unclassified telephone lines at the residence in Chappaqua. He attributed’ this to the number of service providers that a direct line traversed as it connected Washington and Chappaqua. As a result the lines consistently had bad connections. Additionally, the red pi the second floor in Chappaqua did not function properly and eventually CLINTON directly, ask fo remove the phone{___ stated that he removed the phone but it created some internal issues for him as the phone was maintained by IRM and not group. (UPOBOL__btated that the “Server: Basement Telephone Closet,” as listed in the attachment to the aforementioned "Secretary Residential Installation Hotwash” email, refereed to the point of presence for the telephone system in Chappaqua and was not a reference to a computer server{ was aware that there wes an ernail server in the Chappaqua residence. However, he believed it was Tor CLINTON’s family email and he did not realize that CLINTON was using the server for DOS business. (UiPEKE|__Joould not recall when he first learned that CLINTON was using a private email account but stated that was sometime during her tenure. He did not think that CLINTON’ use of a private emailaccount was odd because COLIN POWELL had a private email account that he accessed from DOS. Iso assumed CLINTON had a DOS issued account| lid not communicate directly UNCLASSIFIED/FOBO be BIC bs bre bs Bre bs BIC BIC Ie b7c UNCLASSIFIED/FOUS FD-3028 (Rev. 10-6-95) 6 wre Continuation 7 FD-302 of _,__Interview aff On 6/21/2016, Pase with CLINTON on email and instead worked through HUMA ABEDIN when necessary} Hid not ree recall anybody ever expressing concern over CLINTON’s server or email, but noted that he did not attend the S/ES-IRM meetings were such topics would likely have be discussed. (U/FOH) A copy of the original interview notes and referenced documents are attaches in a TA envelope. UNCLASSIFIEDFOCO AUL ssr niosarioy commas | Ne we eset 15 inicuassT?rEo UATE 10-22-2018 BY ¥37980T9E NSIS PD-302a Res. 10.95) FEDERAL BUREAU OF INVESTIGATION Date of transcription _s/1672016 (U/FOBE) On May 12, 2016] was interviewed by Federal Bureau of Investigation (FBI) Special Agents| fan| jin room 374 at the Eisenhower, Office Bui 1650 Pennsylvania Avenue 7aSbington, DC 20502, Also be present was] fous Department Of Tustice attornes agents, and the purpose of the intervie (ws is currently employed as oe oe the National Security Council has held a Top Secret/Sensitive Comparimented Information (FS/SCI) After being advised of the Identities of the interviewing [provided the following information: Jearance since 2003 when he was originally sponsored by the Central Intelligence Agency (CIA, __ not,nor has he ever been, an Original Classification Authority (OCA). In =] bs Gan a fellowsbip at t ) in the South Asi moving (the Tran Bre desk for a few weeks i began working for the Special Representative for Afghanistan and Pakistan (SRAP), While at the SRAP office worked for PAUL JONES, FRANK RUGGIER C GROSSMAN BROOKE| remained working for the SRAP unt Jwhen be moved f lar DOS, (U//FORO) While he worked att ]was unaware of how information flowed to Secretary of State HILLARY CLINTON. fwas generally aware that the Executive Secretariat al the DOS was responsible for information Tow to the Secretary of State| ould not say who be ‘communicated or emailed with CLINTON. [did not email or communicate with CLINTON 7c directly and did not know that CLINTON hada private email address bosted on a private server until he - was made aware via various media outlets in March 2015 (UFOu@[____]was assigned official DOS email accounts on both an unclassified network and the Secret Internet Protocol Router Network (SIPRNet) did not have a Joint Worldwide Intelligence Communications System (JWICS) email account that Fe could access in his office, but was aware that he was issued one by the Bureau of Intelligence and Research (INR) at the DOS. v6 indica plies used his JWICS account hecause his work did not necessitate it and it was hard to pre access 1 any specific DOS training pertaining to official email usage guidelines, policies or practice eS “obviously classified information goes on classified systems." —- —~ ws bre Tnvestigasion on __SiUQ2UI6__at_Washinglon, D.C, Filed v2 05 on Date dictated Wy “ be By ——a a “This document contains nether recommendations nor conclusions ofthe Fil. Is the property ofthe FB] and is leaned 19 your agency, it and its contents are not io be distributed outside your agency FD-3028 (Rey. 10-6-85) ‘Continuation of FD-302 of _Joterview of On 511222016, Page (urmete[____]stated Principal's Committee (PC) meetings were initiated by the National Security Advisor via official notice to government agencies. The PC meetings would involve participating government agencies presenting their policy on topics prescribed by the National Security Advisor. A Deputy’s Committee (DC) meeting would involve the same process although convened by the Deputy National Security Advisor. Durini tenure at the DOS, he recalled weekly DC meetings related to Afghanistan and Pakistan issues. While in the SRAP ciel pe contribute to packages assembled for DC and PC meetings. Usually, the Deputy SRAPWouTd assign various taskings for a policy paper to be used in a DC or PC. Within the SRAP office! lated there was no science as it related to who was ‘work. The assignments could be based On your area of expertise or who you knew within DOS| lwas unaware of any formal process when collaborating, drafting, editing or publishing a written product with another bureau or office at the DOS. (ul as unaware of the term “upclass” as it referred to the classification of a oduct, [did not know how classification of a written product was ultimately decided. called seeing written product with suggested classification markings and he would always those by appropriately marking the same information carried over to his products or edits. ied portion markings at the DOS were uncommon before WikiLcaks released classified DOS ‘cables on their websit lunderstood the classification process to “happen organically” and to be “more of an art than a science.” (U/POO) At this point in the interview, Agents displayed documents and cinails conceming a October 5, 2009 PC meeting involving the DOS| [provided the following information: wirevel lecalled the general topic of the October 5, 2009 PC:meeting, but did not recall the exact meeting oF any of the displayed documents. stated there were many PC and DC meetings regarding Pakistan and Afghanistan policy in 200 fid not recall drafting or editing any portion of the briefing paper or the attachments. ccall who drafted any of the briefing paper or the attachments. When shown metatata tdicatin, fed the attachments associated with the foregoing briefing paper| .e metadata Taferred he interacted with the attachments, or possibly saved them at one pomnt, Bul did not recall doing so. uirexe]| Jdeseribed the feport as the result of a review of Afghanistan and Pakistan policy reques eral STANLEY MCCHRYSTAL. The report resulted in a request for a troop suige in the area] recalled there bei fied version of th report released and then shortly after, an unclassified version teleased| lieved it was standamdrpractice to have both classified and unclassified versions of a document released around the same time| scribed the report as relevant one day, n shortly after, irrelevant. During his tenure at jcould not recall ever reading re wunpevel recalled having no concerns over classification ot mishandling of documents while at the DOS. bs Bre bé bre be BIC be Bre b6 bre be b7e bs Ie FD-302a (Rev, 106-95) be Contanaton of 2.302 of __turerview of On S122016, Page 3 bre (U/POUE) Notes of the interview and the documents displayed fof pill be maintained in an FD340 envelope and filed with the captioned investigation. BS pre ALL PAT THFCRUATION CONTATNED YS Y SEREIN Ts DATE 10~ ‘INCLASSTEIED 2018 BY ga7JanT84 NSTCS FD-302a (Rev, 10-4-95) ao : FEDERAL BUREAU OF INVESTIGATION Date oftars-iption | 200016 (U/FOHO) On January 29, 2016 ] tate ot vi ed by Federal Bureau of Investigation (FBI) Specral Agents -_— Jat Starbucks Cafe, 370 7” Ave, New York, NY 10001. Repiapemtn; present for the interview, was| Attorney at Law, telephone (202 Z ng advised of the identities of the interviewing agents and the purpose of the Interview provided the following information: : joined the Department Wirovel yereafter she be th TAKE SULLIVAN] left the DoS inf__]to wor (uiPevel_____ provided that as a Special Assistant at DoS she was a politica appointee. Upon starting at DoS she was sworn in and then received the standard on-boarding and security trainings. However, Jcould not recall any specific training about the Freedom of Information Act (FOIA) or the Federal Records Act. (UiFFORS) ertraveled with CLINTON and had no knowledge of her iPad or other devices that she Used] ldid not have direct owe 7 ; at a while she was at DoS and did not email directly with her untit after she had left DoS, new that CLINTON was using a personal email account but did not know that it was a potential Tssue until she read about it in the met unaware of an official policy at DoS regarding the use of personal email accounts and recalled that other people on CLINTON’s staff would use their personal emails periodicalty. (WAFERS) Cl clearance while at DoS and received training on the handling of classified taFormation, routinely handled classified information on the ‘but did not know Row such mlormation was transferred from SULLIVAN of 0 CLINTON. (U/FEHO) ZFS is a, was established for the Office of Hillary Rodham Clinton, by| (U/FORE) Wher inally joined t! based in Washington, D.CTat The office then 7 Investigation on 2412016, at_New York Cig, 0 Date dictated __N¢A. Fite by: “This dasumend oontaine neither revommenditions nor conelusions of dhe FBI, 18 zhe property ofthe FBI and is loaned 10 your agency, it ‘and its contents are not 0 be disivibuced outside your agency. be Bre bs bie be bre ne bie be BIC Be Ic bs BIC b3 bIE bé b7e FD-302a (Rev. 10-6-95) CCominvation of ED-302 of __ Interview o On 12972016, Page _ Jeverybody had to work from home untill___] irsve) was originally an] Jat tnd ind was prmvarily responsible for arranging phone calls. drafting memos and summarizing news aiticles. She was later promoted to the and positions of the folowing individuals wh luring that time period: HUMA ABEDIN - Chief of Staff MONICA HANLEY ~ Personal Assistant wv) latte River Networks: ort to the frequently spoke with] from PRN, about routine matters such as purchasing laptops and maintaining the IT systems. no recollection of ever receiving a laptop from PRN or [ipoke with HANLEY regarding this matter approximately one month ago jer ema records to see if she had any further information about the laptop. found one email between her and HANLEY in whicl sending the laptop to "However, the discussion 1 ‘om email (o phone = t no further recollection on what occurred | Jnoted that this occurred during the period when everybody ‘was working from home due to the aforementioned lease issue, the laptop was shipped to her she would have had it sent to her apartment, She further noted tha was responsible for opening, the mail for the office but that he would not have opened anything drected to her| speculated that pethaps it was shipped to the Clinton Foundation in New York City Bat she did not know what they would have done with it. usreve had no recollection of 's emails being tumed over to DoS. ‘Nor was she involved in the culling of CLINTON’s emails| iad no knowledge of any + archives of CLINTON’s emails aside from the laptop in question (UF 2) be bre be Bre be bre bé BIC be BIC bs BIC Be Ic FD-302a (Rev. 10-6-95) BS Bre Cominvation of FO-302 of __ Interview of On 12912016. Page (U/FOLS) Following the interview. sreed to provide the above referenced email be chain with PRN to the FBI. On Febriary 3, Jcounsel electronically provided the bre email to 8) (U/POHS) A copy of the original interview notes and the email provided a Be attached in a 1A envelope. bre ALL FAL INPORMATION CONTAINED MEREWT TS UNGLASSTST20 GATE 19-12-2026 BY J97OBNTS6 WSEES FD-302a (Rev. 104.95) -L FEDERAL BUREAU OF INVESTIGATION ate oftanseription _O8/102015, to the Inspector General, United States Department of State, Office BS of Inspector General ( 7121 Virginia Avenue, NW, Suite 8100, SA-3, Washington, DC BTC 20037, email state, gov was interviewed in person by FBI Special Agents ‘After being advised of the identity of the interviewing Agents and the nature of the interview] lprovided the following information: In early March 2015, the New York Times published an article about Secretary Clinton's personal emai) account while at the Department of State. The article alleged Secretary Clinton used a personal email account to conduct official goverment business in violation of federal laws. Sometime thereafter, John KERRY, Secretary of State, sent STATE 1G a letter requesting a review of email and records ‘management at the Department of State. On or about March 12, 2015, STATE IG and Office of the Inspector General of the Intelligence Community (ICIG) received letters from Congress requesting a review of State Department employees’ use of personal email for official purposes and coordination with relevant agencies to determine whether classified information was transmitted or received by State Department employees over personal systems. STATE IG initiated a review of the use of personal communications hardware and software by five Secretaries of State and their immediate staffs. The review went as far back as former Secretary Madeleine ALBRIGHT. In Fall 2014, the Department of State wrote to the last four Secretaries of State asking whether they had any official email in their personal records. The Department of State issued preservation requests, asking each former Secretary to preserve all electronic data they had while at the Department of State. Secretary Colin POWELL responded that he used an America on Line (AOL) account. Secretary ALBRIGHT reported that she did not have personal accounts with official records. Secretary Condoleezza RICE reported having @ Gmail account, which she did not use for official purposes. In response to the preservation request, Secretary Clinton’s attomey, David KENDALL wrote a letter to STATE IG stating Williams & Connolly, LLP was in possession of three thumb drives with Secretary Clinton's email from her private network. KENDALL and Katherine TURNER were the only people at the firm with access to the thumb drives. The letter further stated Platte River Networks was in possession of the server and had been made aware of the preservation request. Investigation on 0807/2015, at __Washingtoa, DC bs ite wedieined Nv Fite Date dicted_NYA poe ws BS “This document contains nsither recommendations nor conclusions ofthe FBL. It isthe property ofthe FB an bre and its coments ere not tobe cstriouted ouside your agen D.302« (Rev. 1056-95) CContinsation of FD-3020f tnt On 08/1O2OLS. Page —_2 6 In December 2014, Williams & Connolly, LLP produced twelve boxes, approximately fifty five B7¢ thousand pages of about thirty thousand emails to the Department of State from Secretary Clinton's private sorver. There is a court order in place, which requires all thirty thousand emails to be released by January 30, 2016. The emails have to be released on a monthly basis. The emails are released based on select percentages. Thus far, two waves of Secretary Clinton’s emails have been released on tke FOLA, website. Department of State had about fifty to sixty people working on Secretary Clinton's emails Zoe the FOIA review process. Upon receipt of the emails, they were scanned, entered to the OCR process and then updoaded to Department's of State ClassNet system, which was classified up to SECRET. The emails were then divided into sub-groups. Then each email went through the FOLA process to determine the appropriate FOIA exemptions, if any. Lltimately, the emails were publicly released. Initially, senior State Department officials were being used to review the emails, The officials would review the email, identify which State Department equity worked on the information, and would then send the email to that department. The receiving department would then identify certain exemptions and/or send to other agencies, if other agency equities were involved. The emails would come back to Department of State for further review and were ultimately reviewed on tie FOLA website. The B (1) exemption was used to protect sensitive Department of State equities, B (5) exemptions were used to redact internal deliberations. B (6) exemptions were used to redact Personally Identifiable Information (PI). STATE IG brought in ICIG to assist with the identification of classified information and to take a look at the FOIA review from ICIG reviewed Department of STATE’s FOIA v6 review ‘ought broader experience to Department of State's assembly line review pre process, jbickly determined Department of State needed to make some changes to their review process. Onor about June 19, 2015 STATE IG and ICIG jointly made four recommendations to the State Department related to the FOIA review process. The recommendations were as follows: 1. Recommend State Department FOIA office request staff support from IC FOIA offices to assist it the identification of intelligence community equities; 2, Recommend IC FOIA officers review the emails to ensure that ClassNet use is appropriate before transmitting to the State Bureaus for review; 3. Recommend State Department FOIA seek classification expertise from the interagency to act as a final arbiter if there is a question regarding potentially classified materials; and 4. Recommend State Department FOIA Office incorporate the Department of Justice into the FOLA process to ensure the legal sufliciency review of the FOTA exemptions and redactions, Patrick KENNEDY, Under Secretary for Management, U.S. Department of State was a key figure in all of this. KENNEDY accepted FOIA recommendations number one and three on behalf of the Department of State. During a July 2015 meeting with STATE IG and KENNEDY, KENNEDY said something to the effect “We sent our folks from Diplomatic Security (DS) to conduct a security FD-302a (Rev. 106.95) Continsation of FD-3020f___Inteviewof | on oatoors Page 3 assessment of Williams & Connolly”. DS concluded Williams & Connolly had procedures in place to secure the three thumb drives. KENNEDY mentioned Williams & Connolly handled the General Petreaus investigation, so they had the appropriate clearances and were safe. STATE IG left that meeting with the impression that Department of State had an electronic copy of Secretary Clinton’s ernails. Later, STATE 1G was told that Department of State did not have an electronic copy. STATE IG still would like to obtain an electronic copy of the thumb drives. STATE IG’s review focused on the following areas: 1) Preservation of Records a. Are records being preserved for archival purposes? b. Are appropriate systems in place for Freedom of Information Act (FOIA) purposes? c. Are records being kept in line with the Federal Records Act? 2) On-Boarding Process a. How are methods of communications established for new Secretaries? b. Bach Secretary may like various devices, how does Department of State make those devices secure for usage at Department of State? ¢. How had Department of State addressed security issues? 4d. How did State Department set up secure phone line at Secretary Clinton's house? ©. What precautions were in place for personal devices? 3) Records Creation Designation a. How does State Department make sure draft documents get captured in Department of State's reconds retrieval process? 4) How has Department of State handled FOIA and the Congressional Process? lopined Department of State’s record keeping process was not good. Prior to the last couple of years, record keeping was done on a print and file basis. Literally, if someone wanted something to be kept as an official file, that person would have to print the document and request another person file it away. STATE IG was in the process of taking a deep dive into the on-boarding process of Secretary Clinton’s server. Secretary Clinton preferred to uge Blackberries. In fact, she had at least two email accounts that went directly to her blackberry account was not sure whether Secretary Clinton had an Information Technology (IT) infrastructure from her time in the U.S. Senate or her presidential campaign. Bryan PAGLIANO worked in IT support for Secretary Clinton's campaign. Shortly after Secretary Clinton started her tenure at Department of Siate, PAGLIANO was hired as a Schedule C, directly reporting to Secretary Clinton. PAGLIANO set up Secretary Clinton’s personal server and provided her direct IT support. PAGLIANO left the Department of State sometime in 2013 and came back in early 2015 as a contractor. STATE IG contacted PAGLIANO as part of STATE IG’s ongoing review. STATE IG was informed PAGLIANO was represented by attorneys from Akin Gump Straus Hauer & Feld, LLP, be bre bs bre be BIC FD-302a (Rev. 10-6-95) Continuation of FD-302 of _Interview .OnO8102018, Page 4 be PAGLIANO refused to talk without being granted immunity from prosecution. pie ‘Secretary Clinton had at least two AT&T blackberry accounts. The first account was the HR1S email account. In September 2013, there was an article about Sydney BLUMENTHAL having his email account hacked. Apparently Secretary Clinton’s HR15 account was cited in that article. Asa result, Secretary Clinton changed her email to HRD14. lbclieved that Secretary Clinton’s server at some point was held at her Chappaqua. BS residence. Departmer would send an advance team to set up Secretary Clinton’s communications 7° wherever she needed. Jdid not know who paid for the server. Huma ABEDIN and Cheryl MILLS were the conduits for contacting Secretary Clinton, Only a few people at the Department of State were able to contact Secretary Clinton directly. ve . BIC Aspartof STATE IG'songoingreview[__[ » bS per Dos 2) x» FFecormmended the EBLalk to pacitiano[ and Hho were all Be Departmnent of State employees| was willing to provide the FBI with assistance as necessary. ALL FRI THFORSATION coNTaINEr HEREIN 15 UNCLASSIFIED DATE 10-12-2016 BY J2798S7S4 NET FD-302a (Rev. 1046-95) le FEDERAL BUREAU OF INVESTIGATION Daté of ranscription _ 6/3/2016 cu ) On June 3, 2816, , Department of Sine (DoS| je ti td a hy reer Bureay of InvesticalTon PBN Spocal Maen] | fan lin his office located at|___—T Virginia, Ing advised of the identities of the interviewing agents, and the purpose of the interview, provided the — information: wasth{—=«@Y to Pe ines during the tenure of for of State CONDOLEEZZA Ri YR. CLINTON at DoS, most recently reported to] (UFERO) (IT) Operations for DoS. ‘This included, but was not limited to, software applications, hardware, telecommunications, email DoS Information Resource Management (IRM) (uurese[________] provided IT briefings to CLINTON’ transition team upon their arrival, however, the DoS executive office did not fall unde esponsibility. JOHN BENTEL, who oversaw Executive Secretariat Information Resource Management (S/ES- 1RM), would have been] in regards to managing IT programs for executive management. \board transition, PATRICK KENNEDY, Under (U/POHO) Around the time of CLIN’ interview BRYAN PAGLIANO, who Secretary of State for Management, sugeested| served on CLINTON’s 2012 Presidential Campaign, 10 bad a MBA from the Universit jereed he would be a good fit for Subsequently hired on to DoS in a Schedule C position, d with assisting mainly with cost recovery planning and researching DoS technical enhancement opportunities. (uiFoHe) jwas not aware PAGLIANO had a secondary role of providing technical assistance to CLINTON. Althoug! was aware PAGLIANO came from CLINTON’s campaign, he noted PAGLIANO did not have any overtly apparent ties to the 7" floor [a reference to whe IN"s executive suite was located at DoS], Jonly recalled one incident whereit as dealing with a matter that needed iiput from tie 7” floor, and PAGLIANO mentioned he occasionally had contact with individuals on the 7" floor. PAGLIANO vnnpnine ape a [Lok Fite Loe Date diciateé _._Ni By \ Wwe ye “This document contains nether recommendations nor conclusions ofthe FBI. It isthe property ofthe FB and is loaned to youre) ang ils contents are not to be distributed cutside your agency. “i be BTC be bre be bre be bre bs Bye bs BIC bé BIC 3 bE bre D-302a (Rev. 10-6-98) Cominuation of FD-302 of _Inevisw of On 61372016. Page offered to reach out to his 7” floor contacts, ool enone! the offer ané proceeded through regular channels. As a Schedile C hire, PAGLIANO would ave becn required to report any additional income he received from side work with CLINTON PAGLIANO not have (LiFeH)| Iwas not aware of, nor did he have concerning CLINTON’s use of a private cmail account or email server. direct correspondence with CLINTON, and learned of her use of a p-iv.t¢ €1 about it in the Vew York Times. (UNFORS) It was| understanding that DoS policy “discourages” the use of private email, but does not probibit it uikewe|___ vas not aware of the specific IT setup in either CLINTON’s office or How FCLINTON's residences had a DoS Secure F. Janavoy ve had knowledge of her office sctup. Was assigni and, fo, but later went Work on the 7” 7 assessed jave more insight a 10 what DoS IT equipment was installed at both of CLINTON'S residences fas an IRM technician who would know who installed DoS equipment at the Searetary's homes. (U/POHO) The State Messaging and Archival Retrieval Toolsci (SMART) records management system was implemented by IRM as a result of recommendations from a DoS Executive Steering Committee. SMART replacs “stel system, and was developed to automate / streamline the process for archiving, oes involved in discussions about the development and rollout of SMART, as were representatives from SES. Representatives from the Executive Secretariat asked to be the last to rece Hout. However, ultimately SMART was never rolled out to the Executive Secretariat Jcould not recall exactly when SMART was implemented at DoS, however, he assessed SMART was rolled out sometime in 2007 - 2008, (U/POHE) A copy of the original interview notes are attached in a LA envelope. bs BTC be Bre be pre be bie be b7c bs BIC ALL FEE INFORMATION coyTasNED REREIN TS WCLASSIPIED - Vv UATE 10-23-2016 BY Ja708BT9S WSIEE FD-302a (Rev, 10-695) ole FEDERAL BUREAU OF INVESTIGATION ti following information: (UOTE) served ag hit the Department Date of transcription _ 9/11/2016 May 10,2016[______—__—+) DOB telephone 2 jiewed by Feder Investigation mo. at his residenc MD._After being advised of the identities of the Interviewing agents, andthe purpose oF the Inierview| provided the of State (DoS) je eginning of KERRY’s tenure to] TPriorto joining DoS, kerved as| hen KERRY was the Chairman of the Senate Foreign Relations Committee. (U/FEES) A lot of information would fh n route to KERRY, to include information concerning Congressional Oversight. tangentially i the process of production of DoS records to the Benghazi Committee, in that KERRY aske the ‘Committee did not face any DoS roadblocks in response to the request. Furthermore wants make certain DoS was as comprehensive as possible in their response to the Committee’s request ‘was primarily concemed with KERRY being questioned by the Committee over the totality of the production, and thus wanted to cover every production avenue possible to avoid KERRY being blindsided if called to testify to the Committee. The production of documents related to Benghazi began in the spring (April/May) of 2013 and continued as a “rolling production.” (UFORO) |was not aware former Secretary of State HILLARY R. CLINTON was using a private email account untT 2013, when he recalled hearing news of her email account potentially being compromised as a result of a hack into Sidney Blumenthal’s email account. Ivised KERRY to use a government email account when he became Secretary of State, despite what previous Secretary's may have chosen to do, maintained on a private server. (UiFOBe)| called seeing Benghazi production documents cont personal email beginning in early 2014| is not aware until recently that CLINTON’s private email account was ing CLINTON’s id not recall having any concems after seeing that CLINTON used a personal email account, as he was aware other Secretary's of State had done the same. Investigation on 51022016. at __Washington, P.c, Fite # az Date dictated __N/ By ‘This document contains neither eecommen: nor onclusions ofthe FB It is the property of the FBI and is loaned to your agendy it and its cantentsare nat to be distributed outside your agency. be Bre be Bre be BIC be bie be bic 3 BIE 6 bie FD.302a (Rev. 106.95) jon of PD-302 of _Interview o On 5102016, Page —_2 be BIC (U/FORE) In August or September of 2014 went to Capitol Hill to meet with the staff members of the Benghazi Committee, in preparation for a pending hearing with KERRY| recalled the topic of issue in his meeting with the committee staff surrounded inquiries regarding the preservation of records, Following his meeting with the committee staff contacted CHERYL MILLS to advise BS of possible ieaks from the committee referencing their praduetion concerns related t ‘ON’s email bre r yne phone conversation with MILLS concerning the matter. alsa spoke Win from a Public Affsirs perspective also had some visibility in the matter, as| (U/#@H6) In approximately Decemt 4[____]recalled a large number of printed CLINTON emails being dropped off at Des es Surprised at the volume of emails produced, ed the production to be close 10 es. Two attomeys fro i ast Name Unknown (LNU) an eu [believed to be a reference | were brought onto DoS to and coordinate the redactions Ta regards To be Benghazi FOIA production, Hescribe 's someone who would be “eneyelopedic” bre concerning, Zi, to include the production of CLINTON’s email. DoS| was aiso involved with the DoS production and review process as Wt pertained 10 's emails and Benghazi as a whole. PATRICK KENNEDY, DoS Under Secretary for Management, also had insight into the production process (U/POBO) During the course of the Benghuzi production, DoS recognized there was a gup in records related to emails pertaining to not caly CLINTON, but other former Secretaries of State who did not use DoS email accounts, As such, Executive Secretary JOSEPH McMANUS drafted a letter in October 2014, requesting former Secretaries produce any personal emails responsive to the Federal Records Act in attempt to retroactively address the gap in DoS records currose] vas [ved with the discussions or the process concerning how the be email production was cont ey did not provide direction on how the emails should be bre produced, nor did he have any knowledj xt methodology was used in determining what emails, ‘were responsive to production requests pe unaware of any concems that the original production of emails provided by CLINTON was not entirely comprehensive in response to the request, nor was he aware of any concerns that the email production might contain classified material. : (U//FE88) A copy of the original interview notes are attached in a 1A envelope. oe ED-202a (Rev. 104.95) Ae FEDERAL BUREAU OF INVESTIGATION Date of raseription 07232015 43 per ODNE bé per FET BIC per FBI (uiPeHe)| jdate of bisth{________] was interviewed at the Office of the Inspector General of the Intelligence Community, Patri Res Also present during the interview wer an After being advised of the identity of the interviewing Agents and the nature of the interview rovided the following information: b3 per ODT : be per ¥Br Ty Jad worked as an Inspector in the Office of the Inspector General of the bac’ sex FEI Pe Intelligence Community (IC/IG) for approximately 2 years, In May 2015, IG/{C began to assist in the Department of State’s Inspector General’s (STATE/G) review entitled “Use of Personal Communications Hardware and Software by Five Secretaries of State and Their Immediate Staffs.” This assistance was requested pursuant to the March 12, 2015 letter from the United States Senate. 0) GPA On or about May 28, 2015 met wit e Inspector General, United States Department of State (STATE) and other STATE emuployees in order to assist in completing the review. It appeared that STA’ of Information Act (FOIA) employees were at least already 6 weeks into the review process, immediately recognized problems that impeded STATE’s review process. Some of the problems were 1) STATE’s computer software was at least 2 generations behind; 2) the optical character recognition (OCR) was faulty; and 3) STATE 2 PeF ODNT ns char : 3) STATE 6 per rer = initials to describe organizations, as opposed to using intelligence designations. paces, par found STATE FOIA employees very helpful. On various occasions many of the FOIA officials, Stayed affer midnight to conduct the email'review. ‘Di ($84 On or about May 22, 2015, STATE publicly released two hundred ninety-six e-mails belonging to former Secretary of State Hilary Clinton (CLINTON). The two hundred ninety-six e-mails were previously reviewed and released by STATE FOIA officials ia response to previous FOIA requests. According to the Defense Intelligence Agency, National Security Agency, and National Geospatial Intelligence Agency officials, at least one of those un-redacted e-mails should have been treated as Invesigation om 07293201 a___ Reston, Vicia bo File# | ‘Date dictated __N/ rE By 34] Pp bs ‘This document contains neither recommendations aor conclusions ofthe FBI. It isthe propery of the FBI and s loaned to your agency: it 7G. and itmgontents are nocto he distributed outs SECRES/7oRcenROEOR, D-302a (Rev. 104.98) Continuation of FO-302 of _Imgrview o On Q1232015, Page _2__—-B3 per ODNT classified. On or about June 25, 2015 the IC/IG notified the Director of National Intelligence and Oe members of the senate of this leak of classified information, ® ‘WiZSF) ICG believed that the release of the two hundred ninety-six e-mails did not ‘comply with FOIA regulations. In fact, public figures were completely redacted from the TO, FROM and CC lines. in violation of FOIA regulations. It also appeared that no STATE FOIA personnel knew how the two hundred ninety-six ¢-mails had been selected to be released. STATE, FOIA personnel indicated during the FOIA review process, some BI (Classified National i‘ormation) were removed and changed to BS FOIA exemptions (Privileged Communications). lieved STATE FOIA redactions of ps per opwt classified information were inappropriately designated or changed. bé per FRI bic per FBI °U) {S#88F) The two hundred ninety-six emails were taken from approximately fifty-five thousand pages of thirty thousand e-mails provided to STATE by the Law Offices of Williams & Connolly LLP, (William & Connolly) CLINTON’s personal counsel. According to Williams & Connolly, the firm had provided all of CLINTON’s work related or potentially work related e-mails from her @clintonemail.com account. Williams & Connolly also maintained a copy of the .PST file containing the electronic copy of the above referenced e-mails, on a thumb drive, stored in a secure safe at Williams & Connolly's, Washington, DC office. David Kendall (KENDALL) and Katherine Turner, Esq, (TURNER) were the only two people that had access to the thumb drive. The firm further advised they believed the server equipment used to host CLINTON's @clintonemail.com account was no longer valid or active. Platte River Networks in Colorado maintained custody of the equipment and had received preservation notices. iT) (SHEP) ICG had considered serving legal process to Williams & Connolly in order to retrieve the thumb drive. Diplomatic Security had attempted to retrieve the thumb drive from William & Connolly, but were informed that since the firm had received preservation I PST files, the firm could not release the thumb drive to Diplomatic Security. According of aislones 3 per ODNE Security was led to believe Williams & Connolly in fact had 3 copies of the thumb drive. b6 per FEI BIC per FEE \U) SASF) In December 2014, Williams é& Connolly informed STATE they had fourteen boxes coniauing the approximately thirty thousand e-mails. However, when STATE officials arrived to pick up the boxes, STATE only received twelve boxes. IC/IG had no information as to whether Williams & Connolly were authorized to store classified information or if KENDALL and TURNER held security clearances, b3 per ODNI Ul seep Jand other STATE, FOLA officials FS Per aoe were suspicious i Legislative Affairs of attomeys| por Jand other STATE FOIA, B f Ji the FOTA teview process was abnorm: Jan made recommendations an i ges that were not routine both previously had worked at| which appeared to create a conflict of interest sugeea/7ORtoRNOZoMN SECRET, (OFORN FD-3024 (Rev, 104-95) 3 per ODNI 6 per FEI b7¢ per FBI Continuation of FD-362 of _Inerview 0 On 222018 page 3 clieved both attomeys had also worked at the land was Possibly,» pee opwr Involved in the Lois Lemer, Internal Revenue Service situation, be per FBI b7c per FEE (U/FOLO) On or about June 15, 2015 ICG sent a letter to STATE/G documenting potential issues identified in the Preliminary Review of the State Department FOIA Process, The recommendations were: 1. Recommend State Department FOIA office request staff support fiom IC FOIA offices to assist in the identification of intelligence community equities; 2. Recommend IC FOIA officers review the email to ensure that ClassNet use is appropriate before ‘transmitting to the State Bureaus for review; 3. Recommend State Department FOIA seek classification expertise from the interagency to act as a final arbiter if there is a question regarding potentially classified materials; 4. Recommend State Department FOIA Office incorporate the Department of Justice into the FOIA Process to ensure the legal sufficiency review of the FOLA exemptions and redactions; 3 per ODN bé per FEI {URS On or about J 15, aeview of the thirty thousand e-mails revealed five 7° Per FBI additional classified e-mai jused key word searches in order to review the e-mail. It appeared that one in every five e-mail addresses were not a GOV e-mail address. In the thirty thousand e-mails there were about seventeen unsigned classification upgrade memorandums. These memorandums were packages of information which were being held for the Assistant Secretary of State for Administration’s signature, ‘UrsrKe) On or about July 1, 2015, ICG officials met with Patrick Kennedy, Under Secretary of State for Management and other STATE representatives. IC/IG informed STATE that Jdassist 343 per Dw? STATEAG conduct the review, whether or not STATE welcomed ICAG’s ‘input. lleged 6 pex FBI STATE made several misrepresentations during this meeting. One such statement made by STATE’s b7¢ per FBI legal counse] was “there were no classified information contained in the thirty thousand e-mails”. bd per ONT [res witing to assist the FBL further as needed. 6 per FBI bic per FBI SECRETZZOReONZNOFORN FD-3028 (Rev. 10-6-95) AUL FHI IRFORIATICN CONTAINED A BEREIN TS INCLASSTFIEE [AME 19-12-2016 BY Ja7aRsT94 wstcc FEDERAL BUREAU OF INVESTIGATION Date of wranscripcion _o820/2015 United State ent of State, Office of Inspector Gene [G), 212 Winainia Avenue, xa Suite Washington, D.C. 20037, telephone (202 email Fistate gov, date of birth was interviewed in person by FBI Special Agent in her office, After being advised of the identities of the interviewing Agents and the natare oF He interview, Jprovided the following information: begs In| he became| Evaluations and Special Projects unit, which consisted of approximately 10 people from both STATE IG and the Intelligence Community Inspector General cto, pee on Congressional requests and other special inquiries that are handled by STATE 1G, which included a special project related to the Freedom of Information Act (FOIA) process as a whole. [J stare 1c were in the process of conducting a review at STATE, focused on three main areas, ‘Those areas were how 1) STATE records are preserved; 2) how STATE employees handled the FOIA process; and 3) the on-boarding process for new STATE employees, specific to rnmunication, with an emphasis on the Secretaries of State. As part of thal review, sit a questionnaire in late March 2015 to the former Secretaries of State Madeleine ‘ALBRIGHT, Colin POWELL, Condoleezza RICE, and Hillary CLINTON along with current Secretary of State John KERRY. The questionnaire specifically asked ther about theis use of personal email for work purposes. On April 15, 2015 STATE IG sent out requests to a broad number of STATE-related persons, inchiding former staff members and others who may have sent or received work-related emails to oF from the personal email accounts of the former Secretaries of State. The request asked for and any policy or training given related to the use of personel email for business purposes, had not yet received any email files from any of the staif members of the former Secretaries of State and was ‘old that there would be no response to the request by the attomey of Bryan PAGLIANO, former information technology advisor for CLINTON. CLINTON sent out an all-staff cable that personal email should not be used day-to-day for business purposes and that personal email is not secure, so do not use them for business purposes. To the Investigation on 0819201 t__Washineton, DC File# Date dicted __N/ and its contents are nt distributed outside your agency, be bre be BIC be bre be bre 3 BIE be bre FD-B02a (Rev. 1046-95) be Bic Contin io OngB/19A018, Page _2. dest of eeolection CLINTON sent that cable out in 2009. After CLINTON’ time as bs Secretary of State, there was also STATE guidance that if STATE employees had to use their personal Bre email for business purposes they should send a carbon copy (Ce) to their “gov” work email as well. In August 2014, STATE Under Secretary for Management Patrick KENNEDY sent out a ‘memorandum for STATE employees not to use personal email for business purposes, but it did not address whether personal servers may be used for business purposes. There was STATE guidance that all information/emails related to work should be on an “approved automated system,” but there was no bé known STATE guid ing the use of, pre official “finding” by| collea, STATE IG. a jinterviewed PAGLIANO’s former boss while at STATE, and be PAGLIANO’S former boss was unaware PAGLIANO set-up CLINTON’s personal work server for ber. e There were no on-boarding policies in place to prevent what happened related to CLINTON using a personal server. STATE IG was unsure what, if any, site survey or systems security and maintenance checks were conducted prior to the installation of CLINTON’s server by PAGLIANO. STATE IG was also unsure if anyone else other than STATE employees knew of, ever saw, or had access to the server. All of STATE’s top officials’ email records related to their “ gov” emails were being preserved, or “joumaled,” no matter what. Most STATE employees, those not considered top officials, could create ‘email records themselves using the SMART system. The onus was on the regular STATE employees to self-determine what a record is and if they didn’t use the SMART system and they've double-deleted the emaail, it was more than likely not going to be preserved. bs Regarding STATE G's review and interaction with KENNEDY ad met Pe KENNEDY several times, and stated KENNEDY was never overly uncooperative and never did anything unusual with regards to his cooperation, EDY’s tone and tenor were definitely not positive when dealing with STATE IG. Iso attended meetings with KENNEDY in the post that discussed general goals going forward for STATE with regards to STATE 1G’s review. review led her to interview STATE officials who worked the FOLA process fiom >. within the Bureau of Administration, Office of Information Programs and Services, which fell under ere KENNEDY’s purview. Some FOIA officials have seen events and behaviors they did not like or that made them uncomfortable, to include KENNEDY’s attitude toward them and how they handled the FOLA. process related to CLINTON. Additionally, there was a request from the FOIA officials to STATE, ‘employees that asked for any emails sent to or from personal email accounts related to the CLINTON FOIA request. Some STATE employees responded they had no emails that fit the request; despite the negative response, for some STATE employees, FOIA officials knew there were at least some emails that should have been included in their response because the FOIA officials had already reviewed those emails FD-302a (Rev. 10-4.95) b6 b7c Continuation of P3020, Onggs015, Page __3 from within the batch of 30,000 CLINTON-related emails. Despite knowing some STATE employees had not responded correctly, the FOIA officials had no recourse to compel a positive response. For the FOIA request related to the 30,000 CLINTON-related emails and the Congressional v6 inquiry that requested Benghazi-related emails, those review process were handled outside the normal b7¢ chain of led outside the normal chain of people, but BS per DOS recommended the FBI talk t for more information on events discussed above and for names of other people the FBI would be interested in talking with regarding the same. 6 bre D-302a (Rev. 1046-95) ALL FBT THFORMATION CCHTATUED ole EREIN IS WICLASSITIED fs o-a2-2016 BY as7Jeate4 Hsxcc FEDERAL BUREAU OF INVESTIGATION Date of tansription _ 95262016 (U/OBO) On May 25,2016[_______] Special Ageat, United States Sepret Service Be USSS), was in eral Bureau of Investigation (FBI) Special Agents (SA jand 8: Also present for the interview was a Federal Law Enforcement ‘Association (FLEOA) Attomey and USSS Sal ter being advised of the identity of the interviewing agents and the nature ofthe interview provided the following information: wy apre ras assigned to the protective detail of WILLIAM CLINTON from Pe Because 0 information technology (IT) skills, he was asked [do neon assesses ‘and troubleshoot IT issues at the Clinton Foundation. From to Jassisted the Clinton Foundation in a case related to theft of information on the Information systems. Clinton Foundation Be re (U/FFORS)| vas contacted by JUSTIN COOPER in Jant ssist with the security of an email server at the Clinton residence in Chappaqua, Ne Jdid not physically or remotely access the server in the residence at Chappaqud jas not aware of the hardware components of the server or software installed on the server| mndueted open source research relating to the security of email ntacted BRYAN PAGLIANO to recommend adding outbound IP filtering a PAGLIANO’s name and contact information from COOP! aS aware OF n0 other information pertaining to the email server located in Chappaqua. (U/OHO) Notes of the interview will be maintained in a FD340 envelope and filed with the captioned investigation. ba Investigation on _ 08/25/2016 at_____ Boston, Massachusers, bE niet [pe = 93 De towed N/A YF be By. Pp BIG ‘This document conlains neither recommendations nor conclusions ofthe FBI. Its the property ofthe FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. PD-302a (Rev. 10-6-95) aL FEDERAL BUREAU OF INVESTIGATION ALL FAL INFORATION coNTAINEE HEREIN IS UNCLASSIFIED DME 10-12-2078 BY ag79a8T94 WETCE Date of transcription _ 09/17/2015 On September 17,2018[ orted sues Department of. ~ Street NW, Washington, D.C. 20520, was interviewed by ic Examine DoS, office telephone ‘The DoS email system uses a hub and spoke configuration. There are approximately 120,000 mailboxes on the system, of which approximately 95,000 are for unique users. The other 25,000 mailboxes are general mailboxes and aren’t assigned to a specific user. Approximately 35,000 mailboxes reside on the local hub and are administered by Information Resource Management (IRM). The remainder of the mailboxes reside on spokes within the system and are not controlled by IRM. Spoke mailboxes, such as those at overseas posts, are administered by the local Information Security Officer and backup procedures vary by site. ovided the following information: Upon receiving the preservation request from the FBI, IRM preserved and thereafter exported the mailboxes for all of the individuals listed on the request whose mailboxes are on the [RM system. estimated that approximately 400 of the 900 accounts listed on the preservation request are Botive users on the IRM system, with the other accounts residing on spokes, POEMS, or are associated with users who are no longer at DoS. Each exported mailbox includes all of the active mail folders as well as any items in the Recoverable Items storage area of Microsoft Exchange, which retains items for 90 days after they are deleted by the user. The export does not include any files, or mailboxes, that may have been archived by the user to their local desktop. be BTC ‘The IRM operating system is backed up and retained for approximately 30 days. However, the ‘email database is not part of the backup. For email recovery, IRM uses Database Availability Groups (DAG) whereby five dynamic copies of each mailbox are maintained, at two sites, to allow the system fo be quickly restored if the primary database fails. prinea that the exported mailboxes were unlikely to contain many emails from prior to cm 2012, Prior To That time mailboxes were limited to SOOMB of data and users were regularly required to b3 Investigation on_020I72015 at_ Washinton DG eat BIE ries _| sa_~ © Date dietasd NA sal BB Byt y Bre ‘This document contains neither recommendations nor conclusions of the FBI. It isthe propesty of the PBI and is loaned to your agency: it end its contents are not to be distributed outside your agen. FD-3022 (Rev, 10-6-95) Continuation of FD-202 of __Interview o On Oe172015., Page 2 delete old emails, or to create Personal Storage Folders (pst files), when they hit the storage limit. Between 2012 and 2013, the storage limits were increased to SGB. IRM uses the State Messaging and Archival Retrieval Tool (SMART) to archive record emails The system was implemented i ‘between 2008 and 2010 and replaced CableXpress for archiving cables and record eee od that communications sent (o an embassy are referred to as a cable and emails sent to a person are record emails. SMART requires the users to identify an email as, meeting the record standard and then selecting the appropriate SMART tags within Outlook while composing the email. The period of retention for a SMART record is dependent on the tags selected by the user. wided that S/ES-IRM, also commonly referred to as the POEMS system, does not use th tem to archive email records. They are instead obligated to follow the ‘print and file’ ther noted that records for senior offtcials are archived when they leave office. [recommended contacting Deputy Assistant Secretary MARGERET (PEGGY) GRAFELD, Deputy Assistant Secretary for Global Information Services (A/GIS) for more information on this process. ‘The Bureau of Intellige ch (INR) is responsible for \inistering the mailboxes on the top secret network at DoS. provided that telephone 202[ ] woul ‘be able to provide further details on INR and the top secret mail system. ey be bre BS Bre be bie be Bre D302 ALL FBI TNFOR HEREIN IS VUCLASSITIED DATE 10-12-2035 (Rev, 106.95) TIO CONTAINEE Ae FEDERAL BUREAU OF INVESTIGATION BY JE7I88T54 Wi Date of transcription 09/22/2015, » On September 21, 2015, [United States Department of State (STATE), Office of Taspector General (OMG), Off igation: N. Moore Street, Sui ington, VA 22209, office telephone 70 fax 70. Jemail addres: state. gov , Information Technology “Specialist/Forensic Examiner eo Washington Field Office (WFO) Computer Analysis Response Team (CART) ‘The writer ask jo provide ger formation regarding a group of fifty (50) email messages of interest that were found by luring his review of the Microsoft Outlook Personal Stoy (.pst files, or *mailboxes”) for HUMA M. ABEDIN and CHERYL D. MILLS| |confirmed that the Federal Bureau of Investigation (FBI) ived a full copy of the two (2) mailboxes on a Lexar thumb drive provided by from STATE. tated that he performed a search across the email data for the words “Secret” and“ Tsing as called “Pereeptive Search” and that the search retumed fifty documents of tees ced that most of the search hits appeared within the metadata of Microsoft Word documents, which he identified as “Call Sheets,” or d provided to the Secretary of State prior to attending briefings with foreign dignitari believed the search hits appeared within the metadata of the documents and not within the acwal content of the documents. The identified documents were sent as attachments to emails. ‘ould not remember if there were also search hits within any email messages. believed that the documents may have been generated from a classified system and that at some point they may have been moved to an unclassified system. However, he Was unsure whether the “Secret” and “NOFORN” so ts been generated automatically by the system that was used to create the documents. stated that STATE had not yet determined how the documents would have been marked with regard to classification. ‘The writer requested tha rovide the FBI with the fil Message- Digest algorithm 5 (MDS) hash values Tor the files identified by STATED davied that STATE was in the process of moving the email data onto a stand-alone computer within a Sensitive Compartmented Information Facility (SCIF) and that he anticipated this would happen Investigation on __D921/2013 ‘t____Washington, DC race _| 02-2 Dae dicted _NIA a ‘This document contains neither recommendations nor conclusions ofthe FBI. itis the propery of the FB and is loaned to your agency. it and its contents are not Lobe distributed outside your agency be bac be Bre bs BIG bs bre Be Ic bs DIE be Bre ED-302a (Rev. 10-6.95) be bie Continuation of FD-302 of _Teephone call wih] On Page 2. toward the end of [stated that he would wit (OIG, STATE, telephone 703- bs Cee es slate gov to obtain and provide the FBI with the MDS hash bre ‘Values OT the identified files and that he would contact the writer when this process was complete, FD-302a (Rev. 10-6-95) ae FEDERAL BUREAU OF INVESTIGATION ALL FBI INFORUATION CONTAINEE HESEDN I WICLASEIPIZD DATE 102-2016 BY Js7IB5TS4 NSICS Date of tanseription 6237016 (UFOS) On June 23 2016L__} date of bint vas ewed by Federal Bureau of [avestigation (FBI) Special Agent Also present for the call was nse land Homey at Pay advised of the identities of the interviewing agents and the purpose OF the interview, [provided the following information: cul had no new information regarding the whereabouts of the laptop that was shipped irom Platte River Networks (PRN) to the Clinton Foundation in April of 201 fas not sure who the mailroom manager for the Clinton Foundation was at that time but offered To contact the foundation to inquire about the shipment! Jconfirmed that the address of the Clinton Foundation was 1271 Avenue of the Americas, 42™ Floor, 10020. ew York, NY (U/POLE) Following her January 2016 inter rovided the FBI an email chain from April 2014 with the subject “RE: HRC emails.” [had not reviewed the email chain 1 and could not immediately access the email So the interviewing ayent read the chain to nn refresh her memory, wing the content of the email, she recalled having a discussion with{ [about remotely accessing the HILLARY CLINTON email archive via the inc. Howes Jcould not recall if she actually accessed the email archive remotely thereafter, during the call and agreed to check her personal records for any relevant formation. [provided that lieved that she may have taken tiotes about the process (U#FEHE) A copy of the original interview notes and the referenced email aré attached in a 1A envelope. Investigation on 61737016 ot ____ Washingt Fes oo ~O Dote dictated _ Na By "This document contains nithor recommendations nor eonelusions of tbe FBI, It is dhe propery ofthe FBI and is loaned 0 your agency; it and its Contents are not 10 be stibuted outside your agency, be Bre be bre be BTC B3 BIE bs bre D308 (Rev. 10-695) AGL FBI INFORMATION OoHTAIMED ol BBREIN [5 UAGLASSTFTEC UATE 10-12-2016 BY o37288T34 wezce FEDERAL BUREAU OF INVESTIGATION: Date oftanseciption 127015 be On October 27, 2015, pie a Special Agent with Homeland Security Investigations tment of Homeland Security (DHS), Norfolk Virginia, (757) was interviewed at the Norfolk Federal Building. after being advised of the identity of the interviewing Agent and the nature of the interview, provided the following information: bs was previously employed as an Agent at the Department of PS, State, Bureau of Diplomatic Security (Ds), and assigned former Secretary of State Rice’s personal protection detail from until January 2009. In January _2009 he was reassigned to former Secret: Clinton’s detait.[____|servea on Clinton's detail until Clinton’s tenure at State brought about significant changes to established security and diplomatic protocols owing to the dissimilar management styles and attitudes between Rice and Clinton. claimed that his time on Clinton’s detail was short and that he dno information to offer with regard to security violations or mishandling of classified information on the part of Clinton or her staff. advised his recollections were vague regarding his time on Clintons le and that he could not recail specific events with clarity. was aware that a Blackberry phone was kept in a desk drawer in Clinton's SCIF but could not say with any degree of certainty that the phone belonged to Clinton or that storing security violation. provided the name.of a former ASAC on Clinton's security det jomeone who may be in @ position to provide additional insight. | was not familiar with the current whereabouts of be bre b3 Investigation on 1027/2015 at Newfoik, VA 7 File # 302 - 2 Date dictted__WA. vs ‘baseman upmouser own eoupoey ech sw nr ayiceetranettaasatin ox FD-302a Rev. 10.6.95) ALL FBI INFORMATION CONTAINED HEREIN [3 UNCLASST: CAME 40-12-2006 BY 594 nsros FEDERAL BUREAU OF INVESTIGATION Date of transoription 062015 ‘On November 6, 2015] ISenior Special Agent, (FBI) Computer Office of Investigations, Office jector Oe STATE), office telephone 70. cell 20 led the writer, Information Technology Specialisv/Forensic Examiner F the Washington Field Office (WFO) Federal Bureau of Investigation [ysis Response Team (CART). , United States Department of State jemail address [stated that he located an email containing content from a “confidential cable” sent from 2 Microsoft “Hotmail” email account to the STATE email address for Huma Abedin (Abedin}H@state.gov) that could be found in the data contained within evidence item 1B26 provided by STATE to the FBI on or around August 14, 2015. Evidence item [B26 is further described as a white and grey Lexar words "Dept of State 703-312-3856. s ib drive labeled with a sticker containing the tated that when the email was received in 2011, the information was classified and that i was Supposed to be declassified in 2013 but that he did not know if that was the case and did not know the current classification of the document, On November 6, 2015, in locating the identified em: included in a 1A envelope. sent the writer an email containing information to assist in the FBI data set in evidence item 1B26. A copy of the email is Investigation on 106/201 at _Washington, ritew | a by ITSE| Jor =27 datedicwes ngs "this document contains neither recommendations nor conclusions ofthe FBI. Itis the propery of the PI and is feared to your agency’ it and its contents are not to be distnbsted outside your agency. be BTC be Bre b6 Ie ba BIE BS bie

You might also like