A Review of Various Actions by the Federal Bureau of Investigation and Department of Justice in Advance of the 2016 Election

Oversight and Review Division 18-04 June 2018

CHAPTER THREE:

OVERVIEW OF THE MIDYEAR INVESTIGATION

In this chapter, we provide an overview of the Midyear investigation. More specifically, we describe the referral and opening of the investigation, the staffing of the investigation by the Department and the FBI, and the investigative strategy.

1. Referral and Opening of the Investigation
2. Background
3. Clinton’s Use of Private Email Servers

Hillary Clinton served as Secretary of State from January 21, 2009, until February 1, 2013. During that time, she used private email servers hosting the @clintonemail.com domain to conduct official State Department business.44 According to FBI documents, former Secretary Clinton and her husband, former President Bill Clinton, had a private email server in their house in Chappaqua, N.Y., beginning in approximately 2008 (before Clinton’s tenure as Secretary of State) for use by former President Clinton’s staff. Former Secretary Clinton told the FBI that, in or around January 2009, she “directed aides…to create the clintonemail.com account,” and that this was done “as a matter of convenience.”

According to the FBI letterhead memorandum (LHM) summarizing the Midyear investigation, Clinton used her clintonemail.com account and personal mobile devices linked to that account for both personal and official business throughout her tenure as Secretary of State. The LHM states that Clinton “decided to use a personal device to avoid carrying multiple devices.” Clinton never personally used an official State Department email account or State Department-issued handheld device during her tenure, although there were official State Department email accounts from which emails were sent on her behalf.

2. Production of Emails from the Private Email Servers to the State Department and Subsequent Deletion of Emails by Clinton’s Staff

On September 11 and 12, 2012, terrorists attacked the U.S. Temporary Mission Facility and a Central Intelligence Agency (CIA) Annex in Benghazi, Libya, killing four Americans.45 On May 8, 2014, the U.S. House Select Committee on Benghazi (House Benghazi Committee) was established to investigate the Benghazi attack and, thereafter, sought documents from the State Department as part of its

44 As described in Chapter Five, the FBI discovered three servers that for different periods stored work-related emails sent or received by Clinton during her tenure as Secretary of State.

45 See U.S. Senate Select Committee on Intelligence, Review of the Terrorist Attacks on U.S. Facilities in Benghazi, Libya, September 11-12, 2012, 113th Cong, 2d sess., 2014, S. Rept. 113-134, https://www.intelligence.senate.gov/sites/default/files/publications/113134.pdf (accessed May 7, 2018).

investigation. In the summer of 2014, State Department officials contacted Cheryl Mills, who had served as former Secretary Clinton’s Chief of Staff and Counselor, concerning the State Department’s inability to locate Clinton’s and other former Secretaries’ emails to respond to Congressional requests. Mills later told the FBI that she suggested that the State Department officials search State Department systems for Clinton’s clintonemail.com email address. In addition, Mills told the FBI that State Department officials requested that she produce former Secretary Clinton’s emails and advised her that it was Clinton’s or Mills’s “obligation to filter out personal emails from what was provided to State.”

Former Secretary Clinton asked Mills and Clinton’s personal attorney, David Kendall, to oversee the process of providing her emails to the State Department. In late summer 2014, Mills contacted Paul Combetta, an employee of the company that administered Clinton’s private server at the time, and requested that he transfer copies of Clinton’s emails onto Mills’s laptop and a laptop belonging to Heather Samuelson, a lawyer who had served in the State Department as Secretary Clinton’s White House Liaison. Mills, Samuelson, and Kendall then developed a methodology for Samuelson to “cull” former Secretary Clinton’s work-related emails from her personal emails, to produce her work-related emails to the State Department.

In October and November 2014, the State Department sent letters to four former Secretaries of State, including Clinton, requesting that they “make available copies of any Federal records in their possession, such as emails sent or received on a personal email account while serving as Secretary of State.”46 In December 2014, former Secretary Clinton produced to the State Department “from her personal email account approximately 55,000 hard-copy pages, representing approximately 30,000 emails that she believed related to official business.”47 After receiving these documents, the State Department, in addition to responding to the House Benghazi Committee’s document request, reviewed Clinton’s emails for potential public release in response to Freedom of Information Act (FOIA) requests.

As described in Chapter Five, Mills, Samuelson, and Combetta told the FBI that in late 2014 or early 2015 Mills and Samuelson asked Combetta to remove former Secretary Clinton’s emails from their laptops. Combetta then used the commercial software “BleachBit” to permanently remove or wipe former Secretary Clinton’s emails from Mills’s and Samuelson’s laptops.48 Mills told the FBI that at some point between November 2014 and January 2015, Clinton decided she no longer wished to retain on her server emails that were older than 60 days and Mills

46 See U.S. Department of State Office of the Inspector General (State IG), Office of the Secretary: Evaluation of Email Records Management and Cybersecurity Requirements, ESP-16-03 (May 2016), https://oig.state.gov/system/files/esp-16-03.pdf (accessed May 7, 2018), 3.

47 See State IG, Office of the Secretary, 4.

48 According to documents we reviewed, BleachBit is a “freely available software that advertises the ability to ‘shred’ files. ‘Shredding’ is designed to prevent recovery of a file by overwriting the content.”

instructed Combetta to change Clinton’s email retention policy accordingly. Combetta, however, failed to do so until late March 2015.

On March 3, 2015, the House Benghazi Committee sent preservation orders requiring former Secretary Clinton to preserve emails on her servers.49 As described in more detail in Chapter Five, Combetta told the FBI that later in March 2015 he realized that he had neglected to make the change to former Secretary Clinton’s email retention policy earlier that year, had an “oh shit” moment, and, without consulting Mills, used BleachBit to permanently remove Clinton’s emails from her server. These included emails that had been transferred from a prior server. According to FBI documents, former Secretary Clinton’s attorneys advised Combetta about the congressional preservation order before he made the deletions. As a result of Combetta’s actions, 31,830 emails that former Secretary Clinton’s attorneys had deemed personal in nature were deleted from three locations on which they had previously been stored—Mills’s and Samuelson’s laptops and the Clinton server.

1. State Department Inspector General and IC IG Review of Clinton’s Emails and Subsequent 811 Referral

On March 12, 2015, three Members of Congress requested that the State Department Inspector General (State IG) conduct a review regarding State Department employees’ use of personal email for official purposes. The Members of Congress requested that the State IG coordinate with the Office of the Intelligence Community Inspector General (IC IG) to determine whether classified information was transmitted or received by State Department employees over personal systems. Following this request, the IC IG reviewed 296 of the 30,490 emails that former Secretary Clinton’s attorneys had provided to the State Department and determined that at least two of these emails contained classified information. The 296 emails, including the two determined to contain classified information, had already been publicly released by State Department FOIA officials.

In a June 24, 2015 letter, Kendall told the State IG and the IC IG that a copy of the 30,490 emails provided by former Secretary Clinton to the State Department was stored on a thumb drive in his law office and that her personal server was in the custody of the company “Platte River Networks” (“PRN”). Based on this information, the IC IG concluded that “the thumb drive and personal server contain classified information and are not currently in the Government’s possession.”

On July 6, 2015, the IC IG made a referral to the FBI pursuant to Section 811(c) of the Intelligence Authorization Act of Fiscal Year 1995 (811 referral). This provision requires Executive Branch departments and agencies to advise the FBI “immediately of any information, regardless of its origin, which indicates that

49 See U.S. House of Representatives, Select Committee on the Events Surrounding the 2012 Terrorist Attack in Benghazi, Final Report of the Select Committee on the Events Surrounding the 2012 Terrorist Attack in Benghazi, 114th Cong., 2d sess., 2016, H. Rept. 114-848, https://www.congress.gov/congressional-report/114th-congress/house-report/848/1 (accessed May 7, 2018).

classified information is being, or may have been, disclosed in an unauthorized manner to a foreign power or an agent of a foreign power,” and is typically used to refer to the FBI a loss or unauthorized disclosure of classified information. The IC

IG referred the matter to the FBI “for any action you deem appropriate.”

1. FBI’s Decision to Open a Criminal Investigation

On July 10, 2015, the FBI Counterintelligence Division opened a criminal investigation in response to the 811 referral from the IC IG. Although only a small percentage of 811 referrals result in criminal investigations, witnesses told the OIG that a criminal investigation was necessary to determine the extent of classified information on former Secretary Clinton’s private server, who was responsible for introducing the information into an unclassified system, and why it was placed there. The FBI gave the investigation the code name “Midyear Exam,” choosing it from a list of randomly generated names.

The FBI predicated the opening of the investigation on the possible compromise of highly sensitive classified secure compartmented information (SCI). One of the Midyear case agents told us that the Midyear investigative team was focused at the outset on the “potential unauthorized storage of classified information on an unauthorized system and then where it might have gotten [sic] from there.” A Department prosecutor assigned to the investigation similarly described the scope of the investigation as “related to the email systems used by Secretary Clinton, and whether on her private email server there are individuals who improperly retained or transmitted classified information.”

The FBI designated the Midyear investigation as a Sensitive Investigative Matter (SIM). According to the DIOG, a SIM includes “an investigative matter involving the activities of a domestic public official or domestic political candidate (involving corruption or a threat to the national security)” as well as “any other matter which, in the judgment of the official authorizing an Assessment, should be brought to the attention of FBI [Headquarters] and other DOJ officials.” FBI witnesses told us that the SIM designation is typically given to investigations involving sensitive categories of persons such as attorneys, judges, clergy, journalists, and politicians, and that that SIM investigations are overseen more closely by FBI management and the FBI Office of General Counsel than other investigations.

The Midyear investigation was opened with an “Unknown Subject(s) (UNSUB),” andat no time during the investigation was any individual identified by the FBI as a subject or target of the investigation, including former Secretary Clinton. FBI witnesses told us that the “UNSUB” designation is common and means that the FBI has not identified a specific target or subject at the outset of an investigation. According to FBI witnesses, this allowed the FBI to expand the focus of the investigation based on the evidence without being “locked into a particular subject.” With respect to the Midyear investigation, witnesses told the OIG that the FBI did not identify anyone as a subject or target during the investigation because it was unclear how the classified material had been introduced to the server and who was responsible for improperly placing it there.

Despite the UNSUB designation, witnesses told us that a primary focus of the Midyear investigation was on former Secretary Clinton’s intent in setting up and using her private email server. An FBI OGC attorney assigned to the Midyear team (FBI Attorney 1) told the OIG, “We certainly started looking more closely at the Secretary because they were her emails.” Randall Coleman, the former Assistant Director of the Counterintelligence Division, stated, “I don’t know [why] that was the case, why it was UNSUB. I’m really shocked that it would have stayed that way because certainly the investigation started really kind of getting more focused.”

In his OIG interview, Comey described former Secretary Clinton as the subject of the Midyear investigation and stated that he was unaware that the investigation had an UNSUB designation. Similarly, in his book, Comey referred to former Secretary Clinton as the subject of the Midyear investigation, stating that one question the investigation sought to answer was what Clinton was thinking

“when she mishandled that classified information.”50

1. Initial Briefing for the Department

On July 23, 2015, Coleman and then Deputy Director Mark as’ met with Deputy Attorney General (DAG) Sally Yates and Principal Associate Deputy Attorney General (PADAG) Matt Axelrod to brief them on the opening of the Midyear investigation. According to Coleman, he and Giuliano told Yates and Axelrod why the Midyear investigation was opened and laid out their vision of how the investigation would be conducted, including that the FBI planned to run the investigation out of headquarters.

Yates recalled being briefed by Giuliano and Coleman at the beginning of the Midyear investigation, but said that she did not recall having concerns about the information they presented at the meeting or remembering anything significant about it. Axelrod told the OIG that Giuliano and Coleman showed them a copy of the 811 referral that the FBI had received, and either showed them or told them about some of the emails that had been identified as potentially classified. Axelrod stated:

That, my recollection is that the way they explained it was that review of the certain emails contained on the personal server that Secretary Clinton had been using showed that some of those emails contained classified information. And so that, and that they, one of the things that was sort of standard practice when there was classified information on non-classified systems was that a review needed to be done to sort of contain the, I think the word they use in the [intelligence] community is a spill…. The spill of classified information out into sort of [a] non-classified arena. And so that they needed to, this was a referral so that the Bureau could help contain the spill and identify if there was classified information on non-classified systems so that that classified information could be contained and either, you

50 JAMES COMEY, A HIGHER LOYALTY: TRUTH, LIES, AND LEADERSHIP at 162 (Amy Einhorn, ed., 1st ed. 2018).

know, destroyed or returned to proper information handling

mechanisms.

Asked whether he considered the Midyear investigation to be criminal as of the date of this initial briefing, Axelrod replied, “Not in my view.” According to Axelrod, “it was some time…before I, at least I understood that it had morphed into a criminal investigation.”

The prosecutors and career Department staff assigned to the Midyear investigation told us that they considered it a criminal investigation from early on. Deputy Assistant Attorney General (DAAG) George Toscas, who was the most senior career Department official involved in the daily supervision of the investigation, told us that he approached it as a criminal investigation from the beginning of NSD’s involvement. Prosecutors 1 and 2, both of whom were assigned to the investigation by late July 2015, understood that it was a criminal investigation from very early in the investigation. Prosecutor 1 told us, “I mean, pretty quickly this seemed like a, a criminal investigation…. [I]t looked, looked and it smelled like a criminal investigation to me.”

1. Staffing the Midyear Investigation

1. FBI Staffing

The Midyear investigation was conducted by the FBI’s Counterintelligence Division. For the first few weeks, the investigation was staffed by FBI Headquarters personnel and temporary duty assignment (TDY) FBI agents. Thereafter, FBI management decided to run the investigation as a “special” out of FBI Headquarters. This meant that the investigation was staffed by counterintelligence agents and analysts from the FBI Washington Field Office (WFO) who were temporarily located to headquarters and received support from headquarters personnel. FBI management selected WFO personnel based on WFO’s geographic proximity to headquarters and its experience conducting sensitive counterintelligence investigations. FBI witnesses told us that previous sensitive investigations also had been run as “specials,” and that this allowed FBI senior executives to exercise tighter control over the investigation.

There were approximately 15 agents, analysts, computer specialists, and forensic accountants assigned on a full-time basis to the Midyear team, as well as other FBI staff who provided periodic support. Four WFO agents served as the Midyear case agents and reported to a WFO Supervisory Special Agent (“SSA”). Several FBI witnesses described the SSA as an experienced and aggressive agent, and the SSA told us that he selected the “four strongest agents” from his WFO squad to be on the Midyear team.

The SSA reported to Peter Strzok, who was then an Assistant Special Agent in Charge (ASAC) at WFO.51 Comey and Coleman told us that Strzok was selected to lead the Midyear investigative team because he was one of the most experienced and highly-regarded counterintelligence investigators within the FBI.

There were also several analysts on the Midyear team. Some analysts assigned to Midyear were on the review team, which reviewed and analyzed former Secretary Clinton’s emails. These analysts reported to a Supervisory Intelligence Analyst, who in turn reported to the Lead Analyst. FBI witnesses, including Coleman, told us that the Lead Analyst was highly regarded within the FBI and very experienced in counterintelligence investigations. Other analysts were on the investigative team, which assisted the agents with interview preparation and performed other investigative tasks. These analysts reported to the SSA and Strzok, in addition to reporting directly to the Lead Analyst. Several analysts were on both the review and investigative teams.

Until approximately the end of 2015, the Lead Analyst and Strzok both reported to a Section Chief in the Counterintelligence Division, who in turn reported to Coleman for purposes of the Midyear investigation.52 The remainder of the reporting chain was as follows: Coleman to John Giacalone, who was Executive Assistant Director (EAD) of the National Security Branch; Giacalone to DD Giuliano; and DD Giuliano to Director Comey.

During the course of the investigation, some FBI officials involved with the Midyear investigation retired or changed positions. In late 2015, Coleman became the EAD of the FBI Criminal, Cyber, Response, and Services Branch and was no longer involved in the Midyear investigation. At the same time, E.W. (“Bill”) Priestap replaced Coleman as AD of the Counterintelligence Division. EAD Giacalone and DD Giuliano retired from the FBI in early 2016 and were replaced by Michael Steinbach and Andrew McCabe, respectively.

In addition, Lisa Page, who was Special Counsel to McCabe, became involved in the Midyear investigation after McCabe became the Deputy Director in February 2016. Page told the OIG that part of her function was to serve as a liaison between the Midyear team and McCabe. Page acknowledged that her role upset senior FBI officials, but told the OIG that McCabe relied on her to ensure that he had the information he needed to make decisions, without it being filtered through multiple layers of management. Several witnesses told the OIG that Page circumvented the official chain of command, and that Strzok communicated important Midyear case information to her, and thus to McCabe, without Priestap’s or Steinbach’s knowledge. McCabe said that he was aware of complaints about Page, and that he valued her ability to “spot issues” and bring them to his attention when others did not do so.

51 Strzok was promoted to a Section Chief in the Counterintelligence Division in February 2016, and to Deputy Assistant Director (DAD) in the fall of 2016.

52 A Deputy Assistant Director in the Counterintelligence Division was between the Section Chief and Coleman in the reporting chain but had limited involvement in the Midyear investigation.

The FBI Office of General Counsel (OGC) assigned FBI Attorney 1, who was a supervisory attorney in the National Security and Cyber Law Branch (NSCLB), to provide legal support to the Midyear team. A second, more junior attorney (FBI Attorney 2) also was assigned to the Midyear team. FBI Attorney 1 reported to Deputy General Counsel Trisha Anderson, who in turn reported to then General Counsel James Baker.53

Figure 3.1 describes the FBI chain of command for the Midyear investigation. This figure does not include intervening supervisors who had limited involvement in the investigation.

53 Anderson now is the Principal Deputy General Counsel.

Figure 3.1: FBI Chain of Command for the Midyear Investigation

i

Deputy Director Special Counsel

Andrew McCabe Lisa Page

(February 2016-March 2018) (February 2016•

Mark Giuliano

March 20 18)

(November 2013-January 2016)

I

NSB EAD

Michael Steinbach

(February 2016-February

2017)

John Giacalone

(July 2015-February

2016)

t

AD Counterintelligence

Division (CD)

E.W. “Bill” Priestap

(January 2016-Present)

Randy Coleman

(May 2014-December

2015)

Agent Lead

Pete Strzok

f

Supervisory

Special Agent

t

Agents

1. Department Staffing

Within the Department, the Midyear investigation was primarily handled by the Counterintelligence and Export Control Section (CES) of the National Security Division (NSD), with support from two prosecutors in the United States Attorney’s Office for the Eastern District of Virginia (EDVA). All of the prosecutors assigned to the Midyear team had significant experience handling national security investigations or white collar criminal cases.

The lead prosecutor (Prosecutor 1) was a supervisory attorney in CES.

Prosecutor 1 told us that he selected the “best” nonsupervisory line attorney within

CES (Prosecutor 2) to handle the Midyear investigation with him. The two CES prosecutors reported directly to the Chief of CES, David Laufman, who in turn reported to DAAG George Toscas. Toscas was the highest level career Department employee involved in the Midyear investigation, and the prosecutors and supervisors below him who were involved in the Midyear investigation were also career employees. As described in more detail below, Department officials above Toscas, including then Assistant Attorney General (AAG) John Carlin, Axelrod, Yates, and Lynch, received briefings about the Midyear investigation but were not involved in its day-to-day management.

In August 2015, EDVA was brought into the Midyear investigation. EDVA assigned two supervisory attorneys to work with the CES prosecutors: Prosecutor 3 and Prosecutor 4. The role of the EDVA prosecutors initially was to facilitate the issuance of legal process, including grand jury subpoenas, search warrants, and 2703(d) orders. However, the NSD prosecutors told the OIG that ultimately they consulted and worked closely with the EDVA prosecutors on many issues and decisions throughout the course of the Midyear investigation. Prosecutor 3 similarly told us that as the investigation progressed, he and Prosecutor 4 were considered “equal partners” with the NSD prosecutors.

EDVA senior leadership, including then U.S. Attorney Dana Boente, received briefings on the Midyear investigation from the EDVA prosecutors and were informed of significant developments, but they were not involved in investigative decisions. Axelrod told the OIG that he recalled that he spoke to Boente early in the Midyear investigation and “let[] them know that this was NSD’s investigation.” Axelrod stated:

[S]ometimes when you have a U.S. Attorney’s office and a Main Justice component, you know, things have to go up two chains and…that’s cumbersome…. [I]n…an investigation like this we figured it was easier just to have everything centralized in NSD. There’sa reason why NSD has the ticket on, you know, all these matters, right? They’re the subject matter experts[.]

Axelrod explained that NSD has primary responsibility for counterterrorism and counterintelligence cases not only because it has subject matter expertise in those areas, but also because those cases are nationwide. He stated that there are certain areas of law where it is important to ensure nationwide consistency in how the law is applied, because if “one district does something really different than another district it can have very bad…ramifications or consequences.” As noted previously, the USAM requires NSD to expressly approve in advance charges involving certain national security statutes, including those that were considered in this investigation.

Prosecutor 2 stated that NSD’s typical role varies from case to case, and depends on the resources and experience of the specific U.S. Attorney’s Office. This prosecutor told the OIG that NSD typically “drives” counterintelligence cases, but that its role “runs the gamut” from taking the lead on cases to playing a supporting role. Prosecutor 2 stated that EDVA has been more willing to allow NSD attorneys to play an active role in charged cases and is “very open to [NSD’s] partnership and support.”

Prosecutor 3 similarly told the OIG that EDVA’s supporting role in the Midyear investigation was unusual, but he attributed this to logistics. This prosecutor stated, “[Prosecutors 1 and 2] were right across the street from FBI Headquarters…. [I]t was pretty work intensive, more so for them because they would have to go over there at the drop of a hat for meetings. You know, we were always kept in the loop of what was going on. But [the] FBI kept a pretty tight hold of the classified documents.” Prosecutor 3 also said that running the case out of NSD, supervised by Toscas, allowed the Department to keep “one central location of control by a career person over the investigation.”

Several witnesses told us that the FBI was frustrated at the perceived slow pace of bringing a U.S. Attorney’s Office into the Midyear investigation. However, Toscas told us that it is not unusual for a U.S. Attorney’s Office not to be involved in the beginning of an investigation, and that it took some time to determine the proper venue and select the most appropriate U.S. Attorney’s Office. Prosecutor 1 told us that although the U.S. Attorney’s Office for the District of Columbia also was considered, EDVA was selected in part based on the good historical working relationship between NSD and EDVA.

Boente told the OIG that he expressed concerns that EDVA was not the appropriate district given that former Secretary Clinton lived in New York. He said that they potentially could establish venue through an email server or victim agency server located in EDVA, but that it would be unusual to select venue to prosecute a high-profile public figure on that basis. Boente said that while no one explained why the Department chose EDVA, he assumed that it was because “we move quicker and do things a lot quicker than some districts can.”

III. Role of Senior FBI and Department Leadership in the Investigation

1. FBI Leadership

The Midyear investigation was closely supervised by FBI leadership from the outset. Comey told the OIG that he received frequent briefings on the Midyear investigation: And then once it got underway, either in July or maybe in August [2015], I told them I wanted to be briefed on it on a much more frequent basis then I would normally on a case because I was keen to make sure that they had the resources they need and that there was no—that I could both support them if they needed additional things and protect them in the event anybody outside of the investigative team tried to monkey with them in any way or exert any pressure on them or anything like that. Because I could see immediately how significant the matter was…. So I think they got into a rhythm of briefing me maybe every couple of weeks.

Comey said that briefings took place roughly every two to three weeks at the beginning of the investigation, and occurred on a weekly basis as the investigation progressed.

Comey said that the Midyear briefings typically were attended by a core team of senior officials:

• The Deputy Director (Giuliano, then McCabe);
• Comey’s Chief of Staff, James Rybicki;
• FBI OGC personnel including Baker, Anderson, and FBI Attorney 1;
• The EAD of the National Security Branch (Giacalone, then Steinbach);
• The AD of the Counterintelligence Division (Coleman, then Priestap);
• Deputy Director McCabe’s counsel, Lisa Page (beginning in February

2016); and

• Strzok and the Lead Analyst.

Other FBI officials periodically attended these briefings, including then Associate Deputy Director (ADD) David Bowdich after his appointment in April 2016, but witnesses told us that briefings were carefully controlled and limited to a select group of senior FBI managers.

Comey said that the Midyear team typically produced a biweekly or weekly written summary of their progress in the investigation, and that briefings generally focused on what the team had completed and what needed to be done. Comey stated, “[T]he way it tended to break down is [the Lead Analyst] would talk about exploitation of media and sorting through emails and things. And Pete [Strzok] would focus on investigative steps, interviews, things like that.” Comey told the OIG:

[I]t would typically be here in the [Director’s] conference room at the table and they would give me a progress report on where they were and I would typically ask the questions that were rooted in my interest in it to begin with which is— do you have the resources you need? Any problems that I can help you with? I just felt the need to stay close to it[.]

As described in more detail in Chapter Six, the same officials were involved in discussions about whether to do a public statement announcing the closing of the Midyear investigation. Comey characterized these discussions as “great family conversations,” stating that he was a great believer in oppositional argument and encouraged people to bring up different points of view.

In addition to the Midyear-specific meetings, Comey and the Deputy Director (first Giuliano, then McCabe) had daily morning and late afternoon meetings about significant developments or issues that were impacting the FBI. The Midyear investigation was sometimes discussed immediately following these meetings in “sidebar” meetings involving a smaller group of participants due to the sensitivity of the investigation.54

As the result of these frequent briefings, Comey and McCabe knew about and were involved in significant investigative decisions. McCabe stated:

[Comey] relied on me for kind of my advice and recommendation on those decisions. But he was very involved in the decisions on Midyear…. Not decisions like what time is the interview with John Jones going to take place tomorrow, but…we think we should serve a subpoena on so-and-so for these records, and the Department of Justice is saying no, we want to try to work it out with a letter. And so…as that conflict was brewing, he would learn about it and weigh in on it and not necessarily decide it. But he was up-to-speed on all of the kind of significant things that were happening in the case.

McCabe told the OIG that although Strzok and Priestap made the day-to-day investigative decisions, he and Comey were informed about any problems that arose during the investigation, as well as any significant information that the team discovered.

As described in more detail in Chapter Five, our review found examples where Comey or McCabe approved or directed specific investigation decisions. These included directing the Midyear agents to deliver a preamble at the first interview of Cheryl Mills about the need to answer questions about the process used to cull former Secretary Clinton’s personal and work-related emails, without informing the prosecutors; authorizing Baker to contact Beth Wilkinson, counsel to Mills and Samuelson, again without telling the prosecutors; approving the consent and immunity agreements used to obtain the Mills and Samuelson laptops; and not prohibiting Mills and Samuelson from attending the interview of former Secretary Clinton as her counsel.

54 Other senior FBI officials involved in the Midyear investigation received additional briefings as needed. The Deputy Director, EAD, and AD met on a daily basis regarding significant matters affecting the Counterintelligence Division, and these meetings at times included significant developments in the Midyear investigation. McCabe said he was briefed when issues arose. In addition, the Lead Analyst and Strzok briefed Giacalone on the Midyear investigation on a weekly basis.

1. Department Leadership

Unlike the FBI’s senior leadership, senior Department officials played a more limited role in the Midyear investigation. Although Lynch, Yates, Axelrod, and Carlin described making a conscious decision to allow the career staff to handle the Midyear investigation with minimal involvement by political appointees, they also told us that their involvement was consistent with their normal role in criminal investigations.

Lynch

Lynch told the OIG that she received limited briefings on the Midyear investigation. She explained that the Midyear investigation was not discussed at her morning meetings or staff meetings because it was a sensitive matter and involved potentially classified information. Lynch said that she had a monthly meeting with NSD, and that although the Midyear investigation was too sensitive to

discuss during that meeting, afterward the meeting would “skinny down” to discuss

sensitive cases among a smaller group of people that included Yates, Axelrod, Carlin, Toscas, and sometimes members of her staff. She said that the cases discussed among this smaller group included not only the Midyear investigation, but also other sensitive counterterrorism and classified cases.

Lynch said that she understood that there were political sensitivities inherent in the Midyear investigation, and she wanted to protect the Midyear team from perceived pressure from Department leadership. She stated:

Because we knew that it was going to be scrutinized, we wanted to make sure that not only was the team supported, but they also were insulated from a lot of people talking about it and just discussing it in general throughout the office…. And so, my view was that unless you need me for something, you know, I don’t want to be on top of the team for this. They, they should work as they always work. They should know that [they have] whatever they need to have, whatever resources they need to get. But the Front Office is not, you know, breathing down their neck on this.

Asked whether there was ever a conscious decision by the political appointees to step back and allow the career employees to handle the investigation, Lynch replied:

Certainly it was my view, and I can’t recall having discussions about that. But that was how I viewed the setup, was that we wanted to make sure that this was always handled by the career people, and that essentially even though they would need input, and certainly toward the end of anything you’d have to make certain decisions. But not to have, at least certainly from…the fifth floor level where I was, not to have that kind of input early on. Although I typically wouldn’t have had input…in the inner workings of an investigation.

Lynch said that Toscas was the most senior career Department official involved in making decisions about the Midyear investigation, and that she had faith and confidence in his ability to handle the case.

Lynch explained that she was not involved in the day-to-day investigative decisions about how to staff the investigation, what witnesses to interview, or any

of the other “things that [she] used to do as a line [Assistant U.S. Attorney (AUSA)].” Nor did she intervene in conflicts between the prosecutors and agents.

She told the OIG that this was not unique to the Midyear investigation but rather represented her standard practice, stating:

[M]y view is that…whoever is, is leading the team needs to deal with that initially because they’ve got to keep working with each other. And based on my experience as an AUSA, if you can resolve it at that level first, you will have a team that is, is, is more solid and can work together more easily. If not, then I think the, the next level supervisor has got to be involved in that…. [M]y view is that the chain of command is set up is there for that reason.

But I wouldn’t, if someone said to me the agents want to interview this person, and the prosecutors don’t, my first question before I got involved would be to say what do the supervisors think? Because if, if I as AG, or even as U.S. Attorney immediately step in and make that decision, then what I’ve done is I may have solved a problem, but I’ve cut the knees off of every supervisor in between me and them. And, and that creates bigger problems down the road.

Lynch said her view was that problems or conflicts should not be elevated to the Attorney General unless the parties had exhausted all other remedies.

Yates and Axelrod

Yates told the OIG that although Department leadership understood the

significance of the Midyear investigation, they agreed that it should be handled like

any other case. She said that the role of Department leadership in the Midyear

investigation represented their normal approach to criminal investigations, stating:

[L]ook, we got the sensitivity of this matter obviously even from the beginning. And I remember we wanted to make certain that NSD had all the resources that they needed, that they were on top of it. That we stayed briefed on what was going on but from the very beginning it was important to us for this to be handled like any other case would be handled. That we wanted to make sure that the line prosecutors and lawyers who were doing this didn’t feel like they had the leadership office breathing down their neck because that’s going to put a layer of pressure on them that is not appropriate we felt like here. So it was important to us for NSD to be handling the day to day aspects of this. But at the same time we wanted to make sure that they were getting what they needed. And that we were staying apprised of significant developments in it….

Not only doing it the right way but making sure that we did this, that it had the appearance of doing it the right way too. And public confidence was going to be important. We knew that from the very beginning. And that we wanted to make sure that we had a process in place that was going to be the right process. And that would be for NSD to handle the day to day aspects of it. And so we had [that] conversation. You know, the DAG’s office is really sort of more the operational one between the two leadership offices. And so I certainly had conversations with the AG about how we set this up and we’re running it. But again, there was no real dispute with anybody about this. This seemed like the natural and right way to do things….

Asked whether her role in the Midyear investigation differed at all from her usual process, Yates replied:

Every other case is not on the radar screen of…[the] DAG, obviously. But this was a significant matter for the Department that was one of those small handful of cases that how you do it can be defining for the Department of Justice…. And we were very aware of that from the very beginning. So when I say we were handling it like any other case what I mean is that we wanted to ensure that the factors that went into a decision about how we should proceed in that matter and how, the kind of latitude that the line people were handling had to do it in that matter, that that should be done like any other case. Nobody should get any special treatment. Nobody should be treated more harshly…because of who they were. That’s what I mean it should be like any other case. But we weren’t stupid. I mean, we recognized that the profile and import of this matter was such that we needed to make sure that things were done correctly.

Yates explained that the DAG typically gets involved in an investigation from a decisionmaking standpoint if there is disagreement between one of the Department’s litigating components and another government agency, or between a Department component and a U.S. Attorney’s Office, or if there is “real uncertainty” about whether to take a potential investigative step. She stated,“Normally the DAG’s office is not running an investigation and we weren’t running this one.”

Yates told the OIG that she received more frequent updates on the Midyear investigation than she did on other cases, attributing this to the profile and time sensitivity of the investigation. Yates told the OIG that it was hard to generalize how frequently she received updates, but that she had regular meetings with NSD every other week. Although the Midyear investigation was not discussed with the larger group present during these meetings, afterward they would “skinny down” to a smaller group to discuss sensitive matters, including the Midyear investigation. This smaller group included Carlin, Toscas, and Mary McCord, who was at the time the Principal DAAG in NSD. Yates said that she also participated in Lynch’s regular meetings with NSD, which would similarly “skinny down” at the end.

The NSD and EDVA prosecutors told the OIG that they were concerned at various points during the Midyear investigation that there was a disparity between the involvement of Department and FBI leadership in discussions about investigative steps. For example, while McCabe (the second in command at the FBI) attended meetings at which the Midyear agents and prosecutors debated whether and how to obtain the Mills and Samuelson laptops, the highest ranking official representing the Department’s position at those meetings was Toscas. Asked whether she was informed of these concerns, Yates told the OIG that she was not. She said that she was not aware that McCabe attended meetings with the Midyear prosecutors, nor did she know that Comey was closely involved in the investigation. Yates stated that she spoke to McCabe regularly about various issues, and that she thought he was “relaxed enough” with her to tell her that she needed to be at any meetings. Yates said that any disparity resulted from the unusually high level of involvement by FBI leadership, not a decreased role by Department leadership.

Axelrod similarly told the OIG that at the outset of the Midyear investigation, senior Department officials “made efforts to…set up a structure that would maintain the integrity of this matter.” He explained that they were aware that no

matter how the investigation turned out, there was likely to be criticism at the end.

As a result, he said that they considered it “extra important to make sure things

were…done…by the book, following procedures. Making sure that when people criticize[d] whatever the outcome was that we’d be able to say no, this was done straight down the middle on the facts and on the law.”

Axelrod said that he met with Toscas at the outset of the investigation and explained that Toscas would be the primary supervisor over the investigation. Axelrod stated:

[W]e were going to have sort of a lighter touch from the leadership offices than we might on a sort of high profile case. In other words, we were there for him for whatever he needed. But we weren’t going to be sort of checking in day to day or week to week for updates or briefings. When…something significant happened…that we needed to know about he would let us know….

And I, when I say a lighter touch I don’t mean that folks weren’t engaged or paying attention. I, not at all. I just mean we wanted to give them the space they needed to do whatever they thought necessary in the investigation. So that at the end…I just wanted to make sure that any allegation that there was some sort of political interference with this investigation wouldn’t hold water.

Axelrod told the OIG that the difference between the role of Department leadership in the Midyear investigation and the typical high-profile investigation was “just a matter of degree.” He said that he and Yates relied on Toscas to bring issues to their attention at “skinny down” sessions following the biweekly meetings with NSD, but that “it wasn’t us saying okay, and what’s the latest on the email investigation?”

Carlin

Carlin told the OIG that NSD’s standard practice is for cases to be handled by the career staff, supervised by a DAAG. He said that at the beginning of the Midyear investigation, he held a meeting with McCord, Toscas, and the NSD

prosecutors in which he emphasized the need to “go more by the book” and to

follow the normal procedure. Carlin said that he wanted one person in the NSD Front Office to be in charge of the Midyear investigation, and that he chose Toscas

based on his historical expertise with investigations involving “espionage, the straight-up a spy [cases], and the leak mishandling type portfolio.”

Carlin said that he preferred having one person who was clearly accountable and in charge. He stated:

I tend to like that as former career person…I knew what it felt like when you’re in one of those spots. So, in general, I prefer that type of structure. In this case, I knew, as well, at the end of the day, whatever decision was made in the case, it was going to be a high-profile controversial decision. And so…you might need to explain later what process do we follow at the Department. And so, I wanted to make that clear, internally and to our partners, that this was the process we were following…at the National Security Division.

And just, seeing some other cases in my career that were, they were high profile. They were handled in a way than was different than the norm. More people got involved in trying to make the day-to-day decisions. I didn’t think that that redounded to the benefit of the case. Not just for appearance purposes, but…it also just created confusion and frustration among the relevant teams. And kind of, inconsistencies in how they were staffed, sometimes, when someone had a great idea later, and came in over the top, and changed the way they were approaching the case. So, right from the beginning, I wanted to, to set it up, and structure…it that way. I felt pretty strongly about it.

Carlin said that he discussed this with Lynch and Yates and made it clear to them that the team had the authority to make investigative and prosecutorial decisions. Carlin said that he told Lynch and Yates that “like other sensitive matters, we would periodically update them.” According to Carlin, Lynch and Yates knew that this was how Carlin was handling the investigation and supported this structure. Carlin said that he also explicitly communicated this to the FBI, explaining it to both Giacalone and McCabe.

1. Investigative Strategy

The Midyear team sought to determine whether any individuals were criminally liable under the laws prohibiting the mishandling of classified information, which are summarized in Chapter Two. To do so, the team employed an investigative strategy that included three primary lines of inquiry: collection and examination of the emails that traversed former Secretary Clinton’s servers and other relevant evidence, interviews of relevant witnesses, and analysis of whether classified information was compromised by hostile cyber intrusions.55

1. Collection and Examination of Emails that Traversed Clinton’s Servers and Other Relevant Evidence

The Midyear team sought to collect and review any emails that traversed Clinton’s servers during her tenure as Secretary of State, as well as other evidence that would be helpful to understand classified information contained in those emails. This included a review of the 30,490 work-related emails and attachments to those emails that former Secretary Clinton’s attorneys had produced to the State Department.

The team also attempted to recover or reconstruct the remaining 31,830 emails that Clinton’s attorneys determined were personal and did not produce to the State Department. As described above and in Chapter Five, before the Midyear investigation began, these emails had been deleted and “wiped” from former Secretary Clinton’s then current server. The Midyear team also believed that some work-related emails could have been deleted from Clinton’s servers before her attorneys reviewed them for production to the State Department.

The Midyear investigators sought to recover and review deleted emails by obtaining and forensically analyzing, among other things, Clinton’s servers and related equipment; other devices used by Clinton, such as Blackberries and cellular telephones; laptops and other devices that had been used to backup Clinton’s emails from the server; and the laptops used by Clinton’s attorneys to cull her personal emails from her work-related emails. The team also obtained email content or other information from the official government or private email accounts of certain individuals who communicated with Clinton by email, originated the classified email chains that were ultimately forwarded to Clinton, or transferred Clinton’s emails to other locations.

As described in Chapter Five, the Midyear team did not seek to obtain every device or the contents of every email account that it had reason to believe a classified email traversed. Rather, the team focused the investigation on obtaining Clinton’s servers and devices. Witnesses stated that, due to what they perceived to be systemic problems with handling classified information at the State Department, to expand the investigation beyond former Secretary Clinton’s server systems and devices would have prolonged the investigation for years. They further stated that the State Department was the more appropriate agency to remediate classified spills by its own employees.

Analysts examined both the original 30,490 emails produced by former Secretary Clinton to the State Department and the emails recovered through other

55 This section does not contain an exhaustive list of investigative efforts in the Midyear

investigation, but rather is intended to be an overview of the Midyear team’s investigative strategy.

We discuss the specific investigative steps used during the Midyear investigation in Chapter Five.

means to identify potentially classified information. Once the analysts identified information that they suspected to be classified, the team sought formal classification review from government agencies with equities in the information. The analysts also examined the emails for evidence of criminal intent. For example, they searched for:

• Classification markings to assess whether participants in classified email chains were on notice that the information contained in them was classified;
• Statements by former Secretary Clinton or others indicating whether Clinton used private servers for the purpose of evading laws regarding the proper handling of federal records or classified information;
• Statements by former Secretary Clinton or others indicating whether they knew that emails contained information that was classified—even if they were not clearly marked—when they sent or received them on unauthorized systems;
• Evidence as to whether former Secretary Clinton or others forwarded classified information to persons without proper clearances or without the need to know about it; and
• Documentation showing whether originators of classified emails had received classified information in properly marked documents before transferring the information to unclassified systems without markings.

1. Witness Interviews

The Midyear team told us that witness interviews covered several areas of investigative interest. First, the team interviewed individuals involved with setting up and administering former Secretary Clinton’s servers to understand her intent in using private servers and to assess what measures they used to protect the servers from intrusion. These witnesses also helped FBI analysts understand the server structures to inform subsequent analyses. Additionally, they helped FBI investigators identify additional sources of evidence, such as devices containing backups of Clinton’s emails.

Second, the Midyear team interviewed individuals who introduced, transmitted, or received information on unauthorized systems, including the originators of classified information, Clinton’s aides who forwarded the originators’ emails to her, and Clinton herself. The originators included State Department employees and employees of other government agencies. The team interviewed these witnesses to, among other things, assess: (1) whether they believed the information contained in the emails was classified; (2) how or from where they originally received the classified information (and whether based on those circumstances they should have known that the information contained in the emails was classified); and (3) why they sent the information on unclassified systems.

Third, the Midyear team interviewed individuals with knowledge of how and why 31,830 of former Secretary Clinton’s emails were deleted from her servers and other locations. The team sought to assess whether Clinton or her attorneys deleted or directed the deletion of emails for an improper purpose, such as to avoid FOIA or Federal Records Act (FRA) requirements.

Fourth, the Midyear team interviewed State Department employees with knowledge of the State Department’s policies and practices regarding federal records retention. The team sought to determine whether Clinton’s use of a private server was sanctioned by the State Department, as well as what measures the State Department put in place to protect Clinton’s private server from intrusion.

1. Intrusion Analysis

The FBI also conducted intrusion analyses to determine whether any classified information had been compromised by domestic hostile actors or foreign adversaries. Agents and analysts specializing in forensics examined the servers, devices, and other evidence to assess whether unauthorized actors had attempted to log into, scan, or otherwise gain access to the email accounts on the servers and, if so, whether their efforts had been successful. They also examined various FBI datasets to assess whether emails containing classified information had been compromised.