Newly Declassified DOJ Watchdog Report Shows FBI Cut Corners in Clinton Email Investigation
I'm archiving "Clinton annex" here to make its text searchable. You can download the annex in PDF format via the link below:
Check my other posts for the previous parts. This is part 3.
(redacted) The data on the first five thumb drives has been queried three times since (redacted). In early 2016, the FBI obtained permission from the White House Counsel and the Office of the Deputy Attorney General (ODAG) to conduct queries using keywords associated with (redacted). The authorization to conduct these queries was based on concerns that (redacted). These queries revealed that (redacted) was targeting (redacted) and the FBI subsequently sought and obtained approval to conduct a second set of queries using additional (redacted) terms. However, witnesses told us that the FBI was not permitted to review any victim data during these searches, meaning that the FBI was unable to review any potential U.S. government communications, including those referencing information about (redacted) that might be in the possession of the Russian government.
(redacted) During the (redacted) searches, FBI analysts used a program to create a "word cloud" of words extracted from U.S. victim content on the first five thumb drives, which they refer to as the "index."2 In August 2017, an FBI OGC attorney granted permission to an FBI analyst to query this index using terms relevant to the Special Counsel investigation being conducted by Robert Mueller III. The OIG was told that the FBI analyst viewed the authorization to conduct these queries as an opportunity to see what was on the first five thumb drives, and to show FBI and Department leadership the value of the information. The additional queries conducted by this employee included "Clinton," which returned (redacted) hits, and "clintonemail.com," which returned (redacted) hits. After reviewing a draft of this classified appendix, one FBI witness told the OIG that these searches likely did not comport with the review protocols approved for searches of thumb drives 6 and 7, which are briefly discussed below. We discuss these search results and the relevance of the (redacted) data to the Midyear investigation in more detail in Section IV below.
(redacted) Thumb Drives 6 and 7
(redacted) Thumb drives 6 and 7 contain (redacted) about cyber intrusions, mostly (redacted), with some U.S. victim data included as attachments. The FBI received thumb drives 6 and 7 from T1 in (redacted). FBI witnesses told us that these thumb drives have been reviewed by a filter team, subject to Department-approved protocols that prohibit the review of any exfiltrated content from EoP, the State Department, or Congress. These protocols allow the FBI to analyze non-victim information for foreign intelligence and evidentiary value related to (redacted) computer intrusion activity, but not to review victim communications and documents.
(redacted) Thumb Drive 8
(redacted) The FBI received thumb drive 8 from T1 in (redacted). Thumb drive 8 has never been reviewed. Its content is unknown, and was only uploaded onto an FBI system in early 2018. Several witnesses told us that they believe it contains victim data related to EoP, the State Department, and the House of Representatives, and that it may duplicate the information that is on the other thumb drives because T1 (redacted)
(redacted) One FBI witness told us that thumb drive 8 "fell through the cracks" because the FBI received it after thumb drives 6 and 7 and never added it to the memorandum requesting authorization to review them, while another witness told us that the inability to review thumb drive 8 was based on concerns that U.S. victim data from the first five thumb drives could be present.
(redacted) Post-8 Data
(redacted) In addition to the data on the thumb drives, T1 also provided to the United States Intelligence Community (USIC), including the FBI, (redacted). Referred to as "Post-8 data" or "Mission Ridge data," witnesses told us that this data consists of (redacted) as well as (redacted) reports. At the request of the USIC, T1 established filters to limit the data that is provided. FBI witnesses told us that T1 is filtering out certain victim data before providing the data to the USIC. FBI witnesses also stated that the Post-8 data is unlikely to contain data exfiltrated from EoP, the State Department, and the House of Representatives because it is from (redacted). FBI witnesses told us that they obtained approval to review the "Post-8 data" subject to review protocols that are similar to the ones used for thumb drives 6 and 7.
2 (redacted) Witnesses told us that some of the data on the first five thumb drives consists of (redacted) rather than (redacted) and thus requires manual review. As a result, the index likely does not fully account for the data present on these drives.