FBI Clinton email investigation interviews
released on September 23, 2016
Transcribed from FBI documents filed at:
With use of OCR found at:
Table of Contents:
- 1 (Jeffrey Feldman) 2/26/16
- 5 (Wendy Sherman) 3/3/16
- 8 (Paul Combetta) 9/15/15
- 14 (Paul Combetta), 2/18/16
- 21 (Paul Combetta) 5/3/16
- 28 (???), 9/11/15
- 30 Monica Hanley, 1/11/16
- 37 (Tim Davis) 11/13/15
- 40 (???) 8/17/15
- 47 Monica Hanley 6/23/16
- 50 Jake Sullivan 2/27/16
- 56 Patrick Kennedy, 12/21/15
- 60 (???) 12/14/15
- 62 Steve Linick, 8/5/15
- 66 Justin Cooper, 9/2/15
- 71 Justin Cooper, 3/2/16
- 75 Justin Cooper, 6/24/16
- 78 Eric Boswell, 2/19/16
- 80 Lewis Lukens, 6/15/16
- 84 Huma Abedin 4/5/16
- 95 (Shelby Smith-Wilson) 11/20/15
- 99 Cheryl Mills, 5/28/16
- 104 Cheryl Mills, 4/9/16
- 111 Stephen Mull, 2/1/16
- 114 (???) 11/3/15
- 117 (???) 3/15/16
- 121 (Cameron Munter) 3/10/16
- 124 (Cameron Munter) 4/25/16
- 127 (Victoria Nuland) 12/11/15
- 130 Sid Blumenthal, 1/7/16
- 133 (??? CIA) 5/17/16
- 135 (Philippe Reines) 12/31/15
- 139 (???) 6/21/16
- 142 (???) 11/23/15
- 145 Heather Samuelson, 5/24/16
- 151 Marcel Lehel Lazar 5/26/16
- 155 Bryan Pagliano, 12/22/15
- 163 Bryan Pagliano, 6/21/16
- 165 (Anne-Marie Slaughter) 12/16/15
- 170 (???) 2/18/16
- 174 (??? CIA) 5/19/16
- 178 Mike Morell 3/17/16
- 182 (Bill Thornton) 9/15/15
- 184 (BIll Thornton) 2/18/16)
- 186 John Bentel 6/10/2016
- 188 Colin Powell 12/21/2015
(Jeffrey Feldman) 2/26/16 Page 1
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:
On February 26, 2016 (JEFFREY FELDMAN), DOB [ XX/XX/XXXX ] was interviewed by Federal Bureau of Investigation (FBI). Special Agents [X] and [X] at the FBI Washington Field Office, 601 4th Street NW, Washington DC. Present for the interview was [X] counsel. [X] Attorney at Law at [X] as well as [X] and [X] from the Department of Justice (DOJ) Counterintelligence and Export Control Section. Prior to the interview [ xxxxx] agreed to sign a non-disclosure agreement in anticipation of viewing classified documents during the interview. After being advised of the identities of the interviewing agents, and the purpose of the interview, [ Xxxxx ]provided the following information:
(FELDMAN)became the U.S. Department of State (DoS) [ x ] under [ x ]. He continued to serve as the [ x ] under [ x ] before being named the [ x ]. As the [ x ] office was located in Washington DC but he traveled frequently and took trips to Afghanistan and Pakistan every four to six weeks.
(FELDMAN)did not have frequent contact with the Secretary of State when [ x ]. This was because [ x ] handled all of the direct communications with the Secretary and her team himself. (FELDMAN)described his role under [ x ] as being external facing. He further explained that he was responsible for coordinating with Congress and facilitatingotherinternational and economic engagements. (FELDMAN)became more focused on Afghanistan matters when [ x ] became the [ x ] because [ x ] wanted to focus mainly on Pakistan. In this role, (FELDMAN)had more regular contact with the Secretary and her team, which included traveling to the region with them.
(FELDMAN)provided that he primarily interacted with the following individuals on the Secretary’s team: CHERYL MILLS for USAID and communications matters; JAKE SULLIVAN for policy matters and to prepare for Deputy Committee or Principal Committee meetings; HUMA ABEDIN for logistics and [ x ] for communications matters. (FELDMAN) noted that he has [ x ].
(FELDMAN)communicated directly with SULLIVAN and MILLS for anything that needed the Secretary’s attention. Examples include topics that involved international matters, topics that could potentially impact DoS equities, and topics involving private sector engagements. These exchanges could be either classified or unclassified depending on the specific content and were done via the appropriate telephone or email system.
While at DoS, (FELDMAN)had an OpenNet and ClassNet account but he did not have a JWICS account. DoS also issued xxx a Blackberry, which was linked to his unclassified DoS email account and a STE for his home. (FELDMAN)used his Blackberry email extensively when he was overseas because other communication channels were often not available.
(FELDMAN)could only recall one instance following the birth of his son when he received an email directly from the Secretary. He remembered that the email came from a non-DoS email account but he didn’t think much of it at the time. (FELDMAN)was not aware that the Secretary was using a private email account and server to conduct DoS business, nor was (FELDMAN)aware of any other DoS employees using personal email accounts for official business. (FELDMAN)provided that he had the personal email addresses of both SULLIVAN and MILLS but he did not recall ever using those accounts for official business.
(FELDMAN)confirmed that he was read into a Special Access Program. (FELDMAN)understood the sensitivities surrounding the program and the need to appropriately safeguard related information. As such, the DoS stance was not to publicly comment on the program.[ REDACTED PARAGRAPH ]
(FELDMAN)as shown a copy of an email chain from December of 2011 with the subject “(SBU).”After reviewing the email (FELDMAN)stated that he did not remember the circumstances in which the email was originally sent.However, based on the email time stamp (FELDMAN)believed he was in California when he received the email and that he would not have had any other means of forwarding the information to those who needed it. (FELDMAN)stated that sending information of the unclassified system was not ideal but that he often did not have a choice when it came to time sensitive information. (FELDMAN)did not recall receivingany specific training or guidance on how time sensitive information should be transmitted.
(FELDMAN)was shown a copy of an email chain from February of 2013 with the subject “Alert.” (FELDMAN)did not remember the email chain.However, after [ REDACTED]. Nonetheless (FELDMAN)did not have concerns sending this type of information on an unclassified system because the story was about to break in the news and it was important that they get the information to the Secretary before that occurred.
(FELDMAN) was shown a copy of an email chain from [ x ] with the subject [ x ]. (FELDMAN)stated it was sent prior to the referenced article being released in the press. (FELDMAN)could not recall any further details about the information provided in the email. He noted that a number of similar stories were being released by the press at the time. (FELDMAN)believed that the information in the email could be treated as unclassified because the article was about to be released and it was critical that he notify the appropriate people within DoS.
(FELDMAN)was shown a copy of an email chain from X ] with the subject [ x ].(FELDMAN)provided that the email was forwarding a news article of interest to individuals within DoS. (FELDMAN)stated that the comments he included when he forwarded the email were not meant to confirm the veracity of the news article but rather to express his frustration with the article. (FELDMAN) further explained that 2011 was a particularly difficult period for bilateral relationships in the region and that DoS efforts were often complicated by such articles.
(FELDMAN)was shown a copy of an email chain from May of 2011 with the subject “Update.” (FELDMAN)did not recall the exact circumstance of the email but noted that it was unusual for him to interact directly with [ x ] provided that he forwarded the email because it was a matter that required the immediate attention of DoS to preserve its equities.
At the conclusion of the interview (FELDMAN)noted that none of the emails that he was shown were originated by him. The emails either involved information that was about to be released publicly or were authored by another individual.
A copy of the original interview notes and NDA signed by (FELDMAN)are enclosed in a 1A envelope.
(Wendy Sherman) 2/03/16 Page 5
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:
On February 3, 2016, (WENDY SHERMAN)telephone number (xxx) xxx-xxxx was interviewed by Federal Bureau of Investigation (FBI) Special Agents [ x ]and [ x ] at the offices of [ x ] Washington DC. Also present for the interview was [ x ] an [ x ] Principal, whom (SHERMAN)asked to sit in on the interview.After being advised of the identities of the interviewing agents, and the purpose of the interview, (SHERMAN)provided the following information.[REDACTED PARAGRAPH]
(SHERMAN’s) office at DoS was located on “Mahogany Row,” a term given to the Executive hallway where the Secretary of State’s office is also located. (SHERMAN)held a Top Secret (TS), Sensitive Compartmented Information (SCI) clearance while at DoS, and handled classified information on a daily basis. (SHERMAN)[ x ] received copies of the Presidential Daily Brief (PDB), the dissemination of which was restricted to only the highest positions in the United States Government.
When (SHERMAN)needed to communicate something classified to CLINTON (SHERMAN)would walk down “Mahogany Row” and talk to CLINTON face-to-face. If CLINTON was not in the office, or on travel, and (SHERMAN)needed to discuss classified information, (SHERMAN)would contact CLINTON vial a secure phone or send her a secure memo.
(SHERMAN)was not aware that CLINTON was using a personal email account while she was Secretary of State, nor did [ x ] recall what address [ x ] typed in or saw when [ x ] sent emails to or received emails from CLINTON. (SHERMAN)assumed whatever devices CLINTON used to conduct business while she was Secretary of State were approved, because nobody at DoS used devices without approval. (SHERMAN)was not aware of any DoS policy against using personal or private email accounts to conduct unclassified DoS business.
On a few occasions, (SHERMAN)traveled with CLINTON. However, the majority of (SHERMAN)ravel while [ x ] was [ x ] was done so on [ x ] own.
Agents asked (SHERMAN)a 2013 speech to the American Foreign Service Association, [ x ] [REDACTED PARAGRAPH]
(SHERMAN)explained the quote was in response to a question [ x ] in regards to how business had changed at DoS since [ x ] PRESIDENT CLINTON’s administration. (SHERMAN) further explained that during [ x ] previous assignment to DoS[ x ] nobody at DoS had access to unclassified systems of any sort. Blackberries didn’t exist, and unclassified computer systems were not yet installed at DoS. The only way to communicate during that time period was via cables and on the telephone. In contrast, when (SHERMAN)returned to DoS in [ xxx ] had access to SIPRNet, JWICS, and Unclassified computers, as well as unclassified Blackberries, and secure iPads. (SHERMAN)the above statement [ x ] was trying to explain how technology has allowed for a different form of information flow, and ultimately sped up the way in which DoS does business.
(SHERMAN)further clarified [ x ] referenced above in [ x ] 2013 speech, was unclassified. (SHERMAN)as not implying that information CLINTON may have been communicating classified material on her Blackberry concerning the unclassified matter.
It was (SHERMAN’s)opinion that everybody at DoS takes security very seriously and understands the importance of protecting sources and methods.(SHERMAN)thinks there is a misconception about how DoS classifies documents, and further explained that generally the only way to discuss topic with Foreign Partners is via unclassified channels, or in very sensitive cases, by making arrangements to meet in person at Embassies or at DoS. Since there isn’t a classified system that allows DoS to communicate with its foreign counterparts, conversations that are held with foreign partners in unclassified channels are later “up-classified’ to Secret to protect the information.
In defense of DoS practices, (SHERMAN)shared a story concerning [ x ] interaction with then FBI Deputy Director MARK GIULIANO, wherein [ x ] stated [ x ] interacted frequently with GIULIANO via email. (SHERMAN)stated [ x ] had the upmost respect for GIULIANO, but believed if [ x ] was to review [ x ] unclassified email exchanges with GIULIANO,[ x ] would find emails that some would consider sensitive.
When (SHERMAN)received a request to produce documents in response to Freedom of Information Act (FOIA) inquires, [ x ] also queried and produced emails from [ x ] personal Gmail account that [ x ] determined were “even remotely related to work.” (SHERMAN)sometimes sent short emails to [ x ] family via Gmail while [ x ] was on travel and felt that if [ x ] referenced negotiations or anything concerning [ x ] role at DoS, [ x ] should produce the documents in an abundance of caution. (SHERMAN)further explained that it was not uncommon for [ x ] to have to use [ x ] personal Gmail account to communicate while on travel, because there were often times [ x ] could not access her DoS unclassified account. (SHERMAN) would try to copy her DOS email account on any communications [ x ] may have sent from her Gmail account.
(SHERMAN)was not aware of any specific instances where [ x ] received notification concerning a potential hack of any of [ x ] email accounts (DoS or personal) or the email accounts of other DoS employees.However, (SHERMAN)explained [ x ] was sure people tried to hack into [x ] personal email account and the accounts of [ x ] team approximately two years ago during [ x ] in the Iran negotiations. Specifically, [REDACTED] received a similar email. (SHERMAN)reported the incident to DoS Diplomatic Security who reportedly traced the emails back to a [ x ].
A copy of the original interview notes are attached in a 1A envelope.
(Paul Combetta) 9/15/15 Page 8
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:
(PAUL COMBETTA), date of birth xx/xx/xxxx was interviewed at the offices of PLATTE RIVER NETWORKS (PRN), 5700 Washington Street I Denver Colorado 80216, by Federal Bureau of Investigation (FBI) Special Agents SA[ x ]and [ x ]. Also present during the interview were [ x ] attorney, U.S. Department of Justice and [ x ] attorney at [ x ]. After being advised of the identity of the interviewing agents, and the nature of the interview (COMBETTA) provided the following information:
In mid-2013, (COMBETTA) was selected to provide technical support on a contract PRN had acquired for the management of a new server used solely for email exchange for domains and accounts associated with BILL CLINTON, HILLARY CLINTON and their aides under the PRN account name CESC (CESC client). (COMBETTA)knew the company InfoGrate to be the contact who initiated the PRN contact with the CESC client. (COMBETTA) understood the CESC client was already using email domains hosted on a server out of their residence in Chappaqua, New York, and in order to effect the transition to the PRN managed new server (COMBETTA) needed to understand the needs of the client and the configuration of the server being housed in Chappaqua. (COMBETTA) was put in contact with BRYAN PAGLIANO, who (COMBETTA) understood to be the administrator of the server in Chappaqua. PAGLIANO granted (COMBETTA) remote administrator access to the server under the administrator user name [ x ] and in mid-2013, (COMBETTA) logged in to the server at Chappaqua.
(COMBETTA) described the physical equipment comprising the email server at the Chappaqua residence as a Dell PowerEdge 2900(Power Edge 2900) running Microsoft Exchange 2007, a Dell PowerEdge 1950 (PowerEdge 1950) being solely used as a BlackBerry Enterprise Server (BES), a Cisco NSS 324 for Network Attached Storage (NAS), a switch, a firewall and a Uninterruptible Power Supply (UPS). The PowerEdge 2900 server hosted the email domain presidentclinton.com, wjcoffice.com and clintonemail.com, and had 20 to 30 email accounts associated. The PowerEdge 2900 was used exclusively for email, with no file or print options. The PowerEdge 2900 had Microsoft Forefront security and Norton Symantec anti-virus software installed on it. No one but PAGLIANO had administrator rights to the PowerEdge 2900 server. (COMBETTA)believed the Chappaqua residence had Comcast as an Internet Service Provider (ISP).
In order to effect the transition from the foregoing server equipment in the CLINTON’s residence in Chappaqua to the new PRN server infrastructure and service, CESC and PRNarranged a time to power down the equipment in Chappaqua, transport it to a data center and migrate the existing email accounts and domains to the new server infrastructure being provided by PRN.
On or around 06/22/2013, and based on an infrastructure plan as part of a Service Level Agreement (SLA) to provide the CLINTONs with new hardware,(SHERMAN) a PRN employee, setup a Dell PowerEdge 620 (PowerEdge 620), two PowerConnect 2824 switches, two Fortinet firewalls and a Datto SIRIS 2000 (DATTO), and hooked them up in a rented space at Equinix, a data center located in Secaucus, New Jersey.
On 06/23/2013, (COMBETTA) traveled to the CLINTON residence in Chappaquaand picked up the PowerEdge 2900, the PowerEdge 1950, and the NAS while leaving the switch, firewall and UPS at the residence. (COMBETTA)transported the equipment to the same rented space at Equinix as the PowerEdge 620, where (COMBETTA) plugged in and networked all the equipment to get it back online in order to provide CESC with continued email access. (COMBETTA)plugged in the NAS, but according to (COMBETTA)no email archiving or back-up was on it and it appeared to only have install files. The NAS was not configured to archive email by (COMBETTA) or PRN at any time. (COMBETTA) changed the mail exchanger (MX) record to specify the transition to the new IP address and configuration at Equinix.
On or around 06/30/2013, (COMBETTA) began the email migration for all CESC accounts from the PowerEdge 2900 to the PowerEdge 620. (COMBETTA)performed this by right-clicking on individual mailboxes and migrating them over one at a time. (COMBETTA)stated he brought over the entire content of all the mailboxes from the PowerEdge 2900 to the PowerEdge 620 as there was no way to do it “piece meal” or partially. (COMBETTA)described the migration process as more of a “sync” and once the servers “agree” that the mailbox is moved, the mailbox is removed from the old server. As a result of the migration, no email content existed on the PowerEdge 2900. During the migration, the PowerEdge 2900 and 620 worked together in the same exchange, where the servers agree that each email sent or received is an identical copy. Additionally, (COMBETTA) configured the PowerEdge 620 to host a Blackberry Enterprise Server (BES) and a Domain Controller as virtual machines. (COMBETTA) explained the Domain Controller as being used for password and authentication requests. The PowerEdge 620 was also running Microsoft Exchange 2010 software, which was an upgrade from the software on the PowerEdge 2900. Additionally, as part of the new server infrastructure provided by PRN, (COMBETTA) configured the DATTO back-up device to take multiple snapshots of the server a day that purged at 60 day intervals. (COMBETTA) also configured both sets of firewalls and switches for redundancy in case one went down. After several days of migration, the PowerEdge 620 had all email mailboxes migrated to it and was processing email on Microsoft Exchange 2010 for the email domains presidentclinton.com, wjcoffice.com and clintonemail.com. (COMBETTA) was “very confident” that all email had migrated from the PowerEdge 2900 to the PowerEdge 620. At some point later, (COMBETTA) remembers adding the domain [ xxx ] to the PowerEdge 620. After total migration, PRN decided to keep the PowerEdge 2900, 1950 and NAS running, even though it was nolonger processing email, in order to ensure email was being delivered without failure through the PowerEdge 620. There was no official user security policy to have an account on the PowerEdge 620. [ xxxx ] registered the Secure Sockets Layer (SSL) certificate for the domains hosted on the PowerEdge 620. Additionally, PAGLIANO gave (COMBETTA) the credentials for the clintonemail.com domain, registered at Network Solutions.
On or around 12/2013, PRN made the decision that email delivery was working well after the migration from the PowerEdge 2900 to the PRN managed PowerEdge 620. In order to power down the PowerEdge 2900, (COMBETTA) stated Microsoft Exchange 2007 would need to be uninstalled from the PowerEdge 2900, or the PowerEdge 620 would generate error messages. (COMBETTA) uninstalled Microsoft Exchange 2007 from the PowerEdge 2900 by clicking on uninstall and following the system prompted checks to ensure there were no ties between the PowerEdge 2900 and the PowerEdge 620 and no active mailboxes were on the PowerEdge 2900. From that point on, the PowerEdge 2900, 1950 and NAS sat disconnected in the cage at Equinix until the FBI picked up the PowerEdge 2900 on 08/12/2015. The uninstallation of Microsoft Exchange and powering down of the PowerEdge 2900 was an action taken by PRN as standard protocol without order or direction from the CESC client.
Based on his experience (COMBETTA) described PAGLIANO’s set-up on the PowerEdge 2900 as a standard email set-up. (COMBETTA) also described his set-up on the PowerEdge 620 as standard. Moreover, (COMBETTA) described that email messages accepted by the PowerEdge 620 would first go through MX Logic, a third party company that removes viruses and spam before sending the message through Giglinx, the Internet Service Provider (ISP) at Equinix. From there (COMBETTA) could not recall if the email would go through CloudJacket or the firewall, but he knew they were in succession. CloudJacket was an appliance used for intrusion prevention on the PowerEdge 620. CloudJacket had pre-configured settings that would block or blacklist certain email traffic it identified as potentially harmful. Occasionally, CloudJacket would send email notifications to (COMBETTA) as the system administrator, prompting him to block certain IP addresses. (COMBETTA) described these notifications as normal and could not recall any serious security incident or intrusion attempt that he was aware of. (COMBETTA) could not identify any IP addresses, or their country of origin, that were involved in a brute force attack (BFA) against the PowerEdge 620. Email traffic would then go through the switch and to the PowerEdge 620 where it would be processed by Microsoft Exchange 2010. Additionally, (COMBETTA) installed Trend Micro AntiVirus and later, Webroot AntiVirus.
(COMBETTA) stated the CESC client originally requested to encrypt email such that no one but the user could read the content. This, ultimately, was not the way the email was configured so that the system administrators could troubleshoot all problems occurring within user accounts. (COMBETTA) recalled [ x ] and [ x ] as having system administrator rights to the PowerEdge620, although (COMBETTA) believed he handled almost all issues entirely. [ x ] was seldom used, if at all, for work on CESC. System administrators could move mailboxes, change and reset passwords, and sometimes view email for archive searches when the users didn’t have the time and CESC requested PRN complete the task. After PRN took control of the server, the CESC client never requested another individual have administrator access. (COMBETTA) stated BRYAN PAGLIANO’s password for the PowerEdge 2900 was changed and he did not have access to the PowerEdge 620. The CESC client did request 24-hour access to someone who could assist with any issues that should arise regarding their email accounts. In order to meet this request, PRN contracted with Level Platforms or Managed Workplace, a third-party company used for troubleshooting and help desk related issues for any late night or off-hour requests that [ xxxx ] could not handle. The third party company did not have administrator access to the server or email content, but could provide assistance with troubleshooting devices, connectivity to the server and password resets. (COMBETTA) stated the help desk service was not used often and the CESC client would contact him directly. (COMBETTA) was unsure, but thought the third party help desk service was no longer contracted with PRN for CESC client help.
In or around 02/2014, (COMBETTA) was contacted by someone from CESC, that he recalled as [ x ] Last Name Unknown (LNU), informing him that she was going to ship him a MacBook containing a folder with old HILLARY CLINTON emails. (COMBETTA) recalled no other identifying information regarding the MacBook. (COMBETTA) recalled the MacBook being shipped via FedEx to his personal residence in [ x ] but does not recall any other information regarding the shipment. Once (COMBETTA) received the MacBook, he identified the folders containing the HILLARY CLINTON email and recalled five subfolders being labeled 2009 through 2014. (COMBETTA) did not recall the specific HILLARY CLINTON email account the tranche was from. (COMBETTA) created a local storage folder under the email@example.com copied the pst files to it. Thehrcarchive@clintonemail.comaccount was not configured to send or receive email messages. [ xxx ] or someone from CESC requested that only HILLARY CLINTON and two associates be granted access, but (COMBETTA) could not recall the names of the associates. (COMBETTA) shipped the foregoing MacBook back to [ xxx ] LNU, but recalled nothing about the return shipment.
In or around 09/2014, (COMBETTA) was contacted by CLINTON aide CHERYL MILLS requesting (COMBETTA) perform an archive search of all HILLARY CLINTON email, during her tenure as Secretary of State, from 01/2009 to 02/2013, sent to or received from an email address ending in .gov. It was originally requested that (COMBETTA) burn the foregoing archive search to a DVD and FedEx it to CHERYL MILLS. Instead of that transmittal (COMBETTA) conducted the foregoing archive search, zipped the resulting .pst email files, encrypted them with AES256, and used a Secure File Transfer Protocol (SFTP) to transfer the files to the workstations of CHERYL MILLS and HEATHER SAMUELSON. Additionally, XXX password protected the pst files. Sometime shortly after, CHERYL MILLS contacted XXXX and asked him to perform another archive search for all email on all accounts in HILLARY CLINTON’s mailbox during her tenure and Secretary of State.
XXXX conducted the requested archive search and transmitted it to MILLS and SAMUELSON using the same process, an SFTP transfer using AES256 encryption to their personal workstations. XXXX knew no additional detail regarding the workstations of MILLS and SAMUELSON. Additionally, the archive search conducted by XXXX did not contain email from the local storage firstname.lastname@example.org.
In or around 12/2014, (COMBETTA) was put in touch with an individual named [ x ] by someone from the CESC client. [ x ] informed (COMBETTA) that HILLARY CLINTON and HUMA ABEDIN were going to have new email accounts on a new domain hosted on another server not administered by PRN. [ x ] informed (COMBETTA) that HILLARY CLINTON’s new email address wasXXXX@hrcoffice.comand HUMA ABEDIN’s new email address wasXXXX@hrcoffice.com. [ x ] requested that (COMBETTA) begin forwarding the email from HILLARY CLINTON’email@example.com hosted on the PowerEdge 620, to her newXXXX@hrcoffice.comaccount, hosted on another server unknown to [ x ] not anyone from CESC client requested (COMBETTA) to transfer any archived email to the new server referenced by [ x ](COMBETTA) was not aware of any detail related to the new server referenced by [ x ] to include who managed it or what it was being used for.
In or around 03/2015 (COMBETTA) was contacted by CESC with a request to inventory the CESC mailboxes to determine what exists, where it was stored and how it was backed up. (COMBETTA) talked with[ x ] to coordinate the request and it was decided (COMBETTA) would travel to Equinix to ensure the PowerEdge 2900, 1950 and NAS contained no email data. Once onsite at Equinix (COMBETTA) powered on the PowerEdge 1900, 1950 and NAS and verified no old email data or backups existed. When (COMBETTA) returned to Equinix in 08/2015 to provide the PowerEdge 2900 to the FBI, he powered it up to check for any email or backup data. The 0?/2015 inventory by (COMBETTA) was not requested by anyone from CESC and was a step taken by PRN.
(COMBETTA) stated all email accounts on the PowerEdge 620 had some back-up policy. Everything on the PowerEdge 620 was backed up through the DATTO device by taking several snapshots of the server daily and maintaining the data for 60 days. Additionally, all accounts had some back-up set by the user in their individual email client settings. Users could also archive email locally, by making pst files on their computer workstation for example. (COMBETTA) stated the server just presents the email to the user – after that, the user could do whatever they want with the email. (COMBETTA) did not know what any CESC client individual emails user’s setting was. Additionally, in or around 08/06/2015, PRN was made aware that DATTO was syncing with the DATTO cloud and storing email data related to CESC off-site. This off-site logging to DATTO’s datacenter was not requested by PRN or CESC. Once the DATTO offsite logging was discovered, DATTO disabled the offsite logging feature leaving DATTO with 60 days of CESC email back-up from the day it was disabled (COMBETTA) believed. DATTO was preserving the offsite email data.
(COMBETTA) was shown a list of CESC email accounts provided to the FBI by PRN. (COMBETTA) recognized most of the email accounts and knew that some were added and deleted throughout the life of the contract, but couldn’t give a timeframe for the addition/deletions and wasn’t aware of all the users for each account. Additionally, (COMBETTA) was unaware of the devices used by each user. When CESC users would acquire a new mobile device, they could configure it themselves due to Microsoft ActiveSync technology on the mobile device. On rare occasions, (COMBETTA) would have to assist old blackberry users with synchronization with the BES.
PRN set-up a share folder on the PRN network for all documentation related to the CESC client (COMBETTA)believed PRN took this step to limit the individuals at PRN that had access to information regarding the CESC client.
(COMBETTA) believed that PRN never used the company Techno+Rescue to recycle equipment related to the CESC account. (COMBETTA)believed that PRN never used Veeam software or service to backup the PowerEdge 620.
PRN never took action to purge or delete CESC email data from the PowerEdge 620 or DATTO. CESC never requested that PRN purge or delete email data associated with their account.s aware of no discussions with CESC regarding classified information or retention of federal
(COMBETTA)was aware of no discussions with CESC regarding classified information or retention of federal records.
(Paul Combetta) 2/18/16 Page 14
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:
On February 18, 2016, (PAUL COMBETTA)date of birth xx/xx/xxxx was interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) xxx and SA xxx at the offices of Platte River Networks (PRN), 5700 Washington Street, Denver CO. Also present for the interview were SA xxx Information Technology Specialist/Forensic Examiner xxx, Department of Justice (DOJ) Attorney xxx and xxx from xxx. After being advised of the identity of the interviewing agents and the nature of the interview xxx provided the following.
MONICA HANLEY contacted (COMBETTA) via email on or about February 2014 regarding email belonging to HILLARY CLINTON. The email was stored on a MacBook and CLINTON did not want to lose the email, so HANLEY requested (COMBETTA) transfer it to the Clinton Executive Services Corporation (CESC) server (Server) managed by PRN. The Server housed four virtual machines:a Microsoft Exchange server, a BlackBerry enterprise server, an administrative server, and a domain controller. (COMBETTA) attempted to accomplish the task via a remote session using a remote support application called ScreenConnect. However, (COMBETTA) was unable to import files using ScreenConnect since the email was stored in the MacBook’s Mail program. Therefore, (COMBETTA) had HANLEY ship him the MacBook so he could import the mail files manually.
Upon receipt of the Macbook (COMBETTA) reviewed the files and noticed there were several mail folders and each was labeled with a different year from 2009-2013. He then conducted a Google search to identify an appropriate method for converting the Mac Mail files into .pst files. (COMBETTA) believed he used Gmail as a way to convert the Mac Mail files to a format that could be imported into the Microsoft Exchange server. Once the conversion was complete, he created a new mailbox named HRC Archive. It was likely a regular Microsoft Exchange mailbox that could send and receive email. (COMBETTA) did not recall who had access to the mailbox. Once the import onto the Server was successful, he deleted the mail from the Macbook, but did not use any data wiping tools on the Macbook. (COMBETTA) never deleted the HRC Archive mailbox from the Server and believed it should still exist there today, however users with access to the mailbox could have altered its contents.
In April 2014 (COMBETTA) remotely instructed [ x ] how to access the HRC Archive mailbox using Microsoft Outlook on her computer. (COMBETTA) likely provided this assistance using the ScreenConnect application.
After reviewing several documents dated in and around July 23, 2014, xxx stated in July 2014 he had a conversation with CHERYL MILLS during which she requested (COMBETTA)export a .pst file with all email in CLINTON’s mailbox that was sent to or received from a .gov email address (July Export). After reviewing a list of .pst files modified in or around the same time (COMBETTA) opined he might have attempted the July Export using different tools, such as Outlook or PowerShell. He did not recognize the file name export.pst. After completing the July Export and verifying it would open correctly in Outlook, (COMBETTA) burned DVDs of the files and arranged for a FedEx pickup the next day. However, MILLS subsequently (sic) requested a secure electronic transfer of the files instead of shipping physical media. Once the secure electronic transfer was complete, (COMBETTA)destroyed the DVDs by breaking them in half.
After reviewing a July 24, 2014 email from BRYAN PAGLIANO regarding a regular expression text editor, (COMBETTA) explained when a user changes his or her email address, Outlook updates the old email address with the new email address. MILLS was concerned CLINTON’s then-current email address would be disclosed publicly and would be different from the one CLINTON was using at the time the emails were actually sent. (COMBETTA) and PAGLIANO discussed using a regular expression text editor to find and replace the new email address with the old, but the tool could not accomplish the replacement.
(COMBETTA) used the email firstname.lastname@example.org an account to test email flow when he worked on the Server. It was a “dummy” account he used to test email issues for various PRN clients.
After reviewing work tickets from July 29-30, 2014 (COMBETTA) stated the ScreenConnect remote sessions with MILLS and HEATHER SAMUELSON were for the purpose of transferring copies of the July Export to their Windows workstations. Prior to the transfer (COMBETTA) password-protected the .pst, then placed it in an Advanced Encryption Standard (AES) zip file. The ScreenConnect tunnel was also encrypted, resulting in three layers of protection.
After reviewing an invoice dated August 12, 2014, (COMBETTA) stated he assisted SAMUELSON in reconnecting to the July Export archive.
After reviewing a work ticket dated September 29, 2014 and invoices dated September 30, 2014 and October 1, 2014, (COMBETTA) stated he spoke with MILLS about the creation of a new email archive export (September Export). (COMBETTA) could not recall if the September Export consisted of the complete live mailbox belonging to CLINTON, the exported emails from HRCArchive mailbox, or both. The September Export was several gigabytes in size. (COMBETTA) did not place any limitations or delete any content from the September Export.
After reviewing a work ticket dated November 18, 2014 (COMBETTA) stated he worked with SAMUELSON to reestablish her connection to an archive of CLINTON’s emails.(COMBETTA) could not recall if it was to the July Export, the September Export, the live HRC Archive mailbox, or something else.
After reviewing a work ticket dated November 24, 2014 and an email dated the same day, (COMBETTA) stated he participated in an urgent call with SAMUELSON regarding more specific export requirements. He could not recall the details of the conversation.
After reviewing an administrative server log file from November 24, 2014, (COMBETTA) explained he used Microsoft Outlook on the administrative server to test any .pst file exports he created for CESC. The testing consisted of opening the .pst files to ensure they loaded into Outlook correctly.
Regarding Outlook Office Alert event log entries indicating a mailbox and a “gov export” folder were deleted, (COMBETTA) speculated they were deleted because they were no longer needed on the administrative server.
Regarding the log entry referencing “huma-gmail=yahoo.pst.link,” (COMBETTA) stated HUMA ABEDIN requested her email from Gmail and Yahoo be imported into her mailbox on the Microsoft Exchange server. (COMBETTA) could not recall when ABEDIN requested this assistance.
After reviewing a document where “HRC Archive” is referenced in the Windows Messaging Subsystem profile for [ xxx ].tmp, (COMBETTA) stated he believed this file to be a reference related to the transfer of email from the Macbook he received from HANLEY described above. Specifically, (COMBETTA) believed he used the Gmail account [xxx ]@gmail.comto effect the transfer to the HRC Archive mailbox.He might have used the Macbook for this process, but probably used the server.
After reviewing emails dated December 10, 2014 and December 12, 2014, as well as work tickets regarding December 9-10, 2014 telephone calls with MILLS and SAMUELSON, (COMBETTA) stated they wanted the last 60 days of email for CLINTON and ABEDIN in new accounts that were not on the Microsoft Exchange server, but did not request the migration of any other content.
After reviewing an email dated December 11, 2014 with the subject line “RE: 2 items for IT support,” and a December 12, 2014 work ticket referencing email retention changes and archive/email cleanup, (COMBETTA) stated his reference in the email to” … the Hilary [sic] coverup [sic]operation …” was probably due to the recently requested change to a 60-day email retention policy and the comment was a joke. He did not recall the prior retention policy.
After reviewing a work ticket dated January 5, 2015, referencing a remote session with MILLS and SAMUELSON, (COMBETTA) stated the session was possibly to remove the July Export or September Export .pst files from their workstations.
After reviewing a Server log entry from January 5, 2015, noting the installation of Ontrack PowerControls (PowerControls), (COMBETTA) stated PowerControls was the software utility bundled with the Datto backup device employed as part of the CESC Server architecture. It is used for Microsoft Exchange server restoration, but (COMBETTA) did not recall ever taking any actions with it.
After reviewing a document identifying the “Last Written Time” as January 6, 2015 for “HRC.gov email Archive.pst, HRC.gov emails.pst, HRC.gov emails.pst, and export.pst,” (COMBETTA) stated Outlook updates the modification time and date for any .pst files attached to a mail account when the program is opened.
After reviewing an email dated January 7, 2015 containing a list of mailboxes on the CESC server, (COMBETTA) stated he believed the HRC Archive mailbox should still be on the Server in the possession of the FBI. He did not know why it would not be on the server and said he would check the current server for the existence of an HRC Archive mailbox.Users could control the content of a mailbox, but not the existence of it. Only (COMBETTA) and [ x ]had the capability to login to the Server as an administrator and remove a mailbox. (COMBETTA) stated he did not remove the mailbox, nor did anyone request he remove the mailbox.
After reviewing administrative server log entries ranging from January to October2015, referencing multiple Google Apps (COMBETTA) stated the office of [ x ] used Google Apps for business, so he used Google migration tools to pull the email accounts of users from her office to the Microsoft Exchange server. January 2015, however, was not the correct timeframe for that migration and (COMBETTA) did not recall what he might have used Google Apps for in January 2015.
After reviewing an email dated March 5, 2015, referencing [ x ] from Security Pursuit, (COMBETTA) stated he did not know [ x ] and did not recall implementing any new security features during that timeframe.
After reviewing an email dated March 3, 2015, referencing a .pst file containing all of “HRC s emails to/from any .gov addresses,” (COMBETTA) stated he used filters based on sending and receiving email addresses, as well as a date filter for CLINTON’s time as Secretary of State to produce the July Export.
After reviewing an email dated March 5, 2015 with the subject line “RE: Share,”(COMBETTA) stated the shared drive was located on PRN hardware in Denver. It was a limited access shared drive for individuals working with CESC.
After reviewing an email dated March 5, 2015 with the subject line “RE: CESCFirewall,” (COMBETTA) stated “…HRC’s backup device…” referred to a second mobile device that belonged to CLINTON. He did not recall any details about the device.
After reviewing a document with information concerning “export.pst, HRC archive – complete. pst, and email@example.com–HRCarchive.ost,” (COMBETTA)stated, based on the Last Written Time in the registry, that export.pst existed on the administrative server as of March 7, 2015. He did not recall when it was removed or who removed it from the administrative server.
After reviewing work tickets from March 7-8, 2015 (COMBETTA)stated he determined the Cisco Network Attached Storage device brought to the Equinix data center when PRNtook possession of CESC’s predecessor server and associated equipment did not contain any email content. PAGLIANO had used it for extra storage and it only contained BlackBerry server logs. (COMBETTA) did not know what was on the external USB hard drive that was also part of the predecessor server architecture. PRN did not use either device as part of the Server architecture they designed and implemented.
After reviewing an email dated March 9, 2 015 with the subject line “Re: Email/Data Systems,” where (COMBETTA) is listed as one of the recipients,(COMBETTA) stated he did not recall seeing the preservation documentation from DAVID KENDALL referenced in the email.
After reviewing work tickets dated March 10, 2015 and March 12, 2015, referencing the movement of email for MILLS, (COMBETTA) stated MILLS did not have an account on the Server and he could not recall what work he might have done for MILLS. MILLS occasionally contacted (COMBETTA) with problems related to her personal email account, so the work tickets may have been of that nature.
After reviewing an email dated March 25, 2015 with the subject line “CESC call,” (COMBETTA)stated he had no recollection of the call or what it was about. (COMBETTA) then reviewed an email dated March 25, 2015 with the subject line “Clintons” and a work ticket dated March 31, 2015 referencing a conference call with KENDALL and MILLS. At this point in the interview, [ x ], PRN’s counsel, advised (COMBETTA) not to answer any questions related to conversations with KENDALL based on [ x ] protections under the Fifth Amendment.
After reviewing log files dated March 31, 2015, referencing multiple manual deletions from the Datto server used to backup the Server, (COMBETTA) stated he did not recall performing the deletions, nor did he recall being asked to delete backups from the Datto server. (COMBETTA) further stated everyone at PRN has access to the Datto client portal, which is used to manage the backups for all of PRN’s clients who employ Datto’s services.
After reviewing log files dated March 31, 2015, referencing the installation ofBleachBit on the administrative server, (COMBETTA) stated he believed he used the program for the removal of .pst files related to the various exports of CLINTON’s email discussed above from the administrative server. He took this action of his own accord based on his normal practices as an engineer. He did not recall which settings he used, to include the overwrite free space feature. (COMBETTA)later stated he might have used BleachBit on the Microsoft Exchange server because any .pst exports would be created there, then moved over to the administrative server and opened to verify the exported .pst fileworked correctly.
(COMBETTA) does not recall who or when the conversation occurred, but someonefrom CESC told him at some point s/he did not want the .pst files hanging around and wanted them off of the Server after the export.
After reviewing a text document with the first line “June of 2013” (COMBETTA)stated he did not recall creating the document. However, the statement “PST Files were shredded” is probably a reference to his use of BleachBit.
After reviewing log files from the administrative server dated January – October 2015, (COMBETTA) stated the reference to Google Apps Sync on April 4, 2015 was possibly an automatic update to the software.
After reviewing an email dated April 24, 2015 with the subject line “[ xxx ] 4/27-5/1,”(COMBETTA) stated the entry on April 27, 2015 was a calendar appointment related to regularmaintenance of the Server and associated equipment.
After reviewing an email dated August 18, 2015 with the subject “RE: email,’’(COMBETTA) stated CESC wanted to verify they had a 60-day retention policy. He believed[ x ] misspoke when [ x ] commented on a 30-day retention policy.
After reviewing an email dated August 21, 2015 with the subject line “RE: Dattoremote access” and an email dated August 20, 2015 with the subject line “RE: CESC Datto,” (COMBETTA) stated PRN might have received a new Datto server because in the initial setup of the original Datto server, it auto synced with the Datto data center and created an offsite copy. The new Datto server would not allow that to happen.
After reviewing logs dated September 21-September 26, 2015 from the MicrosoftExchange server and September 25-October 2, 2015 from the administrative server, xxx speculated he may have removed mailboxes attached to Outlook on the administrative server. He was not instructed to delete any user mailboxes on the Microsoft Exchange server in September 2015, nor did he delete any mailboxes. Furthermore, xxx did not do any work with any email exports in the September 2015 timeframe. It was standard practice for xxx to install OnTrack PowerControls on a server because it is required to restore a system from a Datto backup. Additionally, (COMBETTA)would login to the Datto server during regular maintenance appointments to check the backups. Regarding the October visits to the CESC Datto Control Panel referenced in the logs, (COMBETTA) or [ xxx ]probably logged into the Datto server using ScreenConnect to verify it was running properly. ScreenConnect was (COMBETTA)’s primary method of connecting to the administrative server.
(COMBETTA) did not recall manually running a disk defragmenting utility, but would sometimes do it as part of routine maintenance.
(COMBETTA) was shown several other documents for which he had no information.
All documents used during the interview are attached to this communication as a 1A.
(Paul Combetta) 5/03/16 Page 21
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:
On May 3, 2016 xxx Platte River Networks (PRN), date of birth xxx was interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) xxx and SAXxx at the United States Attorney’s Office for the Eastern District of Virginia located at 2100 Jamieson Avenue, Alexandria, VA 22314. Also present for the interview were Supervisory Special Agent xxx, Information Technology Specialist/Forensic Examiner xxx, Department of Justice (DOJ) Attorney xxx, DOJ Attorney xxx, EDVA Attorney xxx, and EDVA Attorney xxx, as well as xxx counsel xxx and xxx. After being advised of the identity of the interviewing agents and the nature of the interview xxx provided the following:
In February 2014, xxx worked with MONICA HANLEY to import an archive of HILLARY CLINTON’s email from an Apple MacBook to the PRN-maintained server hosted for the CLINTON EXECUTIVE SERVICES CORPORATION (CESC). This server hosted CLINTON’s email account. HANLEY told xxx the MacBook contained old email that only existed on the laptop and HANLEY did not want to lose it. The email was stored in Mac Mail within folders labeled by year as 2009 Inbox, 2009 Sent Items, 2010 Inbox, 2010 Sent Items, etc. xxx tried to effect the transfer of the archived email through a remote session using ScreenConnect, but the WiFi connection was intermittent and the MacBook repeatedly turned itself off. Therefore, HANLEY shipped the MacBook to xxx. Xxx was unaware of a USB flash drive containing an identical set of the email files.
Xxx tried various tools and Googled for solutions to effectively transfer theemail files. After researching options. Xxx transferred all of the email content to the “dummy” Gmail account firstname.lastname@example.org. Xxx connected the administrative server tothe Gmail account and used it as a bridge to move the email into a mailbox named hrcarchive on the Exchange server. The PRN architecture consisted of a BlackBerry Enterprise server, domain controller, administrative server, and Microsoft Exchange server (PRN server). After the transfer was complete, he deleted the content from the Gmail account and provided the hrcarchive login credentials to HANLEY or xxx and demonstrated how to access the mailbox using Outlook Web Access. Xxx did not know if xxx or HANLEY provided the credentials to others; however. anyone with the credentials could access the account. Prior to shipping back the Macbook, eitherHANLEY or xxx requested the email be deleted from the Macbook. Xxx deleted the files containing the email, but did not use any special tools to remove the files. Xxx providedan address for the return shipment of the Macbook and xxx used either the United States Postal Service or United Parcel Service.
Xxx and xxx all had access to the prnadmin account credentials to access the PRN server. The xxx account on the server maintained by BRYAN PAGLIANO was created by PAGLIANO during the transition to the PRN server. There was also a built-in administrator account on the PRN server, but xxx never used it. Xxx handled most day-to-day work tickets for CLINTON’s account, while xxx handled the physical infrastructure setup and maintenance. Xxx was authorized to work on the account and served as a backup to xxx however, he only handled a few work tickets. Xxx left PRN in June or July 2015 and, based on PRN’s normal business practice, passwords were changed for all admin accounts.
In July 2014. CHERYL MILLS emailed xxx to schedule a phone call. On the call, MILLS outlined to xxx she needed an export of all CLINTON’s email sent to or received from a .gov email address (July Export) for the purpose of providing them to the United StatesDepartment of State (State). Xxx searched “*.gov” in the live “H” mailbox to find email responsive to MILLS’ request. After preparing the export, xxx worked with MILLS and HEATHER SAMUELSON to transfer the export to each of their workstations. This interaction was the first with MILLS. Xxx previously interacted with xxx and xxx. MILLS served as the primary contact from which xxx took direction for this export and later exports. Xxx only interacted with SAMUELSON once or twice beyond this export and later exports. Xxx only interacted with SAMUELSON once or twice beyond her troubleshooting her access to the exports. He described MILLS and SAMUELSON as proficient computer users with knowledge of basic programs.
Based on the direction provided by MILLS as described above, xxx prepared an export of CLINTON’s email from her live account on the PRN server. Xxx then used 7-Zip to compress the export and password-protect it. to transfer the export to MILLS andSAMUELSON, he connected to each of their workstations remotely using ScreenConnect and installed 7-Zip. On SAMUELSON’s laptop he also installed Outlook 2013 because she did not have Outlook at that time. After the installation of 7-Zip on both workstations and Outlook 2013 on SAMUELSON’s workstation, xxxtransferred the zip file using Secure File Transfer Protocol (SFTP), unzipped the export, and opened the export in Outlook by navigating to it using File->Open->Outlook Data File. When transferring the file, xxx likely dropped it on the desktop or in a folder on the C: drive.
In September 2014, MILLS contacted xxx and requested an export of CLINTON’s entire mailbox (September Export), so xxx followed a similar process to the July Export. He prepared a .pst file, zipped it using 7-Zip, and transferred it to MILLS and SAMUELSONthrough ScreenConnect. In the preparation of this export, xxx discussed different options for the transfer based on the size of the file, but ultimately decided on the same process using ScreenConnect as the July Export. MILLS never requested assistance from xxx in locating CLINTON’s email from January 2009 – March 2009 and xxx was never aware there was a gap during that timeframe.
Xxx did not know why the .pst file provided to the FBI from CLINTON’s counsel contained the email address email@example.com in the metadata because he believed he created email exports from CLINTON’s live email mailbox. However, he provided thefollowing- possible explanations:
Xxx may have imported HRC Archive into CLINTON’s live mailbox;
A user may have moved email from HRC Archive into CLINTON’s live mailbox.
A user may have taken email directly from the HRC Archive mailbox to produce what was provided to State.
Xxx did not assist in the production of any .pst files provided to State.
During the July Export and September Export, xxx transferred one .pst file contained within a zip file, to MILLS and one to SAMUELSON. Their laptops were running eitherWindows 7 or Windows 8.
After reviewing a chart labeled “PST files and Outlook Profiles – Admin Server,”Xxx stated “HRC.gov emailArchive.pst,” “HRC.gov emails.pst,” and “HRC.govemails.pst” reference the July Exports. Xxx described the other files as:“HRCarchive – complete.pst” references the September Export.
“firstname.lastname@example.org – HRC archive.ost” is a remnant of the transfer of files from the HANLEY laptop described above to Gmail.
email@example.com xxx-temp.pst” xxx could not recall creating this .pst file.
“huma-gmail-yahoo.pst” was a result xxx importing HUMA ABEDIN’s email fromthose services to the PRN server.
After reviewing a PRN invoice referencing an October 1, 2014 call with MILLS,Xxx stated the call was in relation to one of the .pst file transfers.
After reviewing a PRN work ticket dated November 18, 2014 referencing a call with SAMUELSON, xxx stated he worked with SAMUELSON to reconnect her to CLINTON’semail archive.
After reviewing an email dated November 24, 2014 with the subject line “MMM,” Xxx stated he did not know what the reference to an urgent call was about.
After reviewing a work ticket dated November 24, 2014 referencing “more specific export requirements,” xxx stated he did not know what the more specific export requirements were, but did not believe an additional .pst file was transferred. Neither SAMUELSON nor MILLS requested xxx assist with searches for emails to/from specific users, emails to/from specific domains, or create additional exports beyond the July and September Exports.
In November or December 2014, MILLS told xxx she did not want the exported data on the laptops anymore and requested he securely delete the .pst files previously transferred to MILLS’ and SAMUELSON’s workstations, but did not specifically request xxx use deletion software. Based on the request of MILLS, xxx recommended BleachBit, a tool he had used previously with clients who had financial information on computer equipment being decommissioned. Xxx described BleachBit as a utility that securely deletes files by overwriting data multiple times. He could not recall what version he used, but would have downloaded the latest version at the time of MILLS’ request. Sometime prior to this discussion, MILLS mentioned once CLINTON’s email s were printed for State, she could put the .pst file on a flash drive and have a master copy. Xxx had theimpression MILLS was referring to all of CLINTON’S emails, not just those provided to State.
Xxx used the same deletion process for the workstations of both MILLS andSAMUELSON. He initiated a remote session, typically while on the phone with MILLS orSAMUELSON, to each workstation using ScreenConnect and downloaded BleachBit from the Internet, then installed the software. He used BleachBit to remove the .pst files by running the shredding function as a standard user, not an administrator. The process took a few minutes to complete during which xxx did not encounter an error message.
Xxx believed he shredded a total of eight files – the two zip and two .pst files on each laptop from the July and September exports. He did not recall:
Altering any settings prior to shredding the .pst files
Wiping free space
Selecting artifact clean up
Verifying the deletion of the files
Selecting “Shred Settings and Quit” once the process was complete
Targeting any temporary files
After reviewing work tickets dated December 12, 2014 and January 5, 2015, xxx stated the work tickets reflected the tasks he completed to remove .pst files from the PRNserver and the workstations of MILLS and SAMUELSON. The requests from MILLS were routine customer service, so no one else at PRN was aware of the removal tasks lxxx completed beyond what was written in the work tickets. Since completion, neither MILLS nor anyone else from CESC contacted xxx to verify this work was complete. Additionally,xxx was not contacted by anyone to discuss the process he used to remove the files from the workstations.
In March 2015, MILLS contacted xxx to discuss CLINTON’S email.Typically, MILLS would contact xxx using the email address firstname.lastname@example.org and setup a time to call. MILLS wanted to know what backups of CLINTON’s email existed and where those backups were located. After discussing the potential for content to exist on the server CLINTON used prior to the PRN server, PRN decided xxx would travel to the datacenter in Secaucus, NJ to power up the old equipment (Predecessor server) and check it for any backups or copies of CLINTON’s mailbox. After xxx arrived at the datacenter and turned on the old equipment, xxx spoke with xxx while they both were logged on to the system. Neither the Cisco Network Attached Storage (NAS) device nor the external USB hard drive that were part of the architecture for the Predecessor server contained backups or other data associated with CLINTON’s email.
PRN used a Datto backup appliance to backup the PRN server and it was PRN’s
common practice to include the administrative server as part of the Datto backup, but xxx could not specifically recall if the administrative server was backed up for CESC.
Xxx had no memory of stopping Datto backups of the PRN administrative server on March 8, 2015. Datto recommends turning off Windows Volume Shadow Copy service because it can interfere with Datto backups.[REDACTED PARAGRAPH]
After reviewing an email dated March 25, 2015 with the subject line “CESC call” and an email dated March 25, 2015 with the subject line “Clintons [sic],” xxx stated he could not recall the content of the call or the reference to backups in the email.
After reviewing a document titled “Exchange Audit Logs” dated March 25, 2015 and March 31, 2015, xxx stated the Platte Admin mailbox received firewall alerts and other internal system alerts. Additionally, the Platte Admin account was used to effect changes on other mailboxes. Xxx did not specifically recall using it to provide full access for prnadmin to the mailboxes H, HDR29, and HRC Archive on March 25, 2015 and then removing the HRC Archive mailbox from the Exchange server. However, xxx believed he had an “oh shit” moment and removed the HRC Archive mailbox. He also changed the mailbox retention policy from 30 days to 1 day, and cleaned the mailbox database because MILLS previously requested in late 2014 or early 2015 he change the retention
policy for CLINTON and ABEDIN’s existing and ongoing email to 60 days. He removed the HRCArchive mailbox manually because all content in the mailbox was older than 60 days. Xxx changed the deleted items retention policy from 30 days to 1 day to ensure no email outside of the 60 days remained on the server and executed the Clean-MailboxDatabase command to clean whitespace within the database, similar to running a disk defragmentation. Xxx also enabled Circular Logging, but did not recall why he did so in this instance. He typically enabled it when importing email because Microsoft Exchange logs contain email that hasn’t been committed to a database. Circular Loggingreduces the log file size by forcing Exchange to commit data to the database immediately.
After reviewing documents titled “BleachBit – PRN Admin Server” and “BleachBit – Exchange Server” indicating the use of BleachBit on March 31, 2015, xxx stated he checked the Exchange Server for remaining copies of CLINTON’s email. When he located a .pst file, he used the most recent non-beta version of BleachBit available at the time to shred the .pst files on the PRN server, but did not recall which .pst files he found or removed. He did not wipe free space, encountered no errors, and viewed the folders to see if the files were gone, but did not take additional steps to confirm the deletions.
Xxx did not talk with MILLS about the files he found and deleted.
After reviewing log files dated March 31, 2015 indicating the deletion of files fromthe Datto backup appliance, xxx stated he did not recall deleting any Datto backups nor did he recall receiving an instruction to delete backups from the Datto, however, it is unlikely anyone else at PRN would have deleted the files. xxx did not know if the administrative server was backed up to the Datto.
After reviewing a document titled “PRN Admin Server – Installed/Uninstalled Application Events,” xxx stated he had no insight into the installation of Google Apps Sync for Microsoft Outlook on April 5, 2015.
After reviewing documents titled “Add-MailboxPermission and Remove-MailboxPermission” and “Export.pst on Admin Server – 9/25/2016 [sic],” xxx stated inSeptember 2015 he looked into replacement options for the PRN server because he believed the server would be turned over to the FBI. To prepare for this eventuality, he logged onto the server to verify the backups of the server were working correctly and evaluate what new hardware PRN would need to order. During the same time frame, xxx restored the mailbox for xxx. This restoration may account for the activity related to Export.pst in September 2015 and it is unlikely Export.pst contained any of CLINTON’S email. Xxx deleted xxx Export.pst after the restoration was complete. However, he did not delete any data related to CLINTON’s email after he was interviewed by the FBI in September 2015.
After reviewing an email dated March 9, 2015 referencing a preservation email from DAVID KENDALL and a preservation request from the FBI dated July 31, 2015, xxx stated he was aware of the preservation requests and interpreted both as meaning he should not disturb CLINTON’sEmail data on the PRN server. Xxx did not receive guidance from other PRN personnel or PRN counsel, or others regarding the meaning of either preservation request.
(???) 8/17/2015 Page 40
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:[ X ] Office of Information Programs and Service s (IPS), United States Department of State (STATE) Bureau of Administration. [ x ] Washington, D.C. 20520, office telephone (XXX) XXX-XXXX, mobile telephone (XXX) XXX-XXXX, email [ x ]@state.gov, date of birth XX/XX/XXXX was interviewed in person by FBI Special Agents [ X ] and [ X ] at FBI Headquarters, 935 Pennsylvania Avenue Northwest, Washington. D.C. 20535. After being advised of the identities of the interviewing Agents and the nature of the interview, [ X ] provided the following information: [ X ]began working for IPS in [ x ] 2015. Initially, IPS officials were told there were 14 bankers boxes of former Secretary of State Hillary CLINTON’s emails at CLINTON’s Friendship Heights office. Later, officials were told that the boxes would be picked up from Williams & Connolly, LLP. On or about December 5, 2014 IPS personnel picked up only 12 bankers boxes of CLINTON’s emails from Williams & Connolly. [ X ]and other IPS officials were not sure if the boxes were consolidated or what could have happened to the other boxes. The boxes were labeled with date ranges, which were accurate for the most part. Some of the documents were filed out of order. [ X ]opined the documents were pre-arranged differently than one would expect if the documents were simply printed out and then stacked into the boxes. IPS personnel provided copies of the documents to STATE’s Bureau of Legislative Affairs, Office of the Legal Adviser, and the Office of Congressional and Public Affairs.
Although, CLINTON was sworn in as Secretary of State in January 2009, IPS officials wereunable to locate any of her emails from January–April 2009 in the documents provided by Williams & Connolly. [ X ]did not know whether CLINTON used a different email address at that time.A preliminary review of the documents did not occur until months later. IPS had to wait on the Office of Legal Counsel to provide an official determination as to whether the emails would be considered official STATE records. At some point, the determination was made that the emails would not be considered official STATE records.
Based on the dates on the boxes, [ X ]opened the box with the Benghazi-related incidents first. There were sensitive Benghazi-related records, some records related to the National Archives and Records Administration and some personal emails in that box. [ X ] Records and Archives performed the records appraisal. [ X ]informed [ X ] there were some potential classified emails, including some from Sidney BLUMENTHAL, that appeared to have been written by Tyler Drumheller, former Central Intelligence Agency (CIA) Division Chief, European Division [REDACTED]as well as other emails that discussed various information related to various foreign governments.
Sometime around late January 2015 [ X ] gave a status brief about the emails to STATE officials Patrick KENNEDY, Under Secretary for Management, [ X ] Bureau of Administration, and [ X ] Global Information Services. KENNEDY and [ X] were each provided with two binders full of email examples of documents [ X ] believed were possibly classified. [ X] returned her binders to [ X] but KENNEDY decided to keep his binders following the brief.[ X ] was not aware of anyone in IPS or at STATE who received the rules or parameters the CLINTON team and/or Williams & Connolly used to segregate CLINTON’s personal and official work emails. There were approximately 60,000 emails, which were reduced to about 30,000. IPS had requested [ X ] Legal Adviser, STATE to ask Williams & Connolly for the rules they used.
To date [ X ] did not believe [ X ] received a response. [ X ] STATE Inspector General, was also trying to determine how Williams & Connolly performed their review and what basis they used in reducing the emails. Initially, Cheryl MILLS, former CLINTON Counselor and Chief of Staff, was the only CLINTON staff member to respond to a formal request by STATE for information pertaining to personal email and devices used to conduct official STATE business.
According to [ X ] in February 2015, attorneys at STATE’s Office of Congressional Affairs since approximately [ x ] and [ X ] along with attorneys from the Office of Legislative Affairs, performed their review of the 30,000 emails, from which 296 emails were located and produced responsive to requests from the U.S. House of Representatives Select Committee on Benghazi. The manual paper search was done using keywords “Libya,” “Benghazi,” and “security.”
Prior to the formal FOIA review by IPS of the 296 emails, Congress threatened to release the 296 emails based on [ X] input that her team had already coordinated with the appropriate STATE bureaus and inter-agency reviewing officials. However, [ X] and her team did not work with the regular interagency reviewers familiar to [ X] did not include [ X] Office of Information Management or [ X] Records Management Division, FBI. [ X] believed [ X] may have coordinated with DOJ, but not with the FBI.
In or around March and April 2015 [ X] and IPS felt pressure by both Congress and internally from KENNEDY and [ X] to quickly approve the 296 emails for release. Initially, [ X] and his team were told to do a “light review with light redactions,” but were later told by the Office of Legal Counsel to perform a regular FOIA review. [ X] special team of senior reviewers, approximately 40 full-time equivalent reviewers, worked with the appropriate Bureaus on possible classified information and sent the proper referrals to the United State Intelligence Community (USIC) partners.[ X] did not think [ X] and the Office of Legislative Affairs attorneys had the appropriate training and experience to review, redact and produce emails responsive to Congressional inquiries and especially not expert enough to respond to FOIA requests. For starters [ X] and her team performed their entire review, redacted what they did, and then copied the 296 emails to a .pdf file on an unclassified network. If any information was later found to be classified, then they would have not only corrupted every computer that touched that classified information, but they might have contributed to a loss of classified data. IPS always pushed their material to the SIPR.NET network and used their “F2” enclave to perform their FOIA review before disseminating their products. Also, the 296 emails provided by [ X] via .pdf included redactions done for CLINTON’s privacy but unrelated to national security. [ X] believed there was interference with the formal FOIA review process. Specifically,STATE’s Near East Affairs Bureau upgraded several of CLINTON’S emails to a classified level with a B(1) release exemption, [ x ] along with [ X ] attorney, Office of Legal Counsel called STATE’s Near East Affairs Bureau and told them they could use a B(5) exemption on an upgraded email to protect it instead of the B(I) exemption. However, the use of the B(5) exemption, which is usually used for executive privilege-related information, was incorrect as the information actually was classified and related to national security, which would be a B(l) exemption.
In or around March or April 2015 there was a meeting where [ X ] told [ X ] Information Services, [ X ] U. S. Department of Justice (DOJ), and [ X ] DOJ, that she had coordinated the review of the 296 emails with the appropriate STATE bureaus and inter-agencies. The emails “were already reviewed and there was nothing classified in them, so the FOIA review should go quickly.” [ X ]was unsure why the FOIA review was taking so long.[ X ] again stressed [ X ]review and coordination were done with people unfamiliar to [ X ] and were not the normal point of contact that IPS used for other agencies. More importantly, although [ X ] and [ X ] thought their quick initial review showed none of the 296 emails were sensitive following the formal FOIA review, one document had been upgraded to classified based on input from [ X ] and [ X ]. There were other documents IPS recommended for upgrade, including one specifically related to the Department of Defense’s United States Central Command (CENTCOM), and others that were still in the referral stage, including emails that have FBI and CIA equities involved that originated from BLUMENTHAL. [ X ] did not know why he and IPS were not part of the initial Congressional review for the 296Benghazi-related emails, like they had been for past Congressional inquiries. [ X ] was cut out of the loop for the materials initially sent to Congress and had no idea what kind of review [ X ] and her team performed. [ X ]and [ X ] seemed to have been placed in their specific positions by top STATE officials; they appeared to have a very narrow focus on all CLINTON-related items, and were put in positions that were not advertised.
In early May 2015, KENNEDY called an interagency meeting regarding the scheduled release of all the CLINTON-related emails by the January 15, 2016 deadline and asked for quick turnarounds on any future requests. People in attendance included[ x ]representatives from White House Counsel, CIA, FBI, Office of the Secretary of Defense (OSD), Director of National Intelligence (DNI) and the National Security Council (NSC).
Immediately following that meeting KENNEDY held a closed-door meeting with [ X ] and [ X ]DOJ’s Office of Information Programs where KENNEDY pointedly asked [ X ] to change the FBl’s classification determination regarding one of CLINTON’s emails which the FBI considered classified. The email was related to FBI counter-terrorism operations.
KENNEDY called [ X ]directly on one occasion. The purpose of that call was to ask [ X ]questions regarding pressure from the Office of the Inspector General of the Intelligence Community (ICIG) to complete the review of the approximately 30,000 emails. Specifically, KENNEDY wanted to know if there was precedent to have outside reviewers help STATE with the FOIA process. At that time [ X ] was unaware of STATE IG’s and ICI’s June 19, 2015 joint recommendation to STATE regarding the FOIA review process [ X ]ICIG, offered [ X ]and IPS extra reviewers from the intelligence community to help review the 30,000 emails. However, many of those reviewing officials arrived untrained to formally review items. After the initial training, those reviewers became instrumental to the review process.[ X ]had not felt as much pressure regarding the review and release of the 30,000 emails as with the 296 Benghazi-related emails. [ REDACTED] Instead of pressure, it felt more like curiosity as to the raw numbers of emails already reviewed, upgraded from unclassified to classified, referred to outside agencies, and/or released publicly. To date, approximately 1,600 referrals were made to USIC partners. Many of those emails discussed foreign governments and their leaders along with various sensitive telephone calls. Other emails existed that would later be referred to the USIC. Those emails included emails from STATE personnel discussing information lost as a result of the Wikileaks scandal.
Some material from the 30,000 emails, though unmarked as such, were definitely classified back in 2009-2012 and still remained classified. On the other hand, it was true some material (in general, not specific to the 30,000 emails) could have been previously classified, but were later downgraded. An example would be CLINTON’s travel schedule or security- related information based on specific timesand places. It was a very large security concern for IPS when they heard some STATE employees assumed all documents on unclassified system were unclassified, based on being on an unclassified system and having no portion markings.
One email that was upgraded from 30,000 emails was an email exchange between CLINTON
and [ X ] former [ X ] where both individuals used their personal email addresses to discuss matters related to Russia. Despite this, [ X ] responded to KENNEDY’s request for all STATE-related personal emails with a letter that stated [ X ] had no STATE-related emails in his personal email account.
STATE was normally able to complete classification upgrades very quickly. The upgrade would happen after STATE bureaus and other agencies determined, 1) how the information was obtained; (2) what the information was; (3) based on current global events/situations; or (4) because the information was, initially, improperly marked as unclassified.
[ X ] heard the argument that some of CLINTON’s emails were unclassified back in the 2009-2012 timeframe when they were initiated, but were later classified due to various circumstances. It was very rare for something that was actually unclassified to become classified years after the fact.[REDACTED] National Archives would be a good point of contact for knowledge on the upgrading process in general.
On or about August 10, 2015, [ X ] from Office of the Secretary of Defense (OSD) called [ X ] and told her CENTCOM records showed approximately 1 ,000 work -related emails betweenCLINTON’S personal email and General David PETRAEUS, former Commander of CENTCOM and former Director of the CIA. Most of those 1,000 emails were not believed to be included in the 30,000 emails that IPS was reviewing. Out of the 30,000 emails, IPS only had a few emails from or related to PETRAEUS, as well as a few related to Leon PANETTA, former Secretary of Defense. There were a lot of emails to/from Denis MCDONOUGH, former Deputy National Security Advisor and current White House Chief of Staff.[ X ] described Jacob SULLIVAN and Cheryl MILLS as “gatekeepers” for sending CLINTON emails/material; they would filter or review most items that CLINTON would receive. [ X ] recommended the FBI talk to his boss, [ X ] specifically about individuals at STATEwho hold a weekly meeting about Congressional records production and the FOIA process as well as where [ X ] felt pressure came from regarding upgrading any of the 296 Benghazi-related emails. [ X ] recommended the FBI should talk with [ X ] regarding the alleged 1,000 emails between CLINTON and PETREAUS
Monica Hanley 6/23/16 Page 30
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 6/27/2016
On June 23, 2016, MONICA HANLEY was interviewed by Federal Bureau of Investigation (FBI) Special Agents [ X ] and [ X ] at [ x ] Washington, DC. Representing HANLEY, and also present for the interview, were [ X ] and [ X ]. After being advised of the identities of the interviewing agents, and the purpose of the interview, HANLEY provided the following information:
HANLEY created an archive of HILLARY R. CLINTON’s email@example.com emails in March 2013 as a result of concerns related to a reported hack of SIDNEY BLUMENTHAL’s email account. HANLEY recalled participating in a conference call with HUMA ABEDIN and JUSTIN COOPER following the hack to discuss changing CLINTON’s email address. [ X ] may have also participated in the call. While the group ultimately decided together to change CLINTON’s account, ABEDIN selected the new name of the email account, firstname.lastname@example.org.
COOPER set up the email account and assisted HANLEY with the technical details concerning creating a backup of email@example.com. COOPER provided HANLEY an Apple Mac laptop from the Clinton Foundation, which HANLEY took home to her apartment in [ x ]. HANLEY remotely signed on to CLINTON’s email server from her apartment, as COOPER telephonically walked her through the steps to transfer the emails from the server to the laptop and a thumb drive. HANLEY used Macmail, a built in application on the laptop, to transfer the emails. HANLEY initiated the process, and left the computer running, as the entire transfer process took a few days.
CLINTON’s email address was changed from firstname.lastname@example.org to email@example.com before the archive was created.
While HANLEY could not recall the specific model of the aforementioned Apple laptop provided by COOPER, she did recall the model was not an “Air,” but was likely a “Pro” because it had an Ethernet port and a thumb drive portal. HANLEY further provided that the laptop she received from COOPER was silver in color and seemed like a newer model. The thumb drive HANLEY used was something she happened to have laying around the house. She could not recall any details concerning the brand or appearance of the thumb drive.
Although it never actually happened the way it was intended, the initial purpose for creating two backups of firstname.lastname@example.org (one on the laptop and the other on the thumb drive) was so a backup was available at both CLINTON’s New York and Washington, DC, residences. The laptop remained at HANLEY’s apartment in [ x ] until she transitioned to a job in the[REDACTED] in early 2014. HANLEY thought the laptop was stored in a drawer or on the desk in her bedroom. HANLEY did not use the laptop after the transfer of emails, nor did she have knowledge of anybody else accessing the laptop. The laptop was also password protected, so it would be impossible for anybody to access the laptop without HANLEY’s assistance.
HANLEY could not recall whatever came of the thumb drive she created, and searched her apartment multiple times in attempts to locate it. HANLEY thought she might have given the thumb drive to ABEDIN when she transitioned to [ x ] as she provided ABEDIN with several items upon departure. However, HANLEY did not specifically recall providing ABEDIN with said thumb drive.
After the emails were transferred from email@example.com the laptop and thumb drive, the intention was to delete the emails off the CLINTON email server. HANLEY would not have been involved with deleting emails, and assessed COOPER would have been responsible for deleting anything directly from the server.
In 2014, after she was no longer working for CLINTON, HANLEY realized she still had possession of the Macbook containing CLINTON’s archived emails. HANLEY subsequently contacted Platte River Networks (PRN) on her own accord and spoke with (PAUL COMBETTA). HANLEY initially tried to remotely send (COMBETTA) the archive via the following application, which(COMBETTA) provided HANLEY via email:
https://broker.gotoassist.com/h/citrixassist?Question=DR051-438-752. HANLEY initially attempted to transfer the archive to [ X ] remotely from CLINTON’s New York residence via the aforementioned website, however it did not work. HANLEY subsequently attempted to send the archive remotely from her own residence, and was also unsuccessful. HANLEY and (COMBETTA) ultimately decided HANLEY would ship the laptop containing the archive to (COMBETTA) and he would transfer the archive to CLINTON’s PRN server. (COMBETTA) was then going to wipe the laptop and return it to [ X ] who was CLINTON’s [ x ] at the time. HANLEY shipped the laptop to (COMBETTA) as they discussed, but was not aware of what happened to the laptop thereafter.
CLINTON did not know her email login information, as HANLEY would generally change the information in CLINTON’s BlackBerry when necessary so Clinton’s email would automatically populate. When CLINTON’s password required changing, HANLEY would choose a new password, update CLINTON’s BlackBerry with the change, and notify ABEDIN, COOPER and BRYAN PAGLIANO. HANLEY had CLINTON’s email logon information and password, so she could check CLINTON’s email if needed. On occasion, CLINTON would ask HANLEY to research an old email that CLINTON was unable to pull up on her BlackBerry. In order to respond to said request, HANLEY would open up CLINTON’s email account remotely from a computer and print the document for CLINTON. HANLEY assumed ABEDIN also accessed CLINTON’S email account on occasion.
HANLEY often purchased replacement BlackBerry devices for CLINTON when she was Secretary of State. CLINTON preferred BlackBerry devices that contained a roller-ball rather than the more modern touch pad. HANLEY recalled purchasing most of CLINTON’s replacement BlackBerry devices from a Washington, DC, AT&T Store in DuPont Circle. HANLEY also recalled purchasing one BlackBerry from an AT&T store in the Pentagon City Mall in Arlington, VA. HANLEY also recalled purchasing a replacement BlackBerry for CLINTON from either Ebay or Amazon, but stated this took place after CLINTON’s tenure at the Department of State.
HANLEY had little insight into the writing process of CLINTON’s book/memoir. She recalled CLINTON meeting with the writers regularly for multi hour meetings, where she assumed CLINTON would share topics and anecdotes she wanted to cover in the book. HANLEY also printed out chapters of the memoir as it was being written so CLINTON could make edits. HANLEY had no knowledge of the writers having access to CLINTON’s emails.
At the conclusion of the interview, HANLEY agreed to provide interviewing agents copies of emails she exchanged with [ X ].
A copy of the original interview notes are attached in a 1 A envelope.
Jake Sullivan 2/27/2016 Page 50
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:
On February 27, 2016, JACOB SULLIVAN, DOB XX/XX/XXXX, was interviewed by Federal Bureau of Investigation (FBI) Special Agents [ X ] and [ X ] at the FBI Washington Field Office, 601 4th Street NW. Washington DC. Present for the interview were SULLIVAN’s attorneys Beth Wilkinson and Alexandra M. Walsh, from Wilkinson, Walsh &Eskowitz, LLP. Also present was FBI Section Chief Peter P. Strzok. as well as David Laufmun, [ X ] and [ X ] from the Department of Justice (DOJ). Prior to the interview, Wilkinson and Walsh agreed to sign a non-disclosure agreement in anticipation of viewingdocuments during the interview that were classified as part of a Special Access Program (SAP). After being advised of identities of the interviewing agents, and the purpose of the interview, SULLIVAN provided the following information:
SULLIVAN was recruited by [ X ] to be an advisor for HILLARY CLINTON during her 2008 presidential campaign. When CLINTON became the Secretary of State in 2009,SULLIVAN became a Deputy Director of Policy Planning at the Department of State (DOS). In and around February 2011, [REDACTED],SULLIVAN became Chief of Staff and Director of Policy Planning at DOS. In this role,SULLIVAN managed and supervised approximately 30 people and his specific duties, and that of most senior officials at DOS, were prescribed CLINTON. Under her tenure,SULLIVAN traveled with CLINTON on almost every business trip she took and acted as a conduit to the National Security Council (NSC). SULLIVAN produced policy papersand proposals with a goal of staying ahead on regional issues and thinking “beyond day-to-day.” SULLIVAN recalled coordinating his official written products to CLINTON through a “clearance process”filtered through career Foreign Service Officers (FSO) and executive assistants [ X ] [ X ] and [ X ]. SULLIVAN would also email CLINTON directly related to a variety of topics. These communications included emails written by SULLIVAN, as well as emails SULLIVAN would forward to CLINTON based on his judgement as to their relevance. SULLIVAN also participated in Principal’s Committee (PC) meetings with CLINTON in the Situation Room.
Every morning throughout her tenure as Secretary of State, CLINTON would head an 8:45am meeting with her deputies to discuss a broad range of topics related to policy formulation. These deputies included SULLIVAN, [ X ] [ X ] WILLIAM BURNS, and CLINTON’s legal advisor and Chief of Staff, CHERYL. MILLS. SULLIVAN described MILLS as a traditional Chief of Staff and a “hands-on manager” who empowered people. SULLIVAN believed MILLS was involved in all “consequential” decisions made by CLINTON. SULLIVAN described HUMA ABEDIN as CLINTON’s Deputy Chief of Staff for Operations. In this role, ABEDIN handled day-to-day operations to include scheduling and trip planning for CLINTON. SULLIVAN described ABEDIN as a close confidant of CLINTON and as someone who has a ‘trusted relationship’ with CLINTON.
SULLIVAN had two computer systems in his office on the 7th floor at DOS Headquarters (HQ): one on the Secure Internet Protocol Router Network (SIPRnet) authorized to handle classified information up to the Secret level and one on an unclassified network. SULLIVAN had an official DOS email account on both of the foregoing networks. Due to size restrictions on SULLIVAN’s email accounts, he often had to “archive” emails to create space in his email account. SULLIVAN recalled archiving email in “big chunks” but otherwise could not recall any methodology or science he applied when archiving emails. It was SULLIVAN’s practice to use his state.gov email account for all DOS related business. SULLIVAN did recall occasionally using his personal google email (Gmail) account for DOS business when traveling and on the weekends. Although SULLIVAN could log in to his state.gov email account while away from the office he used his Gmail account for DOS business because it was sometimes difficult to log in to his state.gov email account from his residence on the weekends and while traveling. SULLIVAN could not recall any DOS guidance involving the use of personal email for work purposes. SULLIVAN could not recall any guidance from CLINTON regarding the use of personal email for work purposes. At some point in his DOS career, SULLIVAN recalled receiving some form of notification that Chinese actors were targeting the Gmail accounts of DOS employees. SULLIVAN did not recall taking any action as it related to this notification. SULLIVAN, MILLS, and ABEDIN did not have access to the Joint Worldwide Intelligence Communication System (JWICS) at the DOS. SULLIVAN recalled being briefed on the elements of information security upon indoctrination to the DOS. SULLIVAN understood the DOS “upclass” process as an unclassified document at some point or when combined with other documents, would become classified. SULLIVAN could not provide an example to this effect.
SULLIVAN had secure telephone equipment in his office on the seventh floor at the DOS. SULLIVAN was issued a BlackBerry mobile device by the DOS and did not recall receiving an upgraded handset during his tenure. SULLIVAN could not recall being issued a secure mobile phone by the DOS. SULLIVAN recalled being issued a secure mobile phone by the White House for a weekend but could not recall anything further about this device or his use of it.
When traveling overseas for his work at the DOS, SULLIVAN recalled being briefed on information security pertaining to the threat in certain countries. For instance, SULLIVAN recalled an unclassified briefing at Joint Base Andrews where the Diplomatic Security Service (DSS) warned of a heightened level of physical and electronic surveillance in Russia. Because of this threat SULLIVAN recalled [REDACTED] SULLIVAN also recalled [REDACTED]Since SULLIVAN traveled with secure DOS communication systems while traveling overseas. SULLIVAN would make a secure call, conduct a secure video teleconference. or use the secure computersprovided on the plane if a conversation needed to take place at the classified level. SULLIVAN recalled the[REDACTED] SULLIVAN had no memory of abnormalsecurity screening or unusual functionality of his electronic devices while traveling overseas. SULLIVAN did not conduct foreign travel for personal reasons while at the DOS.
SULLIVAN recalled CLINTON had a Secure Compartmented Information Facility (SCIF) in her residence in Washington DC with secure phone and fax equipment. CLINTON also received information at her DC residence via courier. SULLIVAN could not recall if CLINTON had a SIPRnet computer terminal in her residence.SULLIVAN would primarily transmit or communicate classified information to CLINTON at her DC residence through a secure call. SULLIVAN could not recall if CLINTON used a secure mobile phone. SULLIVAN was not familiar with the infrastructure in CLINTON’S home in Chappaqua, but assumed it had the same capabilities as her DC residence. SULLIVAN did not know if CLINTON had staff at her residences that also held security clearances.
SULLIVAN recalled CLINTON had an “enormous” amount of information, to include classified information, briefed to her in-person or provided to her through paper flow. CLINTON would routinely digest the Presidential Daily Brief (PDB) in paper form and conduct policy meetings daily. SULLIVAN recalled little to no classified information passed to CLINTON electronically. In most instances, if information needed to be sent to CLINTON, it was routine that a senior FSO in the DOS Operation Center on the 7th floor of DOS HQ would facilitate the transmission. If CLINTON needed to be present to receive the information, as in the ease of a secure call or fax, coordination would be done through CLINTON’s assistants.
SULLIVAN recalled CLINTON used a personal email address when she worked in the Senate and while she was at the DOS, but was unaware email was hosted on a private email server in her residence until it became public knowledge in March 2015. Moreover, SULLIVAN knew JUSTIN COOPER and BRYAN PAGLIANO, but never had a conversation with them regarding any private email server. SULLIVAN had no memory of a conversation regarding federal records retention or FOIA implications as it related to the use of private email. SULLIVAN knew the general guidelines at the DOS related to federal records retention. For example,SULLIVAN knew not to delete email from his DOS email accounts. Upon leaving DOS,SULLIVAN boxed up his official DOS paper records and turned them over to the DOS. SULLIVAN recalled the DOS handled the preservation of his email records hem DOS servers. SULLIVAN recalled one brief conversation in the summer of 2014 with MILLS and [ X ] pertaining to the production of federal records, but could not recall more detail.
The email address SULLIVAN recalled CLINTON using was firstname.lastname@example.org.SULLIVAN also recalled that HUMA ABEDIN had a @clintonemail address but could not remember it specifically. SULLIVAN was never asked to have a @clintonemail address andnever requested that one be issued to him. SULLIVAN was unaware of any back-ups, migration, deletion or wiping of email from the clintonemail.com domain. SULLIVAN recalled a conversation with HEATHER SAMUELSON in the fall of 2014 where SAMUELSON told SULLIVAN he may need to look through documents to see if they constitute a federal record, but this process never occurred.
Upon initiation of his employment at DoS, SULLIVAN received a TOP SECRET (TS) Sensitive Compartmented Information (SCI) security clearance. In order receive the foregoing clearance SULLIVAN recalled an orientation and briefing where handling, transporting, and disseminating classified information was discussed. As far as he understood, SULLIVAN had derivative classification authority and could classify information based on the guidance of a classification manual. Other than CLINTON,SULLIVAN was unaware of anyone at DOS that had Original Classification Authority (OCA). As part of his job, SULLIVAN was briefed into a large number of SAP and covert action programs. The process of being briefed into a SAP required an individual from the DOS Bureau of Intelligence and Research (INR) to brief the program and ensure the requisite forms were signed and maintained.SULLIVAN did not recall ever handling SAP material on a TS computer system, but was aware INR had TS computer systems.[REDACTED]
SULLIVAN stated a PC meeting would be initiated by the NSC chair and would require the staff of the government agencies invited to prepare a package regarding whatever topic the NSC would prescribe. As a Standard Operating Procedure (SOP), a PC would initiate a Deputy’s Committee (DC) meeting where certain subject matter experts in each agency would deliberate on their agency’s conclusion pertaining to the prescribed topic. For the DOS, the bureau that covered the topic of the PC meeting would author packages and then funnel them through [ X ] and [ X ] to CLINTON for use in the PC meeting.SULLIVAN would sometimesbe involved inPC meetings if his bureau had astake in the issue. In that instance, SULLIVAN would author sections of written packages that covered the issue. SULLIVAN would gain his knowledge and source his document through a combination of things he read, conversations he had, and classified information. When the PC occurred, each agency would usually bring their Principal plus one other representative. For the DOS it was often CLINTON and the respective Deputy that attended a PC meeting. SULLIVAN attended PC meetings occasionally” and could not recall a precise amount.
After reviewing an email dated June 17, 2011 with subject Iine “Plan for PCtomorrow,” SULLIVAN stated be did not remember the email specifically. SULLIVAN stated he had already viewed this email when released by the DOS through a Freedom oflnformation Act (FOIA) request.SULLIVAN did not recall the specific email or what the PC meeting was about. SULLIVAN understood “nonpaper’ to means an unclassified document without official markings given to a foreign government that states the unofficial position of the US government. SULLIVAN understood ”nonpaper’ to mean this because he had created a “nonpaper” document for CLINTON before. In the context of the displayed email and while reading it in the moment,SULLIVAN thought CLINTON would have wanted him to make an unclassified version of the document, summarize the contents, and then send it to her on a nonsecure fax. SULLIVAN stated that CLINTON took the protection of classified information very seriously.
After reviewing an email dated October 13, 2012, with subject line “Fw: This am Green on Blue,” SULLIVAN stated he did not remember the email specifically [REDACTED] SULLIVAN knows [ X ] and first met him while [ REDACTED]. SULLIVAN worked as colleagues with [ X ] when [ X ] was at the Pentagon and CIA.
After reviewing an email dated April 10, 2011, with subject line “FW: Stevens Update (important),” SULLIVANstated he did not remember the email specifically. SULLIVAN did not think the email was unusual and wasn’t surprised AFRICOM information would be cited in an unclassified email.SULLIVAN would regularly review situation reports from around the world in unclassified email. SULLIVANknew [ X ] as a career FSO that worked in the DOS Operation Center. SULLIVAN stated [ X ] would regularly share events from around the world in unclassified email and had no reason to question [ X ] judgement regarding the proper handling of classified information.[REDACTED]After reviewing an email dated December 27, 2011. with subject line “FW: (SBU),”SULLIVAN stated he did not remember the email specifically. [REDACTED] SULLIVAN had no reason to believe any DOS employees he worked with ever intentionally mishandled classified information and did the best theycould to make a sound judgement when handling classified information[REDACTED]
After reviewing an email dated July 4, 2009 with subject line “FW: Follow Up: Summary of 1055 EDT DPRK Conference Call.” SULLIVAN stated he did not remember the email specifically.SULLIVANdid not specifically recall the name [ X ]. SULLIVAN did recall the name [ X ] and knew her to be a senior Watch Office in the DOS Operation Center. When asked about the content of the email and if he believed the pending military actives of a foreign military was classified SULLIVAN replied the person at DOS who sent the email must have had reason to believe it could be sent on an unclassified system. SULLIVAN stated everyone he worked with at DOS worked hard while under pressure and used the best judgement they could to accomplish the mission. SULLIVAN was unsure why [ X ] forwarded this particular email to his Gmail account but recalled being in Idaho around this time for a bachelor party. SULLIVAN stated that procedure was not routine practice for [ X ] and could not recall another instance where it occurred.
After reviewing an email dated April 27, 2012 with subject line “FW: Day 2,” SULLIVAN stated he did not remember the email specifically. SULLIVAN knew the “1A process” to mean Interagency process. SULLIVAN recalled the general submit matter of the email and remembers [ X ] trying to open the Ground Lines Of Communication (GLOC) between countries after attacks involving the International Security Assistance Force(ISAF).
After reviewing an email dated August 25, 2010 with subject line “FW: NY Times article on Salehi,” SULLIVAN stated he did not remember the email specifically. SULLIVAN did not recall the name SALEHI [REDACTED] At the time, [ X ] was the [REDACTED] and had the ability to email CLOINTON directly, as well as forward email to SULLIVAN.[REDACTED] After reviewing an email dated July 6, 2011, with subject line “FW: US drone strike kills 4 militants in Pakistan.” SULLIVAN stated he did not remember the email specifically [REDACTED] [REDACTED] After reviewing an email dated February 25, 2012 with subject line “FW: Alert,” SULLIVAN stated he did not remember the email specifically, but recalled seeing this redacted email in a FOIA release by the DOS. [REDACTED] [REDACTED]After reviewing an email dated [REDACTED] with subject line [REDACTED] SULLIVAN stated he did not remember the email specifically. SULLIVAN stated that, based on the subject line, [REDACTED] was reporting in a manner he believed to be sensitive but unclassified. SULLIVAN stated [ X ] may have sent this email on an unclassified system because the drone strike could have already hit the news wire. SULLIVAN did not believe reporting on a drone strike after the fact made it less sensitive, but was speculating on [ X ] judgement. SULLIVAN believed reference to a “secure call” in the email demonstrated [ X ] attempt to delineate between what could go in unclassified and classified channels. Additionally, SULLIVAN stated this email was not out of step with how people approached similar matters at the time. Nothing stood out to SULLIVAN at the time as mishandling classified information.
After reviewing an email dated May 16, 2011 with subject line “Re: Senator Kerry has requested to speak with Secretary Clinton.” SULLIVAN stated he had a general recollection ofthe event discussed in the email but did not recall the email specifically. SULLIVAN did not recall the conversation with [ X ] referenced in the email.
After reviewing an email dated August 24, 2011, with subject line “Re: Rasmussen call.” SULLIVAN stated he did not remember the email specifically. SULLIVAN stated he usually found out about [REDACTED] through open source reports, DOS email reflecting news accounts and more rarely through someone in the DOS HQ building.[REDACTED]After reviewing an email dated [REDACTED] with subject line [REDACTED] SULLIVAN stated he did not remember the email specifically. SULLIVAN stated the email was “unusual” and he could not determine what he was referring to by the [REDACTED] but he was not sure. [REDACTED]After reviewing an email dated[REDACTED] with subject line [REDACTED] SULLIVAN stated he did not remember the email specifically, SULLIVAN stated the call with [ X ] regarding the nomination of a second strike was with [ X ] SULLIVAN stated he infrequently communicated with [ X ] and, when he did, it was through a mix of secure calls unclassified calls and unclassified emails. [REDACTED] After reviewing an email dated [REDACTED] with subject line [REDACTED] SULLIVAN state he did not remember the email specifically. SULLIVAN did not recall how he communicated with[ X ] and guessed it was not by phone and most likely SULLIVAN cut and pasted from another unclassified email.SULLIVAN did not recall speaking with [ X ] generally. While working at the DOS, SULLIVAN stated he can’t recall one time he felt uneasy about something he read in an unclassified email. SULLIVAN could not recall an instance where anyone expressed a concern with the type of information coming over the unclassified email system or with handling classified information in general.SULLIVAN stated CLINTON never expressed a concern about the handling classified information. While at the DOS, SULLIVAN felt his colleagues’ judgement was good and that they had a good understanding of how to handle classified information. Generally, while at the DOS,SULLIVAN stated he had to pay attention to what information goes on what channel. For instance, he would convey what he could on an unclassified system and then go to equipment authorized to handle classified communications to convey more information.
After reviewing an email dated October 4, 2009. with subject line “FW: Cover memo.” SULLIVAN’s attorney. BETH WILKINSON, asked for the classification of the email. After being advised the email was pending classification review and to treat the email as classified WILKINSON stated her client would not answer questions related to the foregoing email, or any documents related to the email.
SULLIVAN stated SYDNEY BLUMENTHAL was someone CLINTON knew from years back and was someone who “liked to help the cause.” As SULLIVAN under stood it. BLUMENTHAL had a variety of sources of information.SULLIVAN was unaware of the identities of the sources used by BLUMENTHAL. SULLIVAN recalled BLUMENTHAL would sometimes refer to information he gathered from former Intelligence officers, but SULLIVAN understood those people to be retired with no access to classified information. SULLIVAN would occasionally talk to BLUMENTHAL through phone conversations and maybe through email. In those conversations,BLUMENTHAL would relay information about “big pictures’ topics BLUMENTHAL thought were relevant and SULLIVAN would pass it on to CLINTON or DOS stakeholders to have them validate the information. SULLIVAN never heard of a concern that BLUMENTHAL had access to, or was relaying, classified information.
The original notes of the interview, signed aforementioned non -disclosure agreements, and documents displayed to SULLIVAN will be maintained in a FD-340 envelope and filed with the captioned investigation.
Patrick Kennedy 12/21/15 Page 56
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 2/21/2015
PATRICK FRANCIS KENNEDY, Under Secretary of State for Management, was interviewed at his office at Department of State (DoS), Harry S. Truman Building, 2201 C Street NW Washington. D.C. by Federal Bureau of Investigation (FBI) Special Agents (SA) [ X ] and [ X ] Also present for the interview was FBI National Security Law Branch (NSLB) Attorney [ X ] and Senior DoS Counsel [ X ]. After being advised of the identity of the interviewing agents, and the nature of the interview, KENNEDY provided the following information:
KENNEDY was aware Secretary of State HILLARY CLINTON used a personal email account during her tenure as Secretary, but was unaware that she was using a personal server. KENNEDY received an unclassified email from CLINTON approximately once a month and noted those emails came from a clintonemail.com address.
The DoS “GO” system allows for DoS employees to remotely access their DoS account from a non-DoS server. DoS policy does not support the routine use of private email accounts for DoS business. However, it was understood that exceptions could be made in emergency situations, and in doing so, the employee should carbon copy their DoS email account for matters of record.
KENNEDY mostly received emails from CLINTON after hours, and so infrequently he was not aware of the volume of which she was using her personal account. KENNEDY was not aware CLINTON was solely using a personal email account for communicating unclassified DoS business.
DoS policy does not support the use of private email servers for continued personal use, nor the use of personal servers for DoS business, thus there is no approval process for their use. DoS policy remains the same for the use of both personal emails and servers today as it was during CLINTON’S tenure.
KENNEDY recalled news stories implying a former DoS employee, BRYANPAGLIANO, set up CLINTON‘s private email and server “on the side” while working for DoS.However, KENNEDY noted he was not aware of PAGLIANO’s involvement until it hit the press. DoS is refraining from direct inquiries into PAGLIANO’s involvement until the FBI completes its investigation.
KENNEDY had no direct knowledge of any of CLINTON’s predecessors [COLIN POWELL and CONDOLEEZZA RICE] using private email accounts, but noted he was aware POWELL publically mentioned he used a private email account during his tenure as Secretary of State in his most recent publication.
DoS has the responsibility of interfacing with foreign diplomats and political representatives within the United States and overseas to help develop policy. Sometimes information from these dignitaries is given in confidence and sometimes it is not. The classification of such information is specific to the situation. KENNEDY explained that information given in confidence may be initially transmitted as unclassified to report the information, but later “up-classified” when it is further assessed the disclosure of such information might damage national security or diplomatic relationships. Ultimately, the originator of a document or email is responsible for classifying the document.
KENNEDY explained the Intelligence Community (IC) “steals” information, and thus has to classify said information to protect sources and methods. DoS may get the same information through diplomatic channels and not classify that information because it was not received from a sensitive source or a method. According to KENNEDY, the classification of a DoS document depends on the content of the message and if it is important for the other party not to disclose the information
If a DoS employee wanted to use classified information derived from IC sources in an unclassified channel, they would need to submit a tearline request to do so. DoS cannot declassify a document that was not originally classified by a DoS classification authority.
The Secretary of State is a declassification authority, as are the Secretary’s Chief ofStaff and Deputy Chief of Staff. KENNEDY believed CHERYL MILLS, JAKE SULLIVAN, and possibly HUMA ABEDIN would have been classification authorities during CLINTON’s tenure at DoS.
KENNEDY acknowledged DoS received their first request to produce emails related to CLINTON’s email sometime in 2014. The request was related to a Congressional inquiry concerning documents related to the 2012 attack of the United States consulate in Benghazi. The initial request was focused on specific emails, but was later expanded to include a broader production.
KENNEDY was not part of the initial dialogue with CLINTON concerning the aforementioned request for emails. KENNEDY was only involved with interacting with Congress concerning the status of the request, but was not involved in the process of deciding what was and was not released in response. The DoS Freedom of Information Act (FOIA) team directly handled the request by reaching out to the appropriate Bureau or Secretariat who maintained the information concerning Benghazi. The Bureau of Near East Affairs would have been contacted by FOIA in regards to generalBenghazi information. [REDACTED]The DoS FOIA team would have reached out to the records staff in the Executive Secretariat for specific CLINTON communications concerning Benghazi.
DoS FOIA inquiries are handled by the Bureau of Administration/Global Information Services, [REDACTED] The DoS Bureau involves a team of supervisors, processors and reviewers, almost all of which are retired foreign or civil service. The supervisors assign the requests to processors who load the information into their FOIA management system and send out requests to all the Bureaus who have a relevant relation to the request. The review team collects the information received from the relevant Bureaus and determines what if any exemptions should be considered and/or applied. The FOIA review team also determines if the information responsive to the request contains any outside agency equities, and appropriately coordinates with those agencies to respond to the request. Furthermore, the FOIA response goes through a review and reconciliation process to ensure all responsive documents are marked and redacted appropriately.[REDACTED] in regards to the DoS FOIA process. However, there is an appeals process which involves a FOIA review board managed out of the DoS Information Oversight Office.
Responsive documents to FOIA requests are also placed on the DoS FOIA website in their releasable form to avoid redundant FOIA requests from other parties.
KENNEDY recalled discussions concerning CLINTON wanting to cull her emails prior to producing emails related to the Congressional/FOIA requests. The purpose of the cull was to remove emails related to personal communications between CLINTON and her family that were not relevant to DoS matters. DoS was not involved in the cull, as it is the responsibility of the individual to produce records of relevance for the record. KENNEDY did not recall who was involved in assisting CLINTON cull her emails.
DoS employees identify their own files for the record and can generally archive them in the State Messaging and Archival Retrieval Toolset (SMART) system, which allows for electronic marking/tagging of emails for the record. However, SMART is not used by the Executive Secretariat, thus CLINTON would have likely had to use a print and file system, or simply keep all of her emails for the record. As a matter of personal preference, KENNEDY retains all of his electronic DoS communications in an active file.
When asked in retrospect if he had concerns over how DoS conducted its response to the FOIA request regarding CLINTON’S emails, KENNEDY responded “yes and no.” KENNEDY did not elaborate. KENNEDY further explained he contacted the FBI Deputy Director and requested an electronic copy of all the CLINTON emails turned over to the FBI in regards to the FBI’s investigation, so DoS could make a better assessment in regards to evaluating their role/response.
KENNEDY “categorically rejected” allegations he attempted influence FOIA markings to protect and/or mask classified information. KENNEDY[REDACTED] and described her as someone who “says it like it is” and has “no fear of telling truth to power.” KENNEDY further explained he has full confidence [X ] would not allow undue influence to effect (sic) her ability to properly carry out the FOIA process in accordance with the Presidents mandate to both air on the side of transparency and national security
KENNEDY was one of three people he was aware of at DoS who have the authority to upgrade the classification of a document, the Secretary of State and [ X ] being the other two. A classification upgrade would be warranted in a situation where the change in a government may change relationships, and information that would not have endangered the United States or sources before saidgovernment change would then be considered a threat to national security or to the sources safety.
KENNEDY stated he was available for re-contact should interviewing agents have additional questions to ask at a later date.
Agent notes are maintained in a I A envelope.
(???) 12/14/15 Page 60
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 12/18/2015
On December 14, 2015, [REDACTED], Information Resource Management/Executive Secretariat, US Department of State, office phone (XXX) XXX-XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) [ X ] and SA [ X ] After being advised of the identity of the interviewing nature of the interview, [ X ] provided the following:[REDACTED] Information Resource Management (IRM) for the Executive Secretariat (IRM/ES) and was in that position during Secretary HILLARY CLINTON’s time in office. Part of [ X ] job was to maintain and support the infrastructure for the UNCLASSIFIED and SECRET networks for the Executive Secretariat. Every Department of State, hereafter State, Secretary [ X ] has interacted with, except for Secretary JOHN KERRY, has used personal email during his or her time in office. For example, Secretary COLIN POWELL used America Online. Secretary Clinton, however, was the first Secretary to use a privately maintained email server, hereafter Server. [ X ] did not agree with the decision, but it made sense to him because Secretary CLINTON had used the Server for the previous two years. Secretary CLINTON did not have adesktop computer in her office to access email while at State, but did have non-SCIF space near her office where she could use her BlackBerry. [ X ] believed Secretary CLINTON received an operational security briefing that involved the National Security Agency after being sworn in as Secretary of State. [ X ] from the Bureau Security Office would have coordinated the briefing. [ X ] became aware of Secretary CLINTON’s Server at the time she was sworn in as Secretary of State. She was offered a State email address, but decided to use the Server from her 2008 presidential campaign. It was at this time [ X ] met BRYAN PAGLIANO. PAGLIANO was the administrator for Secretary CLINTON’s Server, so [ X ] interacted with him to keep it communicating with State systems. For example, there were approximately 5-6 instances where emails sent by Secretary CLINTON to State employees, or vice-versa, were not received by the end user. In these instances, [ X ] and PAGLIANO worked together to modify settings so the emails would make it through. Additionally, the two worked to establish transport layer security (TLS) betweenState systems and the Server as a security measure.
Since PAGLIANO was an IRM Schedule C employee of State [ X ] invited him to various briefings regarding security and system vulnerabilities. PAGLIANO’s job at State was policy development related to mobile computing, so these briefings were also relevant to his role in that capacity. [ X ] specifically recalled discussions about Bluetooth vulnerabilities and blue jacking, becausethose vulnerabilities were [ X ] primary concern due to Secretary CLINTON’s BlackBerry use. Although [ X ] made an effort to keep PAGLIANO informed of security matters, he was notinvolved in decisions regarding Server security, nor does [ X ] know if the Server was hacked or actively monitored for intrusions. [ X ] did not believe it was possible for PAGLIANO to secure the Server as well as State servers, which are monitored and hardened by a team of full time employees. Additionally, he did not know how the Server was paid for or where it was physically located.
In approximately February 2011, several State employees were the victims of a Gmail and yahoo hack where users received an email with a link directing them to change their email password.The link took users to a fraudulent site that allowed [REDACTED] to obtain the user’s Gmail/yahoo account to auto-forward to a [REDACTED]. [REDACTED] group sent a security alert to POEMS users regarding the hack, but since PAGLIANO was not a POEMS user, he would not have received the alert.[ X ] was asked to delete approximately two emails related to the public release of Secretary CLINTON’s emails. The request was in relation to cleaning unclassified State systems, however, due to an FBI preservation request, [ X ] had not deleted any communications. He recalled one of the emails being from an Ambassador and began with a phrase similar to “My classnet is down, so I’ll start here…” [ X ] could not recall any other details, but offered to provide a copy of the emails if requested. There were no spills of classified information on Secretary CLINTON’s email account while she was at State insofar as [ X ] was aware.
Secretary CLINTON received classified information in a paper briefing book that was maintained by her special assistant. When outside of Washington, DC, State travel teams turned hotel rooms into classified information processing areas where personnel, including the Secretary, could communicate securely.
Only Secretary CLINTON’s inner circle could email her directly. This group consisted of JAKESULLIVAN, CHERYL MILLS, and HUMA ABEDIN for State Department purposes. For this reason, when [ X ]emailed ABEDIN’s BlackBerry, he considered it the equivalent of emailing Secretary CLINTON as a proxy for Secretary CLINTON.[ X ] stated the FBI’s investigation would be incomplete without talking to PAGLIANO. PAGLIANO is a very sharp and technically savvy individual who likely took action based on the security information and briefings provide by [ X ] and others. Furthermore, [ X ] believes additional information could exist on the accounts of MILLS because she served a proxy for Secretary CLINTON.
Steve Linick8/5/15 Page 62
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 08/05/2015
STEVE A. LINICK,Inspector General, United States Department of State, Office of Inspector General (STATE IG), 2121 Virginia Avenue, NW, Suite 8100. SA-3, Washington, DC 20037, telephone (XXX) XXX-XXXX mobile phone (XXX) XXX-XXXX email [ X ]@state.gov was interviewed in person by FBI Special Agents [ X ] and [ X ]. After being advised of the identity of the interviewing Agents and the nature of the interview, LINICK provided the following information:
On or about March 12, 2015, STATE IG received a letter from U.S. Senators Bob Corker, Richard Burr and Ron Johnson. The letter requested a review of State Department employees’ usage of personal email for official purposes and coordination with relevant agencies to determine whether classified information was transmitted or received by State Department employees over personal systems. On April 16, 2015, pursuant to this letter, STATE IG initiated a review of the use of personal communicationshardware and software by five Secretaries of State and their immediate staffs. The review covered current Secretary of State John Kerry all the way back to former Secretary of State Madeleine Albright. STATE IG’s review was further broken down into three categories 1) On-boarding Process (which looked into the approval process for the use of personal networks), 2) Preservation of Records (how records were maintained/preserved), and 3) the FOIA response.
LINICK believed STATE IG’s office was not qualified to determine whether classified information was transmitted and referred that portion of the review to the Office of the Inspector General of the Intelligence Community (ICIG). Separately, STATE IG had the Benghazi review and [REDACTED] The Department of State was also conducting a Freedom of Information Act (FOIA) review of fifty-five thousand pages of emails belonging to Secretary Clinton pursuant to a court order. In December 2014, the Department of State received hard copies of those documents from Secretary Clinton’s Counsel.
LINICK initially believed Department of State received electronic copies of Secretary Clinton’s email from her private server. During a July I, 2015 meeting with STATE IG. Patrick KENNEDY, Under Secretary for Management, U.S. Department of State and [ X ] advised STATE IG the Department of State had obtained an electronic copy of Secretary Clinton’s email. On July 10, 2015, STATE IG requested two copies of the .PST files for use by STATE IG and ICIG. Later, KENNEDY advised STATE IG that the Department of State only had hard copies of the documents, which were scanned and uploaded to ClassNet. LINICK obtained preserved Department of State email records for MILLS and ABEDIN.
On May 26, 2015 ICIG and STATE IG sent a joint preservation letter to Williams & Connolly for the @clinontonemail.com (sic) account records in their possession. Although, LINICK was generally aware of the status of ICIG’s ongoing review to identify classified information, which consisted of jointly working with the Department of State FOIA staff, LINICK was not heavily involved in that process. LINICK recommended the FBI interview Department of State employees [ X] Office of Information Programs and Services and [ X ] Office of Global Information Services. Both[ X ] and [ X ] were involved in the FOIA review process and alleged there were potentially hundreds of classified emails found during their review. [ X ] further alleged that two [REDACTED] currently working at State Department were meddling with the FOIA review process.
On or about June 19, 2015 STATE IG and ICIG jointly made four recommendations to the State Department related to the FOIA review process. The recommendations were as follows:
- Recommend State Department FOIA office request staff support from IC FOIA offices to assist in the identification of intelligence community equities;
- Recommend IC FOIA officers review the emails to ensure that ClassNet use is appropriate beforetransmitting to the State Bureaus for review;
- Recommend State Department FOIA seek classification expertise from the interagency to act as a final arbiter if there is a question regarding potentially classified materials; and
- Recommend State Department FOIA Office incorporate the Department of Justice into the FOIA process to ensure the legal sufficiency review of the FOIA exemptions and redactions.
Based on a later response from KENNEDY, the Department of State had accepted recommendations number one and three. LINICK suggested the FBI talk to [ X ] and [REDACTED] who both worked at STATE IG. [ X ] and [ X] would be able to give more insight into the FOIA review process, and STATE IG’s interaction with Secretary Clinton’s counsel, Williams & Connolly. LINICK believed [ X ] had sent emails back and forth with David KENDALL, Secretary Clinton’s attorney.
LINICK surmised the Department of State Foreign Affairs Manual that was in use during Secretary Clinton’s tenure as Secretary of State did not give clear and specific guidance regarding the use of private email, although it was highly discouraged. If employees used private email to conduct official State Department business, that email had to be forwarded to an @state.gov email within twenty days after being sent. The Department of State had no process for approving the use of private networks. There were no rules in place that specifically denied Secretary Clinton the use of her private network.
LINICK did not believe he was qualified to explain the Department of State’s retroactive classification process. LINICK did not know whether the Department of State had provided a safe toWilliams & Connolly, nor did LINICK know if the Department of State had the authority to certify a non-government facility as secure storage for classified information.
LINICK advised Secretary Clinton had brought Bryan PAGLIANO into the Department of State to set up her private network. PAGLIANO was still a Department of State employee who worked in the Department of State’s information technology department. However, PAGLIANO refused to be interviewed by STATE IG. PAGLIANO informed STATE IG he was represented by counsel from Akin Gump Straus Hauer & Feld, LLP. LINICK recommended the FBI interview PAGLIANO.
LINICK did not intend on directly contacting Secretary Clinton to request electronic copies of her private network email. Since there was a spillage of classified information, for which STATE IG is not equipped to handle, the referral was made to the FBI.
Justin Cooper 9/2/15 Page 66
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:09/02/2015
JUSTIN GREGORY COOPER, date of birth (DOB) XX/XX/XXXX and social security account number (SSAN) XXX-XX-XXXX was interviewed in by Federal Bureau of Investigation(FBI) Special Agents (SA) [ X ] and [ X ] at the law offices of [REDACTED] located at [REDACTED]Washington DC 20006. Also present for the interview were [ X ] attorneys [REDACTED]as well as attorney [ X ] U.S. Department of Justice and [ X ] Assistant United States Attorney for the Eastern District of Virginia. After being advised of the identity of the interviewing Agents, and the nature of the interview, COOPER provided the following information:
Before commencing the interview, COOPER’s attorney [ X ] stated the offices of[REDACTED] were in possession of two (2) Apple MacBooks and one (1) Seagate external hard drive belonging to COOPER. COOPER used one of the MacBooks from approximately 2009 to 2013 and transferred his files to the second MacBook in approximately 2013. The Seagate external hard drive contained back-up files belonging to COOPER. On the foregoing digital media existed files related to the upgrade of former Secretary of State HILLARY CLINTON’s BlackBerry, incurred while COOPER upgraded HILLARY CLINTON’s BlackBerry device in 2009 and 2011. These files were separate, segregated and labeled in folders on each of COOPER’s digital media as described above. Additionally, each of COOPER’s digital media items contained email exchanged with an email address belonging to HILLARY CLINTON, [EMAIL ADDRESS NOT LEGIBLE ][ X ] indicated COOPER is willing to discuss providing the FBI the folder containing BlackBerry files relating to the upgrade of HILLARY CLINTON’s device, and all emailinvolving the email address HDR22@clintonemail.com. Additionally, [ X ] indicated COOPER did not have the right to provide consent to search the foregoing BlackBerry files and to gain consent to search, [ X ] believed the FBI would need to consult HILLARY CLINTON’s lawyers at WILLIAMS AND CONNOLLY.
COOPER stated he worked for former President BILL CLINTON for approximately 16 years as an aide serving many capacities. In 2007, COOPER and other aides debated using a private server for the sole purpose of email exchange and as a result, a contract with Apple was signed for the set-up and administration of an OS X server (hereafter, Apple server). The foregoing Apple server was installed at the CLINTON residence located in Chappaqua, New York and was online in and around June 2008 and configured for a handful of users. COOPER recalled[REDACTED]having emailaccounts using the domain presidentclinton.com. The domain wjcoffice.com was another domain used for BILL CLINTON related staff and email, but COOPER referred to it as a legacy domain that had mostly forwarded email. BILL CLINTON did not have an email account on the Apple server and did not use email as far as COOPER understood. In January 2009, HILLARY CLINTON was looking to move away from a BlackBerry with AT&T service, and decided to register the domain clintonemail.com and host it on the Apple server. COOPER had no specific memory, but believed he could have been the individual to register the domain because he handled financial issues for the CLINTONS. In or around January 2009, the users determined the Apple server was not robust enough and based this assessment on unreliable BlackBerry connectivity. At that time, the Apple server was not run in conjunction with a BlackBerry Enterprise Server (BES).
In or around March 2009, BRYAN PAGLIANO, an Information Technology (IT) professional used by HILLARY CLINTON, took full control of setting up a Windows Small Business Server (hereafter, Windows server) as well as a BES, at the CLINTON residence in Chappaqua, New York. PAGLIANO built the server from equipment used in HILLARY CLINTON’S campaign for the democratic nomination to run for President of the United States. COOPER did not know where PAGLIANO built the server, but knew it was in place and running at the Chappaqua residence in or around March 2009. COOPER was aware that PAGLIANO set-up firewalls, spam filters and possibly Cisco AdaptiveSecurity Appliance (ASA) software, but only PAGLIANO would know the configuration of the set-up. PAGLIANO managed the porting of users from the Apple server to the Windows server, as well as handled all software upgrades and general maintenance. COOPER believed there was a back-up drive as part of the Windows server and wasn’t aware of any additional back-ups, although he recalled many boxes around the Windows server and reiterated PAGLIANO would know the exact configuration. Concerning the various avenues of connectivity to the server for user devices, COOPER referred Agents to PAGLIANO. Cablevision provided internet service to the CLINTON residence in Chappaqua, and that internet service was used to connect the Windows server. COOPER believed no outside spam service provider was retained for the Windows server. COOPER believed in instances where the Windows server went down, like in the event of a power outage, emails were re-directed to a Gmail account as a back-up. COOPER was aware of two (2) power outages, based on storms or natural disasters, occurring during the lifecycle of the Windows server, but was not aware of any specific users or corresponding Gmail accounts that had email forwarded.
COOPER was granted administrator rights, along with PAGLIANO, to the Windows server and described his role as the customer service face. As part of this role, COOPER could add a user or reset a password. COOPER also continued in his role of acquisition or purchasing for the CLINTONs, and this extended to server related items. For instance, COOPER recalled using both Network Solutions andGo Daddy to register domains, but would only have used these companies because he was directed to, either by Apple or PAGLIANO. COOPER read in the press about the Windows server being associated with a company called Perfect Privacy, and would not be surprised if it was accurate, but had no specific memory of using the company. COOPER registered a Secure Socket Layer (SSL) at PAGLIANO’s direction and recalled it being used for more security when users accessed their email from various computers, and eventually, iOS devices. Additionally, COOPER vaguely recalled the Windows server using a Microsoft software product called Forefront.
COOPER stated there was no official security policy given to users of the Windows server. Generally, when users received suspicious emails and forwarded them to COOPER, he would forward them to PAGLIANO. As an administrator of the Windows server, COOPER would get emails indicating brute force attacks (BFA). COOPER would also forward those to PAGLIANO and recalled PAGLIANO installing Internet Protocol (IP) blocking software in an attempt to thwart the BFA. On at least two (2) occasions, COOPER remembers making [ X ] Special Agent in Charge, United States Secret Service, aware of suspicious email received on the Windows server.
COOPER recalled conversations between CHERYL MILLS and BRYAN PAGLIANO in or about June 2013 pertaining to the decommissioning of the Windows server and the next phase of communication infrastructure for HILLARY CLINTON, after her tenure as Secretary of State in 2013. Although COOPER wasn’t involved and doesn’t recall how they were selected, PLATTE RIVER NETWORKS (PRN) was chosen to maintain a server for the CLINTONs. COOPER did recall some communication with PRN regarding the transfer of user names and accounts from the Windows server to PRN. An individual employed by PRN named [ X] Last Name Unknown (LNU) was granted administrator rights on the Windows server in order to effect the transition to PRN’s control. At this point Interviewing Agents displayed a document to COOPER identifying administrator accounts on the Windows server. COOPER identified the administrator account [REDACTED]as most likely being the user name for LNU from PRN. In or around July 2013, COOPER received instructions for his email account that indicated PRN was in control of the Windows server email data. Due to COOPER’s transition in employment, his email account was off the server in or around 2013. COOPER does not know when the Windows server was shut down and how or where it was transported.
COOPER had no knowledge of the process HILLARY CLINTON undertook when acquiring her emails from the clintonemail.com domain and providing them to the Department of State as part of a Freedom of Information Act (FOIA) request. COOPER speculated that PRN was involved in the acquisition of the entire content of her account and DAVID KENDALL was consulted when determining which specific emails would be turned over.
COOPER believed the Windows server had three domains: wjcoffice.com, presidentclinton.com and clintonemail.com. To the best of COOPER’s memory, he recalled [REDACTED ] having email accounts using the domain presidentclinton.com or wjoffice.com as part of their work for BILL CLINTON. COOPER believed HILLARY CLINTON, [ X ] and HUMA ABEDIN had email accounts under the domain clintonemail.com as part of their association or work for HILLARY CLINTON. COOPER believed the Windows server was used exclusively for the exchange of email.
COOPER has never stored or transmitted classified information over an unclassified network and was unaware of any discussions regarding the transmittal of classified information on an unclassified network by others
Notes of this interview, as well as the document displayed to COOPER, will be maintained in a FD-340 envelope and filed with this captioned investigation.
Justin Cooper3/2/16 Page 71
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 04/04/2016
On March 2, 2016, JUSTIN GREGORY COOPER, date of birth (DOB) XX/XX/XXXX and social security account number (SSAN) XXX-XX-XXXX was interviewed in by Federal Bureau of Investigation (FBI) Special Agents (SA) [ X ] and [ X ] at the law offices of [REDACTED] located at [REDACTED]Washington DC 20006. Also present for the interview were [ X ] attorneys [REDACTED] and [ X ] as well as U.S. Department of Justice attorneys [ X ] and [ X ] After being advised of the identity of the interviewing Agents, and the nature of the interview, COOPER provided the following information:
After reviewing an email referencing a new laptop for HILLARY CLINTON, COOPER recalled a Macbook Air purchased for CLINTON in the 2008 timeframe, but did not believe she ever used it. He did not recall the backup drive referenced in the email. The Macbook was likely purchased with a credit card because COOPER[REDACTED]to CLINTON’s accounts and, therefore, had credit cards[REDACTED]COOPER was notinvolved in the setup of the Macbook, but believed it was setup to access CLINTON’s email. The intent was for CLINTON to use the Macbook in addition to her BlackBerry. In addition to COOPER, HUMAABEDIN,[ X ] and, later, MONICA HANLEY frequently assisted CLINTON with setting up any new technology devices.
COOPER was aware CLINTON had Sensitive Compartmented Information Facilities (SCIFs) in both her New York residence as well as her residence in the District of Columbia (DC). The SCIF at the DC residence [REDACTED] COOPER knew CLINTON to have access to the SCIF and knew ABEDIN was frequently there, but did not know if ABEDIN could access the SCIF when it was secured. COOPER did not have the combination to open the SCIF. The SCIF doors at both residences were not always secured, including times when CLINTON was not at the residences. When CLINTON became the Secretary of State, COOPER assisted the team from the United States Department of State (State) with questions regarding the communications infrastructure at the New York residence. Both residences had safes, home computers, secure Cisco phones, secure and non-secure fax, and secure video capabilities inside of the SCIF. COOPER was unaware of who would receive secure faxes when they were transmitted. The only individual at either residence COOPER believed to have a clearance was possibly [ X ] as a result of his time in the military.
Leading up to the installation of the Apple Server, COOPER, for several reasons, identified a need to setup a private email server located at the CLINTON residence. Those reasons included:
* segregating different aspects of WILLIAM CLINTON’s post-presidency activities
* separating politics from the work of the Clinton Foundation
* [ REDACTED} President CLINTON’s office and might attempt to gain physical access to the server if it was located in the office
* An outside vendor might not report a hack attempt
After a series of phone calls with Apple, COOPER contracted with Apple Business Services to setup a server, hereafter Apple Server, for handling email for a small number of users working in the office of President CLINTON. COOPER did not recall how he paid for the Apple Server, but he likely used a credit card. Apple installed the Apple Server in the basement of the New York residence, however, COOPER did not recall if he was present for the setup. The CLINTON family and the staff at the New York residence were the only individuals with physical access to the Apple Server. The Apple Server design included a backup to an internal RAID drive. Apple assisted COOPER with the setup of the wjcoffice domain on the Apple Server, but Apple did not have ongoing access to the Apple Server or its contents. COOPER was the only one with administrative access to the Apple Server initially, later, BRYAN PAGLIANO was given access to effect the transfer of data on the Apple Server to a Microsoft Exchange server, hereafter Exchange Server. COOPER did not assist in exporting any of the data or files to the Exchange Server, nor did he create any archives of clintonemail.com data. The decision was made to move to the Exchange Server because the Apple Server did not keep up with changing developments in technology and, eventually, users experienced problemswith email delivery on their BlackBerry devices.
COOPER believed HILLARY CLINTON had an email account on the Apple server; however, ABEDIN did not have an account. CLINTON either came up with or approved the username HDR22 for her email address.
After reviewing an email fragment referencing a potential hack of the Apple Server, COOPER stated he could not recall any details and did not believe the hack was ever confirmed.
CLINTON obtained a new BlackBerry device whenever she had an issue with her device, such as a trackball failure, cracked screen, or the device was too heavy. When one of these issues occurred, whoever was working in close proximity to CLINTON would obtain a new device for her. COOPER believed HANLEY, [ X ] and [ X ] to be the individuals who procured new devices for CLINTON. He did not recall obtaining devices on eBay or similar outlets. COOPER sometimes assisted others with completing the switch to a new device by leading them through the process of backing up data from the old device and transferring it to the new device. After these steps were complete, COOPER would activate the new device on the Apple Server or, later, the Exchange Server. The two BlackBerry backups previously provided to the FBI by COOPER were likely from situations where COOPER directly handled the transition between devices. In these cases, COOPER destroyed the old devices by breaking them in half or hitting them with a hammer.
After reviewing an email referencing the replacement of CLINTON and ABEDIN’s SIM cards, COOPER stated he did not recall a process whereby users would regularly switch SIM cards in their mobile devices, nor did he recall why CLINTON and ABEDIN received new SIM cards in the specific situation referenced in the email.
After reviewing an email dated May 30, 2009, COOPER stated he could not recall any details regarding a new BlackBerry for CLINTON in that timeframe.
After reviewing an email regarding new security policies, COOPER stated Research in Motion (RIM), provided new tools on a regular basis to increase the security of BlackBerry devices. Typically, when a user switched to a new device, COOPER would implement an updated security policy on the device. As an example of a feature he would add to a security policy, COOPER stated he required users to enter a more complex password. Users on older devices would have the old security policy.
The iPads used by CLINTON were for reviewing email and other content. COOPER stated [ X ] advocated for CLINTON’s use of an iPad. Regarding specific iPads, COOPER recalled an iPad mini and at least one iPad having a cellular data connection in addition to a wireless network connection. COOPER never set up any of the iPads and, therefore, had no information on Apple IDs, iCloud accounts, or device passwords. One of the iPads locked out CLINTON’s email account on one of the servers when it attempted to connect using an old password. COOPER could not recall on which server this event occurred.
After re viewing an email dated July 26, 2010, with the subject line “Re: CC for IPad,” COOPER confirmed [ X ] purchased an iPad for CLINTON on or about that date.
After reviewing a chart with the heading “202 [ REDACTED “] COOPER stated he recognized the phone number as CLINTON’s second phone number. CLINTON usually carried a flip phone with her BlackBerry because it was more comfortable to talk on. Additionally, CLINTON could use her BlackBerry while talking on the flip phone. COOPER did not recognize any of the specific phones displayed in the chart.
COOPER stated [REDACTED]and he utilized Google hosting services for email when there was a problem with the Apple Server or Exchange Server. To effect this change, COOPER would alter the settings on a user’s device to check Google for new messages. COOPER could not recall if CLINTON or ABEDIN utilized Google hosting services during Hurricane Sandy or other outages. If they had used Google, it would have been a team effort to set up their devices because COOPER was traveling at the time.
After reviewing emails regarding the transfer of an archive of HILLARY CLINTON’s emails, COOPER stated he did not recall providing a laptop to HANLEY for this purpose, but it was conceivable he could have repurposed a laptop from President CLINTON’s office and assisted in the transfer of the email files. COOPER did not recall a USB flash drive containing the email files. He also did not recall HANLEY returning the laptop in early 2014; however, he became a consultant to President CLINTON in the fall of 2013 and was no longer involved in day-to-day business by 2014.
COOPER had minimal contact with Platte River Networks (PRN). He recalled one interaction with [ X ] to pass along passwords, but did not have any other involvement with PRN. COOPER did not have an email account with President CLINTON’s office after he became a consultant. COOPER had no knowledge of Freedom of Information Act production or the cull down process, as it related to CLINTON’s emails from her time as Secretary of State.
Notes of this interview, as well as the documents displayed to COOPER, are maintained in a FD-340 envelope and filed with the captioned investigation.
Justin Cooper 6/21/16 Page 75
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 06/24/2016
On June 21, 2016, JUSTIN GREGORY COOPER, date of birth (DOB) XX/XX/XXXX and social security account number (SSAN) XXX-XX-XXXX was interviewed telephonically by Federal Bureau of Investigation (FBI) Special Agents (SA) [ X ] and [ X ]. Also on the call for the interview were attorneys [ X ] and [ X] as well as attorney [ X ] U.S. Department of Justice. After being advised of the identity of the interviewing Agents, and the nature of the interview, COOPER provided the following information:
COOPER recalled a personally-owned iMac computer in the Sensitive Compartmented Information Facility (SCIF) of both the Washington, DC and Chappaqua, NY residence of HILLARY CLINTON. Despite not knowing the exact model, COOPER described them as being identical models with a one-inch-thick monitor.
COOPER stated an Apple server was set-up for email exchange for aides working for former President WILLIAM CLINTON. COOPER did not recall a specific person deciding to set-up the server, but more a consensus among aides.
In or around December 2008, COOPER recalled having conversations with HUMA ABEDIN pertaining to HILLARY CLINTON moving away from an AT&T provided email account and establishing an email domain on the Apple server. COOPER and ABEDIN discussed a covert email domain versus a domain including the CLINTON name. ABEDIN “blessed off” on the @clinton.email domain name and COOPER registered the domain in January 2009. COOPER could not recall who created the handle of HILLARY CLINTON’s email account email@example.com, but thought she typically approved her email account names. COOPER did not know if anyone else had HILLARY CLINTON’s email account password, but stated if anyone would, it would be ABEDIN.
COOPER did not have a specific memory of registering HILLARY CLINTON’s email domain and setting up her clintonemail.com account on the Apple server. Most likely, COOPER believed he registered the domain, and added HILLARY CLINTON’s email account to the Apple server, because he could think of no one else that would have performed that task. COOPER stated he most likely initially set HILLARY CLINTON’s firstname.lastname@example.org account to forward to her BlackBerry. When HILLARY CLINTON would reply from her BlackBerry her email address would represent as hdr22@cIintonemail.com. With that configuration, HILLARY CLINTON’s incoming email content would have resided on the Apple server for a period of time, but not her sent message. Again, COOPER stated this was “all a blur” to him and he was relaying the most likely scenario.
In early 2009, COOPER recalled conversations with ABEDIN regarding moving to another email server system, but could not recall specifics. COOPER recalled ABEDIN knew BRYAN PAGLIANO from his work on CLINTON’s 2008 presidential campaign and held him in high regard. PAGLIANO began building a new email server system in early 2009. PAGLIANO had to have been given access to the Apple server in order to migrate email accounts and content to the new server he built. COOPER did not recall giving PAGLIANO administrator access to the Apple Server.
COOPER did not specifically recall acquiring an Apple computer for HILLARY CLINTON to use in April 2009. In general, COOPER recalled multiple attempts to get CLINTON to use Appleproducts.
Around January 2011, COOPER recalled receiving numerous alerts in his email indicating email account users of PAGLIANO s server were entering the wrong log-in credentials. PAGLIANO had set-up the server so that COOPER would receive failed log-in notifications. COOPER thought this to be a brute force attack on the server and contacted PAGLIANO. COOPER recalled nothing else regarding this incident.
COOPER recalled HILLARY CLINTON’S email account was changed to email@example.com SIDNEY BLUMENTHAL’s email account was hacked around March 2013. Although COOPER could not be certain, COOPER thought he could have been the one to change the email address for CLINTON.
COOPER thought PAGLIANO had disabled the built-in Administrator account on the server PAGLIANO built. COOPER had his own system administrator account on PAGLIANO’s server.
In order for Platte River Networks (PRN) to begin administering an email server for the CLINTONS, PAGLIANO gave [ X ] access to PAGLIANO’s server. COOPER was unsure when this took place, but thought it was in May or June of 2013. COOPER did not know if [ X ] removed COOPER’s administrator account.
COOPER could not recall when he last logged into PAGLIANO s server. COOPER did not know what ” IP scanning tools” were.
In the spring of 2013, COOPER recalled giving MONICA HANLEY a MacBook laptop and walking her through downloading CLINTON’s email from the PAGLIANO server to the MacBook. COOPER did not recall a specific purpose for this other than maintaining a back-up copy ofCLINTON’s email. COOPER was unaware of a USB Flash Drive containing CLINTON’s email. COOPER was unaware of the location of the MacBook containing CLINTON s email.
COOPER stated [ X ] did not have access to the Apple server in anyway.
Notes of this interview will be maintained in a FD340 envelope and filed with the captioned investigation.
Eric Boswell2/19/16 Page 78
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 2/23/2016
On February 19, 2016, ERIC J. BOSWELL, DOB XX/XX/XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agents [ X ] and [ X] at the law offices of [REDACTED] Washington DC. Also present for the interview was BOSWELL’s attorney [ X ] After being advised of the identities of the interviewing agents, and the purpose of the interview, BOSWELL provided the following information:
BOSWELL served as the United States Assistant Secretary for State for Diplomatic Security (DS) from June 2008 until December 2012, however, BOSWELL did not resign from DoS until the Fall of 2013. Following his resignation from Department of State (DoS), BOSWELL went into “When Actually Employed” (WAE) status with DoS, which essentially means he still works for and is paid by DoS on an as needed basis.
As the Assistant Secretary of State for Diplomatic Security, BOSWELL was responsible for overseeing the security of DoS communications, personnel, and programs.
BOSWELL did not directly oversee the security of the Executive Secretariat, to include former Secretary of State HILLARY R. CLINTON. A Security Officer who reported further down in BOSWELL’s chain of command had direct oversight over the Executive Secretariat on the seventh floor offices commonly referred to as “Mahogany Row.” BOSWELL could not recall the names of any of the Security Officers who were assigned to Mahogany Row during his tenure.
BOSWELL had no knowledge CLINTON was using a personal email, nor that she was operating said email off of a personal server while she was Secretary of State. He first learned of the private server and personal email use when it was reported in the Press. BOSWELL further stated he found former Secretary CLINTON to be “very responsive to security issues.”
Agents asked BOSWELL to review a redacted memo titled “Use of Blackberries in Mahogany Row.” The memo was redacted by DoS in response to a Freedom of Information Act (FOIA) inquiry. After reviewing the memo, BOSWELL stated the memo was drafted early in the Administration, and shortly after CLINTON began her tenure at DoS.
Continuation of FD-302 of Interview of Eric J. Boswell. On 2/18/2016. Page 2
BOSWELL recalled CLINTON’s DoS executive staff initially inquiring about the possibility of acquiring Blackberries that could be configured for classified material. BOSWELL, tasked his staff to research the request and possibilities. BOSWELL staff notified him that such a device/configuration was not possible, which was relayed to CLINTON’s executive team via the memo.
Furthermore, BOSWELL stated that he recalled there was general concern around the same time regarding the possibility that CLINTON’s staff might use their Blackberries on Mahogany Row, which is a Sensitive Compartmented Information Facility (SCIF). According to BOSWELL there was no specific instance or report that any specific person/people were using Blackberries on Mahogany Row at the time. However, there was some general concern within DoS security personnel that CLINTON’s executive staff may try to use their Blackberries in the SCIF as they were almost all brought on to DoS from CLINTON’s campaign team, and thus were very accustom (sic) to using their Blackberries. Although BOSWELL could not recall a specific report of the use of Blackberries on Mahogany Row, he stated that “they were told to stop (using their Blackberries in the SCIF) and they did.” DS never sanctioned the use of Blackberries on Mahogany Row.
Agents also asked BOSWELL to review a redacted email dated 1/24/2009 with the subject line “Series of questions.” The email exchange, which BOSWELL was not copied on, related to the set up of a “stand-alone separate network PC” for CLINTON. In response, BOSWELL stated the email was written three days after CLINTON began her tenure as Secretary of State. LEWIS “Lou” LUKINS who was included in the referenced email exchange, was the former Chief Administrative Officer of the Executive Secretariat. BOSWELL explained that a “stand alone” work station does not necessarily mean a workstation that was not connected to the DoS network, and it just referred to a normal computer workstation. BOSWELL was unsure if CLINTON ever used a workstation at DoS, and did not recall ever seeing a workstation in her office.
A copy of the original interview notes and the referenced memo are attached in a 1 A envelope.
FD-302a (Rev. 10-6-95)
Lewis Lukens 6/15/16 Page 80
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 06/17/2016
On June 15, 2016, LEWIS LUKENS, Date of Birth XX/XX/XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agents [ X ] and [ X ] at his residence, San Francisco, CA. After being advised of the identities of the interviewing agents, and the purpose of the interview, LUKENS provided the following information:
LUKENS is currently the Diplomat in Residence for the Pacific Northwest region of the US, for the US Department of State (DOS). LUKENS, a career DOS employee, was most recently the US Ambassador to Senegal, before which he was the Deputy Assistant Secretary of State for the Executive Secretariat. As the Deputy Assistant Secretary, from the summer of 2008 until June of 2011,LUKENS reported to the Executive Secretariat, who was initially DAN SMITH until he was succeededby STEPHEN MULL. LUKENS was responsible for providing operational and logistical support to approximately 800 individuals at the DOS, which included the Secretary of State, senior leadership and their staff. LUKENS responsibilities were broken into five main areas: Human Resources, Budget, General Services, Diplomatic Security (DS), and Information Resource Management (S/ES – IRM).
S/ES – IRM was responsible for ensuring that the senior leadership of DOS had the Information Technology (IT) tools and systems they needed to do their jobs. The group was led by JOHN BENTEL and was comprised of approximately 25 to 30 individuals who were a mix of DOS personnel and contractors. LUKENS interacted with BENTEL on a daily basis. He described BENTEL as having “decent [technical] skills” despite not being a “tech guy” and added that he was more technically proficient than LUKENS was. LUKENS was not aware of the statements that had been attributed to BENTEL in the recent OIG report, but thought they were out of character for BENTEL.
LUKENS worked with CHERYL MILLS and HUMA ABEDIN before and during HILLARY CLINTON’s transition to DOS to coordinate CLINTON’s office space and human resource needs. LUKENS explained that the previous Secretary only had one Deputy Secretary but CLINTON planned to have two Deputies, so LUKENS had to reorganize the offices on the 7th floor to accommodate the second Deputy. LUKENS worked with DAN SMITH and Under Secretary PATRICK KENNEDY at DOS to ensure that CLINTON’s needs were met during the transition. LUKENS stated there was not a computer in CLINTON’s office at DOS because CONDOLEEZZA RICE did not have one, and one was not installed for CLINTON.
LUKENS and representatives from DS and S/ES-IRM visited CLINTON’s residence in Washington, DC during the transition to assess what equipment was present and what needed to be
Continuation of FD-302 of Interview of Lewis Lukens On 6/15/2016. Page 2
installed. LUKENS provided that both secure and unsecure telephone and facsimile systems were installed at the residence. LUKENS did not recall if there was a computer in the Washington residence. Lukens did not visit CLINTON’s residence in Chappaqua, NY and instead sent [REDACTED] in his place. LUKENS was not aware of what equipment was installed in Chappaqua. LUKENS stated that the DS representative for these visits was mostly likely[ X ] who was later replaced by [ X ] in the summer of 2009.
LUKENS was shown an email with the subject “State Department Telephone Servicesat Secretary CLINTON’s Residence” that was sent from [ X ] to LUKENS and ABEDIN on January 27, 2009. After reviewing the email, LUKENS explained that “IST/Red Switch” refers to the direct phones to the White House, “Business Lines” refers to unclassified phone lines, and “Ops Dedicated Drop” refers to a phone line that connected directly to the DOS operations center. LUKENS was not sure what “CMS VoIP” referred to but thought it was related to DOS Crisis Management Support. LUKENS noted that equipment was installed both in a SCIF and in an office area located near [REDACTED]. LUKENS stated that he oversaw the installation of the telephone lines in a very broad sense but the actual work was very technical and beyond his expertise.[REDACTED]equipment. LUKENS described [ X ] as likeable but noted that he often interacted directly with CLINTON’s staff and did not always keep his chain of command informed of requests from, and work begin (sic) done for, CLINTON and her team.
LUKENS was shown an email with the subject “Secretary Residential Installation Hotwash” that was sent from [ X ] to BENTEL, [ X ] and [ X ] on March 17, 2009. LUKENS was not immediately familiar with the email or the attachment but believed that “Server: Basement Telephone Closet” referred to a telephone server. LUKENS noted the installationprocesses was unique because there was pre-existing equipment in the residences that had previously been installed for President WILLIAM CLINTON.
LUKENS was not aware that CLINTON was using a private email server until it was released in the papers. Upon learning about the server, LUKENS had some general concerns about how the server had been protected from hackers. LUKENS did not know if the setup was a violation of any existing DOS policy at that time. LUKENS never had any conversations with CLINTON’s staff or other department officials about the server.
LUKENS was shown an email with the subject “HRC blackberry” that was sent from MONICA HANLEY to ABEDIN on August 30, 2011. After reviewing the email, LUKENS provided that he was unaware of the email and that BENTEL never relayed any information to him about the server or it being nonfunctional.
LUKENS was shown an email with the subject “S Communications” that was sent from ABEDIN to MULL on August 30, 2011. LUKENS was familiar with the email and provided the
Continuation of FD-302 of Interview of Lewis Lukens. On 6/15/2016. Page 3
context that the technology at DOS was not very user friendly and that matters were further complicated because CLINTON was not very technology savvy and had little patience for technology issues.
LUKENS was shown an email with the subject “Re: Series of questions” that he sent to KENNEDY on January 24, 2009. LUKENS was familiar with the email and explained that CLINTON could not have her BlackBerry in the SCIF so his idea was to set up a living room area outside of the SCIF where CLINTON could check her emails on her BlackBerry. CLINTON did not have a computer inher office and did not want one because she preferred to use her BlackBerry for checking her emails. While DOS users can check personal email accounts via the unclassified DOS computer systems the proposed ‘stand alone’system would have streamlined the process for CLINTON and would have been similar to the setup used by former Secretary of State COLIN POWELL.
LUKENS was aware that no DOS email account was assigned to CLINTON, aside from a generic account that was used for sending mass emails to DOS employees on behalf of the Secretary. LUKENS was not aware that CLINTON was using a personal email for official business. He was told by MILLS that CLINTON was using her personal account to keep in touch with friends and family. LUKENS did not email with CLINTON directly and typically communicated with ABEDIN, who he described as CLINTON’s gatekeeper.
LUKENS was shown an email with the subject “Re: E-mail test” that was sent from HUMA to “H” on February 27, 2010. LUKENS was unaware of the issues discussed in the email exchange at that time, but he had since seen the email exchange. LUKENS stated that[REDACTED] who worked in BENTEL’s group.
LUKENS was shown an email with the subject “Re: S berry” that was sent from HANLEY to ABEDIN on August 30, 2011. After reviewing the email LUKENS provided that he had not seen the email before and did not know the circumstances in which it was sent. LUKENS did not know why BENTEL made the statement regarding FOIA searches in the email.
LUKENS had heard of the State Messaging and Archive Retrieval Toolset (SMART) but was not aware of any specifics about the program. LUKENS believed that SMART had been rolled out to all departments at DOS and was not aware that it wasn’t used by S/ES-RM.
Once CLINTON’s transition to DOS was completed LUKENS’ primary responsibility became coordinating the travel logistics for CLINTON and her team. This included handling matters related to passports, customs/immigration requirements, baggage, and hotel arrangements. LUKENS travel (sic) on all of the trips with CLINTON.
LUKENS was shown an email with the subject “Communications Guidance for Moscow” the (sic) he sent to several individuals on CLINTON’s staff on March 15, 2010. LUKENS did not recall receiving country specific threat briefs prior to each trip. However, LUKENS recounted that on one trip to Russia they received guidance from the Embassy that they should leave their phones on the plane.
Continuation of FD-302 of Interview of Lewis Lukens. On 6/15/2016. Page 4
However, this conflicted with the guidance from DS so they ultimately elected to take their phones off of the plane. LUKENS explained that the one.state.gov system referenced in the email was used for accessing the DOS OpenNet system remotely using a user specific pin and token.
A copy of the original interview notes and referenced documents are attached in a I A envelope.
Huma Abedin4/5/16 Page 84
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 04/07/2016
On April 5, 2016, HUMA ABEDIN, DOB XX/XX/XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agents [X ] and [ X] at the FBI Washington Field Office, 601 4th Street NW, Washington DC. Present for the interview was ABEDIN’s counsel, MIGUEL RODRIGUEZ, Partner at Bryan Cave LLP, KAREN DUNN, Partner at Boies, Schiller & Flexner LLP and [ X ] Associate at Boies, Schiller & Flexner LLP. Also present was FBI Section Chief Peter Strzok, as well as [X ] Assistant U.S. Attorney –Eastern District of Virginia, and David Laufman,[ X] and [ X] from the Department of Justice (DoJ) Counterintelligence and Export Control Section. Prior to the interview RODRIGUEZ, DUNN and [ X ] agreed to sign a non-disclosure agreement in anticipation of viewing classified documents during the interview. After being advised of the identities of the interviewing agents, and thepurpose of the interview ABEDIN provided the following information:
ABEDIN first met HILLARY R. CLINTON in 1996 when she was an intern in the Office of the First Lady. She then worked on CLINTON’s Senate campaign and her 2008 Presidential campaign, as the traveling Chief of Staff. When CLINTON became the Secretary of State, at the Department of State (DoS), ABEDIN became her Deputy Chief of Staff for Operations where she was primarily responsible for coordinating logistics for CLINTON. ABEDIN worked with JAKESULLIVAN, CHERYL MILLS, JOE MACMANUS, as well as three Special Assistants, a Scheduler, and a Personal Assistant while she was in the Office of the Secretary.
Transition to Department of State
ABEDIN and CLINTON met with DoS on a few occasions prior to CLINTON being sworn into office to discuss her transition. During these instances CLINTON and ABEDIN met with Secretary Rice and her staff to discuss the logistics of the transition. ABEDIN worked with PATRICK KENNEDY and MILLS to fill the available spots on CLINTON’s staff. ABEDIN was directly responsible for identifying and interviewing individuals for the roles of Personal Assistant, Scheduler and Personal Correspondent.
ABEDIN provided that KENNEDY was their main point of contact for setting up CLINTON’s office and that LEWIS LUKENS, MACMANUS and [ X ] were responsible for coordinating the technical aspects of the transition. ABEDIN did not know that CLINTON had a private
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016, Page 2
server until about a year and a half ago when it became public knowledge and did not recall any discussion about it during the transition. ABEDIN did not recall any discussions during the transition about whether using a private email account for DoS business was permissible. However, she did recall that they were advised that they could not have personal emails linked to a DoS device. As a result, CLINTON elected to use a personal device only because she did not want to carry two devices.
ABEDIN had never held a security clearance prior to working at DoS. She received a Top Secret security clearance at DoS but did not remember being read into any Special Access Programs (SAPs) or compartments. When ABEDIN was on boarded at DoS she received a security briefing that detailed the different levels of classified information and the proper handling procedures. ABEDIN did not recall ever receiving any training on the preservation of federal records but noted that she took a lot of training courses when she on boarded so she may have had training on the topic. ABEDIN provided that she was not an Original Classification Authority (OCA) at DoS.
ABEDIN’s Devices and Communication Practices
ABEDIN’s office was located in a Sensitive Compartmented Information Facility (SCIF) at DoS. At her desk she had both an unclassified and classified computer system. ABEDIN was not sure if the classified computer system was a Secret or Top Secret (TS) system, and she was unfamiliar with the term JWICS. ABEDIN did not receive any formal guidance on what system she should use for the different aspects of her work. She did the majority of her work on the unclassified system and would often go several days, or weeks, at a time without logging into her classified system. She would only use the classified system if she was notified that somebody had sent her a message on that system. In addition to the computer systems, ABEDIN had an open line phone and a yellow TS Cisco phone that she typically used for talking with the National Security Council.
ABEDIN provided that she was issued an official DoS email account, firstname.lastname@example.org, which she used for DoS related work. She also had an email account that was provided by CLINTON, email@example.com, which she used for matters related to CLINTON’s personal affairs and to communicate with CLINTON’s personal staff and friends. ABEDIN also had a personal Yahoo email account, [REDACTED]. ABEDIN could access her clintonemail.com account and her Yahoo account via the internet on the unclassified DoS computer system. She would use these accounts if her DoS account was down or if she needed to print an email or document. ABEDIN further explained that it was difficult to print from the DoS system so she routinely forwarded emails to her non-DoS accounts so she could more easily print. ABEDIN al so had another email account that she had previously used to support her husband’s campaign activities, [REDACTED]
ABEDIN had no knowledge of her accounts ever being targeted by hackers and was not aware of any intrusion attempts. ABEDIN recalled that some people at DoS had issues with their Gmail accounts but she never had a Gmail account.
Continuation of FD-302 of Interview of Huma Abedin on 4/5/2016. Page 3
ABEDIN was shown an email dated September I, 201 1, with the subject “Fwd: Calls”, which she forwarded from her firstname.lastname@example.org account to her DoS email account. ABEDIN did not recall the specific email or why she would have forwarded it. However, she noted that based on the date stamp she knew that she was not in the office when it occurred.
ABEDIN was shown an email dated October 4. 2009, with the subject “Fwd: U.S.interest in Pak Paper 10-04”, which ABEDIN received from [REDACTED]and then forwarded to her Yahoo email account. ABEDIN was not familiar with the document but was not surprised that she forwarded it to her Yahoo account. She explained that she routinely forwarded emails from her state.gov account to either her clintonemail.com or her yahoo.com account so that she could print them. ABEDIN stated that she would typically print the documents without reading them. At the time of the email [ X ] worked for RICHARD HOLBROOKE who was the Special Representative for Afghanistan and Pakistan (SRAP). ABEDIN was unaware of the classification of the document and stated that she did not make judgments on the classification of material that she received. Instead, she relied on the sender to make that assessment and to properly mark and transmit the document.
ABEDIN was shown an email chain dated August 16, 2010, with the subject “Re: your yahoo acct”. ABEDIN did not recall the email and provided that despite the content of the email she was not sure that her email account had ever been compromised. She further provided that the [ X ] referenced in the email referred to an older campaign volunteer in Westchester, NY.
ABEDIN was provided with a DoS Blackberry and believed that all of CLINTON’s top aides at DoS were issued Blackberries as well. The team would sometime use secure cell phones when they were traveling but they were not used on every trip. Secure phones were only used when traveling in hostile operational environments. The secure phones were maintained by Diplomatic Security (DS) and would be provided to the team by [ X ] .ABEDIN provided that DS routinely provided country specific security briefings prior to international trips. During these briefings the team would receive instructions on how to handle their communications once in country. For example, the team might be told to leave their phones on the plane or to take the batteries out of their phones. ABEDIN noted that the guidance changed based on the specific location and that it wasn’t uncommon to receive different instructions on separate trips to a given country. For example, the communication plan for Moscow could be different than the plan in St. Petersburg.
ABEDIN was shown an email chain dated October 6, 2009, with the subject “IT security in Moscow” and an email chain dated October 12, 2009, with the subject “Re: Communications”. ABEDIN stated that the content of these emails was typical of the guidance that was provided by DS prior to a trip and that the instructions were closely followed by the traveling team. If CLINTON was not able to attend the DS briefing prior to the team’s departure she would be briefed by DS on the plane. ABEDIN stated that they used computers that were set up and controlled by the Mobile Communications Team to access their DoS and personal emails accounts when they were in Russia.
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016, Page 4
ABEDIN did not recall any potential security issues occurring while the team was traveling overseas aside from one instance in Egypt. Prior to a meeting at President Mubarak’s residence, the team was unexpectedly asked to leave their phones. ABEDIN could not provide any more details on what had occurred but noted that DS was with the team and was aware of the incident.
The Secretary’s Devices and Practices
CLINTON’s office at DoS was located in a SCIF on the seventh floor that was commonly referred to as Mahogany Row. Her office had an unclassified telephone and a TS Cisco phone for contacting other agencies. Initially, she also had a secure ‘white phone’ and a STE in her office but they were later removed. CLINTON did not have a computer in her office and conducted the majority of her work in person or on paper. ABEDIN explained that CLINTON could not use a computer and that she primarily used her Blackberry or iPad for checking emails. If CLINTON needed to check her emails during the course of the day she would leave the SCIF to check her Blackberry, often going to the eighth floor balcony. CLINTON’s email address was not widely known but all of her senior staff had the address and would share it with other government officials if they needed it. ABEDIN stated that CLINTON’s senior staff was not specifically instructed to filter her email but they understood what was relevant toCLINTON and would only share information with her as appropriate.
ABEDIN was shown an email chain dated September 30, 2010, with the subject “Re: HbJ on moratorium”. After reviewing the email, ABEDIN could not recall the email exchange or the context of the email. ABEDIN stated that, in general, she would be told by either CLINTON or the requesting party if the call needed to be secure or not. It would be unusual for ABEDIN to read the content and then make her own judgment as to whether the call should be secure or not. ABEDIN stated that she was likely with CLINTON when she sent the email and she was relaying guidance from CLINTON. ABEDIN provided that [ X ] [ X ] were assistants to CLINTON.
ABEDIN was shown an email chain dated August 30, 2011, with the subject “Re: S Communications”. ABEDIN recalled the email exchange and provided that CLINTON was not issued a DoS Blackberry and that she only used her personal Blackberry because she did not want to carry multiple devices. The email exchange occurred when CLINTON was in the Hamptons and was having communication issues following Hurricane Irene. At that time, ABEDIN felt that it did not make sense to temporarily issue CLINTON a DoS Blackberry because it would require significant effort to transfer all of her emails and contacts to a device that she would only use for a few days. ABEDIN did not know what STEPHEN MULL meant when he wrote that the account could be set up to mask CLINTON’s identity. ABEDIN’s counsel noted that a longer version of this email chain had been released via the FOIA process (DoS case F-20 15-12685, document C0590567I).
ABEDIN was shown a memorandum from DS regarding the use of Blackberries in Mahogany Row. ABEDIN recalled seeing the memorandum in the news recently but did not recall when it was originally released. ABEDIN stated that she did not need her Blackberry when she was in the SCIF
Continuation of FD-302 of Interview of Huma Abedin On 4/5/2016. Page5
so she was not affected by the recommendations in the memorandum. ABEDIN did not remember receiving a specific briefing from DS on Blackberry vulnerabilities but stated that it was possible that she received one because DS frequently briefed CLINTON’s team on security topics.
CLINTON did not have a secure Blackberry and ABEDIN did not know if secure Blackberries were even available at that time. ABEDIN stated that CLINTON had several different standard Blackberry phones during her tenure. It wasn’t uncommon for CLINTON to use a new Blackberry for a few days and then immediately switch it out for an older version that she was more familiar with. The phones were typically purchased by somebody on her staff and would be activated by “whoever was around”. ABEDIN recalled that and MONICA HANLEY helped to setup new Blackberries on different occasions. ABEDIN did not know what was done with the old Blackberries after CLINTON transitioned to a new one. ABEDIN was shown an email chain dated April 1 5, 2009, with the subject “Re: Won’ t get to huma today” ABEDIN did not recall why they were activating new SIM cards for CLINTON. ABEDIN provided that [ X ] [LAST NAME UNKNOWN] was[REDACTED]President CLINTON’s office that may have worked for JUSTIN COOPER.
ABEDIN confirmed that CLINTON’s Blackberry phone number was 212 XXX-XXXX. She was not aware of CLINTON ever using a second cell phone and was not familiar with the phone number 202 XXX-XXXX. [It is noted that a 202 area code was erroneously used when ABEDIN was asked about the aforementioned telephone. The correct number is 212 XXX-XXXX] While ABEDIN noted it would be odd for CLINTON to have a D.C. area code, she ultimately stated that no part of the number was familiar to her]
ABEDIN stated that CLINTON had at least one, or possibly two, iPads during her tenure. She believed that one of them might have been a gift. CLINTON used the iPad for reading news articles but ABEDIN rarely saw CLINTON carrying or using the iPad. CLINTON was trained on how to use the iPad by [ X ] while they were on traveling on a plane. ABEDIN stated that the iPad was briefly used to send and receive emails following Hurricane Irene when CLINTON’s other email systems were down. Although this was only intended as a temporary solution, this capability may have remained after CLINTON’s other systems were restored. ABEDIN noted that she was in Europe when Irene struck and that HANLEY was responsible for handling the communication issues following the storm. ABEDIN confirmed that CLINTON’s email was also down for an extended period of time following Hurricane Sandy. However, ABEDIN was in New York City, with her infant child, at the time and was not sure what efforts were taken to restore or establish temporary email for CLINTON. ABEDIN was unaware of any email accounts, Apple IDs, or cloud storage accounts associated with the iPads.
Email System During Tenure
ABEDIN contacted COOPER about getting a Blackberry for CLINTON while CLINTON was still in the Senate. CLINTON then used the Blackberry when she transitioned to DoS. At that time, her primary email address was email@example.com. Shortly after CLINTON became the Secretary of State COOPER established the @clintonemail.com domain and CLINTON began using
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016. Page 6
firstname.lastname@example.org as her primary email. The only other person at DoS to receive an email account on the domain was ABEDIN. Later in CLINTON’s tenure she changed her email address to email@example.com. ABEDIN was not familiar with the email firstname.lastname@example.org or with [REDACTED]@gmail.com.
Initially COOPER was the primary point of contact for anything related to the setup and maintenance of the email system. ABEDIN was shown three separate email chains with COOPER regarding the operation of the server during CLINTON’s tenure. The first was sent on January 9, 2011 and had the subject “Re:”, the second was sent January 10, 2011 and had the subject “Don’t email hrc anything sensitive. I can explain more in person” and the third was sent October 20 2011 and had the subject “Re:”. ABEDIN provided that she did not recall any details surround these email exchanges but noted that she trusted COOPER to fix any issues with the server. She did not recall the system ever being hacked but assumed that she would have notified CLINTON of any current issues that they were experiencing.
ABEDIN was shown an email chain dated March 17, 2011 with the subject “Re: School”. Upon reviewing the email she provided that she was not familiar with the email or the topics discussed within it. ABEDIN noted that her email address was misspelled on the chain and therefore she would not have received the email. However, she was not aware of the @clintonemail.comsystem ever being hacked.
ABEDIN provided that BRYAN PAGLIANO had worked on the Information Technology (IT) team for CLINTON’s 2008 Presidential campaign and was hired at DoS after CLINTON took office. Thereafter, BRYAN PAGLIANO became the new point of contact for issues with the email system. ABEDIN did not specify when this occurred but stated that there was a transition period during which she would contact COOPER and he would direct her to contact PAGLIANO.
ABEDIN was shown an email chain dated December 24, 2012, with the subject “Fw: Thank You”. After reviewing the emails ABEDIN provided that she did not recognize the SMSGS@state.gov email address and was not aware of any other generic email accounts used by CLINTON for DoS wide email communications.
ABEDIN was shown an email chain dated August 30, 2011, with the subject “Re: S berry”. ABEDIN stated that she did not like the SSHRC@state.gov email address because it was too obvious of an email address. She noted that the email appeared to be related to discussions that occurred when they were working to restore CLINTON’s communications after Hurricane Irene. ABEDIN did not know who JOHN A. BENTAL was but assumed that he worked in the IT department at DoS. When asked about BENTAL’s statement that SSHRC@state.gov would be subject to FOIA searches, ABEDIN stated that she always assumed that all of CLINTON’s communications, regardless of the account, were subject to FOIA if they contained related material. ABEDIN did not recall ever having conversations with CLINTON, or any other staff members, about the Federal Records Act and preserving relevant emails.
Continuation of FD-302 of Interview of Huma AbedinOn 4/5/2016. Page 7
ABEDIN provided that at the time, they believed relevant emails would be captured and preserved by DoS if any of the senders or recipients were using an official DoS email account.
ABEDIN was shown an email chain dated December 16, 2010, with the subject “RE: mail from clintonemail”. ABEDIN recalled that there had been a problem with emails from the @clintonemail.com system being filtered out by the DoS email system, but she did not recall the specific email exchange. ABEDIN noted that it appeared that it was SULLIVAN’s emails that were affected and that it would otherwise be uncommon for him to be involved in discussions about email issues.
Email System Post Tenure
Following CLINTON’s tenure at DoS she established a personal office in New York City for the purpose of writing her book and pursing other interests. Several members of CLINTON’s staff from DoS joined CLINTON’s team in New York. They included: ABEDIN. HANLEY, [REDACTED] [ X ] and [ X ] (believed to be [REDACTED]also continued to support CLINTON on a limited basis as consultants.
When CLINTON’s team was formed [ X ] established temporary G mail accounts for members of the team using the naming convention email@example.com. [REDACTED]had been CLINTON’ [REDACTED]at DoS and ABEDIN described him as being good with technology. He set up the email accounts for the team so that they would have something more formal than their personal emails accounts.
When CLINTON left DoS she stopped using the clintonemail.com system and started using hrcoffice.com to formalize her transition. During this same time period, an outside IT company, PLATTE RIVER NETWORKS (PRN), was hired to maintain CLINTON’s email system. ABEDIN stated that PRN was initially hired to manage President CLINTON and[REDACTED] emails. It was then later decided that PRN should also manage CLINTON’s email as well.
Once the hrcoffice.com system was established, CLINTON’s staff was provided email addresses on the new system. ABEDIN stated that [REDACTED] from PRN, assisted with setting up new accounts for CLINTON’s staff. [ X ] also provided guidance on how to use the Microsoft Outlook based email system. ABEDIN did not know [ X ] or [ X ].
Prior to the transition to hrcoffice.com, ABEDIN was advised that the clintonemail.com system was “going away”. ABEDIN stated that she lost most of her old emails as a result of the transition. She had only accessed clintonemail.com through a web portal and did not have a method for archiving her old emails prior to the transition. ABEDIN did not know if the system administrator had archived the mailboxes before the system was taken down.
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016 Page 8
ABEDIN remembered having discussions with HANLEY about creating an archive of CLINTON’s emails. ABEDIN believed that the archive was placed on a laptop so that it could be referenced while CLINTON worked on her book. ABEDIN did not know that the laptop was sent to PRN, nor did she know what ultimately happened to the laptop. ABEDIN was not aware that a copy of the email archive may have been placed on a thumb drive.
Review and Production of ABEDIN Emails
ABEDIN provided that she learned that DoS was seeking her emails after she read about it in the newspaper. DoS wanted ABEDIN’s emails as part of an effort to ensure that DoS had a complete record of documents from CLINTON’s tenure. ABEDIN contacted DoS and confirmed that it was seeking her emails. She noted that DoS’ prior attempts to contact her were unsuccessful because DoS had an old email account and an old mailing address on file. ABEDIN then turned over her laptop and Blackberry to her attorneys so that they could conduct the review. ABEDIN was not directly involved in the review and relied on the judgment of her attorneys. RODRIGUEZ and DUNN stated that they sought additional guidance from DoS on how the review should be conducted but they never received a response. RODRIGUEZ and DUNN therefore erred on the side of caution and opted to include anything that they were unsure about. It was also noted that ABEDIN had previously responded to a similar request from the Benghazi Committee.
ABEDIN was shown an email chain dated April 2, 2012, with the subject “May – Asia”. ABEDIN confirmed that the email was related to her activities while at DoS and that it would be considered a relevant record with respect to the DoS request. ABEDIN explained that this email was not produced by her team during the review because she did not have access to her clintonemail.com account when the review was conducted. RODRIGUEZ and DUNN stated that the request from DoS only sought records currently in ABEDIN’s possession so they did not contact PRN to request other relevant records.
ABEDIN was not involved in the review and production of CLINTON’s email, in response to a similar request that CLINTON received from DoS. ABEDIN stated that the review was conducted by CLINTON’s attorneys and that she was not consulted during the process.
CLINTON’s residence in Washington, DC (Whitehaven) had a small office on the third floor that was converted to a SCIF by DoS. DoS removed the original door and replaced it with a metal door with a key code lock during the conversion. Inside the SCIF there was a desk where CLINTON worked and a computer, printer, facsimile machine and a television. DoS also installed a STE, a “yellow phone” and a video teleconference (VTC) system. ABEDIN provided that the door to the SCIF was not always locked and that ABEDIN, HANLEY and the [REDACTED] had access to the SCIF.
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016, Page 9
CLINTON’s residence in Chappaqua, NY, was also outfitted with a small SCIF that had the same equipment as the Whitehaven SCF, less the television set. ABEDIN provided that CLINTON was the only person to use the SCIF and that she routinely used the Cisco telephone to make calls from Chappaqua because the cellular coverage was not very good there. ABEDIN, HANLEY and [REDACTED]all had access to the SCIF.
CLINTON received diplomatic pouches each night that contained the briefing material for the next day s meetings. When CLINTON was in Washington, she would be given the pouch prior to leaving DoS. If the pouch was not ready when she left, or if she was in New York, the pouch would be delivered to her residence by DS. The pouch would be received by the DS agent stationed at the house and would then be placed on a bench inside the residence. In Whitehaven, the bench was located outside of CLINTON’s bedroom and in Chappaqua the bench was located near the main entrance. ABEDIN stated that it was less common for the diplomatic pouch to be delivered to Chappaqua because CLINTON would typically take the pouch with her when she was traveling. ABEDIN did not know if [ X ] ever received or transported the diplomatic pouch when it was delivered to the residence in Chappaqua. ABEDIN stated that [ X ] did not handle the diplomatic pouch at the Whitehaven residence because her shift ended before the pouch was delivered at 5PM.
CLINTON typically received the Presidential Daily Briefing (PDB) in person at the office. When she was not in the office the PDB would be delivered with the pouch or sent via secure facsimile. If the content was particularly sensitive she might be briefed in person by a CIA officer.
CLINTON would periodically receive both secure and unsecure facsimiles at her residence in Chappaqua. In order to receive a secure facsimile somebody would have to answer the phone and then wait several minutes for the documents to arrive. Since it was a time consuming process, [ X ] would sometimes assist CLINTON by answering or hanging up the facsimile system but he would leave the documents on the machine for CLINTON or her staff to collect. ABEDIN provided that [ X ] would pick up documents from the non-secure facsimile machine, which was located in a separate part of the residence. ABEDIN stated that they had numerous issues with the secure facsimile system in the Whitehaven residence and that it was often quicker to have the documents couriered to the house from DoS.
ABEDIN was shown an email chain dated March 20, 2009, with the subject “Re: Tomorrow”. After reviewing the email ABEDIN stated that she knew for a fact that there were times when [ X ] assisted with the facsimile machine and may have collected documents from the secure facsimile machine for CLINTON. ABEDIN stated that the intention was to have CLINTON do it herself, but she wasn’t very tech savvy and would get frustrated with the process. ABEDIN provided that the team would also occasionally email things to [ X ] or [ X ] to print for CLINTON.
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016, Page 10
ABEDIN provided that when CLINTON needed to contact the President she would have call the oval office to coordinate the meeting or call. ABEDIN believed that CLINTON had the President’s email address but ABEDIN did not know what it was. ABEDIN noted that the President could only receive emails from approved addresses. She recounted that when CLINTON changed her primary email address they had to notify the White House so that CLINTON’s emails would not be rejected by the server. ABEDIN was not sure how often CLINTON emailed the President. ABEDIN was shown an email chain dated June 28, 2012, with the subject “Re: Congratulations!” ABEDIN did not recognize the name of the sender. Once informed that the sender’s name is believed to be a pseudonym used by the President, ABEDIN exclaimed “How is this not classified?” ABEDIN then expressed her amazement at the President’s use of a pseudonym and asked if she could have a copy of the email. ABEDIN provided that she did not go on the trip to St. Petersburg and noted that security protocols in St. Petersburg were not necessarily the same as they were in Moscow, where they were not allowed use to their Blackberries.
ABEDIN was shown an email chain dated January 8, 2011, with the subject “Re: AGpoints from [ X ] After reviewing the email, ABEDIN provided that she vaguely recalled the email exchange and that the original email was sent in preparation for a call between the Attorney General and CLINTON. ABEDIN stated that she did not have concerns with the content because she was only a conveyor of the information and that she relied on the sender to properly mark any sensitive information. ABEDIN reiterated that she did not take it upon herself to question the sender’s judgment on how a document should be marked. ABEDIN stated that people at DoS took the handling of classified information very seriously. She never had any concerns with how classified material was handled by individuals at DoS. Nor did she ever recall CLINTON expressing concerns over how classified information was handled.
ABEDIN first met SYDNEY BLUMENTHAL in 1996 when she was a junior staffer at the White House and BLUMENTHAL was a senior official. ABEDIN never worked directly with BLUMENTHAL but when CLINTON was in the Senate he would send emails for ABEDIN to pass to CLINTON. ABEDIN did not always forward the messages to CLINTON and BLUMENTHAL eventually stopped emailing ABEDIN when he realized this. When ABEDIN was at DoS, CLINTON would sometimes send ABEDIN emails from BLUMENTHAL for her to print. ABEDIN provided that she did not read the content of the emails from BLUMENTHAL and had no knowledge of his sources.
ABEDIN provided that she was not involved in drafting talking points while at DoS. The authors of the talking points depended on the content and were the responsibility of the appropriate bureau.
ABEDIN was shown an email chain dated September 20, 2012, with the subject “Re:”. After reviewing the email ABEDIN stated that it was not common to stash the diplomatic pouch in the limousine but that it would have been secured by the DS or Secret Service (SS) agents that were with the car. ABEDIN noted that if they were in CLINTON’s car there would be two DS agents present and if they took President CLINTON’s car there would be one DS agent and one SS agent.
Continuation of FD-302 of Interview of Huma Abedin. On 4/5/2016. Page 11
A copy of the original interview notes and the NDAs signed by RODRIGUEZ, DUNN and [ X ] are enclosed in a 1A envelope.
Shelby Smith-Wilson)11/20/16 Page 95
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 11/25/2015
On November 20, 201 5 [ X ] date of birth XX/XX/XXXX was interviewed at the[REDACTED] byFederal Bureau of Investigation (FBI) Special Agents (SA) [ X ] and [X ]. After being advised of the identity of the interviewing agents, and the nature of the interview, [ X ] provided the following information:[ X ] jointed the U.S. Department of State in [REDACTED]and has held the following positions: [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] [ X ] described the OpsCenter as the “eyes and ears” for the Secretary of State. The Ops Center is staffed 24 hours a day and constantly monitors reporting from Department of State cables, other government agencies and open source news outlets for information of interest toDepartment of State leadership. The Ops Center is also responsible for coordinating communications between senior leadership and foreign dignitaries. As a Senior Watch Officer (SWO) [ X ] was the most senior person in the Ops Center and was responsible for overseeing the activities of the other personnel as they worked to identify and disseminate critical information to the Secretary of State and Department of State leadership.
Continuation of FD-302 of Interview of [REDACTED] On 11/20/2015. Page 2
There are approximately seven or eight individuals staffed in the Ops Center during a normal day shift. In addition to the SWO, there are the following positions:
♦ Watch Officer (WO) – The WO is typically a junior civil servant who is responsible for gathering important information and disseminating it to Department of State leadership as necessary. They are responsible for answering incoming calls, monitoring cable traffic and scheduling phone calls for senior Department of State personnel as necessary.
♦ Emergency Action Officer (EAO) – The EAO is responsible for monitoring international hot spots and other current items of interest for the Department of State. They usually work with the Crisis Management Support team, which is collocated in the Ops Center.
♦ Ops Specialist – The Ops Specialist primarily performs clerical work for personnel in the Ops Center. This may include sending and receiving facsimiles or arranging the logistics of meetings or calls for Department of State leadership.
♦ Consular Affairs Officer – The Consular Affairs Officer is responsible for addressing any matters relevant to standard consular duties at foreign U.S. establishments.
♦ Diplomatic Security (DS) Officer – The DS Officer is a liaison between the Ops Center and the U.S. establishments and Regional Security Officers abroad.
♦ Swing Station – The swing station is an extra body that provides support to the SWO and the watch team as necessary.
♦ Bureau of Intelligence and Research (INR) Representative – The INR Rep is responsible for acting on behalf of the INR and for liaising with the broader Intelligence Community as necessary.
When urgent information or breaking news, which requires the immediate attention of senior Department of State personnel, is identified during normal working hours, the Director of the Ops Center is notified by the SWO. The Director communicates the information up the chain of command as appropriate. If such information is identified afterhours, the SWO notifies the Deputy Assistant Secretary (DAS) directly. The DAS will then provide the SWO with guidance on how the information should be transmitted.
During [ X ] tenure as a SWO there were two different Directors for the Ops Center. [REDACTED] was the Director for the majority of [REDACTED] time in the Ops Center and upon [REDACTED]departure. [REDACTED]became the Director.[ X ] did not recall ever emailing the Secretary directly and had no knowledge of the Secretary’s personal email account or private email server. [ X ] recalled receiving a few emails from the Secretary, such as mass emails at the holidays, which she
Continuation of FD-302 of Interview of [REDACTED] On 11/20/2015. Page 3
presumed were sent from a Department of State email account. In instances where she needed to relay information to the Secretary she would send the information to the Secretary’s Chief of Staff (CoS), or to HUMA ABEDIN.[ X ] was shown a copy of the email that she sent on July 3, 2009, with the subject “Summary of 1055 E DT DPRK Conference Call”, which was flagged by the ICIG as possibly containing classified information. [ X ] recalled the events surrounding the email and provided that she was the SWO on duty that day and had been directed to convene a call for key Department of State officials to discuss the DPRK missile launches. The discussion was based on afterhours reporting from the Intelligence Community that was at least confidential if not classified. [ X ] could not definitively recall what agency owned the source reporting but believed that it likely came from the Central Intelligence Agency. [ X ] was on the conference call for the purpose of taking notes but she was not an active participant in the discussion. [ X ] could not recall if the call was on a secure line but noted that it was common for such calls to be held on unclassified phone lines because not all of the key participants would have access to a secure phone if they were at home or traveling.
Following the call, [ X ] was responsible for summarizing the discussion in the referenced email and then forwarding it to individuals within the Department of State who needed to be aware of the situation. The email was sent on the unclassified system because not all of the intended recipients had immediate access to classified email accounts. [ X ] noted that it was not uncommon for the Ops Center to send such emails on the unclassified system. The specific content of the email was based on [ X ] notes and her judgement on what should be included in the summary. There was no formal review of the email, or either its content or for the presence of classified material, prior to it being sent. [ X ] noted that the Deputy Executive Secretary was an Original Classification Authority (OCA) who would on occasion review material for the Ops Center.
The email recipients were based on an established call sheet that indicated who should receive reporting on various topics. Also included were individuals added by the senior leadership. [ X ] identified the email recipients on the above cited email and provided the following information about their roles at that time:
–[REDACTED]was stationed in New York at the time. [ X ] could not recall her specific position but provided that she held a high ranking function within the United Nations.
Continuation of FD-302 of Interview of [REDACTED]On 11/20/2015. Page 4
–[REDACTED] could not recall her specific position or title.
–[REDACTED] were staffers for other bureaus within the Department of State.[ X ]reviewed the subsequent emails in the chain and noted that [REDACTED]was the SWO on duty on July 4th. Based on the time difference between when the conference called occurred and when the emails were sent [ X ] believed that there may have been another SWO, or two, on duty between her shift and [REDACTED] shift. [ X ] could not recall who relieved her at the end of her shift but stated that she would have briefed the incoming SWO on the conference call and any necessary follow up items that the incoming SWO would need to address during their shift. [ X ] provided that the Ops Center maintains a Watch Log where the details of any call arranged by the Ops Center are recorded. The log contains basic information about the call to include the date, time, participants, and in some cases a brief synopsis of the subject of the call. The Ops Center will log any calls that are facilitated by the Ops Center, which involve the Secretary of State, or any Deputy Secretaries, Under Secretaries, Assistant Secretaries, or foreign dignitaries. The Ops Center does not maintain a log for emails sent to, or from, the Ops Center. [ X ] was amenable to recontact if necessary.
Agent notes are included in an attached 1A.
Cheryl Mills 5/28/16 Page 99
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 6/1/2016
On May 28, 2016, CHERYL MILLS, date of birth XX/XX/XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) [REDACTED] and SA[REDACTED] at the law offices of Wilkinson Walsh + Eskovitz, 1900 M Street NW, Suite 800, Washington, DC. Present for the interview was SAMUELSON’s counsel, Beth Wilkinson, Partner, Alexandra Walsh, Partner, and Hal Brewster, Associate. Also present was FBI Section Chief Peter Strzok, as well as David Laufman, [REDACTED] and [REDACTED]from the Department of Justice (DoJ) Counterintelligence and Export Control Section. After being advised of the identities of the interviewing agents and the purpose of the interview, MILLS provided the following information:
Immediately after completing her service at the United States Department of State (State) in 2013, MILLS became personal counsel for HILLARY CLINTON. HEATHER SAMUELSON joined MILLS’ firm, located in Chevy Chase, MD, sometime in 2014.
Transition to Platte River Networks Server
When the respective offices of WILLIAM and HILLARY CLINTON began a search for a company to operate and maintain an email server, the CLINTON’s financial manager recommended [REDACTED]as a technology broker. There were no security concerns with the CLINTON’s then-current email server operated by BRYAN PAGLIANO (Pagliano server). The CLINTON’s wanted an outsourced company accountable for the operation of the server. MILLS coordinated the needs for the server by providing non-technical guidance to [REDACTED] which was focused on the end user experience. After [REDACTED]identified several companies as options, the Office of President CLINTON reviewed the recommendations and selected Platte River Networks (PRN). After PRN was selected to procure, operate, and maintain the server (PRN server), MILLS negotiated the final cost and addressed privacy concerns with PRN. Throughout the negotiation process, MILLS consulted with PAGLIANO to ensure the recommendations of PRN would meet the end user experience guidance she had provided to PRN.
When PRN completed the transition from the Pagliano server, MILLS did not knowif PRN transferred any email to the PRN Server. Additionally, MILLS did not know what PRN planned to do with the Pagliano server after the transition was complete.
Continuation of FD-302 of Interview of CHERYL MILLS. On 5/28/2016. Page 2
Department of State Request
In the Summer of 2014, State was in the process of producing materials for the House Select Committee on Benghazi and raised concerns with MILLS regarding the lack of email for CLINTON. MILLS met with State personnel [REDACTED] and [REDACTED]who told MILLS State had no electronic records for CLINTON, other former Secretaries of State, and some other State personnel. MILLS understood the issue to be that State’s computer systems taped over backup records after a period of time for all users not on the seventh floor and some users on the seventh floor. MILLS suggested to State they search State systems for CLINTON’s clintonemail.com address, while State requested MILLS produce CLINTON’s email. State provided no initial deadline in the first meeting and followed up with a letter documenting the request. MILLS understood State’s request to be in relation to the Benghazi Committee and not a Freedom of Information Act (FOIA) request.
CLINTON asked MILLS and DAVID KENDALL to oversee the process of providing State CLINTON’s emails from her tenure as Secretary of State. As the process was developed, [REDACTED] advised MILLS it was CLINTON or MILLS’ obligation to filter out personal emails from what was provided to State. Additionally, if State received all CLINTON’s emails involving .gov accounts, State would not filter our personal emails.
Collection of Relevant Email
Late in the Summer of 2014, MILLS contacted[REDACTED] at PRN and requested all CLINTON’s email involving a .gov account from her tenure as Secretary of State. MILLS believed [REDACTED]search for .gov email encompassed email headers, the body of emails, and any forwarded emails. She was not aware of which mailboxes or other potential locations [REDACTED]searched for email responsive to her request. However, MILLS did not believe [REDACTED]was asked to search or searched HUMA ABEDIN’s clintonemail.com account. After preparing a .pst file of the .gov emails (July Export) based on MILLS’ request, [REDACTED] discussed different option on the transfer of the July Export with MILLS, to include shipping DVDs, but [REDACTED]recommended a secure remote transfer. Based on [REDACTED] advice, MILLS neither requested nor received DVDs containing the July export.
After deciding on the remote transfer, [REDACTED]provided MILLS with a link which provided[REDACTED] remote access to MILLS’ computer. MILLS clicked on the initial link,then clicked an additional acknowledgement giving [REDACTED]permission to remotely access her computer. [REDACTED]then transferred the July Export to MILLS’ computer and imported it into Outlook. Once the process was complete, MILLS revoked[REDACTED]permission and the remote session was terminated. MILLS did not know where [REDACTED]saved the .pst file on her computer or if it was encrypted, however, MILLS did recall the .pst file was password protected. Sometime after
Continuation of FD-302 of Interview of CHERYL MILLS. On 5/28/2016. Page 3
MILLS received the transfer, HEATHER SAMUELSON received a similar transfer from PRN. MILLS never made copies of the .pst file or transferred it to external media.
MILLS’ Dell laptop (Dell) was the computer that received the transfer described above. The Dell was primarily used for work, but was sometimes used for personal reasons. It was connected to the Internet and had up-to-date antivirus software installed. The Dell was not wiped, otherthan PRN actions described later, or reset to a factory state. MILLS continued to use the Dell until it was turned over to her attorney BETH WILKINSON. The Dell is currently in WILKINSON’s possession.
Shortly after SAMUELSON began reviewing the July Export from PRN, she noticed there was no email from approximately January 2009-March 2009 in the data provided by PRN. MILLS likely reached out to [REDACTED]regarding this matter. [REDACTED] told MILLS PRN did not have any email for CLINTON from the timeframe in question. Since CLINTON was using AT&T for BlackBerry service during that time, MILLS recalled learning AT&T did not keep email records, but did not recall when she became aware of that fact. MILLS did not contact any other email service providers,such as Gmail, because she did not have knowledge of CLINTON using another email service. Additionally, MILLS did not recall attempting to access an Apple server that was once in operation at the CLINTON residence in Chappaqua, NY.
After reviewing a document dated July 28, 2014 referencing a conference call between MILLS, [REDACTED]and PAGLIANO regarding archived email options, MILLS stated she did not recall the specific conversation. Other than the conversation described above, MILLS did not recall any other conversations with[REDACTED]about the request for CLINTON’s email involving .govaccounts.
After SAMUELSON began the review of the July Export, but before her review was complete, MILLS contacted [REDACTED]and requested a .pst file containing all of CLINTON’s email from her tenure as Secretary to review it for non .gov work related email (September Export). MILLS did not instruct [REDACTED]to search ABEDIN’s email and did not know which mailboxes or email addresses [REDACTED]searched to produce the .pst file responsive to her request. PRN remotely transferred the .pst file to SAMUELSON, however, MILLS did not recall if the .pst file was transferred to MILLS’ Dell. Other than the July Export and, possibly, the September Export, MILLS did not receive any other .pst file transfers from PRN. However, SAMUELSON, as the one conducting the review, sometimes contacted [REDACTED]directly and received smaller transfers when she identified gaps in .pstfiles from [REDACTED]. MILLS never had direct access to CLINTON’s mailbox on the PRN server.
Cull and Review of Email
The review methodology employed by SAMUELSON was developed by SAMUELSON, MILLS and KENDALL, but was executed by SAMUELSON. They did not consider using any commercially available e-discovery tools for the review and did not consult any individuals
Continuation of FD-302 of Interview of CHERYL MILLS. On 5/28/2016. Page 4
who were not agents of Clinton during the review process. They also did not discuss how to handle potentially classified emails during the review because they had no reason to believe any classified material was contained in the emails. Additionally, no emails were identified as containing potentially classified or sensitive information, therefore, no emails were removed during the review process.
The review process called for all email from CLINTON’s tenure to be filtered for .gov email addresses, relevant keywords, and the names of government officials. The review took SAMUELSON several months and occurred at MILLS’ office in Chevy Chase, MD. SAMUELSON used her own computer for the review and, as questions arose, SAUMELSON would print any email in question and ask for guidance from MILLS. Emails that contained a mix of work-related and personal content were treated as work related. Once the review was complete, SAMUELSON printed the approximately 30,000 work-related emails identified in the review. The printed copies were then provided to State in December 2014. SAMUELSON produced an electronic copy of the work-related emails which was later provided to KENDALL at Williams and Connolly. MILLS was not aware of who produced the electronic copy provided to the FBI or what the file was named. Other than emails where SAMUELSON requested MILLS’ guidance, MILLS did not review the emails identified by SAMUELSON as work-related.
MILLS was unsure if SAMUELSON encountered duplicate emails during her review. If she did, MILLS was not involved in any efforts to remove duplicates from the collection provided to State. Regarding ABEDIN’s account on clintonemail.com, MILLS did not know why no email between ABEDIN’s account and CLINTON’s account was part of the production to State. There was no distinction between the treatment of email to or from ABEDIN’s clintonemail.com account and ABEDIN’s state.gov account.
After State began reviewing the emails printed by SAMUELSON, Stated (sic) advised MILLS when specific emails were determined to be classified and instructed her to delete the emails in her electronic copy, then empty her deleted items folder.
After reviewing an email dated November 24, 2014 referencing an “urgent call” with “CESC,” MILLS stated she did not recall participating in a call with [REDACTED]MILLS also did not recall SAMUELSON having trouble with her connection to the .pst files in the same approximate timeframe.
MILLS recalled a discussion with PRN where PRN explained, because of the way Outlook functions, it displayed CLINTON’s current email address instead of the email address CLINTON used at the time each email was transmitted. This issue was not resolved and no emails produced to State were altered.
Deletion of Email
Continuation of FD-302 Interview of CHERYL MILLS. On 5/28/2016. Page 5
In late 2014 or early 2015, MILLS contacted [REDACTED]and requested he remove all pst files from her computer. She was unsure if she discussed with PAGLIANO the software proposed by[REDACTED]to effect the deletion. In January 2015, [REDACTED]sent MILLS a link and, in a process similar to the file transfer process described above, took control of her computer in a remote session.[REDACTED]checked the computer for the requested files and removed them using software that permanently deleted the files. MILLS did not know if BleachBit was the software used by [REDACTED]After he completed the process, MILLS looked with [REDACTED]to verify the files were deleted. MILLS did not discuss wiping or deletion software with anyone who was not an agent of CLINTON at the time, nor did anyone other than [REDACTED]remove files from her computer.
In December 2014 or January 2015, CLINTON decided she did not want to retain email beyond a 30 or 60 day retention policy, to include access to any historical content. MILLS contacted [REDACTED]and conveyed this change, but did not specifically instruct him to remove any .pst files or archived mailboxes.
In March 2015, after notifying PRN of obligations to preserve materials relevant to CLINTON’s email, MILLS contacted PRN to determine if any backups of CLINTON’s email existed and, if so, where those backups were located. After discussing the matter with PRN, she instructed PRN to visit the datacenter where the Pagliano server was housed and review it to confirm no records existed on the old system. PRN could not locate any backup data on the Pagliano server or any of the associated equipment, however, MILLS instructed PRN to maintain the equipment. MILLS was not aware of PRN deleting any data related to CLINTON’s email in March 2015, nor did she request PRN delete any data, to include .pst files or Datto backup files. Furthermore, MILLS did not instruct PRN to delete any data using BleachBit on March 31, 2015.
MILLS had no knowledge regarding the following topics:
— At the time it was created, an email archive of CLINTON’s email, including content from her tenure as Secretary of State, created by MONICA HANLEY.
— HANLEY providing the computer she created the archive on to [REDACTED]in early 2014.
— [REDACTED]returning the above computer containing the archive in 2014.
— Any transfer of clintonemail.com content to hrcoffice.com.
— CLINTON’s access, or lack thereof, to her clintonemail.com content after CLINTON’s hrcoffice.com email address was created.
— HUMAABEDIN’s method for accessing email.
— A master copy containing all of CLINTON’s email from her tenure as Secretary of State.
— PRN email exports from September 2015.
A copy of the original interview notes are enclosed in a I A envelope.
Cheryl Mills 4/9/16 Page 104
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 4/13/2016
On April 9, 2016, CHERYL MILLS, was interviewed by Special Agent (SA) [REDACTED]and SA [REDACTED]inside the FBI Washington Field Office. 601 4th Street NW. Washington, DC 20535. Present for the interview were MILLS’ attorneys Beth Wilkinson, Alexandra M. Walsh, and Hal Brewster from Wilkinson, Walsh & Eskovitx, LLP. Also present was FBI Section Chief Peter P. Strzok as well as David Laufman, [REDACTED]and [REDACTED]fromthe Department of Justice (DOJ). Prior to the interview, Wilkinson, Walsh, and Brewster agreed to sign a non-disclosure agreement in anticipation of viewing documents during the interview that were classified as part of a Special Access Program (SAP).
Prior to the interview, agents advised MILLS that while it was understood that the interview was being limited to the period other Department of State (DoS) employment, the FBI believed it essential to the investigation to understand the sort process and the computers used in that process. Furthermore. MILLS was advised the FBI expected to continue the interview after the details were resolved by the attorneys. After being advised of the identities of the interviewing agents and the purpose of the interview, MILLS provided the following information:
From 1992 to 1999, MILLS served in the White House as Associate Counsel to the President. From 2002 to 2009, MILLS served as the Senior Vice President and General Counsel at New York University. MILLS also served as a consultant to HILLARY R. CLINTON’s 2008 Presidential Campaign. In 2009, MILLS transitioned with CLINTON from the campaign to the Department of State (DoS). Initially, from January 2009 until May 2009, MILLS, served in a part-time capacity as Acting Chief of Staff. She converted to full-time Chief of Staff and Counselor for Policy related to Food Security and Haiti thereafter. MILLS resigned from DoS in February 2013.
HUMA ABEDIN and JACOB SULLIVAN were also part ofCLNTON’s DoS executive staff. ABEDIN served as Deputy Chief of Staff for Operations and SULLIVAN served as Deputy Chief of Staff for Policy, [REDACTED]was also assigned to CLINTON’S executive staff as [REDACTED][REDACTED]position was separate from that of the [REDACTED]
Continuation of FD-302 of interview of CHERYL MILLS. On 4/09/2016. Page 2
MILLS held a top Secret/Sensitive Compartmented Information (SCI) clearancewhile in DoS. MILLS believed she likely had security training from Diplomatic Security (DS) upon receiving her clearance, but didn’t recall any specific training. MILLS was not aware, nor was she ever told, she was a DoS original classification authority.
MILLS did not recall receiving any specific training or guidance concerning Federal Records retention policy or procedure during her DoS tenure, but explained it could have happened.
MILLS’s unclassified DoS email account was MillsCD@state.gov. This account was linked to her DoS issued Blackberry and could also be accessed from her unclassified DoS computer or remotely via a fob system. MILLS further stated that the DoS fob system was not always reliable, and sometimes “went down.” MILLS maintained a Gmail account, [REDACTED]@gmail.com that she would use when she could not access her DoS unclassified account. Said Gmail account was the only personal account used by MILLS during her DoS tenure.
MILLS was able to switch over to a classified network in her DoS office. She was unsure as to what level of classification said network could handle, but knew that it could at least handle material declared as Secret.
When MILLS needed to review Top Secret materials, information was provided to her in person and taken away alter she reviewed the materials. MILLS was not familiar with the JWICSsystem, and was not sure who may have had a JWICS account at DoS.
MILLS was asked to review an email dated 6/4/2011 and with the subject line “Google email hacking and woeful state of civilian technology.” In response to the email, MILLS stated she did not recall the email, but the content was not unfamiliar to her. MILLS remembered hearing that hackers may have been targeting Gmail accounts, and further recalled somebody suggesting her account may have been targeted, but she was unsure of who provided her with this information. [REDACTED]the originator of said email, traveled a lot and had frequent difficulties signing into the DoS network, so it was common for her to use personal email.
Agents asked MILLS to review a DoS cable dated 6/28/2011 with the subject line “Securing Personal E-mail Accounts.” MILLS did not recall the cable, but stated that it was probably connected to the 6/4/2011 email she previously reviewed. MILLS did not believe the referenced cable resulted in a “perfect” change of behavior in regards to the use of personal email accounts by DoS employees.
MILLS was asked to review an email dated 7/22/2011 with the subject line “Draft High-Level Narrative and Work Plan [Note Use of Personal/Gmail].” MILLS stated she “did not recall what she meant by (writing) “Note Use of Personal/Gmail.” in the subject line.
Continuation of FD-302 of interview of CHERYL MILLS. On 4/09/2016. Page 3
The only mobile DoS device MILLS was issued was a Blackberry. Most, but not all, people at DoS were assigned a Blackberry. MILLS was not assigned a mobile secure phone, but she was able to check one out from the DoS communication team if/when needed.
MILLS did not travel with CLINTON as often as ABEDIN and/or SULLIVAN. MILLS only traveled with CLINTON on occasion when she visited Caribbean, African, or South American countries. When CLINTON traveled, MILLS ordinarily stayed back in Washington, DC, to manage DoS in her absence. MILLS recalled receiving travel briefings from DS prior to her DoS related travel.
MILLS was involved with the team that helped CLINTON transition to DoS. MILLS’ role was to help CLINTON identify the priorities she wanted to address as Secretary. MILLS also identified individuals for CLINTON’s staff. MILLS further saw her role as helping CLINTON ”balance her life in regards to the transition.” MILLS had no recollection of being involved with discussions concerning the structure of CLINTON’s Information Technology (IT) platform during or after the transition.
Agents asked MILLS to review two emails from February 2009 with the subject lines “Update”‘ and “Recap-Meeting re: Blackberries.” While MILLS did not recall the specific emails, she stated she recalled the issue the emails referenced. MILLS explained CLINTON used a Blackberry to communicate prior to coming to DoS. CLINTON was not computer savvy and thus was not accustomed to using a computer, so efforts were made to try to figure out a system that would allow CLINTON to operate as she did before DoS. CLINTON did not have a computer in her DoS office. MILLS recalled hearing that the National Security Agency (NSA) had secure Blackberry technology that would allow for the use of such devices in a SCIF. MILLS requested DoS communication and security personnel research the possibility of implementing said technology at DoS. Ultimately it was decided that although the technology existed, it was not feasible to implement the same technology at DoS.
When asked what her understanding was in regards to who the six proposed secure Blackberry users were at DoS, as referenced in the email, MILLS explained that the goal was to obtain the technology for CLINTON because she did not have a computer. MILLS was not aware of who else at DoS may have received a secure Blackberry had the technology been approved for use at DoS.
The executive suite at DoS was termed “Mahogany Row” because of the wood paneling throughout the space. Mahogany Row was a SCIF, so the use of Blackberries was not authorized. MILLS was not familiar with waivers issued to previous Secretaries of State, which allowed for use of Blackberries in a DoS SCIF.
MILLS was asked to review a March 2009 DoS Memo with the subject line “Use of Blackberries in Mahogany Row” The memo, from ERIC J. BOSWELL, was addressed to MILLS. MILLS stated she “did not recall the memo, but it was not unfamiliar.” MILLS believed the memo was in
Continuation of FD-302 of interview of CHERYL MILLS. On 4/09/2016. Page 4
response to inquiries and discussions held early on in CLINTON’s DoS tenure concerning the possible use of Blackberries in sensitive DoS spaces. However, MILLS further explained that CLINTON and her executive staff did not use Blackberries on Mahogany Row because they were never authorized to do so.
When CLINTON wanted to email, she would have to leave Mahogany Row to retrieve and use her Blackberry. When CLINTON was inside of DoS Headquarters, most information was relayed to her face to face or on the phone. CLINTON also liked to receive and read a lot of information in paper documents, which is why she would often forward emails to her executive staff with instructions to print. MILLS was not aware of anyone other than CLINTON who had access to CLINTON’s email account.
MILLS was not aware of CLINTON ever being issued a DoS Blackberry, nor could she recall any official request made for CLINTON to receive one. Agents asked MILLS to review an email dated 8/30/2011 with the subject line “Communications” After viewing the email, MILLS stated that she believed the exchange was in reference to conversations about communication issues during Hurricane Irene. MILLS recalled CLINTON’s email was down during that time. Agents asked MILLS what was meant in the email by discussing the creation of a DoS email account that could “mask her identity, but which would also be subject to FOIA requests.” MILLS explained she assumed “masking her identity” was in reference to the ability to give CLINTON a pseudonym so her account was not obvious to outside parties. MILLS also explained she thought that the FOIA reference meant that CLINTON’s emails from the potential account would be subject to FOIA if the filing party knew the pseudonym.
Agents asked MILLS to review an email dated 1/24/2009 with the subject line “Series of Questions.” MILLS stated she recalled the context of the email. As MILLS previously mentioned, CLINTON did not know how to use a computer, so the suggestion of a stand alone computer for CLINTON was not an appropriate solution.
CLINTON’s office was connected to MILLS’ office, so she would generally walk into CLINTON’s office to share information MILLS received from relevant emails. MILLS wanted to create the best flow of information to the Secretary possible. MILLS stated she had no general concerns on how DoS business was handled on unclassified systems.
When CLINTON first came to DoS, she was using an email account associated with her AT&T Blackberry (firstname.lastname@example.org ), and a few months later, CLINTON transitioned over to the @clintonemaiI domain. MILLS did not know why CLINTON transitioned, but was aware of the transition because she was notified of the change in CLINTON’S email address. MILLS further stated she was not aware of anyone at the time, from DoS or otherwise, who was responsible for the email transition.
It was MILLS ‘practice to use her State.gov email when conducting DoS business.
Continuation of FD-302 of interview of CHERYL MILLS. On 9/09/2016. Page 5
MILLS was not aware of any efforts to archive emails for federal records retention requirements or otherwise while she was at DoS. MILLS may have had conversations with BRYAN PAGLIANO concerning the Federal Records Act, but she was not sure. MILLS met with PAGLIANO frequently. MILLS did not recall any conversations with [REDACTED]concerning CLINTON’s use of a private server and/or the Federal Records Act. MILLS stated that [REDACTED]name was familiar, but she did not recall any interactions she may have had with him.
MILLS recalled CLINTON using an iPad to review news articles. MILLS did not know if CLINTON used her iPad to email. MILLS was not aware of how many iPads CLINTON may have had during her DoS tenure. MILLS did not recall CLINTON using a “flip phone.” MILLS was onIy aware of one mobile phone number for CLINTON.
MILLS did not recall any temporary email accounts or phone numbers being set up for CLINTON during Hurricane Sandy.
MILLS did not learn CLINTON was using a private server until after CLINTON’s DoS tenure. MILLS stated she was not even sure she knew what a server was at the time. MILLS had no insight as to who came up with the idea of using the private server, nor was she aware of who made the final decision to use said server. However, MILLS believed the idea was to “piggyback” on the already existing server being utilized by President WILLIAM J. CLINTON. MILLS stated that there may have been technical people at DoS who were aware the Secretary was using a private server, but MILLS was only speculating. MILLS was not aware of any DoS procedures to approve the setup and use of a private server by CLINTON.
ABEDIN also had an account on the clintonemaiI.com domain. MILLS was not sure why she was not offered an account on the clintonemail.com domain, but stated that she was now “glad (she) did not have one.”
MILLS was not familiar with the email address email@example.com. MILLS also stated she was “not aware of the email account [REDACTED]@gmail.com while at DoS.”
It was MILLS’ belief that the front office at DoS had a strong understanding of the need to maintain federal records. Agents asked MILLS to review an email dated 12/11/2012 with the subject “Significant FOIA Report.” After reviewing the email. MILLS stated she was not sure if she was involved in the FOIA request filed by Citizens for Responsibility and Ethics in Washington (CREW) as discussed in the email. MILLS further explained there was a large volume of FOIA requests while she was at DoS. DoS Executives were made aware of significant FOIA requests, but it was not typical for MILLS to respond to FOlA because “it was not in her realm” MILLS also stated she “couldn’t say who (at DoS) FOIA responses fell on.”
Continuation of FD-302 of interview of CHERYL MILLS. On 9/09/2016. Page 6
MILLS did not have knowledge of any backups or migrations of clintonemail.com accounts, nor was she aware of who might have knowledge of such events. MILLS was not aware of any emails being deleted or wiped from CLINTON’S private email server prior to CLINTON leaving DoS.
Agents asked MILLS to review an email dated 10/13/2012 with the subject line “This am Green on Blue” After reviewing the email. MILLS stated she remembered the event, but not the specific email. MILLS did not know why[REDACTED] might have forwarded her the email in question, but assumed it was “because he wanted her to read it.” MILLS also noted the email was sent on a Saturday, so she was probably not in the office to receive the information directly from[REDACTED]. MILLS further stated she did not have any concerns over the classification of the content of the email, nor that it was sent via an unclassified email.
Agents asked MILLS to review an email dated 2/20/2011 with the subject line “follow Up to Davutoglu Call.” After reviewing the email, MILLS stated she did not recall the email, nor could she speak as to [REDACTED] reason for drafting the email and sending it to her. MILLS further explained if the media was interested in a story related to DoS[REDACTED] would have notified MILLS regardless of the sensitivity.
Agents asked MILLS to review an email dated 3/12/2011 with the subject line “radiation-fyi.” After reviewing the email, MILLS stated she was not sure why [REDACTED]wouId have sent her the email. [REDACTED] was a private citizen.[REDACTED] MILLS stated she could not recall what she meant when she typed “sending for info not for forwarding” before sharing [REDACTED] email with CLINTON. MILLS had no concerns over her decision to forward the email on to [REDACTED] STEPHEN MULL, or CLINTON.[REDACTED]MILLS recalled being read into Special Access Programs but did not recall the specifics concerning the SAPs or read-on process. [REDACTED]
MILLS was asked to review an email dated 12/23/2011 with the subject “(SBU)” After reading the email. MILLS stated the email originated from [REDACTED]who was the[REDACTED] and was forwarded to[REDACTED]who was [REDACTED]and later[REDACTED] MILLS stated she was “not surprised to see an email like this.” She further stated that nothing in the email concerned her in regards to its classification. MILLS was not sure why[REDACTED]would have sent the email string to MILLS’Gmail account rather than to MILLS’ DoS account. MILLS
Continuation of FD-302 of Interview of Cheryl Mills. On 04/09/2016. Page 7
further stated she did not recall if it was common to receive emails similar to the email in question in her Gmail account. MILLS was not aware of a formal process for providing notification of concurrence related to a High Value Target (HVT) to DoS Headquarters.
Agents asked MILLS to review an email dated 12/27/2011 with the subject “(SBU).” After reading the email, MILLS stated that she had no concerns regarding the classification of the email and her decision to forward CLINTON the email she received from [REDACTED]. MILLS explained the goal was to observe what was going on in local media at the time, and she believed the email was related to that purpose.[REDACTED]Agents asked MILLS to review an email dated [REDACTED]with the title [REDACTED] and another dated [REDACTED]with the title [REDACTED]. The first of the two emails was sent on the DoS Secret network, whereas the latter of the two documents was sent via unclassified DoS email. Both emails pertained to[REDACTED]. MILLS stated that she did not recall the originator of the document [REDACTED], nor did she remember the email, nor how the information contained in the email would have been relayed to CLINTON. At the prompting of her counsel, MILLS also stated she received between 400 and 700 emails a day while at DoS, and thus could not remember specific emails. MILLS stated she could not confirm if the information contained in the email agents asked Iater to review would have been relay
ed to CLINTON. [REDACTED]MILLS did not have any concern over the content of the information in the email being sent on an unclassified system.
MILLS was involved in the development and draft process of some DoS policy memos, but it depended on the topic. Agents asked MILLS to review two of the same email dated 10/4/2009 with the subject “Draft Holbrooke Team” and an attachment titled “Pak Paper 10-03dcjjs.docx.” One of the two emails was redacted by DoS in response to FOIA production, whereas the other was shown in a non-redacted format. MILLS stated she did not recall the information containedin the email she reviewed. MILLS did not know who would have drafted the memo. MILLS stated she was not familiar with the [REDACTED] Report.”
According to MILLS, something might start in an unclassified format at DoS, but later be reclassified at a higher level when that information related to policy matters. MILLS was not sure who at DoS made the determination to change the classification.
MILLS did not recall any instances wherein she had concern over the way sensitive or classified information was handled at DoS. MILLS also did not recall any instances wherein CLINTON shared (with MILLS) any concerns over the way sensitive or classified information was handled at DoS.
A copy of the original interview notes is enclosed in a 1 A envelope.
Stephen Mull 2/1/16 Page 111
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 2 /2 /2016
On February 1, 2016, STEPHEN D. MULL, DOB XX/XX/XXXX, was interviewed by Federal Bureau of Investigation (FBI) Special Agents[REDACTED] and [REDACTED] in his office at the United States Department of State (DoS), 320 2Ist Street NW, Washington, DC, Room 3417A. After being advised of the identities of the interviewing agents, and the purpose of the interview, MULL provided the following information:
MULL is a career DoS Foreign Service Officer. From 2009 until June of 2010, MULL served as a Senior Advisor to the Secretary of State on Political Affairs. In June 2010, MULL was appointed DoS Executive Secretary, a position in which he served until October 2012.
MULL later served as the United States Ambassador to Poland from November 2012 until September 2015. Thereafter, MULL was appointed to his current position, Coordinator for Iran Nuclear Implementation.
As Executive Secretary, MULL oversaw the entire DoS Executive Secretariat in regards to information processing, crisis management, travel support, and Information Technology (IT). MULL was more specifically tasked with overseeing the formal processing of information to and from the Secretary of State, HILLARY CLINTON, and her executive staff, to include the DoS Operations Center. This also included providing both mobile and in office IT support to the Secretariat.
While serving as Executive Secretary, MULL had very little direct interaction with the Secretary of State. MULL mostly interacted with the Secretary’s Chief of Staff (COS) CHERYL MILLS.
Everybody in CLINTON’s front office, except CLINTON herself, was on the Principal Officer Electronic Messaging System (POEMS) system. MULL communicated with CLINTON’s executive staff via POEMS. MULL was not aware how messages sent to CLINTON’s executive staff were relayed to CLINTON, but assumed they were orally briefed.
MULL was aware CLINTON was using a personal email account while at DoS. However, MULL had no role in setting up or maintaining CLINTON’s personal account. MULL stated he did not know if the use of personal email accounts was common practice for previous Secretaries of State. MULL was not aware of a DOS policy at the time prohibiting the use of personal email accounts or servers. MULL further explained as Executive Secretary, he was responsible for overseeing the formal communications of the Executive Secretariat, but would not have been involved with providing and/or
Continuation of FD-302 of Interview of Steven Mull. On 2/I/20I6. Page 2
maintaining information communication platforms. MULL did not know who assisted CLINTON in setting up the private email account and server she utilized at DoS. MULL did not know who was responsible for maintaining CLINTON’s personal mobile communications devices, nor who was responsible for making sure the installation and use of said devices were within DoS policy.
Early into CLINTON’s tenure as Secretary, MULL recalled being contacted by either MILLS or HUMA ABEDIN who asked about the possibility of the Secretary using an iPad to receive communications in her office. MULL recalled following up on their iPad inquiry, but explained he believed it was ultimately decided that CLINTON could not have the iPad in her office because of restrictions associated with her office being a Sensitive Compartment Information Facility (SCIF).
MULL never observed CLINTON using a mobile device in her office, but recalled seeing a picture of CLINTON using her Blackberry device on her DoS plane. MULL was unaware if there was any prohibition concerning the use of a Blackberry on the DoS plane.
MULL assumed Bluetooth capabilities were disabled on DoS issued mobile devices. MULL was not sure if CLINTON‘s private devices were configured the same way.
Agents asked MULL to review an email titled “S Communications,” dated 8/30/2011, wherein it appears MILLS and ABEDIN ask MULL about the possibility of the Executive Secretariat issuing CLINTON a DoS Blackberry to use while her personal Blackberry was malfunctioning. MULL recalled informing ABEDIN and MILLS that while the Executive Secretariat could issue a DoS device, the DoS issued Blackberry would be subject to FOIA requests. MULL further recalled it was eventually decided CLINTON no longer needed the DoS device, and thus her request for a DOS Blackberry was never fulfilled.
MULL recalled receiving information from DoS Security[REDACTED]sometime in 2011, indicating there was concern over the possibility that some personal email accounts of DoS employees were hacked. MULL specifically recalled hearing CLINTON’s Deputy Chief of Staff (COS) JACOB SULLIVAN’s personal email account was amongst those compromised. [REDACTED] is currently assigned to the U.S. Embassy in [REDACTED].
MULL also provided the following names of individuals at DoS who had knowledge of CLINTON’s IT setup during her tenure as Secretary of State:
–[REDACTED]who worked under MULL was the[REDACTED] for the Secretary and her executive staff.
–TULINABO (TULI) MUSHINGI was the DoS Deputy Director for Administrative Support and supervised the DoS Mobile Communications Team. MUSHINGI is now the United States Ambassador to Burkina Faso.
–JOHN BENTEL managed the DoS POEMS system.
A copy of the original interview notes are attached in a 1 A envelope.
(???) 11/3/16 Page 114
FEDERAL BUREAU OF INVESTIGATION
Date of transcription:11/04/2015[REDACTED] date of birth XX/XX/XXXX was interviewed at his office at The Washington, D.C [REDACTED] mobile telephone number (XXX) XXX-XXXX by Federal Bureau of Investigation (FBI) Special Agents (SA)[REDACTED] and [REDACTED]. After being advised of the identity of the interviewing agents, and the nature of the interview,[REDACTED]provided the following information: [REDACTED] served as the[REDACTED] at the U S. Department of State, under the former Secretary of State HILLARY CLINTON, from[REDACTED]until the end of CLINTON’s term in February of2013.[REDACTED] is a self described “Clintonista.” His relationship with the CLINTONS dates back to [REDACTED]under President Clinton. In 2009,[REDACTED]
As the[REDACTED] held a TS/SCI clearance and was responsible for [REDACTED]any current Department of State matters. Each morning[REDACTED]worked with his staff to generate unclassified talking points and responses to [REDACTED]This process often required the team to reference classified reporting to ensure that they had the proper context when formulating the response. The talking points were generated on the low side and were often based on reporting from the relevant country desk officer. Desk officers were responsible for coordinating information with external agencies as necessary, and were knowledgeable in how to protect sensitive sources and methods within their reporting.
Composing unclassified talking points required a continuous and conscious effort to evaluate if a given piece of information was derived from a classified or unclassified source. [REDACTED]described this process as an ongoing dilemma that they had to work through–How do you talk about diplomatic conversations in the public sphere without getting into details that may be confidential or protected? However, he noted that, they had grown up in this environment and knew how to separate classified information from unclassified statements. [REDACTED]provided that he and his team had received training on the handling of classified information.
Continuation of FD-302 of Interview of [REDACTED]. On 11/03/2015. Page 2[REDACTED]worked very closely with CLINTON and would meet with her four or five times a day to ensure that[REDACTED] were consistent with the thoughts and statements of CLINTON. [REDACTED]initially traveled with CLINTON and then when she became comfortable with the position he stopped traveling to manage his team in Washington D.C. [REDACTED]would typically communicate with CLINTON via the Ops Center when she was traveling. [REDACTED] described CLINTON as a “paper person” noting that she preferred paper documents over electronic communications but he would email CLINTON when necessary. In these instances he would usually send the email to CHERYL MILLS who would either forward the message to CLINTON or respond on her behalf. On occasion he would email CLINTON directly. [REDACTED]did not receive any formal guidance on what, or when, to email CLINTON directly. This decision was based on his judgment. [REDACTED]in the recent CLINTON email releases many of which were related to the posting of diplomatic cables by Wikileaks in 2010. In April of 2010, [REDACTED]first began to get a sense of Wikileaks as it began to post Department of Defense information. Then in November of 2010 he was notified by[REDACTED] that the New York Times was preparing to publish a large number of diplomatic cables in conjunction with a Wikileaks release. Over the next several months [REDACTED] had regular contact with [REDACTED]as well as[REDACTED] to discuss cables that there about to be released. Upon receiving a media inquiry or a notification of an upcoming release,[REDACTED]would review the cable(s) in question and then make requests to the media outlet(s) to omit or redact specific information that was deemed sensitive for operational or diplomatic reasons. These requests were not always honored and [REDACTED]estimated that they had a .250 or .300 batting average. The Department of State had a rule by which they would not discuss any classified information in the cables but in instances where the cable was being incorrectly portrayed, or could easily be misconstrued by the reader, [REDACTED]would provide additional unclassified background information to set the proper context for the cable. [REDACTED] routinely worked with MILLS, and any agency that had an equity in the specific cable, to formulate the response to the media outlet.
Wikileaks, and other media leaks, posed a difficult problem for the Department of State because the information was already outside of the control of the Department of State and was often about to be published. While the Department of State could say nothing in response to a media notification or inquiry, the stance of the Department of State was to play defense and try to limit the potential damage by engaging the media outlet and providing a justification for why sensitive information should be omitted or redacted.[REDACTED]first became aware of CLINTON’s private email account when he received an email where “H” was the sender. He initially thought the email was spam but upon reading the message quickly realized that it was from CLINTON. Aside from the ambiguous username,
Continuation of FD-302 of Interview of[REDACTED]. On 11/03/2015. Page 3.[REDACTED]was not surprised that CLINTON was using a personal email account because it is a common practice within the Department of State. [REDACTED] had no knowledge about the setup of CLINTON’s private server but assumed that Under Secretary PATRICK KENNEDY and MILLS would have been involved in that process. [REDACTED]had no concerns about how CLINTON handled her communicationsduring her tenure as Secretary of State. Nor did [REDACTED] have security concerns about anybody on CLINTON’s team. He did not recall any instances where classified information was intentionally sent to, or from, CLINTON’s email account. However, with respect to the emails on Benghazi, he noted that in hindsight some of the content should have been classified even though they did not believe it was classified at the time it was sent.
Due to the sensitivity of the matter, the interviewing agents verbally requested that [REDACTED] verbally keep the interview and the nature of the discussion confidential. [REDACTED] verbally agreed that he would not discuss the interview with other parties.[REDACTED] was amenable to recontact regarding this matter, if necessary.
Agent notes are included in an attached 1 A.
(???) 3/15/16 Page 117
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 3/21/2016
On March 15, 2016. [REDACTED] telephone number (XXX) XXX-XXXX [REDACTED] was interviewed by Special Agent (SA) [REDACTED] and SA [REDACTED] of the FBI Washington Field Office (WFO). After being advised of the identities of the interviewing agents and the purpose of the interview, [REDACTED] provided the following information:[REDACTED] served as the [REDACTED] he was named [REDACTED] remained [REDACTED] when he became [REDACTED] retired fromDepartment of State (DOS) in [REDACTED]. [REDACTED] did not get along with [REDACTED] and described him as a “big head.” [REDACTED] further explained he thought [REDACTED] did not know his lane, specifically concerning his weekly updates to DoS Headquarters. [REDACTED] sent a weekly report directly to the Secretary of State when it was widely known “you didn’t go direct” with the Secretary. Furthermore, there were concerns over [REDACTED] joining him in an unaccompanied post. [REDACTED] [REDACTED]
During his entire DoS tenure, [REDACTED] was never in direct contact with the Secretary of State. [REDACTED] was not aware HILLARY R. CLINTON was using a personal email address for DoS business nor that she was operating off a private email server while she was Secretary of State. When [REDACTED] needed to relay a message that required the attention of the Secretary, he would follow the chain of command and go through an Assistant Secretary of State. [REDACTED] main DoS contact at that level was [REDACTED].
Continuation of FB-302 of Interview of [REDACTED]. On 03/15/2016. Page 2[REDACTED] understood any emails he sent to [REDACTED] or other contacts at DoS could be forwarded. He did not recall ever copying JACOB SULLIVAN, HUMA ABEDIN. or CHEYRL MILLS, on emails because they were not in his chain of command. For urgent matters, [REDACTED] would follow protocol and contact the necessary parties via the DoS command center. [REDACTED] recalled communicating directly with [REDACTED] prior to Secretary CLINTON’s visit to Kazakhstan in 2010, but dial was the only time he could recall going outside of his normal command channels. [REDACTED] [REDACTED] had access to both DOS unclassified and secret networks at the Embassy in [REDACTED]. He could not recall if he had access to JWICS or a top secret network, but stated he did not use a top secret network. [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED]. After reviewing the email, [REDACTED] laughed and pointed out a portion in the email wherein he types, “My high side is down, so I’m summarizing this on this system” [REDACTED] explained it wasn’t common for the high side to go down at the Embassy, but it sometimes happened. He further explained alternative options for communicating classified information would have been a secure call to the DoS Operations Center or “a carefully worded summary like this one” (a reference to the email he reviewed). [REDACTED] stated he found the email “fascinating because it was just following theraid on the Usama Bin Laden (UBL) compound [REDACTED] further stated the email was “getting close to the line, obviously,” However, he was not concerned about the email because it was just “business as usual” for he and others to have to communicate sensitive matters this way. [REDACTED] never received formal guidance on how to communicate information concerning [REDACTED] however, he stated that “if you are a professional, you know how to do it and how much to do.”
Continuation of FB-302 of Interview of [REDACTED]. On 03/15/2016. Page 3[REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED]. After reviewing the email, [REDACTED] explained he did not recallthe context of the email. [REDACTED] further explained that the people to whom the email was addressed were aware [REDACTED]. Furthermore, he had no concerns with sending information contained in the email over an unclassified network because [REDACTED] believed he drafted the email so that it did not contain specific sensitive details. [REDACTED] Agents asked [REDACTED] to review email dated [REDACTED] with the subject [REDACTED]. After reviewing the email, [REDACTED] explained he did not recall the context because there were [REDACTED] [REDACTED] [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED].After reviewing the email, [REDACTED] exclaimed “again, this is right on the line.” While [REDACTED] did not recall the specifics concerning the context of the email, he stated there were no details contained in the email that would compromise a sensitive program. [REDACTED] also pointed out that there were only three people involved in his original email. [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED].After reviewing the email,[REDACTED] stated that the email would have been sent around the time Pakistan closed off border crossings with Afghanistan during which there was increased tension between Pakistan and the United States. [ REDACTED] did not believe the information contained in the email was of concern [REDACTED] [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED].Agents noted that the email was sent on a classified network and marked SECRET//NOFORN. [REDACTED] stated that he sent the email on the Secret network because it was still during working hours in Washington, DC. compared to the previous emails he viewed that were sent after hours, and it made more sense for accessibility. The right method of sending a communication. according to [REDACTED] was whatever method allowed for the fastest possible dissemination of the message. According to [REDACTED] the SECRET//NOFORN marking and the sensitivity marking on the email he reviewed were automatically inserted as a default. [REDACTED] Agents asked [REDACTED] to review an email dated 7/6/2012 with the subject “US drone strike kills 4 militant in Pakistan.“ After reviewing the email [REDACTED] stated “that’s interesting.” [REDACTED] RENDON (media/news service) was hired byDoS. [REDACTED] noted that [REDACTED] sent the news alert and further complained that she was always “sticking her nose where it didn’t belong.” [REDACTED] noted the information he added to the email chain [REDACTED]
A copy of the original interview notes is enclosed in a 1A envelope.
(Cameron Munter)3/10/16 Page 121
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 04/8/2016
On March 10, 2016, [REDACTED] former [REDACTED] was interviewed by Special Agent (SA) [REDACTED] and SA [REDACTED] in an FBI office in New York, NY. After being advised ofthe identities of the interviewing agents and the purpose ofthe interview, [REDACTED] provided the following information:[REDACTED]was the [REDACTED]. Prior to his tenure[REDACTED] retired from Foreign Service. Following his retirement[REDACTED]served as a visiting Professor [REDACTED]. [REDACTED] is currently [REDACTED]a non-government organization (NGO).
During his Department of State (DoS) tenure[REDACTED]had very limited interaction with the Secretary of State. [REDACTED]assessed he likely only met Secretary HILLARY R. CLINTON in person on six occasions. These contacts occurred when [REDACTED] traveled back to Washington. DC. for various meetings, or when the Secretary visited [REDACTED] further assessed that during the same time period he only spoke with Secretary CLINTON via telephone on two to three occasions[REDACTED] also participated in monthly Secure Video Teleconferences (SVTC) with the Secretary.[REDACTED]was never in direct email contact with Secretary CLINTON and did not know Secretary CLINTON’s email address. When [REDACTED] needed to relay a quick message back to DoS Headquarters, he would generally email direct with Deputy Secretary of State JACOB SULLIVAN or the Special Representative to Afghanistan and Pakistan (SRAP) office [REDACTED] SRAP contacts included RICHARD HOLBROOKE,[REDACTED]and [REDACTED] also sent a regular Secret cable to Secretary CLINTON once a week. On rare occasions, [REDACTED]may have emailed the SRAP office or SULLIVAN via unclassified email to alert them to a classified cable. [REDACTED] was not sure how information he provided was briefed to Secretary Clinton, but [REDACTED] “assumed the SRAP would brief at the level they saw fit.“
Continuation of FB-302 of Interview of [REDACTED]. On 03/10/2016. Page 2
There were three main ways [REDACTED] could report information back to DoS Headquarters:
- Classified email–usually for lateral information to other Ambassadors or to the National Security Council and [REDACTED]
- Unclassified email–for day to day interaction
Continuation of FB-302 of Interview of [REDACTED]. On 03/10/2016. Page 3[REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject line [REDACTED].Upon reviewing the email, [REDACTED] “wow…I don’t recall this email chain. I’m surprised to see it and prefer not to comment.” [REDACTED] was subsequently asked to review several other emails. Upon reviewing each document, [REDACTED] again indicated that he did not want to comment. [REDACTED]stated that the reference to “talkers” in referenced document [REDACTED]related to “talking points” for foreign government discussions. [REDACTED]also explained the “SBU” caveat in the email meant “Sensitive but Unclassified” was a selected classification option in his unclassified email. Other classification options included “U” for unclassified, or “LU/SBU Limited Use/Sensitive but Unclassified.”
While being escorted to the elevator by SA [REDACTED] stated he recently read a news article about the investigation into Secretary CLINTON’s personal email server that opined that most of the classified documents were over classified. However, [REDACTED]stated that after seeing the above referenced documents, he now understood why people were concerned about this matter.
A copy of the original interview notes is enclosed in a 1 A envelope.
(Cameron Munter)4/25/16 Page 124
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 4/27/2016
On April 25, 2016, [REDACTED] former [REDACTED][REDACTED] was interviewed by Special Agent (SA) [REDACTED]and SA[REDACTED]in the FBI Washington Field Office (WFO), 601 4thStreet NW, Washington, DC 20535. Also present for the interview was[REDACTED] counsel, [REDACTED] as well as [REDACTED]and [REDACTED] from the Department of Justice (DOJ). The interview was conducted as a follow up to an interview of [REDACTED]conducted by SA [REDACTED]and SA[REDACTED] on March 10, 2016. Prior to the interview, [REDACTED] agreed to sign a non-disclosure agreement in anticipation of viewing documents during the interview that were classified as part of a Special Access Program (SAP). After being advised of the identities of the interviewing agents and the purpose of the interview, [REDACTED] provided the following information:[REDACTED] [REDACTED] [REDACTED]
Continuation of FB-302 of Interview of [REDACTED]. On 04/25/2016. Page 2[ REDACTED [ REDACTED [ REDACTED] As a matter of practice [REDACTED] tried to meet the needs of DoS executive management by passing relevant information [REDACTED]. [REDACTED] only relayed information to individuals at DoS Headquarters at high levels “on the 7th floor” (a reference to the DoS executive suite referred to as Mahogany Row). As an alternative to unclassified email, [REDACTED] stated he has access to both DoS classified email and cable system. However, [REDACTED] the process for sending a cable was not quick nor were executives as likely to get a classified email in a timely manor (sic). [REDACTED][REDACTED][REDACTED] explained that he tried to use his best judgement. [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED].After reviewing the email, [REDACTED] explained he recalled the situation surrounding the email [REDACTED][REDACTED]. The Pakistanis were seeking an apology for a November 2011 event wherein U.S. Special Operations crossed the Pakistani border and killed Pakistani border guards. The Pakistanis responded by shutting down major supply routes used by U.S military forces. [REDACTED] [REDACTED]. [REDACTED] also explained the“(SBU)” reference in the subject line of the email related to one of two sensitivity choices available in the unclassified DoS system: Unclassified or Sensitive But Unclassified (SBU). [REDACTED]used SBU when he “wanted to point out that while something was unclassified, it should still be treated as sensitive,” [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject [REDACTED].Agents also informed [REDACTED] the email in question was sent on [REDACTED] DoS classified network. [REDACTED] stated the email was sent [REDACTED][REDACTED], and before the NATO Summit. [REDACTED]did not recall the specific email, but remembered conversations around the time regarding attempts to persuade the Pakistani’s (sic) to lift the supply route ban.
Continuation of FB-302 of Interview of [REDACTED]. On 04/25/2016. Page 3[REDACTED]usually communicated with Special Representative to Afghanistan and Pakistan (SRAP), [REDACTED]and[REDACTED] but assumed he must have also wanted SULLIVAN to know, as he noted SULLIVAN was one of the recipients. [REDACTED]assumed SULLIVAN would relay information to “anyone at DoS who needed to know:” the Secretary of State, Deputy Secretary of States, etc. SULLIVAN was not given guidance on how to relay such information back to DoS Headquarters, but stated the email in question was sent at a time wherein it was important to report. [REDACTED]was not sure why he chose to send the email in question on a classified network. [REDACTED] Agents asked [REDACTED] to review an email dated [REDACTED] with the subject “(SBU).” After reviewing the email, [REDACTED]explained he did not recall the context. However, [REDACTED] stated that the previously explained “cross border event” took place at the end of November 2011, so the email in question was sent shortly thereafter. [REDACTED] [REDACTED] [REDACTED] Agents asked [REDACTED] to review an email dated 7/6/2012, with the subject “US drone strike kills 4 militants in Pakistan.” After reviewing the email [REDACTED], explained the email was sent [REDACTED]. The email originated from an AP article found and forwarded to [REDACTED] subsequently forwarded the article to the Deputy Chief of Mission. [REDACTED][REDACTED] also stated that at the time he sent the email, he did not think the information he provided jeopardized anyone involved. [REDACTED]who was Cc’d on an email in the exchange was the [REDACTED]for the U.S. in Pakistan.
A copy of the original interview notes is enclosed in a 1 A envelope.
(Victoria Nuland)12/11/15 Page 127
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 12/11/2015
On December 11, 2015, [REDACTED] U.S. Department of State, was interviewed by Federal Bureau of Investigation (FBI) Special Agents [REDACTED] and [REDACTED]. After being advised of the identities of the interviewing agents, and the purpose of the interview, [REDACTED] provided the following information:[REDACTED] for the U. S. Department of State, from [REDACTED] where she was responsible for [REDACTED] [REDACTED] She assumed the role when [REDACTED] left the position. On atypical day [REDACTED] would meet with the then Secretary of State HILLARY CLINTON at the daily 8:30 A.M. meeting to discuss key issues [REDACTED] During the meeting CLINTON would provide guidance on what should be communicated [REDACTED] Prior to finalizing the briefing materials [REDACTED] would then work with the relevant Department of State components to verify the message and to add any necessary details. [REDACTED] did not deal with the U.S. Intelligence Community (USIC) aside from a daily interagency [REDACTED]. [REDACTED] traveled with CLINTON on all of her foreign trips, during which [REDACTED] were handled by one of [REDACTED] deputies. [REDACTED] stated that she saw CLINTON frequently throughout the day and as a result most of her communications with CLINTON were spoken. [REDACTED] could only recall one time when CLINTON emailed her directly and that was on the night of the Benghaziattack.[REDACTED] stated that at that time she had no knowledge that CLINTON was using a private email server. [REDACTED] noted that CLINTON was not an email person and therefore assumed that CLINTON was conducting personal business when she was on her Blackberry. [REDACTED] also worked closely with JAKE SULLIVAN, CLINTON’s Chief of Staff for Political Affairs, for routine matters. [REDACTED] understood that SULLIVAN would relay pertinent information to CLINTON but she did not know if SULLIVAN directly forwarded her emails to CLINTON or not. [REDACTED]provided that she occasionally interacted with CHERYL MILLS but didnot have regular contact withHUMA ABEDIN.
Continuation of FB-302 of Interview of [REDACTED]. On 12/11/2012. Page 2[REDACTED] reviewed an email, [REDACTED] that she sent on [REDACTED] with the subject [REDACTED] piece.” She confirmed that she remembered the events surrounding the email. After carefully reviewing the entire email string [REDACTED] gave a brief overview of the Benghazi attack and provided that this email was sent after she learned that the New York Times was planning to publish an article about the Benghazi attack and the annex. The topic was of particular interest because at that time the media only knew of the Consulate in Benghazi and information on the annex had not yet been publicly released. [REDACTED] further explained that [REDACTED] was to notify Department of State leadership when the media was preparing to release information on sensitive or controversial topics. Alerting leadership allowed the Department of State an opportunity to engage the media outlet to negotiate what details should be released and to prepare an appropriate public response.[REDACTED] stated that she sent the email in question to alert Department of State leadership and National Security Council personnel of the upcoming article because of potential sensitivities around disclosing the existence of the annex. The subsequent messages in the email chain are responses from other individuals as they discussed a subsequent call that occurred with the New York Times that afternoon.
During the discussion [REDACTED] provided that she is participating in the Freedom of Information Act (FOIA) review process for the ongoing release of CLINTON’s emails. [REDACTED] has a team of individuals who are reviewing all emails pertinent to [REDACTED] prior to their release, to assess if they contain information that is either classified or represents an internal Department of State deliberation.[REDACTED] explained that internal deliberations are internal discussions about various international affairs and policies. These conversations do not necessarily reflect the official, or final, stance of the Department of State on a specific topic. Additionally, the information may be misconstrued by the casual reader or cause embarrassment to the Department of State if it is released in its original form. When her team finds an email containing a deliberative discussion they mark the relevant sections for redaction under the B5 exception. [REDACTED] reviews the team’s work before it is passed to the next phase of the review process within the Department of State. [REDACTED] noted that a significant number ofthe items that her group recommended for redaction because they were deliberative products were ultimately marked for redaction, by internal counsel, using the classified material (B1) exception. [REDACTED] did not know why internal counsel elected not to follow her group’s recommendations but noted that as a result a significant number of FOIA released documents that are marked as containing classified information really only contain deliberative material. [REDACTED] acknowledged that some of the emails marked as containing classified information did in fact have classified material. However, she quickly noted that she did not recall seeing anything that would potentially compromise national security or be considered criminal in nature.
Continuation of FB-302 of Interview of [REDACTED]. On 12/11/2015. Page 3[REDACTED] explained that the U.S. Department of State personnel commonly operateon the unclassified system. She gave the example of a diplomat who summarizes a diplomatic conversation on the unclassified computer system. In general, they don’ t believe such diplomatic conversations are classified because it is usually obtained through diplomatic discussions and not from sensitive sources. They would consider the discussion to be Sensitive But Unclassified (SBU) and transmitted on OpenNet with the expectation that it would be contained on the Department of State system and only accessed by legitimate users. [REDACTED] was aware of the counterintelligence threats facing the Department of State and noted [REDACTED][REDACTED] Based on these experiences she is careful not to transmit sensitive information on the unclassified or unsecured systems and she advised her subordinates to do the same. However, despite her security posture she did not find fault with her colleagues who did otherwise.
A copy of the original interview notes are attached in a 1 A envelope.
Sid Blumenthal 1/7/16 Page 130
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 1/19/2016
On January 7, 2016. SIDNEY BLUMENTHAL was interviewed at the law offices of [REDACTED] NW Washington, DC 20005 by Federal Bureau of Investigation (FBI) Special Agent (SA) [REDACTED] and [REDACTED] Also present for the interview was BLUMENTHAL’s attorney [REDACTED] office telephone (XXX) XXX-XXXX, email address [REDACTED] as well as Department of Justice attorneys [REDACTED] and [REDACTED]. After being advised of the identity of the interviewing agents and the nature of the interview, BLUMENTHAL provided the following:
BLUMENTHAL is a friend of HILLARY CLINTON (CLINTON). During her tenure as Secretary of State from 2009-2013, he served as an informal political advisor by sending emails containing information he deemed to be helpful and interesting topics. BLUMENTHAL did not recall sending any such emails prior to CLINTON becoming Secretary of State. There was no set schedule for these emails, BLUMENTHAL was never paid for his advisory services, and there was no specific conversation with CLINTON regarding his informal role. However, CLINTON would occasionally acknowledge the value of his emails in a response to BLUMENTHAL. During this time, BLUMENTHAL was also employed by the Clinton Foundation where his duties were related to former President BILL CLINTON, his legacy, and some communications of the Foundation. BLUMENTHAL reported to [REDACTED] and does not recall what HILLARY CLINTON’s role was in defining his role at the Foundation. During this timeframe, BLUMENTHAL was also involved with the Clinton Global Initiative.
TYLER DRUMHELLER was a career Central Intelligence Agency (CIA) employee who served in a number of capacities during his tenure. [REDACTED] During the timeframe in which BLUMENTHAL used DRUMHELLER as a source for information provided to CLINTON, DRUMHELLER was retired from the CIA. DRUMHELLER knew the information he provided would be forwarded to CLINTON and provided it because he thought the information would be useful and helpful to the United States Government (USG). He did not receive any compensation for the information. The caveats provided regarding the source of the information were directly from DRUMHELLER, with the
Continuation of FB-302 of Interview of SIDNEY BLUMENTHAL. On 01/07/2012. Page 2
exception of the CONFIDENTIAL marking BLUMENTHAL would frequently place at the top of his communications with CLINTON. The CONFIDENTIAL marking was meant to imply the email was of a personal nature from BLUMENTHAL and did not refer to classified USG information.
DRUMHELLER had a business with large corporate contracts, but BLUMENTHAL did not know specifically who these contracts were with or what they were for. During a conversation with DRUMHELLER regarding humanitarian aid projects, BLUMENTHAL conceived of a project that would provide field hospitals and aid to Libyan refugees. DRUMHELLER stated BLUMENTHAL would receive a finder’s fee if the project materialized, but it did not come to fruition. This potential finder’s fee was the only financial relationship between DRUMHELLER and BLUMENTHAL.[REDACTED] has been a friend of BLUMENTHAL for several years and was retired during the time when BLUMENTHAL used him as a source. BLUMENTHAL does not know where [REDACTED] would get the information he provided. [REDACTED] is a journalist involved in international education and has been a friend of BLUMENTHAL’s for decades.
GARY BERNTSEN is a retired CIA officer who BLUMENTHAL met through LARRY JOHNSON, another former CIA officer. JOHNSON wanted BLUMENTHAL to hear BERNTSEN’s story as described in BERNTSEN’s book JAWBREAKER. Neither BERNTSEN nor JOHNSON ever stated they were providing classified information or that they obtained any information from the CIA. BLUMENTHAL did not ask if the information was classified.[REDACTED] is a former [REDACTED] who BLUMENTHAL met when [REDACTED] was assigned to [REDACTED] in the 1980s.
BILL MURRAY is a former CIA Chief of Station and a friend of DRUMHELLER[REDACTED] wasthe [REDACTED] duringthe GORDON BROWN and TONY BLAIR administrations. He is an old friend of BLUMENTHAL’s and provided information on British politics and personalities. [REDACTED] was a [REDACTED] who BLUMENTHAL met through [REDACTED] BASHAR AL-ASSAD, as well as others in the [REDACTED] government personally. He provided BLUMENTHAL with information on the ASSAD regime. [REDACTED] is an [REDACTED] with experience in [REDACTED]. [REDACTED] provided information he picked up and sometimes knew the information would be provided to CLINTON.
Continuation of FB-302 of Interview of SIDNEY BLUMENTHAL. On 01/07/2016. Page 3
BLUMENTHAL had no concerns regarding the sensitivity of the information he provided to CLINTON during her term as Secretary of State. Additionally, he does not believe any of it was classified.
BLUMENTHAL held a clearance in the 1997-2001 timeframe when he was an assistant to President BILL CLINTON. He recalled a quick briefing on security and clearances, but has no recollection of being read-on to any special programs.
A copy of the original interview notes and the referenced documents is enclosed in a 1A envelope.
(??? CIA)5/17/16 Page 133
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 5/19/2016
On May 17, 2016 [REDACTED]was interviewed by Special Agent (SA) [REDACTED] and SA [REDACTED] at the Central Intelligence Agency (CIA) in McLean, Virginia. Also present for the interview was [REDACTED] CIA attorney [REDACTED] [REDACTED]. After being advised of the identities of the interviewing agents and the purpose of the interview [REDACTED] provided the following information:[REDACTED]
Continuation of FB-302 of Interview of [REDACTED]. On 05/17/2016. Page 2[REDACTED]
[REDACTED] [REDACTED] was shown a copy of an email from [REDACTED] with the subject [REDACTED].After reviewing the email he provided [REDACTED] [REDACTED] that he would have classified the email if he was sending the information [REDACTED]. [REDACTED] was shown a copy of an email from [REDACTED] with the subject [REDACTED].After reviewing the email [REDACTED] believed that the email was discussing [REDACTED] but stated that a casual reader would have difficult time figuring out what the email was about. [REDACTED] was shown a copy of an email from [REDACTED] with the subject [REDACTED].After reviewing the email [REDACTED] stated that he would not have put this information on an unclassified systembut that the authors were only responding to a media article.
A copy of the original interview notes and the reference documents is enclosed in a 1A envelope.
(Philippe Reines)12/31/16 Page 135
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 1/2/2016
On December 31, 201 5, [REDACTED] of [REDACTED] was interviewed by Federal Bureau of Investigation (FBI) Special Agents [REDACTED] and [REDACTED]. Also present were Beth Wilkinson, Partner, and [ REDACTED] Attorney at Law, at Paul Weiss, Rifkind, Wharton & Garrison LLP, 2001 K Street, NW, Washington, D.C., 20006, and [REDACTED] U.S. Department of Justice. After being advised of the identities of the interviewing agents, and the purpose of the interview, [REDACTED] provided the following information:[REDACTED] has worked for HILLARY CLINTON since [REDACTED] when he was hired as her [REDACTED]. In this role he served as [REDACTED]. [REDACTED] worked on her campaign and was subsequently named [REDACTED] when CLINTON became the Secretary of State (Secretary), at the U.S. Department of State (State). [REDACTED] currently works at [REDACTED] but noted that he still acts as a part time advisor to CLINTON. [REDACTED] reported to [REDACTED] and was primarily responsible for leading the [REDACTED] team and for acting as the Secretary’s [REDACTED]. [REDACTED] traveled with the Secretary on all of her trips, with the exception of two or three trips. [REDACTED] noted that zero percent of his official job function was related to Information Technology (IT) or the maintenance of the Secretary’s phones or computers. However, [REDACTED] was technically savvy and was frequently in contact with the Secretary and as a result she often asked him for assistance with such matters. [REDACTED] likened it to your parents asking for technical help with their phone or computer. [REDACTED] had regular and ongoing contact with the Secretary and, as such, the majority of their communications occurred in person. However, he would communicate with her via phone or email when necessary. [REDACTED] stated that he received his first email from CLINTON in 2007 and confirmed that she used the following email accounts: firstname.lastname@example.org, email@example.com, [REDACTED]@gmail.com during her tenure. [REDACTED] stated that he had no knowledge of CLINTON’s private email server until it recently became public knowledge. [REDACTED] knew JUSTIN COOPER because Cooper was a long time aide for Bill Clinton. [REDACTED] never discussed the private server with COOPER until after it was
Continuation of FD-302 Interview of [REDACTED]. On 12/31/2015. Page 2
documented in the press. Similarly, [REDACTED]knew BRYAN PAGLIANO but never discussed the email setup or any other IT matters with him.
Upon starting at State in 2009 [REDACTED] received a security clearance and received training on the handling of classified information. He was provided with a classified terminal at his desk but didn’t have a reason to communicate classified information via email given his position. He could not recall any specific instances of using the classified email system and stated that he never transmitted anything marked as classified on an unclassified system.[REDACTED] did not recall receiving any guidance from State on records management or the use of private email for official business. However, he noted that it may have been included in one of the numerous documents that he was required to sign when he first started at State. Nevertheless, he tried to use his official email for official business and his personal email for personal business. [REDACTED] noted that there were some instances where he would email the Secretary from his personal email account such as when he was at home or traveling and wanted to send an article or press clipping of interest to the Secretary. Other examples of when he did this included when he first started and did not have a government email account; times when there were system outages, or when he had difficulty remotely accessing the system. [REDACTED] provided that the Secretary neither approved of, or discouraged, the use of his private email account in these instances. [REDACTED] had no knowledge of any intrusions or attacks against either his personal or government email accounts. [REDACTED] listed the Secretary as ‘EVERGREEN’ in his personal email contact list. He explained that this had been the codename used by the Secret Service since she was the first lady.
During the interview [REDACTED] was shown several emails that he had authored during his tenure at State while providing technical support to the Secretary. [REDACTED] reviewed each email and provided the following context:
- The first e mail was sent in approximately 2010 after he purchased the first iPad for the Secretary. [REDACTED] did not recall the specifications for the device but believed it was thelatest model available at that time. [REDACTED] purchased the iPad and configured it to use the [REDACTED]@gmail.com email account so that he could send articles of interest to the Secretary. [REDACTED] stated that she could not view the articles on her Blackberry and the iPad and email account were setup as a way to test a different delivery method. [REDACTED] did not recall the email account being used thereafter and was “fairly sure it wasn’t used” after the initial setup.
- The second email was sent just prior to the end of the Secretary’s term but [REDACTED] could not recall any further details about the context of the email. [REDACTED] stated that he only purchased one ipad for the Secretary and could not remember a second iPad, or any details of a recovery account. [REDACTED] recounted how after he gave the Secretary the iPad, the Secretary fell asleep holding the unopened packaging inn her arms. This struck [REDACTED] as funny because, in contrast, he would not be able to sleep if he had just received a new iPad. He noted that this episode was foreshadowing for how little she would use the iPad.
- The third email referred to the cover of a People Magazine edition from August 2010 and as an example of when [REDACTED]would use his personal email to send a message to the Secretary.
- [REDACTED] could not recall any specific details regarding the fourth email but speculated that it referred to the collating of relevant news clips.
- In the fifth email the term “Dirty Space” refers to a non SCIF space, where unsecured communications could be used.
6 The sixth email references the Secretary’s transition between Blackberry devices [REDACTED] remembered that her first device was blue in color but he could not recall the make or model [REDACTED] stated that her second Blackberry was “not blue” but again could not recall any additional details. The second device was remotely activated by COOPER and [REDACTED] provided it to the Secretary once it was activated. He was unsure if she had additional Blackberry devices thereafter.
- The seventh email references a photograph that the Secretary took of the reporters traveling with her while they were in Greenland or Iceland. The Secretary wanted to share the photo with the individuals in the picture and asked [REDACTED]to remove any “identifiers” before sending the picture to them. [REDACTED] stated that “identifiers” simply referred to the Secretary’s email address as she did not want to inadvertently give out her email address.
- The eighth email refers to the Secretary’s house in Washington, D.C., on Whitehaven St. While discussing the email [REDACTED] provided that he did not recall any other emails being configured on the iPad besides [REDACTED]@gmail.com. Nor did he see her use any other devices to access the clintonemail.com domain, aside from her Blackberry. He did not
Continuation of FD-302 of Interview of [REDACTED]. On 12/31/2015. Page 4
recall her traveling with a laptop or other personal computers.
- The ninth email references the switch to a personal office email system that was created after the Secretary left State. [REDACTED] stated that he had no involvement in the process aside from what is described in the email and that he did not have any other interactions with Platte River Networks. He was unsure who secured the hrcoffice.com domain but did not believe that it was [REDACTED] further provided that after leaving State he acted as a paid advisor to the Secretary while she was promoting her book. During this time he used a personal Gmail account until the hrcoffice domain was stood up.
A copy of the above referenced emails and the original interview notes are attached in a 1 A envelope.
(???) 6/21/16 Page 139
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 6/22/2016
On June 21, 2016 [REDACTED] DOB XX/XX/XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agents and [REDACTED] in his [REDACTED] Washington, D.C. After being advised of the identities of the interviewing agents, and the purpose of the interview, [REDACTED] provided the following information:
From January. 2009, until January, 2011 [REDACTED] was the [REDACTED]at the United States Department of State (DoS). In this capacity, [REDACTED] reported to [REDACTED].
Following his tenure at DoS, worked at the [REDACTED] as a [REDACTED]. In June of 2012, [REDACTED] transitioned from the [REDACTED] to the [REDACTED] where he served as the lef[REDACTED] in 2015 for his current position with the [REDACTED].[REDACTED] held a Top Secret (TS)/Sensitive Compartmented Information (SCI) clearance while at DoS. He interacted regularly with Secretary of State HILLARY R. CLINTON, and accompanied her on a few international trips. [REDACTED] was not in direct email contact with CLINTON, and was not aware until recently how much of the information he emailed to her staff was forwarded up to CLINTON. [REDACTED] recalled knowing CLINTON had a “different” account than others at DoS, but did not know it was a “private” email account.
While at DoS, [REDACTED] “irregularly” attended Deputies Committee (DC) and Principal Committee (PC) meetings. However.[REDACTED] was present for more PC and DC meetings when he was working [REDACTED]. The NSC hosted all PC and DC meetings, which were convened by either the National Security Advisor or Deputy National Security Advisor. DoS was not present at every PC or DC meeting. Invitations and attendance depended on the topic. When DoS was invited to a PC or DC meeting, it was not uncommon for the DoS Regional Bureaus to sendrepresentation relevant to the topic of discussion.
Continuation of FD-302 of Interview of [REDACTED]. On 6/21/2016. Page 2[REDACTED] [REDACTED] was familiar with the [REDACTED] Report,” and recalled [REDACTED] was tasked with conducting a policy review of Afghanistan and Pakistan early in President OBAMA’s administration,[REDACTED] did not recall how many different versions of the [REDACTED] Report were generated.
Agents asked [REDACTED] to review an email and attachment dated 10/4/2009 and with the Subject: “draft” and an attachment title “Pak Paper 10-03dc.docx.” After reviewing the email and attachment [REDACTED] explained he vaguely remembered the period of time surrounding the email, but did not specifically recall the email or attachment. [REDACTED] assessed he would not have been one to write the document attached to the email, and believed it was likely drafted by somebody in the Special Representative to Afghanistan and Pakistan’s (SRAP) Office. [REDACTED] would have likely been one of the final reviewers of the document, describing himself as the “Clean up guy.”[REDACTED] who was in the DoS Policy Planning Office, may have also been involved in drafting the document.
Agents drew [REDACTED] attention to the fact that information contained in the referenced 10/4/2009 email attachment also appeared as SECRET//NOFORN in a March, 2009, version of the [REDACTED] Report. [REDACTED] did not know who at DoS would have ultimately determined the classification of the document. [REDACTED ]assesedeither CLINTON or someone in her front office would have classified the document. [REDACTED] believed CLINTON and RICHARD HOLBROOKE would have at least read the contents of the report prior to finalization. Specific information contained in the report was publically discussed at the time, so in [REDACTED] opinion, the document was not classified. Much of the information contained in the report was originally based from various contributors’ expertise; therefore it would not have been classified. He further stated that while he had no visibility into the DoS classification approval chain,[REDACTED] assessed the report might have been considered Unclassified while it was a working document, and later classified when it became an official record. It also could have been marked classified because almost all documents intended for the NSC are classified for transmission.[REDACTED]
Continuation of FD-302 of Interview of [REDACTED]. On 6/21/2016. Page 3[REDACTED]
Notes of the interview and the documents displayed for [REDACTED] will be maintained in an FD340 envelope and filed with the captioned investigation.
(???) 11/23/15 Page 142
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 11/25 /2015
On 11/23/2015, [REDACTED] was interviewed in his office at the [REDACTED] by Federal Bureau of Investigation (FBI) Special Agents (SA) [REDACTED] and [REDACTED]. After being advised of the identity of the interviewing agents, and the nature of the interview [REDACTED] provided the following information:
From 2010 through 2012 [REDACTED] served as the [REDACTED] in the Department of State (DoS) Bureau of Near Eastern Affairs (NEA). [REDACTED] oversaw the office which focused on DoS interests in North Africa. [REDACTED] was the DoS senior level Expert on [REDACTED].[REDACTED] did not directly communicate with Secretary of State HILLARY R. CLINTON, in fact, [REDACTED] did not recall ever communicating directly with any Secretary of State. [ REDACTED] did not recall ever communicating directly with CLINTON’s executive staff. [REDACTED] may have exchanged an email with CLINTON’s Chief of Staff for Public Affairs, JACOB SULLIVAN, on one or two occasions. [REDACTED] did not recall ever communicating directly with CLINTON’s Chief of Staff for Operations, CHERYL MILLS. [REDACTED] interfaced with DoS executive management predominately through his superiors in NEA. [REDACTED] would communicate to Deputy Assistant Secretary (DAS) JANET SANDERSON and RAY MAXWELL or Assistant Secretary JEFFREY D. FELTMAN, who was later replaced by BETH JONES. [REDACTED] and NEA management had separate computer terminals for handling Unclassified and Classified materials.
During his tenure as the [REDACTED] was on the phone dally with the then Ambassador of Libya, CHRISTOPHER J. STEVENS, who was later killed in the September 12, 2012 attacks on the U.S. consulate in Benghazi, Libya.[REDACTED] would come into work early and talk to STEVENS on the phone. [REDACTED] and STEVENS would communicate through both open and classified means of communication. However, the classified communication capabilities were limited in Libya.
Continuation of FD-302 of Interview of [REDACTED]. On 11/23/2015. Page 2
Following his conversations with STEVENS [REDACTED] would orally brief the NEA DAS. If the information was particularly time sensitive [REDACTED] would sometimes write an email. [REDACTED] assumed the NEA DAS briefed up whatever information they deemed important from [REDACTED] briefings to SULLIVAN and/or MILLS. Questions regarding the information [REDACTED] provided came back down through his chain of command. [REDACTED] did not recall ever being directly questioned by CLINTON, MILLS or SULLIVAN regarding any of his reporting.[REDACTED] was not aware CLINTON was using a private email account not assigned by DOS nor did [REDACTED] have knowledge that CLINTON’s email was hosted on a private, non-DoS, server. [REDACTED] did not recall ever receiving a direct email from CLINTON, other than an email or two that would have been sent to the entire DoS. [REDACTED] only learned of CLLINTON’s private email and server when the story broke in the Press earlier this year.
Agents asked [REDACTED] to review an email dated 11/18/2012 with the Subject line “FYI – Reports of arrests–possible Benghazi connection.” The email was shown to [REDACTED] as it was released by DoS FOIA office, and as it appeared on the DoS Reading Room. [REDACTED][REDACTED] noted that the email was sent on a Sunday evening, and it would not have been unusual for [REDACTED] to be in his office during that time. [REDACTED] assessed that he likely sent the email from the office, but sent it via unclassified email, as most of the people who needed to be briefed on the information were not in the office and did not have access to classified communications at the time.
The individuals [REDACTED] addressed the email in question to were as follows:
BETH E. JONES, Assistant Secretary NEA
RAYMOND D. MAXWELL, Deputy Assistant Secretary NEA[REDACTED] [REDACTED] noted that [REDACTED] and [REDACTED] spoke nearly daily during [REDACTED] tenure as [REDACTED]. The two would converse via high side email or orally. [REDACTED]assessed that the information he typed in the email concerning [REDACTED] was received via an unclassified telephone conversation. He further assessed [REDACTED] received the information from the RSO or Legal Attache (LEGAT) visiting from Cairo. [REDACTED] had no knowledge of his email being forwarded, but assumed that the individuals he emailed direct would either forward the information on to the appropriate executives or
Continuation of FD-302 of Interview of [REDACTED]. On 11/23/2015. Page 3
brief them orally.[REDACTED] noted that in general if information is sent to SULLIVAN, he assumed it would be forwarded or briefed to CLINTON.[REDACTED] noted that some of the language contained in the email may have later been classified, but due to special circumstances surrounding the situation at the time he received the information, there was a necessity to share the information quickly. [REDACTED] kept notes with his calendar, and may have recorded some information concerning the call that preceded the email in question. [REDACTED]indicated he would attempt to locate his calendar/notes from that time period if requested. [REDACTED] interacted with the DoS Ops Center a few times a week during the Libya crisis. The Ops Center would set up management level conference calls. DoS’s Crisis Management Group was also collocated in the Ops Center during the crisis in Libya. [REDACTED] prefers oral briefings over email, and noted he did not grow up in the age of email. [REDACTED] does not mark his DoS emails for the record, but maintains an archive of his personal DoS email account when his mailbox fills up and he needs to free-up more space. [REDACTED] never used a non-DOS email account for work related to communications. [REDACTED] was never asked to move something from the high side to the low side in a way that seemed inappropriate.
Agents notes are maintained in a IA envelope.
Heather Samuelson 5/24/16 Page 145
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 5/25/2016
On May 24, 2016, HEATHER SAMUELSON, Date of Birth (DOB) XX/XX/XXXX was interviewed by Federal Bureau of Investigation (FBI) Special Agents [REDACTED] and [REDACTED] at the law offices of Wilkinson Walsh + Eskovitz, 1900 M Street NW, Suite 800, Washington, DC. Present for the interview was SAMUELSON’s counsel, Beth Wilkinson, Partner, Alexandra Walsh, Partner, and Hal Brewster, Associate. Also present was FBI Section Chief Peter Strzok as well as [REDACTED] and [REDACTED] from the Department of Justice (DoJ) Counterintelligence and Export Control Section. After being advised of the identities of the interviewing agents and the purpose of the interview SAMUELSON provided the following information:
SAMUELSON is currently serving as a personal attorney for HILLARY CLINTON. She previously worked at the Department of State (DOS) during CLINTON’s tenure as the Secretary of State. SAMUELSON initially worked as an assistant in the White House Liaison Office at DOS and then was promoted to the head of the office. SAMUELSON had infrequent interaction with CLINTON while she was at DOS and primarily interacted with CHERYL MILLS. Following the completion of CLINTON’s tenure, SAMUELSON worked for one year in the office of the White House Counsel before becoming CLINTON’s personal attorney.
SAMUELSON held a TS/SCI security clearance while she was at DOS. She maintained the clearance when she left DOS and still holds the clearance today. SAMUELSON’s clearance was reinvestigated in 2014 per standard procedures. SAMUELSON received training on the handling of classified information when she received her clearance and after the reinvestigation but she did not recall the specifics of the training. SAMUELSON did not receive training on the Freedom of Information Act (FOIA) or the Federal Records Act while at DOS. However, she did receive training on the Presidential Records Act while she was at the White House. SAMUELSON did not receive any specific guidance on what documents she should retain when she left DOS.
SAMUELSON provided that she only received two emails from CLINTON while she was at DOS; one on her birthday and another following the death of SAMUELSON’s grandmother. SAMUELSON did not become aware of CLINTON’s use of a private email account and server until she was serving as CLINTON’s personal attorney.
Continuation of FD-302 of Interview of Heather Samuelson. On 5/25/2015. Page 2
SAMUELSON had no contemporaneous knowledge of the decision to transition from the private server in Chappaqua, NY to the services of Platte River Networks (PRN). Nor did SAMUELSON have contemporaneous knowledge that an archive of CLINTON’s emails was created by MONICA HANLEY following CLINTON’s tenure at DOS. SAMUELSON did not know the location of the laptop, or thumb drive, containing the archive created by HANLEY.
SAMUELSON knew CLINTON transitioned her email to an @hrcoffice.com domain following her tenure at DOS. SAMUELSON believed no old emails were transferred from the @clintonemail.com to the new domain. SAMUELSON did not know how CLINTON or HUMA ABEDIN accessed old emails after the new domain was established.
Request from DOS
SAMUELSON provided that she was not involved in the initial discussions with DOS regarding the production of records from CLINTON’s tenure. SAMUELSON believed DOS had noticed gaps in its records and had reached out to CLINTON, and other former Secretaries of State, to request that they produce any relevant records in their possession. MILLS spoke with the department about this request in late July or early August 2014 and then asked SAMUELSON to assist with the effort. MILLS also received a formal letter from DOS Under Secretary PATRICK KENNEDY, in October 2014 regarding the request.
To SAMUELSON’s knowledge DOS did not provide any formal guidance on how to conduct the search aside from indicating that it was CLINTON’s responsibility to assess which products were work related and which were personal. SAMUELSON stated that DAVID KENDALL and others from Williams & Connolly LLP served as external representation for CLINTON in this matter.
Collection of Relevant Emails
SAMUELSON had no emails that were responsive to the DOS request before she contacted PRN. In late July or early August of 2014 she requested PRN provide all emails from of CLINTON’s tenure that were sent to, or received from, a “.gov” email address.[REDACTED] of PRN, extracted the relevant files and then transferred them to SAMUELSON. To transfer the files, [REDACTED] sent SAMUELSON an email link that gave him access to her computer after she clicked on it.[REDACTED] then downloaded the email files onto her laptop and configured them so she could access the password protected emails via Microsoft Outlook. SAMUELSON described herself as “technically deficient” and stated she was near her computer while this transfer occurred but she did not pay close attention to what he was doing. She did not recall the name of the file he transferred to her computer, the location on her computer where it was placed, or if [REDACTED] took any steps to encrypt the file before transferring it.
SAMUELSON was not aware of how [REDACTED] queried the files or what mailboxes on the PRN server were searched. More specifically, she did not know if the emails were taken
Continuation of FD-302 of Interview of Heather Samuelson. On 05/25/2016. Page 3
from the live mailbox or from the HRC archive that had previously been provided to PRN by HANLEY. SAMUELSON stated that she just asked PRN for the “.gov” emails and [REDACTED] gave them to her.
In late September or early October of 2014, SAMUELSON requested that PRN provide a full export of all of the emails from CLINTON’s tenure to ensure they captured all relevant emails. SAMUELSON stated this request was not done in response to any identified gaps, but in an effort to produce all relevant emails. [REDACTED] provided the full export to SAMUELSON using the same remote access process as described above. While providing the full email export to SAMUELSON, he removed the previously provided “.gov” emails. Upon realizing this SAMUELSON asked [REDACTED] to give her the “.gov” export files again because she wanted to use it as the starting point for her collection of responsive records. Upon receiving the “.gov” export for a second time, SAMUELSON noticed that some of the emails from the initial export were no longer included. SAMUELSON recalled that there seemed to be a pattern with the missing emails and it involved “.gov” addresses that were in the carbon copy (CC) line of the email. SAMUELSON again contacted PRN and requested that they provide the missing documents and in response [REDACTED] provided several smaller .pst exports to fill the identified gaps.
SAMUELSON had requested PRN pull all emails from CLINTON’s tenure, January2009 to February 2013. However, upon receiving the above described exports she noticed emails were missing for the period of January 2009 to March 2009. She asked PRN to double check for emails from that time period but they were unable to locate any responsive emails. SAMUELSON came to believe that those emails were not backed up on any server and had only resided on the Blackberry CLINTON was using at that time, thus making them un-retrievable. SAMUELSON did not have contemporaneous knowledge of the Apple server and therefore did not make an effort to check it for relevant records. SAMUELSON checked the [REDACTED]@gmail.com account and found one email exchange. SAMUELSON did not contact other associates of CLINTON, to include HANLEY, to request any records they might have.
SAMUELSON was shown a PRN invoice #37068, dated August 16, 2014, which contains the work description “Worked with Heather via phone/remote session to restore access to archived emails per CDM.” In response, SAMUELSON stated that she did not know what that work description meant and that she didn’t recall ever losing access to the exported emails, aside from when the initial “.gov” export was removed by [REDACTED].
SAMUELSON was shown an internal PRN email from [REDACTED] referencing an urgent phone call with CESC on November 24, 2104, to which she provided she had no recollection of what the call was about. SAMUELSON was then shown a PRN work ticket report from November 24, 2014, which contains the summary note “Worked with Heather via phone/remote control session on more specific export requirements.” In response, SAMUELSON stated she could not speculate on what those notes meant and she was unaware of any activities by PRN to “re-establish connection to HRC emails” in November of 2014.
Continuation of FD-302 of Interview of Heather Samuelson. On 5/25/2016. Page 4
SAMUELSON was never given direct access to the mailboxes on the server and she was not aware of anybody else being granted such access. SAMUELSON was never given administrative access to the server and she was not aware of anybody else being granted administrative access.
Cull and Review of Emails
SAMUELSON stated she was primarily responsible for conducting the review at the direction of MILLS and KENDALL. She conducted the review over the course of several months and completed it just prior to December 5, 2014, when the documents were turned over to DOS. SAMUELSON conducted the review on her laptop, both in her apartment and in MILLS’ office in Friendship Heights, Washington DC.
SAMUELSON reviewed the emails provided by PRN in Microsoft Outlook and placed any responsive emails in a separate folder. She began by adding all of the “.gov” emails and any email to or from a “.mil” email address to the folder. She then searched the emails provided by PRN for any email to or from senior leadership at DOS. This included key individuals such as Under Secretaries, Assistant Secretaries, Ambassadors, Department Heads, and Senior DOS Aides. SAMUELSON then reviewed the sender and receivers of the remaining emails to identify any congress members, foreign leaders, or other official contacts. Lastly, she searched the remaining emails for key words that included terms such as Afghanistan, Libya, and Benghazi.
SAMUELSON reviewed the sender, receiver and subject line of every single email during the review. However, she stated that she did not read the content of each individual email if she could determine it was a work or personal email from the sender, receiver or subject line. SAMUELSON provided that she did her best to review and identify any emails that were potentially a mix of work and personal content. When asked how work related emails between ABEDIN and CLINTON may have been missed, SAMUELSON stated ABEDIN may have kept emails that CLINTON did not.
SAMUELSON did not have a formal process for removing duplicate copies of the same email from the set of work related emails. She did not ask PRN to assist with this process. SAMUELSON stated she would remove a copy of the email if she noticed that it was a duplicate but she did not have a formalized or consistent process for identifying and removing duplicates.
Upon completing the review, SAMUELSON printed all of the emails she deemed to be relevant. The paper copies were then subsequently reviewed by MILLS and KENDALL and anything they deemed not to be work related was shredded. The remaining physical documents were ultimately provided to DOS. SAMUELSON stated that she printed the emails in MILLS’ office and noted there is still a printer in MILLS’ office but she was not sure if it was the same printer.
Following the review, SAMUELSON created a digital copy, or a “preservation copy,” of the relevant documents that were provided to DOS. The files were placed on a thumb drive and provided to KENDALL. SAMUELSON believed this drive is the same thumb drive provided to the FBI by KENDALL. SAMUELSON also created a second copy of the documents provided to DOS and placed
Continuation of FD-302 of Interview of Heather Samuelson. On 5/25/2016. Page 5
them on a second laptop of hers. SAMUELSON was not aware of any other copies of the files. Nor was she aware of a master copy of all of the personal and private emails.
SAMUELSON was shown copies of the thumb drives previously provided to the FBI but could not recall if any were the same as the one she had used. One of the thumb drives was labeled as “HC PRIME 2” and SAMUELSON did not know what the label referred to.
The review methodology was developed by SAMUELSON, MILLS and KENDALL. SAMUELSON did not consider using any commercially available e-discovery tools for the review and they did not consult any individuals who were not “an agent of Clinton” during the review process. SAMUELSON stated they did not discuss how to handle potentially classified emails during the review because they had no reason to believe any classified material was contained in the emails. She further noted that none of the emails were marked as being classified.
During the review process SAMUELSON noticed the imported emails displayed CLINTON’s email as firstname.lastname@example.org despite the fact this address was not created until after CLINTON’s tenure. SAMUELSON discussed the issue with [REDACTED] but she did not fully understand his explanation for why this was occurring and he was never able to resolve the problem. SAMUELSON did not consult anybody else about this issue.
Deletion of Emails
In January of 2015, SAMUELSON asked [REDACTED] to remove the exported emails files that had previously been provided to her by PRN. While she retained separate digital copies of the emails provided to DOS, as discussed above, she no longer wanted the email exports provided by PRN on her computer. Using a similar process as described above [REDACTED] accessed her computer remotely and removed the files. SAMUELSON provided that [REDACTED] took additional steps during the deletion process so the files would not be recoverable. SAMUELSON did not know what software or processes were used by [REDACTED] but believed that the files would be difficult, if not impossible, to recover. SAMUELSON did not remember having any discussions with [REDACTED] about deleting relevant date from the free space of her laptop. Nor did she recall any discussions with [REDACTED] about the use of “BleachBit.” SAMUELSON did not recall deleting any of the files by herself before contacting PRN.
SAMUELSON stated that in May of 2015 she deleted some emails from her copy of the work related emails that were previously provided to DOS. SAMUELSON explained that she was notified by DOS, prior to the release of the first tranche of FOIA emails, that some of the work related emails they had turned over were classified. She was instructed by DOS to delete the files and then empty those files from the trash bin. SAMUELSON did not believe these files were removed from the thumb drive she had previously provided to KENDALL.
In or about December of 2014, SAMUELSON was on a call in which the email retention policy was discussed. She was aware the retention period was changed to 60 days and any older
Continuation of FD-302 of Interview of Heather Samuelson. On 5/25/2016. Page 6
emails would be deleted. However, SAMUELSON did not direct PRN to remove any exported .pst files on the server or any mailboxes on the server.
SAMUELSON was not aware of any other deletions of relevant emails. She was aware PRN traveled to the datacenter in March of 2015, via her role as counsel, but had not instructed them to do so. SAMUELSON was not aware of exports or deletions conducted by PRN on the server in September of 2015.
Devices used During the Review
SAMUELSON used her own laptop to conduct the review and noted that she also used the laptop for other work related matters as well. She described it as a Lenovo Yoga 2 laptop. SAMUELSON stated that following the review she accidentally spilled water on the laptop. Fearing that the computer would fail, she purchased a second Lenovo laptop and placed a copy of the emails that were prepared for DOS on it. SAMUELSON noted that the Lenovo Yoga 2 computer continued to work until sometime last year when it failed to power on. The Lenovo Yoga 2 computer is currently in the possession of her counsel and the second Lenovo was given to KENDALL and then subsequently turned over to the FBI. SAMUELSON reviewed pictures of the laptops that were previously turned over to the FBI and stated that the silver Lenovo laptop appeared to be the same as the laptop that she used.
SAMUELSON stated that both laptops were connected to the internet and they both had antivirus software installed on them. SAMUELSON did not repurpose the laptops after the review and never attempted to reformat or factory reset the computers.
A copy of the original interview notes are enclosed in a I A envelope.
Marcel Lehel Lazar (Guccifer) 5/26/16 Page 151
FEDERAL BUREAU OF INVESTIGATION
Date of Entry: 6/7/2016
MARCEL LEHEL LAZAR (LAZAR), also known as (AKA) “GUCCIFER”, date of birth XX/XX/XXXX alien registration number [REDACTED] was interviewed at the UNITED STATES ATTORNEY’S OFFICE (USAO), 401 Courthouse Square, Alexandria, Virginia 22314. LAZAR was advised that the nature of this interview was to discuss the extent of LAZAR’s hacking activities related to HILLARY CLINTON’S (CLINTON) personal email server. After being advised of the identities of the interviewing Agents and the nature of the interview, LAZAR provided the following information:
LAZAR began by stating that he had never claimed to hack the CLINTON server. SA [REDACTED] then advised that FOX NEWS had recently published an article which reported that LAZAR had claimed to hack the CLINTON server. LAZAR then stated that he recalled the interview with FOX NEWS, and that hehad lied to them about hacking the CLINTON server. SA [REDACTED] then asked LAZAR to provide a complete explanation of his hacking activities surrounding the CLINTON server. LAZAR provided the following information in response:
On or about March 14, 2013, at approximately 6:00 AM (Romanian Time), LAZAR was perusing [REDACTED] address book. Within it, LAZAR identified an AMERICA ONLINE (AOL) email account of [REDACTED]@aol.com, which he later determined to be the personal email account of SIDNEY BLUMENTHAL. LAZARthen made several attempts to access BLUMENTAL’s email account. After approximately 20 minutes, LAZAR was able to successfully gain access to the account by correctly answering an account security question, which in turn allowed him to reset the password for the account. LAZAR then utilized the new user credentials to access BLUMENTHAL’s account.
LAZAR recalled that BLUMENTHAL’s account contained approximately 30,000 emails, which took him approximately six to seven hours to sort and review. LAZAR downloaded approximately 25 attachments that were contained in the emails, including memorandums (memos) and briefing documents. He recalled that some of those attachments were official memos between BLUMENTHAL and CLINTON. Additionally, LAZAR took screenshots of other items in the account that he deemed to be of interest. LAZAR recalled taking a screenshot of an email that contained information related to the Benghazi incident.
Continuation of FD-302 of Interview of Marcel Lehel LAZAR. On 5/26/2016. Page 2 of 4
While looking through BLUMENTAL’s account, LAZAR identified one email exchange between BLUMENTHAL and CLINTON, where CLINTON was using the domain of clintonemail.com. LAZAR reviewed the header information for that email in attempt to identify the originating IP address for the mail server associated with that domain. LAZAR identified one corresponding IP address, which was 127.0.0.1. LAZAR recognized that IP address as being an internal routing address and assumed that it was assigned to an internal mail server at the AOL service provider. Therefore, LAZAR had no additional information about the CLINTON email server, and concluded his hacking attempts against it at that time. LAZAR stated that this was the full extent of his hacking activities related to the CLINTON email server.
After spending approximately six or seven hours in BLUMENTHAL‘s account, LAZAR took a break from the computer which lasted approximately two to three hours. When he returned to the computer, he no longer had access to BLUMENTHAL’s account. LAZAR recalled that his access wasterminated around 8:00 AM [REDACTED] Time. He assumed that BLUMENTHAL likely made a phone call to AOL in order to reset his password and regain access to the account. LAZAR believed that BLUMENTHAL resided in [REDACTED] at that time.
As a form of normal practice, LAZAR would send the results of his hacking activities to news agencies world-wide. After accessing BLUMENTHAL’s account, LAZAR contacted [REDACTED] at THE SMOKING GUN and advised that he was going to send the BLUMENTHAL information to approximately 100 different news agencies, which he had identified prior to the compromise of BLUMENTHAL’s account.
LAZAR recalled using a variety of computer hacking tools for his hacking activities, such as ANGRYIP, METASPLOIT, SUBSEVEN, and CAIN AND ABLE. LAZAR used a remote administration tool (RAT) as well, to create his own malware. That tool operated by splitting an existing malware exploit into two pieces, manipulating the hexadecimal code, and then repacking the malware for deployment. LAZAR recalled using the SUBLEGEND7 tool for this activity. LAZAR utilized this technique to send out spear-phishing emails to various targeted victims. The malware would ultimately install a key-logging software on the victim computer.
When asked to elaborate on the key-logging software, LAZAR stated that he could not. When asked how he retrieved the results of the key-logging software from the victims, LAZAR provided that the software allowed him to enter a return email address and the results of the key-logger were emailed to that account. LAZAR could not recall the email accounts that he used for this activity. LAZAR sent this form of malware to approximately 100 different people and estimated that only approximately 15
Continuation of FD-302 of Interview of Marcel Lehel LAZAR. On 5/26/2016. Page 3of 4
of them ultimately opened the attachment. LAZAR did not send any spear-phishing emails to users at the clintonemail.com domain.
During other hacking quests, LAZAR utilized various IP scanning tools to determine whether or not an IP address was online and which ports they made available on the Internet. LAZAR recalled using the ANGRY IP scanning tool most frequently. LAZAR attempted to use Russian proxy servers for his scanning activities in order to evade monitoring by the United States government. Russian IP proxies afforded him with faster Internet speeds than others. LAZAR repeatedly checked his outfacing IP address in order to ensure that he was using Russian proxies.
When asked how he utilized Russian proxies with the ANGRYIP tool, LAZAR relayed that the tool itself afforded the ability to connect to Russian proxies. LAZAR could not provide any additional details on how the ANGRYIP tool accomplished this.
When asked about other Internet proxy usage, LAZAR provided that he also utilized MOZILLA FIREFOX as his browser of choice, and that a plug-in was available for the browser which routed Internet traffic through Russian proxies. LAZAR could not provide any additional details on how the plug-in accomplished this, nor could he recall the plug-in that he used in FIREFOX. LAZAR also used the HIDEMYASS website for masking his online activities as well.
In the beginning of the interview, LAZAR recalled using the METASPLOIT tool in approximately 2008 or 2009. He stated that he was merely an amateur with METASPLOIT and that he really didn’t understand how to use it. LAZAR utilized METASPLOIT on WINDOWS computers only, from a graphical user interface (GUI) rather than the WINDOWS command prompt. LAZAR is not familiar with the LINUX operating system. Later in the interview, LAZAR recalled using METASPOIT in either 2009 or 2010, during which time frame he made a how-to FACEBOOK video that demonstrated how one could take a remote screenshot of a user’s desktop with METASPLOIT.
LAZAR utilized the CAIN AND ABLE software tool for password cracking. He also used that tool from a GUI rather than the command prompt. LAZAR recalled that the GUI had green and red buttons on it. When asked to describe how he utilized the CAIN AND ABLE program, LAZAR stated that he would use it for password cracking once inside a network. When asked whether or not he used it for cracking password hashes that were dumped from a system he replied yes. When asked to further describe the process of dumping hashes from a system, LAZAR provided that he could not do
Continuation of FD-302 of Interview of Marcel Lehel LAZAR. On 5/26/2016. Page 4 of 4
so in English. When asked whether or not he could describe that process in Romanian, he stated that he could not. LAZAR used the CAIN AND ABLE software product in either 2010 or 2011.
LAZAR used other remote administration tools for his hacking activities, but could not recall the names of any of them. When targeting an IP address for access LAZAR often attempted to log into it via his web browser, by typing the IP address into the browser. LAZAR utilized multiple different computers for his hacking activities, none of which he has access to anymore. LAZAR recalled working with computers since he was approximately 15 years old.
On approximately four or five occasions during this interview, LAZAR referred to himself as being an amateur hacker and not a professional. On one occasion, LAZAR also referred to himself as being a “script kiddie”, who merely knows how to hack accounts by answering security account questions correctly, as he did with the BLUMENTHAL account.
Present during this interview were the following individuals: LAZAR, FBI SA [REDACTED], LS [REDACTED] FBI SA [REDACTED] DSS SA [REDACTED][REDACTED], DOJ CCIPS [REDACTED], AUSA [REDACTED] AUSA [REDACTED] and LAZAR’S Attorney, Public Defender [REDACTED].
Bryan Pagliano 12/22/15 Page 155
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 12/30/201
On December 22, 2015. BRYAN PAGLIANO was interviewed by Federal Bureau of Investigation (FBI) Special Agents [REDACTED] and Information Technology Specialist/Forensic Examiner [REDACTED] at the offices of the Department of Justice’s Counterintelligence and Export Control Section (CES). Also present, were AkinGump attorneys [REDACTED] Connor Mullin, Counsel and Mark MacDougall, Partner. Additionally,[REDACTED] and [REDACTED] from the U.S. Department of Justice were also present. After being advised of the identities of the interviewing agents, and the purpose of the interview, PAGLIANO provided the following information:[REDACTED] HILLARY CLINTON, PAGLIANO came to work on HILLARY CLINTON’s 2008 presidential campaign as an information technology specialist. Following HILLARY CLINTON’s appointment as the Secretary of State in 2009, PAGLIANO gained employment at the Department of State (DOS) as an Information Technology Specialist in the Bureau of Resource Management.
In the fall of 2008, JUSTIN COOPER introduced himself to PAGLIANO via email and subsequently called PAGLIANO. In the call, COOPER stated he understood PAGLIANO was liquidating computer equipment from HILLARY CLINTON’s 2008 presidential campaign and explained he was interested in transitioning from an Apple OS X private email server used by aides of BILL CLINTON to another email exchange server. COOPER asked PAGLIANO for help setting up new equipment to support a new email server and for assistance in the administration of the server.PAGLIANO began work on building an email server at K street using computer equipment from HILLARY CLINTON’s 2008 presidential campaign. In late 2008, at the time PAGLIANO was building the server, he did not know HILLARY CLINTON would be Secretary of State or have an account on theserver. PAGLIANO believed the email server he was building would be used for private email exchange with BILL CLINTON aides.
Around March 2009, once the new server equipment was assembled, COOPER and PAGLIANO met at the CLINTON residence in Chappaqua, NY to install the server and migrate the email
Continuation of FD-302 of Interview of Brian Pagliano. On 12/22/2015. Page 2
accounts from the Apple OS X server to the new server. PAGLIANO also recalled that[REDACTED] was present, as well as some United States Secret Service (USSS) Special Agents. PAGLIANO recalled the Apple OS X server to be in the basement at Chappaqua and consisting of an Apple Power Macintosh G4 or G5 tower and an HP printer supported by Internet Printing Protocol (IPP) over port 9100 so that staff could print from the Harlem office. PAGLIANO installed the new server equipment which was comprised of a 12-unit (12U) rack with a Dell PowerEdge 1950 used as a Blackberry Enterprise Server (BES), Dell PowerEdge 2900, Dell unmanaged switch, 3U power supply, 3 terabyte (TB) external hard drive. Kiwi Syslog Server, and a Cisco Private Internet eXchange (PIX) 515E IP firewall (the collection of server equipment hereafter referred to as Exchange Server 1). PAGLIANO stated that he did not utilize tape backups but implemented “disk-to-disk” backups instead. PAGLIANO began the email migration from the Apple OS X server to Exchange Server 1 while on-site in Chappaqua in March 2009, but did not finish on-site and continued working on the migration from his hotel room. PAGLIANO believed he “popped out” all the email from the Apple OS X server when migrating and that no email content should have existed on the Apple OS X server once it was migrated to Exchange Server 1. COOPER changed the Mail Exchange (MX) records to ensure delivery to Exchange Server 1. There were only two system administrators on Exchange Server 1, PAGLIANO and COOPER. PAGLIANO disagreed with housing Exchange Server 1 in a residential basement due to having only one unreliable internet connection. COOPER disagreed and wanted physical access to Exchange Server 1. PAGLIANO never knew of Exchange Server 1 residing in another physical location other than Chappaqua.
As far as the Apple OS X server is concerned, PAGLIANO did not know of any other function or use of the server, other than to facilitate email exchange. PAGLIANO did not know who installed the Apple OS X server, but believed COOPER was the only person with administrator access. Two email domains existed on the Apple OS X server, presidentclinton.com and clintonemail.com. Both domains were also maintained on Exchange server 1. PAGLIANO believed [REDACTED] COOPER,[REDACTED] and [REDACTED] had email accounts on the presidentclinton.com domain, and HUMA ABEDIN and [REDACTED] had email accounts on the clintonemail.com domain. Once email was migrated to Exchange server 1, all users could use either the presidentclinton.com or clintonemail.com domains for receiving email but replies would be sent from the clintonemail.com domain for users of the clintonemail.com domain. PAGLIANO did not know if HILLARY CLINTON had an account on the Apple OS X server, but he did not migrate one. PAGLIANO did not know how users connected to the Apple OS X server. [REDACTED] or COOPER would monitor the printer linked to the Apple OS X server, but PAGLIANO was unaware what, if anything, it was used for. PAGLIANO believed the people with physical access to the Apple OS X server was anyone who had access to the basement at the CLINTON residence [REDACTED] had physical access, but not administrativeaccess, to the OS X server. Sometime after the email migration from the Apple OS X server to Exchange server 1 was complete, COOPER discussed repurposing the Apple OS X server with PAGLIANO.PAGLIANO believed the intention was for the Apple OS X server to be installed as a workstation somewhere in the basement in Chappaqua for use by either COOPER or [REDACTED].
Continuation of FD-302 of Interview of Brian Pagliano. On 12/22/2015. Page 3
PAGLIANO requisitioned the hardware for Exchange Server 1 from a datacenter at HILLARY CLINTON’s presidential campaign headquarters at 4420 W. Fairfax Drive, Arlington, Virginia. He recalled the PowerEdge 2900 to have been a Microsoft SQL server and PAGLIANO did not recall if he wiped the drives of the hardware used to build Exchange Server 1. PAGLIANO made the decision to use a Microsoft Small Business Server (SBS) environment on Exchange Server 1 since he hadused it before and assessed it would be perfect for a small amount of users exchanging email. Exchange Server 1 was only used for email exchange, and although PAGLIANO did enable Windows SharePoint Services, it was never used. PAGLIANO wanted to use a cloud service similar to that used in HILLARY CLINTON’s 2008 Presidential campaign, but COOPER disagreed with PAGLIANO and did not want to use a cloud service. Because of this decision, PAGLIANO used an external hard drive to back-up Exchange Server 1 using Windows back-up service. To effect this change, PAGLIANO scheduled a task through Windows for a full back-up once a week and a differential back-up every day. These periodic back-ups would overwrite on the hard drive in a first-in, first-out manner. For security, PAGLIANO used Microsoft Forefront on the Dell PowerEdge 2900 as a baseline security analyzer. PAGLIANO recalled finding a virus, but recalled no other detail, other than it being nothing of great concern. PAGLIANO chose to turn File Transfer Protocol (FTP) off
PAGLIANO thought the biggest vulnerability to Exchange Server 1 to be a Brute (BFA). PAGLIANO stated that BFAs increased over the life of the server and he set-up the logs to alert COOPER of a failed log-in attempt. The Internet Protocol (IP) filtering on the server was manual using a 515E straight IP block and PAGLIANO used Domain Name System (DNS) for inbound filtering. On the Dell PowerEdge 1950, PAGLIANO used a Kiwi Syslog server and tried to pull and review the firewall log files once a month. At some point, COOPER put PAGLIANO in contact with [REDACTED] from the USSS for a reason unknown to PAGLIANO. [REDACTED] told PAGLIANO to also perform outbound filtering of email traffic.
The back-up hard drive and mailboxes on Exchange server 1 were not encrypted.PAGLIANO wanted to move toward two-factor authentication using an RSA authentication server for all Remote Desktop Protocol (RDP) access on Exchange Server 1 because he thought it was a good practice. As a test, PAGLIANO installed it on his workstation, as well as COOPER’s, but PAGLIANO did not end up implementing two-factor authentication and did not turn off RDP access. PAGLIANO stated there were no security breaches on Exchange Server 1, but there were a lot of BFAs. PAGLIANO knew the attempts were BFAs instead of users forgetting their passwords because the user names in the BFA attempts weren’t even close to any legitimate user name. PAGLIANO could not recall a specific country that would attempt an inordinate amount of BFAs.
In summer 2009, PAGLIANO noticed an account on Exchange server 1 called “H.” PAGLIANO asked COOPER who this email account belonged to and COOPER stated it belonged to HILLARY CLINTON. PAGLIANO assumed the account was a personal email account. PAGLIANO
Continuation of FD-302 of Interview of Brian Pagliano On 12/22/2015. Page 4
recalled the email account to be HDR22@clintonemail.com. Later, after SYDNEY BLUMENTHAL’s email account was hacked, HILLARY CLINTON’s account changed to HROD19@clintonemail.com.
In summer 2009 [REDACTED] and [REDACTED] both Information Technology Specialists at the DOS, contacted PAGLIANO and asked him to come to the 7th floor in DOS Headquarters. Once there, PAGLIANO was asked if he was aware of the clintonemail.com domain and PAGLIANO replied in the affirmative. PAGLIANO recalled nothing further about this encounter. PAGLIANO relayed this incident to [REDACTED] and [REDACTED] had a “visceral” reaction and didn’t want to know anymore. In late 2009 or early 2010, [REDACTED] reached out to PAGLIANO again and relayed to PAGLIANO that the use of a private email server by HILLARY CLINTON may be a federal records retention issue. [REDACTED] relayed to PAGLIANO that he wanted to convey this to HILLARY CLINTON’s inner circle, but could not reach them and asked if PAGLIANO would relay this information. PAGLIANO then approached CHERYL MILLS in her office and relayed [REDACTED] concerns regarding federal records retention and the use of a private email server. PAGLIANO remembers MILLS replying that former Secretaries of State had done the same thing, to include COLIN POWELL. PAGLIANO thought he may have also mentioned the federal records retention issue with JUSTIN COOPER. Additionally, PAGLIANO recalled a third conversation with [REDACTED] where [REDACTED] brought up security concerns and stated that email transiting from a state.gov account to Exchange Server 1 should be through a Transport Layer Security (TLS) tunnel. [REDACTED] stated to PAGLIANO that he wouldn’t be surprised if classified information was being transmitted.
PAGLIANO stated the hardware used for Exchange Server 1 was paid for by the CLINTON family and through the 2008 presidential campaign and at least some of the hardware was acquired through US21 Computers. PAGLIANO believed most financial and acquisition matters regarding the CLINTONs would go through COOPER directly. PAGLIANO performed work for the CLINTONs without a contract and through contact with COOPER. COOPER wanted to do work under a retainer, but they settled on an hourly wage.
In June 2011, PAGLIANO travelled to Chappaqua to perform maintenance and install new upgrades to Exchange Server 1. The discs began failing in the 3 TB external hard drive in Exchange Server 1 and PAGLIANO replaced it with a CISCO NAS storage device. PAGLIANO chose CISCO because they make good products and he may have consulted US21 Computers as well. PAGLIANO allocated more than half of the storage space for back-ups of Exchange Server 1 and the rest for file storage. When uninstalling the 3 TB hard drive and installing the CISCO NAS, PAGLIANO did not move the contents from one to the other. PAGLIANO simply unplugged the USB connection for the 3 TB hard drive and pointed the server back-ups toward the CISCO NAS. PAGLIANO also added memory to the Dell PowerEdge 1950, added a Gigabit switch, upgraded to a CISCO ASA 5500 firewall, offloaded syslogging to the CISCO NAS, bought a CISCO botnet filter and CISCO Intrusion Prevention Service (IPS) and replaced the batteries on the UPS along with other various upgrades and maintenance. Additionally, PAGLIANO ungraded the BES from 5.0 to 6.0 and checked for any software patching.
Continuation of FD-302 of Interview of Brian Pagliano. On 12/22/2015. Page 5
In the Winter of 2011, the Internet Service Provider (ISP) providing internet service to the CLINTON residence in Chappaqua went down due to a storm. As a result, Exchange Server 1 was unable to process email. While the Internet was down, and to ensure email delivery, PAGLIANO advised COOPER to change the mail exchanger (MX) record for email accounts on Exchange Server 1 to point to Google. PAGLIANO wasn’t certain if COOPER did this or who it was done for, but assumed it was done for HILLARY CLINTON and HUMA ABEDIN since they were the most concerned about lack of email delivery.
Individuals with an email account on Exchange Server 1 could log into their account through any means available to them. PAGLIANO viewed his responsibilities as maintenance and operation of the server. PAGLIANO recalled HILLARY CLINTON used a BlackBerry as a mobile device, but could not recall the various handsets. PAGLIANO met with MONICA HANLEY at some point in 2011 or 2012 to configure a BlackBerry for HILLARY CLINTON, but could not recall any detail about the device.
Upon [REDACTED]leaving the CLINTON’s employ and pursuant to a request from [REDACTED] PAGLIANO recalled doing an export of 40 Gigabytes of [REDACTED] email. This is the only export PAGLIANO could recall doing. PAGLIANO believed he may have done an export of email for [REDACTED] but could not recall. PAGLIANO did recall doing an import of DOS contacts for HUMA ABEDIN onto Exchange Server 1.
PAGLIANO could not recall accessing the content of email on Exchange Server 1 and was never aware of any classified information residing on Exchange Server 1.
In early 2013, PAGLIANO recalled the user limitations and reliability of Exchange Server 1 prompted discussions to search for another vendor to manage a CLINTON email exchange server. PAGLIANO recalled a conversation with [REDACTED] and COOPER about [REDACTED] career aspirations and what email requirements she may need. Eventually, MILLS and [REDACTED] weighed in relating to Exchange Server 1 and the end of HILLARY CLINTON’s tenure as Secretary of State. At some point, an individual named [REDACTED] began the process of finding a vendor to manage a new CLINTON email exchange server. PAGLIANO did not know [REDACTED] previously, or how she came to be involved with the search for a vendor. Eventually [REDACTED] showed PAGLIANO a presentation detailing three vendors and their capabilities. PAGLIANO recommended a company called Platte River Networks (PRN). Ultimately, PAGLIANO recalled the decision being with [REDACTED] and she chose PRN.
Once the decision was made to go with PRN, PAGLIANO recalled communicating with PRN employee [REDACTED]. Related to the transition from Exchange Server 1 to the server PRN was going to use. Around this time, PAGLIANO was already 4 to 5 months into a new job as an IT
Continuation of FD-302 of Interview of Brian Pagliano. On 12/22/2015. Page 6
specialist at GARTNER. PAGLIANO gave [REDACTED] administrator access to Exchange Server 1 as well as user names and passwords to individual email accounts.PAGLIANO recalled talking to [REDACTED] once or twice and possibly [REDACTED]. In order to prepare Exchange Server 1 for the transition to PRN, PAGLIANO also “trimmed” mailboxes and cleared out white space. PAGLIANO described this as a maintenance process of reclaiming space from old mailboxes, like in the example of [REDACTED].
Based on conversations he had or was aware of, PAGLIANO recalled knowing that PRN was going to use a DATTO service for backing up their server, a CloudJacket device for network protection, and potentially, two-factor authentication. [REDACTED] was responsible for establishing the contract of services PRN was going to implement and ensure they were implemented.
PAGLIANO was shown an email dated January 30, 2014 where a user list was populated by Platte River Networks regarding their management of a CLINTON email server. Regarding the email, PAGLIANO did not recognize the mailbox “HRC Archive.” PAGLIANO stated after PRN took control of managing an email server for the CLINTONs, he had no visibility into the server or the mailboxes.
In what PAGLIANO remembered as the fall of 2013, MILLS called PAGLIANO and inquired about the effectiveness of two types of software for wiping computer data, but PAGLIANO could not recall the names of the software. PAGLIANO discussed the difference between “bit” wiping and deleting with MILLS. PAGLIANO inferred from his conversation with MILLS that PRN was going to excise data. PAGLIANO recalled using Boot and Nuke software when deleting and repurposing computers while working on HILLARY CLINTON’s 2008 presidential campaign, but didn’t recall if he discussed that with MILLS.
In July 2014, PAGLIANO had a conference call with MILLS and to discuss an archive of HILLARY CLINTON emails from her time as Secretary of State. PAGLIANO recalled that MILLS and [REDACTED] were trying to determine why a gap existed in HILLARY CLINTON’s emails between January 2009 and March 2009. In separate conversations with COOPER, PAGLIANO understood that CLINTON used a BlackBerry email address before hosting her account on Exchange Server 1 and that explained the gap from January 2009 to March 2009. PAGLIANO could not recall a conversation with MILLS or [REDACTED] after July 2014.
In Spring 2015, MILLS asked PAGLIANO if he would mind talking to DAVID KENDALL from Williams & Connolly LLP. PAGLIANO agreed to talk to KENDALL and described the interaction as a shorter version of PAGLIANO’s conversation with FBI agents as memorialized herein. PAGLIANO stated there is nothing he told KENDALL that he didn’t also relay to the interviewing FBI agents.
Continuation of FD-302 of Interview of Brian Pagliano. On 12/22/2015. Page 7
At this point in the interview, FBI agents displayed documents to PAGLIANO that were Bates stamped as an identifying mark. PAGLIANO was asked questions as it pertained to each respective document. The following was provided by PAGLIANO:
After viewing a document marked HC-001, PAGLIANO stated the credit of $5,000.00 to his account was a payment, including expenses, for his work in March 2009 setting up Exchange Server 1. The payment of $8,350.83 in June 2011 was for his previously described maintenance work on Exchange Server 1, to include expenses.
After viewing a document marked HC-014, PAGLIANO stated the line item “1/11/2011 Conference call with Security team” was the previously described communication with [REDACTED] related to outbound filtering. PAGLIANO stated [REDACTED] was an individual he worked with at US21 Computers. PAGLIANO recalled HILLARY CLINTON turned off Bluetooth capability on her BlackBerry, while COOPER, and possibly [REDACTED] enabled Bluetooth on their handsets.
PAGLIANO stated [REDACTED] referred to in a document marked HC-023, was [REDACTED].
After viewing a document marked HC-008, PAGLIANO stated the “Mailbox kick off” indicated in the invoice was related to the previously described work exporting mailbox.
After viewing a document marked HC-004, PAGLIANO stated the iPad referred to in the invoice belonged to HILLARY CLINTON. PAGLIANO did not configure the iPad and could not recall when HILLARY CLINTON started using it, nor any other details related to the iPad.
After viewing a document marked HC-010, PAGLIANO stated in March 2013, MILLS requested an analysis of Exchange Server 1. PAGLIANO recalled giving Exchange Server 1 a B+ grade and conveyed in his analysis the limitations of Exchange Server 1 and recommendations for a more robust email system. PAGLIANO relayed the greatest liability of Exchange Server 1 to be reliability and referenced the incidents in which the ISP lost power and was unable to provide internet service to the residence in Chappaqua. PAGLIANO had always been against housing a server in a residential basement and preferred the security and reliability of an established data center. MILLS did not have an email account on Exchange Server 1 and used state.gov and gmail for email exchange.
After viewing a document marked HC-002, PAGLIANO stated the virtual private network (VPN) referred to in the invoice was not for users of Exchange Server 1 and just for administrator use. PAGLIANO stated he installed the IPS at the same time the CISCO ASA firewall went in place in June 2011. PAGLIANO fine tuned the IPS over time, fluctuating between turning logging on and off as needed.
The notes of the interview and all aforementioned documents displayed to PAGLIANO will be stored in a FD340 envelope and filed with the captioned investigation.
Bryan Pagliano 6/21/15 Page 163
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 6/24/2016
On June 21, 2016, BRYAN PAGLIANO, was interviewed telephonically by Federal Bureau of Investigation (FBI) Special Agents (SA)[REDACTED] andInformation Technology Specialist/Forensic Examiner [REDACTED]. Also on the call for the interview were AkinGump attorneys [REDACTED], Partner and. Connor Mullin, Counsel, Mark Mac Dougall, Partner and [REDACTED]. Additionally, [REDACTED] from the U.S. Department of Justice was also on the call. After being advised of the identity of the interviewing Agents, and the nature of the interview, PAGLIANO provided the following information:
PAGLIANO did not work on the Apple email server, set-up by JUSTIN COOPER for WILLIAM CLINTON aides, and therefore, has no information regarding a Secure Socket Layer (SSL) certificate registered for the Apple server. PAGLIANO did go through the “full registration” process for establishing an SSL certificate on the server he later built, which enabled email to be encrypted while in Transit.
Based on a request from COOPER, PAGLIANO built an email server in early 2009 in HILLARY CLINTON‘s 2008 presidential campaign space on K street. PAGLIANO could not recall the exact address of the building. Once built, PAGLIANO rented a minivan and drove to Chappaqua, New York to install the email server in the CLINTON residence. PAGLIANO could not recall any existing computer systems at the Chappaqua residence, other than the Apple server previously described to the FBI. When designing the network for the server, PAGLIANO left the CLINTON’S home internet network separate from the server–leaving it outside his firewall.
Continuation of FD-302 of Interview of Bryan Pagliano. On 06/21/2016. Page 2
PAGLIANO recalled being given a list of user names and passwords that COOPER asked to be transferred from COOPER’s Apple server to PAGLIANO’s system. PAGLIANO did not recall transferring an account for HILLARY CLINTON and does not know how her account was installed on the server he built. PAGLIANO installed an IP-based printer on this email system with the express intent of allowing the CLINTON office in Harlem to print at the Chappaqua residence. PAGLIANO installed regular updates to software on the email server using “auto patching” every night. PAGLIANO did some work to experiment with two-factor authentication, but did not implement it on the server because it would have been difficult to administer. PAGLIANO changed the name of the built-in Administrator account and eventually disabled it.
PAGLIANO could not recall saving a file called “netstat.txt” When PAGLIANO received a recommendation to do outbound IP filtering from [REDACTED] at the United States Secret Service, he implemented the change.
Around January 2011, PAGLIANO recalled a brute force attack (BFA) on the server where COOPER was receiving failed log-in attempt notifications on his email. Because COOPER could not reach PAGLIANO, COOPER “panicked” and shut down the server. PAGLIANO recalled nothing abnormal about this BFA and eventually trained COOPER to insert IP blocks. PAGLIANO made it clear to COOPER he could not administer the server on a day-to-day basis.
After a recommendation by [REDACTED] an employee at STATE DEPARTMENT (hereafter, STATE) to implement Transport Layer Security (TLS) between the CLINTON email server and STATE servers, PAGLIANO did not implement TLS. PAGLIANO understood the CLINTON email server to be a personal email server and did not see a reason for encryption.
In early 2013, PAGLIANO found employment at GARTNER and conversations began between CHERYL MILLS, and pertaining to hiring a third-party company to administer a CLINTON email server. PAGLIANO could not recall when he gave access to his server to [REDACTED] from PLATTE RIVER NETWORKS (PRN). Once PAGLIANO did grant access to [REDACTED]PAGLIANO did no utility work on the server and was not monitoring it. Although he
Continuation of FD-302 of Interview of Bryan Pagliano. On 06/21/2016. Page 3
could not remember a specific date, PAGLIANO believed the last time he accessed the server was around March of 2013.
Notes of the interview will be maintained in a FD34 0 envelope.
(Anne-Marie Slaughter )2/16/16 Page 165
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 2/16/2016[REDACTED] was interviewed in her office at the [REDACTED] Washing ton, D.C., by Federal Bureau of Investigation (FBI) Special Agents (SA) [REDACTED] and [REDACTED]. Interviewing agentsexplained the interview was voluntary and [REDACTED] could stop the interview at anytime. After being advised of the identity of the interviewing agents, and the nature of the interview, [REDACTED] provided the following information: [REDACTED] [REDACTED] participated in daily 8:45am meetings with the Secretary of State and her executive staff. CLINTON was not always present at said meetings, as she traveled quite a bit.However, [REDACTED] assessed she attended meetings wherein CLINTON was present approximately three to six times a week when CLINTON was in town. [REDACTED] did not have a relationship with CLINTON prior to [REDACTED] DOS employment. [REDACTED] reported directly to CLINTON, but did not email CLINTON directly until six to eight months after she began working at DoS. [REDACTED] was not initially provided CLINTON’s email address, so when she wanted to send or forward a message to CLINTON, she wouldroute it through HUMA ABEDIN. At some point in the first six to eight months of her employment at DoS, [REDACTED] recalled CLINTON responding to one of the messages she forwarded up directly. At this point.[REDACTED] asked ABEDIN if it was okay to go direct with CLINTON, and was granted the“privilege.” [REDACTED] explained the privilege of emailing CLINTON direct was not a privilege she used lightly. While[REDACTED] did not have a history of Government Service, she thought it was normal for someone in CLINTON’s position to have a “gatekeeper system” in place.
Continuation of FD-302 of Interview of [REDACTED]. On 12/16/2015. Page 2[REDACTED] could not recall if the emails she directly sent to and from CLINTON were on CLINTON’s DoS or private email account. [REDACTED] did not recall seeing CLINTON’s actual email address. Rather, when [REDACTED] received or responded to emails from CLINTON, she recalled seeing a single initial. [REDACTED] believed she recalled seeing “S” as the name of the senderwhen she received direct CLINTON emails during her time at DoS, as [REDACTED] and other DoS executives would refer to CLINTON as “S.” [REDACTED] noted that although she is no longer at DoS, she still maintains email contact with CLINTON and now receives emails from CLINTON where the name of the sender is “H.” [REDACTED] had no knowledge CLINTON was using her own private server until it was reported in the media. [REDACTED] held a Secret clearance while she was at DoS, but rarely worked in the classified realm. While [REDACTED] received access to and training on the use of DoS’s classified computer systems, she hardly accessed DoS’ classified system. [REDACTED] did not recall ever using her DoS classified email account. [ REDACTED] would have been more likely to use his DoS classified email account. [REDACTED] assessed [REDACTED] almost entirely worked off the DoS’ classified system. [REDACTED] was asked to review an email dated 9/12/2009 wherein [REDACTED] sent an email titled “For S – for discussion on Afghanistan tomorrow,” from her unclassified DoS email account to CHERYL D. MILLS and JACOB J. SULLIVAN’s unclassified DoS email accounts. [REDACTED] ABEDIN, and [REDACTED] were carbon copied on the email. While reading through the email [REDACTED] at one point stated “good Lord,” and further stated that the information contained inthe email was [REDACTED] writing [REDACTED] was also referenced in the first line of the email). [REDACTED] did not recall specifically sending the 9/12/2009 email to MILLS and SULLIVAN, but mentioned she would not have known the information contained in the body of the email. There Afghanistan Review was ongoing at the time of the 9/12/2009 email, and [REDACTED] recalled strong conflicting opinions concerning the role corruption played in the Afghan political strategy. [REDACTED] likely sent [REDACTED] the information in a separate email, which [REDACTED] would have edited before sending to MILLS and SULLIVAN.[REDACTED] likely spoke to [REDACTED] on the phone or in person about the matter before [REDACTED] emailed the information to [REDACTED].
After reading the 9/12/2009 email, [REDACTED] admitted she was a bit ”shocked when she read over the paragraphs labeled #5 and #6.”[REDACTED]stated she “wondered to whatextent she read. . . thought through carefully” before she sent [REDACTED] email on to MILLS and SULLIVAN. SULLIVAN had no idea what was meant by “Marja” Op as statedin the paragraph #5, but explained she believed [REDACTED] was proposing ideas rather than revealing them. [REDACTED] went on to say she wouldn’t have recommended kinetic action.
Continuation of FD-302 of Interviewof [REDACTED]. On 12/16/2015. Page 3[REDACTED] and [REDACTED] have known each other for many years. [REDACTED] father was a mentor to [REDACTED]. At the time of the 9/12/2009 email [REDACTED] was working for [REDACTED] [REDACTED] [REDACTED] would talk to [REDACTED] about a variety of issues. As [REDACTED] likely viewed [REDACTED] as a back channel to get information to CLINTON. [REDACTED] described [ REDACTED] as a “bold thinker.” [REDACTED] saw her role as ensuring CLINTON received a wide range of viewpoints on various topics.
Agents also asked [REDACTED] if she recalled a 6/3/2011 email she sent regarding a hacking of Google email accounts, in which she recommended using the information as a platform for discussing issues with the DoS Information Technology system. [REDACTED] immediately remembered the email and explained she initially thought it was why the FBI wanted to speak with her.[REDACTED] did not recall being advised or instructed against using a personal email account or personal devices. [REDACTED] used her DoS assigned Blackberry. However, she was assigned a DoS Dell computer, which was very dated, so she opted to use her personal laptop when she was out of the office. [REDACTED] was also issued a fob for which to remotely sign onto DoS systems. While [REDACTED] did use the fob on occasions to remotely sign into the DoS system, she explained the system was slow and would shut down while in use. [REDACTED] who resides in [REDACTED] would often sign into and work off of [REDACTED] network from her home, and transfer information she needed back over to DoS systems.
SULLIVAN was always operating off of his DoS Blackberry, so [REDACTED] doubted he ever used a personal account for DoS business. However, MILLS would sometimes send very early morning emails to [REDACTED](around Sam) that were sent from a personal Gmail account [REDACTED] believed was [REDACTED]@gmail.com [REDACTED] could not recall the specific content of emails she received from MILLS’ personal email account, but believed their content was mainly instructional.[REDACTED] could not recall an instance where a conversation (email or otherwise) was moved from an unclassified to classified space. It would be more common for a conversation to turn “confidential” and the circle of participants would dwindle in size to accommodate sensitivities, rather than change the venue of the conversation. [REDACTED] opined that most policy and strategy discussions would be considered unclassified, acknowledging that some of the participants in policy and strategy discussions may have additional details concerning sources and methods that would have come from classified channels.
At the conclusion of the interview [REDACTED] told agents she had not mentionedthe interview to CLINTON or any of contacts from DoS. [REDACTED] further asked if she was allowed
Continuation of FD-302 of Interviewof[REDACTED]. On 12/16/2015. Page 4
to tell SULLIVAN and/or CLINTON she spoke with the FBI, and explained she was concerned they could be upset to learn she spoke with the FBI without telling them. Agents explained that while they cannot prohibit [REDACTED] from referencing the interview, they would prefer [REDACTED] use discretion when discussing the matter, as to prevent unnecessary information from leaking into the press.[REDACTED] was not previously interviewed by DoS or any other entity related to the topics discussed during this interview.
Agent notes are maintained in a 1A.
(???) 2/18/16 Page 170
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 2/11/2016
On February 18, 2016,[REDACTED], DOB XX/XX/XXXXwas interviewed by Federal Bureau of Investigation (FBI) Special Agents [REDACTED] and [REDACTED]at the law offices of [REDACTED] Washington DC. Also present for the interview were [REDACTED] of [REDACTED] and Department of Justice (DoJ)Counterintelligence and Export Control Section [REDACTED].After being advised of the identities of the interviewing agents, and the purpose of the interview,[REDACTED] provided the following information:
In 2013, [REDACTED] founded [REDACTED] where he continues to serve as the Managing Director. Prior to founding [REDACTED] served as the [REDACTED] to former [REDACTED] and [REDACTED] [REDACTED] also served in various positions on [REDACTED].[REDACTED] coordinated frequently with officials from the Department of State (DoS) during his tenure at both the [REDACTED] and [REDACTED]. [REDACTED] coordinated with DOS weekly while he was at he was at [REDACTED] further stated there was close coordination between the [REDACTED] and DOS on all levels.[REDACTED] coordinated more frequently with DoS during his [REDACTED] tenure, as it was necessary to coordinate with DoS on everything that happened “down range.” [REDACTED] primary DoS contacts while he was both at [REDACTED] and [REDACTED] included CHERYL MILLSand JACOB SULLIVAN. [REDACTED] also occasionally communicated directly with [REDACTED] and some U.S. Ambassadors when he was assigned to [REDACTED]
Most of [REDACTED] contact with DoS while at both [REDACTED] and [REDACTED] was via telephone or email. [REDACTED] had classified and unclassified telephones and email systems available on his desk at both [REDACTED] and [REDACTED]. When [REDACTED] signed on to his computers at [REDACTED] he was directed to a classified network and would have to switch over to [REDACTED] unclassified network if he wanted to communicate on an open/unclassified system, whereas when [REDACTED] signed on to his [REDACTED] computer, the system automatically defaulted to the unclassified network.[REDACTED] could not recall what email account was synced to his [REDACTED] issued Blackberry. [REDACTED] Blackberry while at [REDACTED] was synced to his unclassified account.
Continuation of FD-302 of Interview of [REDACTED]. On 2/18/2016. Page 2[REDACTED] was provided a STE and safe for home use during his [REDACTED] tenure. [REDACTED] explained that he did not utilize the safe to store documents, but occasionally used the STE. [REDACTED] didnot leave the STE plugged in at all times, rather he would wait for someone to contact him on an unclassified line and request a secure call from his home before he would physically plug in the STE. [REDACTED] he attended weekly lunch meetings with then Secretary of State HILLARY CLINTON, and [REDACTED] and CLINTON also met regularly at National Security Council (NSC) Principal Committee (PC) meetings while with the CLINTON family, as he served as President WILLIAM J. CLINTON’s[REDACTED] in the 1990’s. [REDACTED] never emailed directly with CLINTON. He was not aware of the email account CLINTON was using, nor was he aware that her email account was opeating off of a private server. According to [REDACTED] would not have utilized email as a means to communicate with CLINTON. If [REDACTED] wanted to contact or convey a message to CLINTON [REDACTED] would subsequently contact the aforementioned DoS senior staff (MILLS, SULLIVAN, or [REDACTED] to relay the appropriate information.
Agents asked [REDACTED] to review an email dated 3/21/2009 and with the subject line [REDACTED]. The email was sent from [REDACTED]@gmail.com to “H” (identified as CLINTON’s personal email account.) The email [REDACTED] [REDACTED]
Agents asked [REDACTED] to review an email dated 12/30/2009 and with the subject line [REDACTED]. The email was sent from [REDACTED] to CLINTON, and referenced information [REDACTED] claimed to receive from [REDACTED]. After reading the email, [REDACTED]explained he recalled the incident referenced in the email and remembered [REDACTED] when the incident occurred.[REDACTED]recalled being contacted by an Executive Assistant (EA) [REDACTED] Last Name Unknown (LNU) who reported the incident in Afghanistan. [REDACTED]subsequently [REDACTED]contacted [REDACTED] who requested [REDACTED] notify the President, Vice President, Chairman of the Joint Chiefs of Staff, Secretary of State, and Secretary of Defense.[REDACTED]contained some anecdotes about the incident.[REDACTED]could not recall if he received the information from
Continuation of FD-302 of Interview of [REDACTED]. On 2/18/2016. Page 3[REDACTED] LNU via secure phone (STE) or on an open line. [REDACTED] could not recall the specifics concerning how he relayed the incident to [REDACTED] but stated most of the calls he made that day concerning the incident were likely on an unclassified line due to the emergency of the situation. He described his role in the call as contacting his counterparts to relay a brief synopsis of the incident with the caveat that his counterparts should “give their boss a heads up.’ [REDACTED] further explained he may have participated in follow up calls on the STE, but could not say for sure either way.
Agents also showed [REDACTED] an email exchange dated 2/10/2010 with the subject of [REDACTED] email.” In the email chain SULLIVAN contacted [REDACTED]to ask for [REDACTED] email address. [REDACTED] replied that email was [REDACTED]@gmail.com. Thereafter, SULLIVAN asked if this email account was the one that [REDACTED] used for work and [REDACTED] confirmed that it was. After reviewing the email, [REDACTED] explained that he primarily used his unclassified [REDACTED] and [REDACTED] email accounts respectively for work purposes. However, he noted that he may have used [REDACTED]@gmail.com on occasions when he could not access his official [REDACTED] or[REDACTED] unclassified emails.[REDACTED] reviewed another email dated 11/20/2010 with the subject line [REDACTED] in Israel,” in which he sent the email to SULLIVAN on both [REDACTED]@gmail.com and Sullivan’s DoS unclassified email account. Also on the receiving line of the email were [REDACTED] and [REDACTED] via their nsc.eop.gov email accounts. [REDACTED] could not recall why he would have sent the email to SULLIVAN’s gmail account, but stated he would normally email SULLIVAN via his DoS account. [REDACTED] did not recall ever receiving instruction from SULLIVAN or any DoS employee regarding contact on a gmail account rather than their DoS email. [REDACTED] listed both his [REDACTED] and @gmail.com account at the bottom of the email because it provided multiple means for people to contact him while he was on travel in the event his work email was not available.
Agents asked [REDACTED] to review a fifth email dated 9/11/2012 with the subject line “Libya.” [Note: the email shown to [REDACTED] was in a redacted format based on a DoS Freedom of Information Act (FOIA) response to Judicial Watch]. After reviewing the redacted email, [REDACTED] explained there was a series of meeting on 9/11/2012 in [REDACTED] office concerning the events surrounding Benghazi. The email [REDACTED] reviewed referenced what [REDACTED] referred to as a deployment meeting. There are three types of deployment meetings according to [REDACTED]. 1. Deployment orders, which is the standard process of determining who needs to go where. 2. “Careful hurry up deployment,” which takes place over the course of a couple of days and is quicker than the standard process. 3. “On the fly quick reaction” deployment, which is used only in emergency situations. The only time [REDACTED] could recall the “on the fly reaction deployment” happening was after Benghazi.[REDACTED] was asked to review a sixth email dated 10/30/2012 with the subject line “This am Green on Blue.” [Note: The email shown to [REDACTED] was in a redacted format based on a DoS FOIA response]. [REDACTED] referenced said email. [REDACTED] explained he sent the email to rapidly coordinate the Public Affairs responses [REDACTED] and DoS in regards to the incident referenced in the email. [REDACTED] and [REDACTED] were the respective Public Affairs contacts at DoS and [REDACTED].
Continuation of FD-302 of Interview of [REDACTED]. On 2/18/2016. Page 4[REDACTED] [REDACTED]
In response to the article, [REDACTED]. However, [REDACTED] stated that he did not say the [REDACTED] because he did not even know if that statement was true.[REDACTED]did not have any concerns regarding how DoS handled classified information during his tenure at either [REDACTED] or [REDACTED]. [REDACTED] indicated he would be available for re-contact if needed.
A copy of the original interview notes and the referenced emails and article are attached in a 1A envelope.
(??? CIA)5/19/16 Page 174
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 5/20/2016
On May 19, 2015, [REDACTED] was interviewed by Special Agent (SA) [REDACTED] and [REDACTED] at the Central Intelligence Agency (CIA) in McLean, Virginia. Also present for the interview was [REDACTED] CIA attorney [REDACTED]. After being advised of the identities of the interviewing agents and the purpose of the interview, [REDACTED] provided the following information:[REDACTED] [REDACTED] [REDACTED]
Page 2[REDACTED] [REDACTED] [REDACTED] [REDACTED]
Page 3[REDACTED]was shown a copy of an email from [REDACTED] with the subject [REDACTED]. After reviewing the email he provided that[REDACTED] appeared to be trying to coordinate with DOS but that the email shouldhave been classified [REDACTED] [REDACTED]. [REDACTED]was shown a copy of an email from [REDACTED] with the subject [REDACTED]. After reviewing the email he provided that the email shouldbeclassified that he was not surprised that DOS had sent it on an unclassified channel, [REDACTED] noted that the DOS unclassified email system had previously been penetrated by a foreign adversary. [REDACTED]was shown a copy of an email from [REDACTED] with the subject [REDACTED]. After reviewing the email [REDACTED]stated that his true name, and that of [REDACTED]should not have been included in an unclassified email. [REDACTED] provided that talking points could be classified or unclassified. They were conveyed from the CIA to DOS via a cable that included a tear line below which the approved talking point were provided. [REDACTED] was shown a copy of an email from [REDACTED] with the subject [REDACTED]. After reviewing the email [REDACTED] provided that any discussion of [REDACTED] should be considered classified. [REDACTED] [REDACTED] was shown a copy of an email from [REDACTED] with the subject [REDACTED]. After reviewing the email [REDACTED] provided that the details [REDACTED] should be considered classified. Because [REDACTED] [REDACTED] concluded the interview by stating that DOS has shown an increased tendency to communicate via email. He believed that they did this for simplicity, to avoid unauthorized disclosures such as Wikileaks, and to prevent other USG partners from seeing their “back channel” discussions. [REDACTED] continued to say that the personnel at DOS were experienced and knew that this information was classified. However, they did it anyways and their actions hurt the CIA and other agencies whose equities were conveyed in the emails.
A copy of the original interview notes and referenced documents is enclosed in a 1A envelope.
Mike Morrell 3/17/16 Page 178
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 3/29/2016
On March 17, 2016, MICHAEL MORELL[REDACTED ] was interviewed by Federal Bureau of Investigation (FBI) Special Agents [REDACTED ] and [REDACTED ] at the FBI Washington Field Office, 601 4th Street, NW, Washington, DC. Present fo the interview was MORELL’s counsel, [REDACTED ] Attorney at Law, at [REDACTED ]. Prior to the interview [REDACTED ] agreed to sign a non-disclosure agreement in anticipation of viewing classified documents during the interview. After being advised of the identities of the interviewing agents and the purpose of the interview, MORELL provided the following information:
MORELL joined the Central intelligence Agency (CIA) in 19S0 as an analyst and served in a variety of roles of increasing responsibility before he was named the Deputy Director (DD) in 2010. MORIL was the DD from May of 2010 until August of 2013, during which he served as theActing Director on two occasions. The first time was in 2011 when LEON PANETTA left and the second was in late 2012 when DAVID PATRAEUS resigned.
As DD, MORIL had regular interaction with the Deputy Secretary of State WILLIAM BURNS during the daily Deputies meeting at the White House. MORELL would also attend meetings at the Department of State (DoS ), or have secure telephonic conversations, with BURNS or [REDACTED] to discuss inter-agency affairs. MORELL never communicated directly with the Secretary of State (Secretary).
MORELL did not recall ever having direct communications with JAKE SULLIVAN, because SULLIVAN did not attend the Deputies meeting. Nor did he have direct communications with CHERYL MILLS or HUMA ABEDIN.
MORIL never emailed the Secretary directly and had no knowledge that she was using a private email account and server.[REDACTED ]
Continuation of FD-302 of Interview of Michael Morell. On 3/17/2016 . Page 2[REDACTED ] [REDACTED ] [REDACTED] [REDACTED] [REDACTED]
MORELL was shown a copy of an email from [REDACTED] with subject [REDACTED]. MORELL did not immediately recall the meeting referenced in the
Continuation of FD-302 of Interview of Michael Morell. On 3/17/2016. Page 3
email [REDACTED] [REDACTED]. MORELL stated that he understood why the email would be considered classified but he did not believe that the email would jeopardize any sources, methods, or otherwise compromise national security.
MORELL was shown a copy of an email chain from [REDACTED] with the subject [REDACTED]. MORELL stated that he did not recall the cited article. [REDACTED]. MORELL stated that assuming the email was true, then it would be classified [REDACTED]
MORELL was shown a copy of an email chain from April of 2011 with the subject “Scots police, UK govt to meet over Libyan defector (Reuters).” MORELL recalled the matter referenced in the email was provided the following context: At the time of the email, the Libyan Civil war was raging and MUAMMAR GADDAFI was still in power. Part of the U.S. strategy at the time was to induce the defections of high ranking officials from Libya. In the email chain BURNS expressed that MUSA KOUSSA should be treated well following his defection to support future defections. [REDACTED][REDACTED] but that the CIA would say that the content is classified because [REDACTED]. However, MORELL did not feel that the disclosure of this information would cause “horrible” damage.[REDACTED] MORELL was shown a copy of email chains from [REDACTED] with subject [REDACTED]. . MORELL stated that the email discussed [REDACTED] and that it appeared to be classified as it is absolutely clear that they are referencing [REDACTED]. MORELL speculated that SULLIVAN got this information from BURNS or [REDACTED] as he never spoke directly with SULLIVAN regarding [REDACTED]. MORELL typically spoke with BURNS about [REDACTED]. [REDACTED] MORELL was shown a copy of an email chain from [REDACTED] with subject [REDACTED]. MORELL stated that it was clear that they were discussing [REDACTED]. MORELLbelieved that the email was classified as it discussed operational activities. MORELL initially stated that the content of the email did not “give much away” but he conceded that the [REDACTED] information could potentially be damaging to the operation. [REDACTED] MORELL was shown a copy of email chains from [REDACTED] with subject [REDACTED]. MORELL stated that it was clear that they were discussing [REDACTED] and the email was likely classified.
Continuation of FD-302 of Interview of Michael Morell. On 3/17/2016 . Page 4
MORELL suggested that the interviewing agents talk with leadership from the agency’s [REDACTED] and with leadership from the [REDACTED] for another assessment of the referenced emails.
A copy of the original interview notes and the NDA signed by [REDACTED] are enclosed in a IA envelope.
(Bill Thornton) 9/15/16 Page 182
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 9/21/2015
On September 15, 2015 [REDACTED] Project Manager, Platte River Networks (PRN), office phone (XXX) XXX-XXXX, email address [REDACTED] was interviewed by Federal Bureau of Investigation (FBI) Special Agent (SA) [REDACTED] and SA [REDACTED] [REDACTED]. Also present for the interview was [REDACTED] from [REDACTED] and Department of Justice (DOJ) Attorney [REDACTED]. After being advised of the identity of the interviewing agents and the nature of the interview [REDACTED] provided the following:[REDACTED] role with the email server project for WILLIAM CLINTON and HILLARY CLINTON, under the account name CESC, involved transporting and installing hardware. He did not serve as the Project Manager, his normal job function at PRN. His first task for the project was to pick up the CESC server and support devices in use prior to PRN being awarded the contract for the project. The server and support devices were located at the CLINTON residence in Chappaqua, NY. In June 2013, [REDACTED] traveled to New York and drove a rental car to the CLINTON residence. [REDACTED] contact at the residence, [REDACTED] Last Name Unknown (LNU), escorted [REDACTED] to the basement where the equipment was [REDACTED]located. [REDACTED] powered down the equipment and took a Dell PowerEdge 1950 BlackBerry Enterprise Server (BES), Dell PowerEdge 2900 email server (hereafter, predecessor server), Cisco NSS 324 Network Attached Storage Device (NAS), and an external USB hard drive, but left the existing firewall and switch. [REDACTED] then transported the equipment to an Equinix datacenter in Secaucus, NJ where he reconnected the equipment in the same manner in which it was connected at the CLINTON residence. The goal was to get CESC users back online quickly [REDACTED] and [REDACTED] who was working remotely, then started incorporating new equipment PRN purchased for the CESC project, but [REDACTED] did not recall if he set it up before or after transporting the server. The new equipment consisted of a Dell PowerEdge 620 server running multiple virtual machines, two new PowerConnect switches, two new Fortinet firewalls, and a DATTO backup device. During this period of time, the predecessor server and new PRN server (hereafter, PRN server) co-existed. The predecessor server had NAS connected, but it did not appear to be configured for storing any data. The PRN server had a DATTA backup appliance connected to it. After 2-3 days, [REDACTED] departed Equinix and did not participate in the day-to-day management of the CESC account. Those duties were handled remotely by [REDACTED] technicians at Equinix. The CloudJacket was designed to alert PRN and prevent intrusions into the PRN server.
Continuation of FD-302 of Interview of [REDACTED]. On 9/15/2015. Page 2
In or about March 2015, [REDACTED] communicated with CHERYL MILLS regarding any existing backups of the CESC email server and the state of the predecessor server. MILLS requested an audit of the existing equipment, but did not direct [REDACTED] to delete or alter any data found. [REDACTED] traveled to Equinix datacenter in Secaucus, NJ to conduct an onsite review of the equipment. PRN had migrated all accounts off of the predecessor server by this time, therefore it contained no data. [REDACTED] reviewed the NAS and external USB hard drive brought from the CLINTON residence as part of the initial transport of equipment. Neither contained any data. While there, [REDACTED] also took steps to increase security on the system as a result of media articles identifying the existence of the private email server used by the CLINTONS. PRN took these steps without direction from CESC.
None of the Internet Protocol (IP) notifications [REDACTED] reviewed from the CloudJacket device used as part of the security infrastructure for the CESC account were abnormal. All were alerts and some resulted in IP addresses being blocked from accessing the equipment. [REDACTED] does not believe any nefarious actors got into the system.
In or about August 2015, [REDACTED] traveled to the Equinix datacenter in Secaucus, NJ to turn over the predecessor server to the FBI. Prior to turning over the server, [REDACTED] powered on the server to check for proprietary PRN software and license copies of other software purchased by PRN. [REDACTED]recalled removing Magic ISO software because it was expensive and PRN pays for license fees for each copy it use. [REDACTED] review of the predecessorserver was not requested by CESC.[REDACTED]never heard anyone from CESC discuss classified information. [REDACTED] was never asked by anyone from CESC to delete or destroy anything; however, PRN would not have knowledge of individual users deleting content from their accounts.
NO ADDITIONAL NOTES FOUND FOR THIS INTERVIEW
(Bill Thornton)2/18/16 Page 182
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 3/4/2016
On February 18, 2016, [REDACTED] Project Manager, Platte River Networks (PRN), office phone (XXX) XXX-XXXX email address [REDACTED]was interviewed by Federal Bureau of Investigation (FBI) Special Agent [REDACTED] and SA [REDACTED] at the offices of Platte River Networks, 5700 Washington Street, Denver, CO. Also present for the interview were SA [REDACTED] from Information Technology Specialist/Forensic Examiner [REDACTED] [REDACTED] [REDACTED] and Department of Justice (DOJ) Attorney [REDACTED] [REDACTED]. After being advised of the identity of the interviewing agents and the nature of the interview, [REDACTED] provided the following:[REDACTED] handled the technical infrastructure related to the contract PRN had with the Clinton Executive Services Corporation (CESC). [REDACTED] ran the day to day operations and most direct interactions with the client, including managing and maintaining the Microsoft Exchange email server and associated equipment (collectively hereafter, Server).
In March 2015, the CESC requested PRN conduct a complete inventory of data backups and all equipment in PRN’s possession related to the services provided to CESC.[REDACTED] does not recall how or who from CESC communicated this request. In response to the request, [REDACTED] traveled to the Equinix facility in Secaucus, NJ where the Server housing CESC’s data was located. In addition to the currently operating equipment, [REDACTED] found a Network Attached Storage (NAS) device and an external hard drive that were disconnected. He connected them and reviewed for content, but neither contained any data, so he disconnected them before leaving.[REDACTED] did not find any unexpected backups during this trip.[REDACTED] vaguely recalled the name [REDACTED] from Security Pursuit, but did not know why it was familiar to him. He did not recall implementing any new security protocols in the March 2015 timeframe, but [REDACTED] did conduct a high level security check of the Server. [REDACTED] did not recall a backup device of HILLARY CLINTON’s connecting via IMAP/SMTP to the Server.
Continuation of FD-302 of Interview of [REDACTED]. On 2/18/2016. Page 2[REDACTED] never deleted, nor was he asked to delete the mailbox “hrcarchive” from the Server. He never discussed deleting content, creating pst files, exports, or shredding of pst files with [REDACTED] or anyone else. Additionally, [REDACTED] is unfamiliar with a program called BleachBit.However, prior to turning over the Server to the FBI, [REDACTED] Removed PRN system tools such as an ISO mounter and, possibly, a monitoring tool from Level Platforms or LabTech.
NO ADDITIONAL NOTES FOUND FOR THIS INTERVIEW
John Bentel6/10/2016 Page 182
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 6/10/2016
On June 10, 2016, JOHN BENTEL, Date of Birth XX/XX/XXXX, was interviewed by Federal Bureau of Investigation (FB) Special Agents [REDACTED] and [REDACTED] at the office of [REDACTED] Washington DC. Present for the interview was BENTEL’s counsel [REDACTED] Partner, [REDACTED] Partner, and [REDACTED] Special Counsel. As well as [REDACTED] from the Department of Justice (DoJ) Counterintelligence and Export Control Section. Prior to the interview BENTEL was [REDACTED]. After being advised of the identities of the interviewing agents, and the purpose of the interview, BENTEL provided the following information:
BENTEL served at the US Department of State (DOS) for 39 years before retiring in 2012. Most recently, BENTEL was the Director of the Executive Secretariat Information Resource Management (S/ES-IRM) from 2008 until 2012. In this position he reported to LEWIS LUKENS and then to TULINABO (TULI) MIJSHINGI. Approximately 85 people were under BENTEL’s supervision, including two deputies: [REDACTED] and [REDACTED].
BENTEL did not learn that HILLARY CLINTON was using a private email server while she was at DOS until it came out in the press last year. He had no knowledge of the server while he was at DOS. BENTEL met BRYAN PAGLIANO while he was at DOS and knew that he worked for IRM but he did not know that he was also providing support to the CLINTON server.
BENTEL was shown a copy of an email sent from [REDACTED] to BENTEL,[REDACTED] and [REDACTED] on March 17, 2009, with the subject “Secretary Residential Installation Hotwash.” BENTEL provided that [REDACTED] was responsible for setting up secure communications in CLINTON’s office and residence, and that [REDACTED] was a contractor in [REDACTED] section. After reviewing the email and its attachment, BENTEL stated that he did not recall the email and that he might not have read the email originally because he and his two deputies functioned as “a collective.” BENTEL stated that the attachment appeared to be a summary of the communication equipment in CLINTON’s residence at the start of her tenure. BENTEL did not know what the “Server: Basement Telephone Closet” listed in the attachment referred to. He then speculated that it might be a server for telephones. Upon further questioning, BENTEL provided that he did not know if DOS used orinstalled servers to support its telephone equipment.
BENTEL was shown an email sent from MONICA HANLEY to HUMA ABEDIN on August 30, 2011 with the subject “HRC blackberry” that referenced a discussion between HANLEY
Continuation of FD-302 of Interview of John Bentel. On 6/10/2016. Page 2
and BENTEL. Upon reviewing the document BENTEL provided that he did not recall the email and that he would not have used the term “chapp server.” Furthermore, he did not recall CLINTON losing access to her email following Hurricane Irene or any related discussions. BENTEL explained that he did not have a lot of direct interaction with CLINTON’s staff and that communication issues would likely be handled by [REDACTED] from the “tech team.”
BENTEL was aware of the Office of Inspector General (OIG) report from May of 2016 in which it was reported that subordinates raised concerns about the Secretary’s server to BENTEL in 2010 and he instructed them not to discuss the matter any further. BENTEL denied that anybody had raised such concerns to him. He further stated that the account provided by the OIG report was inconsistent with his open and welcoming management style.
BENTEL stated that he did not know CLINTON was using a personal email account for DOS business until after it was released in the papers. BENTEL clarified he knew that CLINTON had a personal email account but that he did not know that she was using it for work related matters. BENTEL did not know if CLINTON had a DOS issued email account.
BENTEL was shown an email that he sent to MONICA HANLEY on August 30, 2011 with the subject “Re: S berry.” The email discusses a DOS issued email account, SSHRC@state.gov, which had been previously established for CLINTON. In the email, BENTEL wrote that emails on the account would be subject to Freedom of Information Act (FOIA) searches. Upon reviewing the email, BENTEL stated that he did not recall the email exchange or the details surrounding the use of SSHRC@state.gov, noting that the account was likely set up by the system administrator. BENTEL included the caveat about FOIA to make sure that HANLEY was aware of FOIA and that any personal messages on the account would also be subjected to FOIA requests. BENTEL stated his group was not directly responsible for FOIA related matters and that the appropriate contact for FOIA matters within S/ES-IRM was [REDACTED].
BENTEL was aware of the State Messaging Archive Retrieval Toolset (SMART) and said it was not used by S/ES-IRM during CLINTON’s tenure. BENTEL speculated that it was not rolled out to S/ES-IRM at that time because it was a new system and they wanted to work out any bugs before giving it to the executives. BENTEL stated that STEPHEN MULL would have made the final decision on rolling out SMART to S/ES-IRM.
A copy of the original interview notes and referenced documents are attached in a 1 A envelope.
Colin Powell 12/21/2015 Page 182
FEDERAL BUREAU OF INVESTIGATION
Date of transcription: 1/7/2016
On December 21 2015, COLIN POWELL, office address [REDACTED] office phone (XXX) XXX-XXXX, was interviewed at his residence byFederal Bureau of Investigation (FBI} Special Agent (SA) [REDACTED] and SA [REDACTED]. Also present during the interview was [REDACTED] to POWELL. After being advised of the identity of the interviewing agents and the nature of the interview, POWELL provided the following:
In his book, It Worked for Me: In Life and Leadership, POWELL wrote a chapter called Brainware outlining his efforts to modernize computer systems at the US Department of State, hereafter State. When he was sworn in as Secretary of State in 2001, one of the largest problems at State was outdated Information Technology (IT) systems. At the time, State and the Central Intelligence Agency (CIA) would swap responsibility every 12 months for the communication connections to overseas embassies. Sometime thereafter, Congress passed a law establishing a White House agency with the responsibility for secure diplomatic telecommunications. POWELL convinced the administration to give him time to assess the situation, so he launched a study to determine the agency best suited to maintain the communication connections. The study found CIA as the most competent, so POWELL fired State and reached an agreement with the then CIA Director GEORGE TENET where POWELL would select and evaluate the CIA staff person in charge of the system. Additionally, the system would be based on POWELL’s requirements.
In 2001, few State employees had a computer at their desks. Typically, there was one computer per office, so POWELL budgeted for the purchase of 44,000 computers and put one on every embassy desk. The project was done in-house without contractors. To convince and encourage others to use computers, POWELL frequently used his to set an example. When traveling to visit embassies, he would sit down at a random computer in each embassy and attempt to login to his account. This action allowed POWELL to gauge if the embassy staff was maintaining and using their computers. Additionally, he would frequently look up Country Notes pages on the State intranet to determine if the various bureaus of State were keeping their information up to date. On his desk at State, POWELL had a State classified computer and a laptop with a 56kbps modem. The modem was used to access POWELL’s personal American Online (AOL) account. He viewed his personal email much like a home telephone line in that it could be used for personal and business purposes. At times, POWELL would correspond with foreign leaders by email. If the conversation became sensitive, whether with foreign leaders or other USG personnel, he would arrange for a secure call.
Continuation of FD-302 of Interview of Colin Powell. On 12/21/2015. Page 2
The IT transformation revolutionized business at State. With a computer on every desktop, the time and space problems were eliminated when sharing information. Prior to the IT deployment, embassies communicated via cables.
The State Inspector General (IG) and Intelligence Community Inspector General (ICIG) both wrote POWELL to ask him if he had any emails from his time as Secretary of State. However, POWELL took no emails with him when he left State and knew of no official record requirements at the time, however, State claimed they were capturing any data necessary. POWELL hasnot been able to get a straight answer from the federal archives regarding what record requirements wereat the time. He is concerned the current environment will discourage open communication and the use of email, ultimately harming US Government efficiency.
When POWELL traveled for State business, a team would put a computer in his hotel room for general use, but he would also have access to State systems. Some threat countries would have additional security requirements such as [REDACTED]. If the need arose to have a classified conversation, POWELL would go to a secure facility, such as the local embassy.
In response to reviewing the email attached to this communication in a 1A, POWELL provided the following:
During POWELL’s first few weeks at State, he received several security briefings that restricted his ability to communicate. He was admonished that CIA and NSA did not want personal digital assistants (PDAs) inside of SCIFs, even if the PDA did not have wireless capabilities. He requested briefings to explain why PDAs were any more of a risk than the television remote controls in the SCIF, but was not convinced of the risks. As a result of these experiences, he advised HILLARY CLINTON, when she became Secretary of State, to resist restrictions that would inhibit her ability to communicate.
REMAINDER OF COLIN POWELL 302 WAS NOT PUBLISHED AT THIS ONLINE FBI VAULT