A Review of Various Actions by the Federal Bureau of Investigation and Department of Justice in Advance of the 2016 Election

Oversight and Review Division 18-04 June 2018

Attachment C TRANSITORY RECORD

Unknown

From: STRZOK, PETER P. (CD) (FBI)

Sent Friday, May 06, 2016 6:08 PM

To: MCCABE, ANDREW G. (DO) (FBI); PRIESTAP, E W. (CD) (FBI); [REDACT]

(FBI); PAGE, USA C. (OGC) (FBI)

Subject: RE: Midyear Exam ··- UNCLASSIFIED

Classification: UNCLASSIFIED

=========================================

Understood and will do.

From: MCCABE, ANDREW G. (DO) (FBI)

Sent: Friday, May 06, 2016 5:32 PM

To: PRIESTAP, E W. (CO) (FBI); STRZOK, PETER P. (CD) (FBI}; [REDACT] PAGE, LISA C. (OGC}

(FBI)

Subject: FW: Midyear Exam — UNCLASSIFIED

Importance: High

Classification: UNCLASSIFIED

===========================================

Folks:

The Director composed the below straw man in an effort to compose what a “final” statement might look like in the context of a press conference. This was really more of an exercise for him to get his thoughts on the matter in order, and not any kind of decision about venue, strategy, product, etc.

The Director asked me to share this with you four, but not any further. The only additional people who have seen this draft are Jim Rybicki and Jim Baker. Please do not disseminate or discuss any further.

I do not know if the boss will want to discuss this at the Monday update but please review it before the meeting just in

case.

Thanks

Andrew G. McCabe

Deputy Director

Federal Bureau of Investigation

[Redaction]

From: COMEY, JAMES 8. (DO) (FBI)

sent: Monday, May 02, 2016 7:15 PM

To: MCCABE, ANDREW G. (DO) (FBI); BAKER, JAMES A. (OGC) (FBI); RYBICKI, JAMES E. (DO) (FBI)

Cc: COMEY, JAMES B. (DO) (FBI)

subject: Midyear Exam — UNCLASSFIED

Classification: UNCLASSIFIED

-==—–=====-========================================

1

E2017001- 0000000099-1

TRANSITORY RECORD

I’ve been trying to imagine what it would look like if I decided to do an FBI only press event to close out our work and hand the matter to DOJ. To help shape our discussions of whether that, or something different, makes sense, I have spent some time crafting what I would say, which follows. In my imagination, I don’t see me taking any questions. Here is what it might look like:

Good afternoon folks. I am here to give you an update on our investigation of Secretary Clinton’s use of a private email system, which began in late August.

After a tremendous amount of work, the FBI has completed its investigation and has referred the case to the Department of Justice for a prosecutive [sic] decision. What I would like to do today is tell you three things: (1) what we did; (2) what we found; (3) what we have recommended to DOJ.

But I want to start by thanking the many agents, analysts, technologists, and other FBI employees who did work of extraordinary quality in this case. Once you have a better sense of how much we have done, you will understand why I am so grateful and proud of their efforts.     So, first: what we have done over the last eight months. The investigation began as a referral from the Intelligence Community Inspector General in connection with Secretary Clinton’s use of a private email server during his time as Secretary of State, focused on whether classified information was transmitted on that private system.

Our investigation focused on whether there is evidence that classified information was improperly stored or transmitted on that private system, in violation of a federal statute that makes it a felony to mishandle classified information either intentionally or in a grossly negligent way, or a second statute that makes it a misdemeanor to remove classified information from appropriate systems or storage facilities.

Consistent with our counterintelligence responsibilities, we have also investigated to determine whether there is evidence of computer intrusion in connection with the private email server by any foreign power, or hackers on behalf of a foreign power. I have so far used the singular term, “email server,” in describing the referral that began our investigation. It turns out to have been more complicated than that. Secretary Clinton used several different servers and providers of those servers during her four years at the State Department, and used numerous mobile devices to view and send email on that private domain. As new servers and

providers were employed, older servers were taken out of service, stored, and decommissioned in various ways. Piecing all of that back together to gain as full an understanding as possible of the ways in which private email was used for government work has been a painstaking undertaking, requiring thousands of hours of effort.

For example, when one of Secretary Clinton’s original private servers was decommissioned in 20:xx, the email software was removed. Doing that didn’t remove the email content, but it was like removing the frame from a huge finished jigsaw puzzle and dumping the pieces on the floor. The effect was that

2

millions of email fragments end up unsorted in the server’s un-used- or “slack” – space. We went through all of it to see what was there, and what parts of the puzzle could be put back together.

FBI investigators have also read all 34,000 emails provided by Secretary Clinton to the State

Department in spring 2015. Where an email was assessed as possibly containing classified

information, the FBI referred the email to the U.S. government agency that was the likely “owner” of the information in the email so that agency could make a determination as to whether the email contained classified information at the time it was sent or received, or whether there was reason to classify the email now, even if its content was not classified at the time it was sent (this is the process sometimes referred to as “up classifying”).

From that group of 34,000 emails that had been returned to the State Department in 2015, the FBI sent xxxx emails to agencies for classification determinations. Of those, xxxx have been determined to contain classified information at the time they were sent or received. Xxxx of those contained information that was Top Secret at the time they were sent; xxxx contained Secret information at the time; and xxxx contained Confidential information. Separate from those, a total of xxxx additional emails were ”up classified” to make them Secret or Confidential; the information in those had not been classified at the time the emails were sent.

The FBI also discovered xxxx work-related emails that were not in the group of 34,000 that were returned by Secretary Clinton to State in 2015. We found those additional emails in a variety of ways. Some had been deleted over the years and we found traces of them on devices that supported or were connected to the private email domain. Others we found by reviewing the archived government email accounts of people who had been government employees at the same time as Secretary Clinton, including high-ranking officials at other agencies, with whom a Secretary of State might naturally correspond. This helped us recover work-related emails that were not among the 34,000 produced to State. Still others we recovered from the laborious review of the millions of email fragments dumped

into the slack space of the server decommissioned in 20xx.

All told, we found xxxx emails that were not among those produced to the State Department last year. Of those, we assessed that xxxx possibly contained classified information at the time they were sent or received and so we sent them to other government agencies for classification determinations. To date, agencies have concluded that xxxx of those were classified at the time they were sent or received, xxx at the Secret level and xxxx at the Confidential level. There were no additional Top Secret emails found. Finally, none of those we found have since been “up classified.”

I should add here that we found no evidence that any of the additional work-related emails we found were intentionally deleted in an effort to conceal them. Our assessment is that, like many users of private email accounts, Secretary Clinton periodically deleted emails or emails were purged from the system when devices were changed. Because she was not using a government account, there was no archiving of her emails, so it is not surprising that we discovered emails that were not on Secretary Clinton’s system in 2015, when she produced the 34,000 emails to the State Department.

It could also be that some of the additional work-related emails we recovered were among those deleted as “personal” by Secretary Clinton’s lawyers when they reviewed and sorted her emails for production in 2015. We have conducted interviews and done technical examination to attempt to  understand how that sorting was done. Although we do not have complete visibility because we are millions of email fragments end up unsorted in the server’s un-used- or “slack” – space. We went through all of it to see what was there, and what parts of the puzzle could be put back together.

FBI investigators have also read all 34,000 emails provided by Secretary Clinton to the State

Department in spring 2015. Where an email was assessed as possibly containing classified

information, the FBI referred the email to the U.S. government agency that was the likely “owner” of the information in the email so that agency could make a determination as to whether the email

contained classified information at the time it was sent or received, or whether there was reason to classify the email now, even if its content was not classified at the time it was sent (this is the process sometimes referred to as “up classifying”).

From that group of34,000 emails that had been returned to the State Department in 2015, the FBI sent

xxxx emails to agencies for classification determinations. Of those, xxxx have been determined to contain classified information at the time they were sent or received. Xxxx of those contained information that was Top Secret at the time they were sent; xxxx contained Secret information at the time; and xxxx contained Confidential information. Separate from those, a total of xx.xx additional emails were ”up classified” to make them Secret or Confidential; the information in those had not been classified at the time the emails were sent.

The FBI also discovered xx.xx work-related emails that were not in the group of 34,000 that were returned by Secretary Clinton to State in 2015. We found those additional emails in a variety of ways. Some had been deleted over the years and we found traces of them on devices that supported or were connected to the private email domain. Others we found by reviewing the archived government email accounts of people who had been government employees at the same time as Secretary Clinton, including high-ranking officials at other agencies, with whom a Secretary of State might naturally correspond. This helped us recover work-related emails that were not among the 34,000 produced to State. Still others we recovered from the laborious review of the millions of email fragments dumped into the slack space of the server decommissioned in 20xx.

All told, we found xxxx emails that were not among those produced to the State Department last year. Of those, we assessed that xxxx possibly contained classified information at the time they were sent or received and so we sent them to other government agencies for classification determinations. To date, agencies have concluded that xxxx of those were classified at the time they were sent or received, xxx at the Secret level and xxxx at the Confidential level. There were no additional Top Secret emails found. Finally, none of those we found have since been “up classified.”

I should add here that we found no evidence that any of the additional work-related emails we found were intentionally deleted in an effort to conceal them. Our assessment is that, like many users of private email accounts, Secretary Clinton periodically deleted emails or emails were purged from the system when devices were changed. Because she was not using a government account, there was no archiving of her emails, so it is not surprising that we discovered emails that were not on Secretary

Clinton’s system in 2015, when she produced the 34,000 emails to the State Department.

It could also be that some of the additional work-related emails we recovered were among those deleted as “personal” by Secretary Clinton’s lawyers when they reviewed and sorted her emails for production in 2015. We have conducted interviews and done technical examination to attempt to understand how that sorting was done. Although we do not have complete visibility because we are

3

not fully able to reconstruct the electronic record of that sorting, we believe our investigation has been sufficient to give us reasonable confidence there was no intentional misconduct in connection with that sorting effort.

The lawyers doing the sorting for Secretary Clinton in 2015 did not individually read tens of thousands of emails, as we did; instead, they used search terms to try to find all work-related emails among the more than 60,000 total emails remaining on Secretary Clinton’s private system in 2015. It is highly likely their search terms missed some work-related emails, and that we found them, for example, in themailboxes of other officials or in the slack space of a server. It is also likely that there are other workrelated

emails that they did not produce to State and that we did not find elsewhere, and that are now

gone because they deleted all emails they did not return to State, and the lav,ryers cleaned their devices in a such a way as to preclude forensic recovery.

And, of course, in additional to our technical work, we interviewed many people, from those involve in setting up and maintaining the various iterations of Secretary Clinton’s private server to staff members with whom she corresponded on email, to those involved in the email production to State, and finally, Secretary Clinton herself.

Lastly, we have done extensive work with the assistance of our colleagues elsewhere in the Intelligence Community to understand what indications there might be of compromise by hostile actors in connection with the private email operation.

That’s what we have done. Now let me tell you what we found.

There is evidence to support a conclusion that Secretary Clinton, and others, used the private email server in a manner that was grossly negligent with respect to the handling of classified

information. For example, seven email chains concern matters that were classified at the TS/SAP level when they were sent and received. These chains involved Secretary Clinton both sending emails about those matters and receiving emails from others about the same matters. There is evidence to support a conclusion that any reasonable person in Secretary Clinton’s position, or in the positon of those government employees with whom she was corresponding about these matters, should have known that an unclassified system was no place for such an email conversation. Although we did not find clear evidence that Secretary Clinton or her colleagues intended to violate laws governing the handling of classified information, there is evidence that they were extremely careless in their handling of very

sensitive, highly classified information. Similarly, the sheer volume of information that was properly classified as Secret at the time it was discussed on email (that is, excluding the “up classified” emails) supports an inference that the participants were grossly negligent in their handling of that information. We also developed evidence that the security culture of the State Department in general, and with respect to use of unclassified email systems in particular, was generally lacking in the kind of care for classified information found elsewhere in the government. With respect to potential computer intrusion by hostile actors, we did not find direct evidence that Secretary Clinton’s personal email system, in its various configurations since 2009, was successfully hacked. But, given the nature of the system and of the actors potentially involved, we assess that we

4

would be unlikely to see such direct evidence. We do assess that hostile actors gained access to the private email accounts of individuals with whom Secretary Clinton was in regular contact from her private account. We also assess that Secretary Clinton’s use of a private email domain was both known by a large number of people and readily apparent. Given that combination of factors, we asses it is reasonably likely that hostile actors gained access to Secretary Clinton’s private email account. So that’s what we found.

Finally, with respect to our recommendation to the Department of Justice. In our system, the prosecutors make the decisions about whether charges are appropriate based on evidence the FBI has helped collect. Although we don’t normally make public our recommendations to the prosecutors, we frequently make recommendations and engage in productive conversations with prosecutors about what resolution may be appropriate, given the evidence. In this case, given the importance of the matter, I think unusual transparency is in order.

Although there is evidence of potential violations of the statute proscribing gross negligence in the handling of classified information and of the statute proscribing misdemeanor mishandling, my judgment is that no reasonable prosecutor would bring such a case. At the outset, we are not aware of a case where anyone has been charged solely based on the “gross negligence” prohibition in the statute. All charged cases of which we are aware have involved the accusation that a government employee intentionally mishandled classified information. In looking back at our investigations in similar circumstances, we cannot find a case that would support bringing criminal charges on these facts. All the cases prosecuted involved some combination of: (1) clearly intentional misconduct; (2)vast quantities of materials exposed in such a way as to support an inference of intentional misconduct;

(3) indications of disloyalty to the United States; or (4) efforts to obstruct justice. We see none of that here.

Accordingly, although the Department of Justice makes final decisions on matters such as this, I am completing the investigation by expressing to Justice my view that no charges are appropriate in this case.

I know there will be intense public disagreement in the wake of this result, as there was throughout this investigation. What I can assure the American people is that this investigation was done competently, honestly, and independently. No outside influence of any kind was brought to bear. I know there were many opinions expressed by people who were not part of the investigation — including people in government – but none of that mattered to us. Opinions are irrelevant, and they were all uninformed by insight into our investigation, because we did the investigation in a professional way. Only facts matter, and the FBI found them here in an entirely apolitical and professional way. I couldn’t be prouder to be part of this organization.

###

–==-=—=============================================

Classification: UNCLASSIFIED

E2017001- 0000000099-5