FEDERAL BUREAU OF INVESTIGATION POI/EA DELETED PAGE INFORMATION SHEET FOI/Pag 1253814-0 Total Deleted Page(s) = 286 Page 5 ~ Referral /Consult; Page 6 ~ Referral /Consult; Page 7 ~ Referral/Consult; Page 8 ~ Referral/Consult; Page 9 ~ Referral/Consult; Page 10 ~ Referral/Consult; Page 11 ~ Referral/Consult; Page 12 ~ Referral/Consult; Page 13 = Referral/Consult; Page 14 ~ Referral/Consult; Page 15 ~ Referral /Consult; Page 36 ~ Duplicate; Page 37 ~ Duplicate: Page 38 ~ Duplicates Page 38 ~ Duplicate; Page 53 ~ Referral/Consult; Page 54 ~ Referral /Consult; Page 55 = Referral/Consult; Page 56 ~ Referral/Consult; Page 57 ~ Referral/Consult; Page 58 ~ Referral/Consult; Page 59 ~ Referral /Consult, Page 60 ~ Referral/Consult; Page 61 ~ Referral/Consult; Page 62 ~ Referral/Consult; Page 63 ~ Referral/consult; Page 64 ~ Referral/consult; Page 68 ~ Referral /Consult; Page 66 ~ Referral/Consult; Page 67 ~ Referral/Consult, Page 68 ~ Referral /Consult, Page 68 ~ Referral/Consult; Page 70 ~ Referral/Consult; Page 71 ~ Referral/Consult; Page 72 ~ Referral/consult; Page 73 ~ Referral/consult; Page 74 ~ Referral /Consult; Page 78 ~ Referral /Consult; Page 76 ~ Referral/Consult; Page 77 » Referral/Consult; Page 78 ~ Referral/Consult; Page 78 ~ Referral/Consult; Page 80 ~ Referral/Consult; Page 81 ~ Referral/consult; Page 82 ~ Referral/consult; Page 83 ~ Referral /Consult; Page 84 ~ Referral /Consult; Page 85 ~ Referral/Consult;Page: Page Page Page Page Page Page Page Page: Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Referral /Consult; Referral /Consult; Referral/Consult; Referral /Consult; Referral /Consult; ~ Referral/Consult; Referral/Consult; Referral /Consult; Reforral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; Referral/Consult; Referral /Consult Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; ~ Referral/Consult; ~ Referral/Consult; Referral/Consult; Referral /Consult Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral /Consult; Referral /Consult; Referral/Consult; ~ Duplicate; ~ Duplicate; XNA HOH NAMEN X peleted Pageis] — % X No Duplication Fee x X Por this Page x RNKXXREREXHKXNAXEHRRRNRE,FO-1057 (Rev 5-410) a FEDERAL BUREAU OF INVESTIGATION Eloctranto Communica: Title: (U//#¥e) Opening of Full Investigation on ' pate: 07/10/2015 a Sensitive Investigative Matter (SIM) cc ra taro bs ow comnunnerentrenies BECLASeEFY ow. azcnte Contacts [ approved By: bre TERANE CARES H 2 A/an0 David W Azchey pratted By: Sora\ 5 case #:[ Neus be OISAANOTINS OF CIRSTTF 129; 8 UNKNONN SUBJECT OR COUNTRY? SENSITIVE INVESTIGATIVE MATTER (SIM) DOCUMENT RESTRICTED TO CASE PARTICIPANTS This document contains information that is vestricted to case participants. synopsis: "!-gyett) FBrHG, Countecespionage Section, is opening a full investigation based on specitic articulated facts provided by an 811 referral fron the Inspector General of the Tneelligence communicy, deted July 6, 2015 regarding the potential conpeonise of classified information. Pull Investigation Initiated: 07/10/2015 SRG / /noroneee 6 SBeKRT/ /erent Title: (U//FOUD Opening of Full Investigation on a Sensitive Investigative Matter (SIM) Ret 97/10/2015 bs : BIE Enclosure(s): Enclosed are the following items: 1. (U//Pe8e) Referral documents received from ICTG Details: WU! (gpmme) PSTHQ, Counterespionage Section, is opening a full investi gation based on specific articulated facts provided by an B11 referral from the Inspector General of the Intelligence Community (TcTs), dated July €, 2015 regarding the potential compromise of classitied information. (U//#6¥0) The purpose of this investigation is to detect, obtain information about, and protect against federal crimes or threats to the national security. The initiation of this Full Investigation is based, as per AGG-Dom I1.B.3 and DIOS Section 7.5, on activity constituting-a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur and the investigation may obtain information relating te the activity or the involvement or role of an individual, group, or organization in such activity. 3) DRAPE the ICIS referral provided 4 sample unclassified e-ail that allegedly contains information et a classified and SOt level. According to the ICIG, this e-mail was part of a larger trove of other Unclassified e-nails they were reviewing daring their ovn anvestigation. Tl dept the following documentation was provided by the ICIG and will be kept in the 1A section of the case file. 1) €11 referral letter from the ICIG dated July 6, 2015 regarding Potential Compromise of Classified Information, 2) Letter from the ICIG dated June 19, 2015 regarding Update to IC IG support to State Department IG. 3) Letter from the ICIG dated June 25, 2019 regarding Classified Material on Personal Storage Devices. 4) E-mail dated April 10, 2011 with example of potential inclusion Bee moron 2@ e “Berkey rover title: (U//Pe¥6) Opening of Full Investigation on @ Sensitive Investigative Matter (STM) Re 07/10/2015 b3 BIE of classified information contained in an unclassified e-mail. 5} Letter from Williams 4 Connolly LIP dated June 24, 2015 regarding preservation efforts related to e-mails, Hy (SPSGF) Due to the extremely sensitive nature of this investigation and the damage its disclosure could cause, the case will be designated as @ prohibited investigation in accordance with the Counterintelligence Division Polacy Implementation Guide. Author requests Assistant Director concurrence to maintain the identified case as pronibites, ‘Ui (sPySe) mis investigation is alse designated a Sensitive Investigative Matter (SIM) due to a connection to a current public official, political appointee or candidate as defined in Section 10.1.2.2.2 of the DIOG. WO) SDs¥tuF) additionaliy, an Assistant Director exemption for uploading to Sentinel is requested. Since the TCIG referral alleges classified SCI material may have been compromised, all investigative work will be conducted on SCION. As documents to the case file are added, a placeholder will be entered inte Sentinel and a serial number assigned to the document. Slectronic copies of the case serials will be stored on SCION. The physical case file documents will be stored in a locked file cabinet located 11 2 currently certified SCIP. BIE ++ Bias oon| ke ol BeSEC Department of Justice Federal Bureau of Lnvestigation In Reply, Please Refer to Washington DC, 20535 File No. July 13, 2015 (0) OPENING LHM FOR FULL INVESTIGATION ON USPER (U) Subject(s) Name: UNKNOWN SUBJECT CLASSIFIED BY: NSICG Ja7ZE5TIE w) Preliminary Investigation REASON. 14 (ch BeewasszeY cy 32-31-2060 (v) _x_- Full Investigation DATE” do-a7-20a8 _— Single subject Aut surOrwaT Ton contaniee HEREIN 13 UNCLASSTEIED BECEDT _X_ multi-sunject WeERe stoke OTMERKISE enterprise Foreign intelligence collection (0) Investigation initiated by: _ Field Office or x FBIHQ (0) FBIHQ/DOT notice via LHM required (if yes to any below): A, full on USPER B. SIM (PI or full) C. enterprise investigation < D. foreign intelligence case (U) I. Purpose of the Investigation: Check the appropriate purpose for which the investigation is being initiated, as per AGG-Dom 1.8.1 and DIOG ''6.2 and 7.2: Classifil Derived From: Declassi: 390 NSIC dated 20130301 Page 1 of 4 ‘This document contains neither recommendations nox conclusions of the £81. It is the Property of the FbIvand is loaned tp your agency: it and 4ts contents are not to be distributed outside your agency. SECRISECRET) FORN ba 8 UNKNOWN SDBIECT OR COUNTR' SENSITIVE INVESTIGATIVE MATTER bs BIE A. To detect, obtain information about, or prevent or protect against federal crimes or threats to the national security. B. To collect foreign intelligence. (Full investigations only} (U) II. Predication for the Investigation: Appropriate circumstances: Check the appropriate circumstance (s} on which the initiation of the Preliminary Investigation or Full Investigation is based, as per AGG-Dom II.B.3 and DIOG Sections 6.5 and 7.5: _X_A. (u) An activity constituting a federal crime or a threat to the national security has or may have occurred, is or may be occurring, or will or may occur and the investigation may obtain information relating to the activity or the involvement or role of an individual, group, or organization in such activity? __. 3. (U) An individual, group, organization, entity, information, property, oz activity is or may be a target of attack, victimization, acquisition, infiltration, or recruitment in connection with criminal activity in violation of federal law or a threat to the national security and the investigation may obtain information that would help to protect against such activity or threat. (0) The investigation may obtain foreign intelligence that is responsive to a Positive Foreign Intelligence Requirement, as defined in D10G Section 7.4.C. [Full investigations only] ‘U) GeAIE} FRIHQ, Counterespionage Section, is opening a full investigation based on specific articulated facts provided by an €11 referral from the Inspector General of the Intelligence Community (CIG), dated July 6, 2015 regarding the potential compromise of classified information. (0/ (#086) The purpose of this investigation is te detect, obtain information about, and protect against federal crimes or threats to the national security. The initiation of this Full Investigation is based, as per AGG-Dom 11.2.3 and D10G Section 7.5, on activity constituting a federal crime or a threat to the national security has vage 2 of 4 “SEGRED7oncONPNGEGENSECK RN et . BIE WISHANDLING OF CLASSIFTE! UNKNOWN SUBJECT OR COUNTRY; INVESTIGATIVE MATTER Bo bre or may have cccurred, is or may be occurring, or will or may occur and the investigation may obtain information relating to the activity or the involvement or role of an individual, group, or organization in such activity. Ul Da@wie) ‘the 1¢16 referral provided # sample unclassified e-mail that allegediy contains infomation at a classified and SC! level. According to the ICIG, this e-mail was part of a larger trove of other unclassified e-maila they were reviewing during their own investigation. ‘Ul PSG4H} the following documentation were provided by the ICIG and willbe kept in the 18 section of the case file. 1) 811 referral letter from the ICIG dated July 6, 2015 regarding Potential Compromise of Classified Information. 2) Letter from the ICIG dated June 19, 2015 regarding Update te IC 1G support-to State Department 1G. 3) Letter from the ICIG dated June 25, 2015 regarding Classified Material on Personal Storage Devices. 4) E-mail dated April 10, 2011 with example of potential inclusion of classified information contained in an unclassified e-mail. 5) Letter from Williams & Connolly LLP dated June 24, 2015 regarding preservation efforts related to e-mails. bi 3 SEC ‘ORN=e aa ba is) et WESHANDEING OF CLassrr ie ere OxkNoW SoBJECT_OB COUNTR’ SETS [ese MATTER bo bre bi 3 (WU) IV. Certification: The case agent and all approving personnel certify that: XA. An authorized purpose and adequate predication exist for initiating the preliminary or full investigations; The investigation is not based solely on the exercise of First Amendment activities or race, religion, national origin or ethnicity of the subject; and The investigation is an appropriate use of personnel and financial resources. (0//#686) The point of con nvestigation is be Assistant Section Chief telephone number| Pe Page 4 of @ _SECRETZIORCON/AOFORN[aia] is y a a bé BICule TEORBATTON conTAIEE “Baki moron cuss SREIN TS UNCLASSITIEG EXCEPT REASON. 14 BECUASE IRE. SHCDA OTRERWISE se DME: 30 17-2036 US. Department of Justice Federal Bureau of Investigation 8 1 Reply, Pease Refer to Fie No. 21 July 2015 To: Sally Quillian Yates Deputy Attorney General Department of Justice From: Mark F. Giuliano Deputy Director Federal Bureau of Investigation Subject: MISHANDLING of CLASSIFIED? UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) S: prsH on 13 duly 2015 and 20 Juty 2015, T verbally advised you of a Section 811(c) referral from the Inspector General of the Intelligence Community received by the FBI on 06 July 2015. The referral addressed the mishandling of classified information on the personal e-mail account and electronic media of a former high-level US Government , the PBT initiated a full investigation, n response to the referral. Two copies of the opening letterhead memorandum for the investigation are attached for the information of the Department of Justice. (0//#686) The point of contact for this investigation is Assistant Director Randall C. Coleman, Counterintelligence Division, telephone number| Mark F. Giuliano FBI, Deputy Director Derived FF fie sources Decl, y 6 91231 Seer / Aeron 1 cu: az-s1-2080 BD EY: NSICG s9TJESTS bl BIE bi BIE b6 b7c07/21/2015 [please have the DD sign these two documents. One will be provided the DAG/DOJ and the other copy will be placed in our records here at FBIHQ, Thar ALL TITORIATION CONTAINED EREIN 13 UNCLASSIFIED FATE 1o-O7=201¢ BY JE72AST98 WSICE be pre Moa. dehuieed \o “phe ‘oD & WD Colerse- 7(238IeBEREIN TS UNCLASSIFIED e ALL TUTORIATTON CONTAINED by Le BY o37985T9a WSICG 2 10) U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0002 July 27, 2018 Re: — Request for Preservation of Records | Pursuant to Title 18, United States Code Section 2703({), this letter is a formal request for the preservation of all records and other evidence in your possession regarding be] ending You are hereby requested to pr ects possession, including records stored o record, and records that may come in request until receipt of a legal court or ™ Yi of this cequest to the subscriber or any 0° request, as the FBI's investigation may! of disclosure. You are also requested not to close the account of t sted to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as 10 your actions to preserve the referenced files and records, please contact Special Agent las soon as possible and before taking any such actions, This preservation request applies to the following records and evidence: d below currently in your that includes the complete date of acknowledgment of this -d not to disclose the existence is necessary to comply with this, A All stored electronic communications and other files reflecting communications to ‘or from the requested account. B. All records and other evidence relating to the subscriber(s). customer(s), account holdex(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying be be bE bs bic be bre bE 6 breIfyou Special Agent information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of comection (e.g., telnet, ftp, http); Data transfer volume; ‘User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers 10 which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. veepe ne Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. regarding this request, please direct all inquiries to yho can be reached at Sincerely, fle ‘Charles H. Kable [V Section Chief Counterintelligence Division bs breCale gyal beALL INFORMATION cOMTAINED . MERETN TS (nICLASSTFIEC CATE 20-27-2016 a¥ seTss0Tse KeICG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 28, 2015 Re: — Request for Preservation of Records Dear Sir or Madam: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all records and other evidence in your possession regarding th [-_]pending further legal process. 1 2 3, 4 5, You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure, You arc also requested not to close the account of the subscriber, unless requested to do so by the subscriber. Uf compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and records, please contact Special Agent las soon as possible and before taking any such actions. ‘This preservation request applies to the following records and evidence: ‘A. Allstored electronic communications and other files reflecting communications to or from the requested account bre bE bé bie b7E. 6 bieIfyou have any questions regarding this request, please direct all inquiries to Special Agentf Yoho can be reached at v6 All records and other evidence relating to the subseriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in clectronic or other form; and ‘All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (eg, telnet, ftp, http); Data transfer volume; ‘User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; 6 Telephone caller idemtification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, inethod of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP cr its subsidiaries, peerr Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person oF entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. pre Sincerely, Yin $_. Charles H. Kable IV Section Chief Counterintelligence Divisiona anand Bae 8 ayae nrronsarras canaries ‘Siu ve urcuserrina jaanoa meres U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 27, 2015 Re: — Request for Preservation of Records Dear| Pursuant to Title 18, United States Code Section 2703({, this letter is a formal request for the preservation ofall records and other evidence in your possession regarding the pending further legal process. ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legat court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure, You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. Uf compliance with this request may result in a permanent or temporary termination of service 10 the accounts described below, or otherwise alert the subscriber or user of these accounts as 10 your actions to preserve the referenced files and records, please contact Special Agent Jas soon as possible and before taking any such actions. ‘This preservation request applies to the following records and evidence: A. All stored electronic communications and other files reflecting communications to or from the requested account. B. All records and other evidence relating to the subseriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of bs 7c BIE 26 BIC b6 7c TE be 7cservices the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time: Method of connection (e.g. telnet, ftp, http): Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. weeNe me Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form, have any questions regarding this request, please direct all inquiries to (eo foto can e reached Me Sincerely, YY Charles H. Kable IV Section Chief Counterintelligence DivisionrE oa bé prc % a© seston sarc Magne ae aS 2016 SY 557085798 WSICG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 27, 2015 Re: Request for Preservation of Records Dea] Pursuant to Title 18, United States Code Section 2703({), this letter is a formal sees for the preservation of all records and other evidence in your possession regatding th You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not o close the account of the subscriber, unless requested to do so by the subscriber, Uf compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and records, please contact Special Agent as soon as possible and before taking any such actions. ‘This preservation request applies to the following records and evidence: A. Allstored electronic communications and other files reflecting communications to or from the requested account. B. All records and other evidence relating to the subseriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of be BIC BIE bs bre BIE be breIfyou Special Agent ® e services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: 1. Conneetion date and time; 2. Disconnect date and time; 3. Method of connection (e.g., telnet, ftp, http); 4. Data transfer volume; 5. User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; - 6 Telephone caller idemtification records; and 7, Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the ‘connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form, have any questions regarding this request, please direct all inquiries to {oho cam be reached a »6 bre Sincerely, ‘Charles H. Kable IV Section Chief Counterintelligence Division& Le be picALL SBE INFORMATION CONTAINED HEREIN TS ONCLASSTFIEC TATE 10-31-2016 BY 97025794 WSICG cee ee United States Senate SESE com on eso SASHNETON DE ArEtOZTS July 24, 2015 VIA ELECTRONIC TRANSMISSION ‘The Honorable James B. Comey, Jr. Director Federal Bureau of Investigation 935 Pennsylvania Avenue, NW Washington, D.C. 20535 Dear Director Comey: The Inspector General of the Intelligence Community (IC) and the Inspector General of the State Department (State OIG) recently notified the FBI and several Intelligence Community agencies of a compromise of national security information in connection with Hillary Clinton's use ofa non-governmental email server while Secretary of State. Specifically, in a sample of 40 of Secretary Clinton’s emails IC identified four containing classified IC-derived information, ‘These recent revelations raise important questions about the role the Federal Bureau of Investigation (FBI) has taken and will continue to take in this matter. In addition, a notification from the IC indicates that these classified emails existed on a thumb drive and may exist on @ server. According to a briefing provided today by the IC and State O1Gs, former Secretary Clinton's personal attorney, David Kendall, was in possession of the thumb drive at the time of the notice to the FBI and other IC components. This raises very serious questions and concerns ‘fa private citizen is somehow retaining classified information, Accordingly, please explain whether Mr. Kendall had the requisite security clearance and, authorization to be the custodian of classified national security information, If not, please explain what steps the FBI has taken of plans to take to secure and prevent further dissemination of the classified information contained on the thumb drive. In addition, what steps are being taken to hold anyone in this matter accountable for unauthorized possession of classified material? Ifyou have any questions, contact Josh Flynn-Brown of my Committee Staff at (202) 224- 5225. Sincerely. Chak Charles E. Grassley Chairman Committee on the JudiciaryWe ask that this be an unclassified report, and that a classified annex be provided if necessary. Thank you for your time, and we look forward to working with you on this important matter of national security. Sincerely, | ‘Chairman Bob Corker Chairman Richard Burr Senate Foreign Relations Committee Senate Select Committee on Intelligence Governmental Affairs Committeea 6 BreALL PRT THFORUATION commamMen BERSIN £5 UNCLASSIFIED CATE ip-aa~roie BY c27JeeT94 USTCE TREY Gowny, SOUTH cAROURA wine, comuncs. anyeano Sra F ‘emote Money Congress of the Gnited States ont ctannsay sog se, wasrncron ‘LYNN WESTMORELAND, GEORGIA it iF i JM JORDAN, oko. House of Representatives NDA T SANTEE GAtroMN A Tae ora LLNS Select Committee on Benghazi TTaRiMY DUCRWORFH LU S MARTHA ROBY. ALABAMA, 1096 Longworth House Office Bullding 112" congress: Susan Bro iba Wothington .¢ 2st s 080 re 4, 120) 228-7100 SUSAINESACISUA SOS. marr oiseron http:benghazi.house.gov Stare Oaecros July 22, 2015 ‘The Honorable James B. Comey Director Federal Bureau of Investigation 935 Pennsylvania Avenue, NW Washington, DC 20535 Dear Director Comey: The House of Representatives charged and empowered the Select Committee on : Benghazi to review the events before, ducing, and after the 2012 attacks in Benghazi, Libya and Specified related matters. During the pendency of our investigation, the Committee has discovered facts suggesting the existence of issues of significant legislative and oversight concern. Inow understand 2 formal referral has been made to the Federal Bureau of Investigation by impartial officials within the Executive Branch regarding potential investigative issues flowing from some of these facts. While the Committee’s work will continue for legislative, oversight, and reform Punposes, itis important the Bureau also immediately consider whether a thorough, independent, and nonpartisan review of the matters referred to it, as well as issues attendant thereto, is Warranted. This is necessary to ensure the laws are enforced fairly, evenly, and impartially wherever the relevant facts may lead. The Bureau is in the best and most appropriate position to evaluate the complete range of counterintelligence and publie integrity equities that may be ‘implicated. Only the Bureau can accomplish this in a way that ensures public confidence in a fair, imely, and exhaustive investigation of these matters, And the Bureau is uniquely well suited to ensure this is accomplished free of any extemal factors save the facts applied assiduously to the law and devoid of either real or perceived political influence. ‘The principles at bar are particularly important with respect to counterintelligence ‘equities and the handling, retention, and ‘storage of classified information. The Department of Justice has recently epplied a consistent standard of aggressive and evenhanded investigation in cases ranging from Edward Snowden to David Petracus in order to unambiguously deter future: mishandling and disclosure. I understand significant concerns have been: referred to the Bureau in this area based on the objective assessment of an interagency review that included consultation with the officials responsible for determining what information is classified. The facts underlying this referral potentially implicate the same important interests the Department has steadfastly sought to protect in the past.Similarly, the Departement has thoroughly investigated matters relating to the handling of, evidence relevant to potential or ongoing investigations and the accuracy of representations made ‘o Congress even in sensitive national security cases. While T expect the Committee will continue to explore relevant facts and issues within its charter, the Committee is willing to Provide access to any information curently obiained during the course of our investigation that ‘may inform and instruct matters raised in the refecral. You have spoken in the past about “the reservoir of credibility and trust that is the Department of Justice” and you have stated “I am a huge believer in the rute of law, but I also believe that no one in this country is beyond the taw.” I could not agree with you more, Your ‘work is ultimately judged, as mine once was, by the blindfolded woman holding nothing but a set of scales and a sword, The evenhanded application of the law and the dogged, impartial pursuit of the facts are the hallmarks of justice. Lhope you will carefully consider these matters. They are outside the purview of what our Committee has been asked to do, but clearly within the four comers of what you have been asked to do. Sinoggely, Ley, rowdy Chairman cc; The Honorable John Boehner Speaker of the House ‘The Honorable Elijah Cummings Ranking MemberbieALL INFORIATICH CONTAINED HEREIN Ts UNCLASSIFIEE DATE 10-s1-2015 BY sa7eSTS4 NETCC U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 July 27, 2015 Steve Linick Inspector General U.S. Department of State Room 8100, $A-3 2201 C Street, N.W. ‘Washington, DC 20520-0308 Re: — Request for Preservation of Records Pursuant to Title 18, United States Code Section 2703((, this letter is a formal request for the preservation of all records and other evidence in your possession regarding the domain account @elintonemail.com and the @state.gov email accounts associated with the following US. Department of State employees, pending further legal process. be Ic TE eee epee pHa PE ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this, request until receipt of a legal court order. You are also requested not to disclose the existenceof this request, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. This preservation request applies to the following records and evidence: A Ifyou Special Agen All stored electronic communications and other files reflecting communications to ‘or from the requested account. ‘The conients of any communication or file stored by or for the accounts and any associated accounts, and any information associated with those communications or files, such as the source and destination emails addresses and IP addresses. All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g,, telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Intemet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. yeene res Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. have any questions regarding this reques| i Il inquiries to {en Pho canbe reached at oe Sincerely, fee Charles H. Kable IV Section Chief Counterintelligence Divisionws gre 6 Bree ALL TFOResTrOM conta DEE nM TS ORCLASSTPIED 10-31-2016 BY J37I88T94 NSTCG U.S. Department of Justice Federal Bureau of Inves' Washington, D.C. 20535-0001 July 31, 2015 David Kendall, Esq Katherine Turner, Esq. Law Offices of Williams & Connolly LLP ‘725 Twelfth Street, N.W. Washington, D.C. 20005 Re: Request for Preservation of Records ‘This letter is a formal request for the preservation of all records and other evidence in ‘your possession, or in the possession of your client, Hillary Clinton, regarding the domain account @elintonemail.com, pending further legal process. You are hereby requested to preserve the records described below currently in your possession, or in the possession of your client, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. ‘This preservation request applies to the following records and evidence: AL All stored electronic communications and other files reflecting communications to or from the requested domain account. B. All servers, computers, thumbdrives, hard drives, smartphones, or any other Aigital storage devices in your possession or in the possession of your client, ‘which may contain communications to or from the requested domain account, C. All business records and other evidence relating to the establishment of the domain referenced above, including subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of secvice and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; andIfyou Special Agen All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g., telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the > {l be pre (u) sessed ore they who mointotejstice,DECLASSIFIED ey: NSICG 997985794 RMD) (FBI) MICHELLE A (RMD)(FBI), NEAGLE, LOUISE M(RMO)(FED) Subject: RE: State Department Emails --FOIA Coordination ~-SEGREF Importance: High SentinelCaseld: TRANSITORY RECORD Classification: Classified By: J23 Derived From: FBI NS Declassify on: 21 132 , dated 20120629 TRANSITORY RECORD a Just received a cal from State. They want to argue about the bi portion. We'll need to discuss, are you free at 2:00? | suspect they may call AD Steinbach, Thanks, (RMD} (FBI) 2015 11.22 AM — cro) (eat ss Rnb) (FBI croy anf }oroyrs| ‘Subject: RE: State Department Emails - FOIA Coordination ----SEGREE Classification: Classified By: J23 Derived From: FBI Declassify On: TRANSITORY RECORD dated 20120629 Forwarded to State. Thankstt! (cro) (FD 2015 10:35 AM 1D) (FBI) (ton ro ronf oven ——] i ‘Thursday, Ap bs bac b7E be BIC bé BIC TE 6 BIC BIEwstes sa7se5798 RMD) (FI) (Aro) (Ft) fs (08C) (Fl) Imation Review - Segment H-3 ~- SEGRETNGEORN- Importance: High SentinelCaseld: TRANSITORY RECORD Classification: Classified By: J23u9 Derived From: #81 NST Declassify on me ‘Subject: FW: Coordination Review - Segment H-3 —- SECRERHNO FERN Importance: High Classification: ORN Classified ay: 32395) Derived From dated 20120629 Declassify On You're about to get drug into an issue on classification ofthe Clinton emails. They are contesting CTD's classification decision and would ike to discuss It with you. (Forum shopping | believe.) 'l call you and give you some info, then they've asked if you could calll_ last name t think] Co (RMD) (FBI) sday, Apr 03, 2015 11:19 AM i FB) (RMD (FBI); NEAGLE, LOUISE M (RMD)(FBI) ‘Subject: FW: Coordination Review - Segment H-3 -~ SEGRESHMOFOAN- Importance: High be Ic bé BIe be BIC be IcRMD) (FBI To: LC . Subject: FW: State Deparment Emails -FOIA Coordination ---SGRET Importance: High SentinelCasela: TRANSITORY RECORD Classification? Derived From Declassify On: TRANSITORY RECORD = »s I've called the State’s Legal Advisor's Office a number of times and haven't connected. As they seemed to be wanting to resolve this quickly, I'm surprised. | wonder if they gave up on me and went higher. Have you heard anything about: ‘pproschesto your AD? Tm aso checking withOGE to see they went Sect to them RMD) (FET) 6 216 PM Ie (CTD) (ret) be RMD} (cry Fey [croxesn); (OGC) (FBI); JUPINA, MICHELLE A (RMD)(FBI), NEAGLE, LOUISE m (RMO)(FBL) ‘Subject: Re: State Department Emails FOIA Coordination SEGRE Importance: High Classification \ SECRET Classified ay: J223g6132 Derived From: FBI Declassify On: TRANSITORY RECORD CJ 2 BIc dated 20120629 Just received a call from State. They want to argue about the bi portion. We'll need to discuss, are you free at 2:00? | suspect they may call AD Steinbach. “Thanks,CRCLASSIFIEC BY: HS: ON 13-07-2016 RMD) (FBI) ES (357) a EMeScaMane ) (FBI) \ Siate Deparment Emails FOIA Coordination ~-GEGREF ‘SentinelCaseld: ‘TRANSITORY RECORD Classification: Classified By: Derived Frot Declassity On TRANSITORY RECORD wu (U}t've not heard anything about approaches to my AD, but I'll have my UC double-check at the 4pm close-out meeting with exec management. (U) usta an FYI, I've also not heard anything back yet from the LEGAT. wf From: RMD) (FBI) a 29, 2015 1:36 PM. To! \¢cTD) (FB1) Subject: FW: State Department Emails -FOIA Coordination SECRET Importance: High Classification: Classified By: J23 Derived From: FBT Declassify on TRANSITORY RECORD dated 20120629 Co ''ve called the State's Legal Advisor's Office a number of times and haven't connected. As they seemed to be wanting to resolve this quickly, 'm surprised. | wonder if they gave up on me and went higher. Have you heard anything about approaches to your AD? I'm also checking with OGC to see if they went directly to them. e agTaasTs4 bs Bic bé BIC Bé Ic 6 IcTECLASSIFIES BY: NSTOG 237996794 ca 11-07-2036 (RMD) (FBI) From: Sent: a To: CF (070) FB) Subject: RE State Department Emails ~FOIA Coordination -- SECRET SentinesCaseld: TRANSITORY RECORD Classification: S8CRET Classified ay: J2359Kt32 Derived From: FBI Declassify On: TRANSITORY RECORD dated 20120629 ‘Thanks! I don't see any urgency at this point. From [CTO) (FBI) ‘Sent: Wednesday, April 29, 2015 2:19 PM ToL__ |(RMO) (FBI) ‘Subject: RE State Department Emails --FOIA Coordination —- SEEREF— Classification Classified By: Derived From TRANSITORY RECORD uw {U} I've not heard anything about approaches to my AD, but I'll have my UC double-check at the 4pm close-out meeting. with exec management, (U} Just as an FY1, I've also not heard anything back yet from the LEGAT. (U From! ONG ‘Sent: Wednesday, April 29, 2015 1:36 PM. Te (cro) cra) ‘Subject: FW: State Department Emails --FOIA Coordination --SREREF— Importance: High Classification: secher bé Ic Be Ic 6 BIC Ps Bic138894 RMD) (FBI) be bic From: Sent: . To: Lt ‘Subject: RE: Stale Department Emails ~FOIA Coordination SECRET Sentine\Caseld: TRANSITORY RECORD Classification: Sacre: Classified By: g23syér32 Derived From: FBI NSXC, dated 20120629 Declassify On; 20481241 TRANSITORY RECORD 6 bic | beteve the fst document reviewed was part ofthis batch-bu am nat entirely sue. State Department Provides New Benghazi Documents To House Panel. Chris Walace reported on Fox News! ‘Special Report (4/90, 1.53M) that the State Department's Benghazi Accountabiity Review Board “tumed over more than 4,000 pages of documents and roles to the House Solect Commitlee on Benghazi Commitice Chairman Trey Govaly said the ocuments “were recently subpoenaed a second fime after the intial request two years ago,” adding that he “is stil waling forthe Department to produce other records that have alzo been requested or subpoenaed.” Poltico (4/30, French, 1.11M) reper that the documents “were not reviewed by the other halécozen committees that investigated ihe 2012 attacks.” Gowidy sai, "Contrary to those who said al had been asked and answered, the Benghazi Commitee has shown there is more stl for Congress % consider.” The Washinaton Times (5/1, Sherfinski, 641K) reports that Democrats “on the committee have said a handful of investigations into the attack have already been done and say Republicans are using the Committge a8 a way to attack’ Hilary Clio, USA Today (5/1, Page, 5.01M) reports that Goudy also “says he might be wilng to aocept assurances under oath from Hilary CGinion that she has provided all her relevant emails o the panel — dropping requests for an independent examination of her computer server’ He told "Capitol Download,” “f she were, under some theory, able 0 say, ‘yes, Ican promise you under penalty of petury you have every single document you'e ented to, that would probably shut ff hat ine of inguiry.Ifshe can, then wil be a short conversion” (CTO) (FBI) v6 prt 28, 2015 2:19 PM bre To: kro) (ret) Subj ‘Department Emails --FOIA Coordination —- SEEREF- Classification: SSCRET Classified By: F4sMs7x Derived From: FBI nszt, dated 20120629 18 @ ALL INPORTION CONTAINED bé BIC From: Sent: To: ce: JUPINA, MICHELLE A (RMD)(FBI, NEAGLE, LOUISE M(RMO)(FB!) Subject: HRC Email —- UNCLASSIFIED/BQUE SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED//foUe TRANSITORY RECORD bé Ic Just ahead’s up. I gota call fron JOD, concerning the classified HRC email. He received a call from State asking if we would revisit the issue. [directed him to CTDas the ultimate SME on harm and the classification decision. (1 did tell him as an OCA | concurred in the markings.) UNCLASSIFIED//FOUGALL THFORMaTIoN cowrATED MEIN 15 UNCLASSIFIED (RMD) (FBI) OLE 137488794 HSI From: Sent: Tor RMD) (FB ] Co: NEAGLE, LOUISE M (RMO)(FBI) Subject: RE: TRIM Document : 15/00/1703 : Letter from Patsick F. Kennedy, Department of State (00S), advising of the receipt of 85.000 pages of e-mails from former Secretary of State Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi SentinelCaseld: NON-RECORD Classification: UNCLASSIFIED fess just sent an enaid tof] saying 1°11 be the offickal. avo) (F83) TB, 2015 2:27 PM y crvo) (F8r);[____] (RHO) (#ex);[-_____] ¢Rno)¢Fer) Ce: NEAGLE, LOUISE M (RMD)(FEI) Subject: RE: TRIM Document : 15/D0/17@3 : Letter from Patrick F. Kennedy, Department of State (008), advising of the receipt of 55.000 pages of e-mails fron forner Secretary of state flllary Clinton and requesting a senior FOr official to coordinate the FBI's revi Classification: UNCLASSIFIED fron: pe (0) cr Sent: Monday, May 18, 2015 2:26 pM to:L 1 crm) (ra) ;[ Jano) ¢FBr), (RD) (FOI) Cci NEAGLE, LOUISE M (RMD)(FBI) Subject: RE: TRIM Oocument : 15/00/1703 : Letter from Patrick F. Kennedy, Department of State (B05), advising of the receipt of 55.008 pages of e-mails from former Secretary of State Hillary Clinton and requesting 2 senior FBI official to coordinate the FBI's revi Classification: UNCLASSIFIED -++--Original Nessage~ From: (RMD) (FBX) sent: Ronday, May 18, 2015 2:04 6M Ee camo) (F02) (RMD) (FB); (av0)¢F8r) Cc: NEAGLE, COUISE m (RMD)(FBI) Subject: FW: TRIM Document : 15/00/1703 : Letter from Patrick F. Kennedy, Department of State (005), advising of the receipt of 55.000 pages of e-mails from former Secretary of State Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revi has anyone suggested to you that our POC will be anyone other than[—__] bs Ic be Ic be bic bs bac be BaeClassification: UNCLASSIFIED Good afternoon, please note the short deadline (tomorrow!!) for response to the Department of state. Original hessagi From: ExecSec (D0)(FBI) Sent: Monday, May 18, 2015 1:55 PM To: (RMO) (FBI); JUPINA, MICHELLE A (RMO)(FBI);| RMD) (FBI); b6 NEAGLE, LOUISE FL ot (RMD) (FBI); (RMD) (FBI); Bie RMD) (FBI) te (osc) (Fax); [06 cer), (osc) (FBI (D0) (OGA) ; JOHNSON, GORDON 6, (D0) (FBI); PERKINS, KEVIN L, (DO) (FBI); (00) (FBI); (0) (FBI); (DO)(FBI); GIULIANO, MARK F (DO) (FBI); (CTD) (FBL) 5} (D0) (00)(OGA) Subjects TRIM Document : 35/00/1703 : Letter from Patrick F. Kennedy, Department of State (00S), advising of the receipt of 55.000 pages of e-mails from former Secretary of State Hillary Clinton and requesting a senior FBI official to coordinate the FBI's revie -- Classification: UNCLASSIFIED NOTE TO RMD: This TRIM document has a short deadline of 5/19/15. ACTION OFFICE: RAD The above division, designated as the action office, is assigned the attached Director's Office correspondence for preparation of a response over the signature of YOUR APPROPRIATE DIVISION OFFICIAL by the OUE DATE indicated below. The original will be forwarded to the action office’s point of contact. INFORMATION ONLY electronic copies’ are being sent to O6C, Chief of Staff, Associate Deputy Director, Oeputy Director and Special Counsel to the Director. IMPORTANT NOTE: Jf you, represent an FBI Field Division and are receiving this e-mail, you are being provides © coy sf correspondence which has cone to the attention of the Director, for other FBI executive. You are not being tasked with any action in this regard by the 81's Office of the Executive Secretariat. You are being provided a courtesy copy only. Responses handled vtrougt other means, such as via telephone contact, e-mails, etc., should be forwarded to the ExecSec via e-mail, and mst include the Trim 00# and sufficient relevant data, such as date, contact, and disposition, to allow ExecSec to close the pending action. Hf this matter needs to be reassigned to another entity, the FSI ExecSec should be advised immediately (within 2 days of e-mail receipt). The ExecSec will need to know to whom the request should be reassigned, together with a point of contact (if known), and the original correspondence will need to be returned to ExecSec, Room 6147. ACTION OFFICE INSTRUCTIONS: (Failure to comply with the following instructions will delay the closing of pending action and will result in the correspondence appearing on the overdue report) A. Response Preparation:-One UNDATED letterhead copy, -An envelope or mailing label, -A blocked yellow UNDATED file copy, attaching the original incoming correspondence to the yellow file copy, and 2 copy of the incoming to each designated “courtesy copy” (cc), as appropriate. The yellow copy mail room block must be checked and initialed, and cha TRIN number noted on the yellow (can be handwritten). : 1. Prepare the following: 2. At a minimum, the copy count must include the following copy designation: Trim Xx/D0/2200 1 - (Your confirmation white copy, if desired) B. Routing of the Final Response Package: 1. Route your final response package to the FBI ExecSec, Roon 6147. The FBI ExecSec will forward the completed package to the mailroom for delivery. < TRIM Record Information >-— Record number 35/00/1763 Date Due =: ~—s Tuesday, May 19, 2015 Addressee: AD-Records Management (Addressee) Current Action PREPARE RESPONSE PER INSTRUCTIONS (Responsibility of: Executive Secretariat, Due 5/19/2015 at 1:43 PM (14 hours, 55 minutes)) All Contacts: AD-Records Management (Addressee) Office of General Counsel (Other) Chief of staff (Other) Associate Deputy Director (other) Deputy Director (Other) Special Counsel to the Director (Other) ‘Access DB or Workflow = From KENNEDY, PATRICK F. Constituent: Title (Free Text part) : Letter from Patrick F. Kennedy, Department of State (005), advising of the receipt of $5.00@ pages of e-mails from former Secretary of State Hillary Clinton and requesting @ senor FBI official to coordinate. the FBI's review with their FOIA team. Notes : RHO advised during electronic routing that there is a short deadline for this TRIP record. ‘Monday, May 18, 2015 at 1:44:58 PH (GHT-e4:08) " bs bie r e Communication : ‘Thursday, May 14, 2015 teiateu Records Classification: UNCLASSIFIED Classification: UNCLASSIFIED Classification: UNCLASSIFIEDClassification: UNCLASSIFIED Classification: UNCLASSIFIEDa) e¢ -= e (RMD) (FBI ae yer nro JUPINA, MICHELLE A (RMD)(F8I) Searet ia ae Subject: HRC Emails —- UNCLASSIFIED/FOUO ceeeecaiy ow ta-a2-z040 CATE: 1i-o7-z025 Importance: High SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED//FOUO TRANSITORY RECORD Michelle, dust ceturned rom the meting a State hosted by USS Kennedy concerning HRC emai, Aer dacursng the logis of dn consultations egatding the 8,000 pogesin rae to meet a court-ordered lan 2016 decline, Secretary Kenney requested] Do/OIP, and me to sty behind discuss the Fl determination of clastied moter nan intl bates OTTBEEms deoing with Benghar, These emai were pocessed in response tos request by the House Sele! Committe on Berghe they were processed using FOIA guidelines, State Department referred the document to us for our review. | passed the email to CTD who reviewed and marked the document with FBI equities. Included was one line marked with the with classification "SECRET." Attached is the email In question with markings. AS an OCA, this marking was entirely consistent with the thousands of FBI documents I've reviewed over the years. State OLC contacted me initially objecting to the classification. Later Secretary Kennedy contacted] |i 100, who then contacted me. |'ve notified CTO Exec Sec in each instance of the contact. ‘The redaction lists “interference with foreign relations” as the rationale. The crux of States argument is they know better what will impact foreign relations and there is no longer a government in place. The more appropriate rationale is sources and methads, While the email does not name the particular official, this might be deduced and, given the ‘threat of violence in this region, any surmise could be fatal for whoever cooperated with us. State will say no one will know ifits redacted, but that is not how classification works. This all said, CTO is ultimate decider as to the level of harm contained in the information. | told Secretary Kennedy this and he said he would be calling AD Steinbach, is SECRET//NOFORN,” ZB 105739808 - Work + CTO Redact. bs bac 6 Ie Be pic be BIG bi BSALL THFORMATION coMTAINED HEREDI 16 UUCLASSITIEC RMD) (FBI pare 3 Se ee JUPINA, MICHELLE A (RMO\FBI[________]RMo) Subject: SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED TRANSITORY RECORD all Lust spoke to Pat Kennedy at DoS reference a State gov email dated November 18, 2014 07:01PM from[___] bs [Jara in which the FBI was requested to review a pending FOIA request bic | advised him independent and objective reviews by both RO and CTD previously determined two portions needed to be redacted based on exemption (b)(1) — "specifically authorized under criteria established by an Executive order to be kept secretin the interest of national defense or foreign policy.” We spoke earlier today and in the conversation requested that, as the Assistant Director CTD, 1 review the content and revise the determination and redact based on ‘exemption (b}(7)(0) only- “could reasonably be expected to disclose the identity of confidential source, including 3 State, local, or foreign agency or authority...” After discussions with RMD and CTD today, | explained to Mr. Kennedy to only exempt for (b}(7)(0) was not appropriate a the information in the two portions in question was classified at the Secret/NOFORN level and exemption (b)(1) was ‘needed in addition to exemption (b)(7(D). Therefore, I would not change the original determination made by the FB} ‘Michae! 8. Steinbach Assistant Director Be bic Classification: UNCLASSIFIEDALL INFORMATION COUTAINED BEREIN TS UNCLASSIFIEC RMD) (FBI) a From: JUPINA, MICHELLE A (RMD)(FBI ‘Sent: Thur 21, 2015 4:16 PM. To: {RMD) (FBI) Subject: Tale email FOIA --- UNCLASSIFIED. SentinelCaseld: TRANSITORY RECORD, be BIC UNCLASSIFIED Classification TRANSITORY RECORD From: JUPINA, MICHELLE A (RMO)Fa)) Sent: To: RYBICKI, JAMES E (DO)(OGA); GIULIANO, MARK F (00) (FB); GIACALONE, JOHN (D0)(FBI); STEINBACH, MICHAEL 8, (CTO) (FBI); BAKER, JAMES A (OGC)(FBI) Subject: RE; State email FOIA ~- UNCLASSIFIED Classification: UNCLASSIFIED TRANSITORY RECORD is an OCA and he can classify the information, unless CTO would prefer to classify i. Be bic From: A JAMES E (BO)OGA) Sent: re ‘To: GIULIANO, MARK F (00) (FBI); GIACALONE, JOHN (D0)(FBI); STEINBACH, MICHAEL B. (CTD) (FBI); JUPINA, MICHELLE A (RMD)(FBI); BAKER, JAMES A (OGC)(FBI) ‘Subject: FW: State email FOIA --- UNCLASSIFIED, Classification: UNCLASSIFIED TRANSTTORY RECORD State Department COS Jonathan Finer called this aftemoon reference this matter. He provided the background on the review process, stated that he was not attempting change the AD’s classification decision, and said that he just wanted to make sure that FB! leadership was aware of the decision and the procedural process and media attention it would likely trigger. | spoke to AD Steinbach who provided the background on the decision and | relayed back to the State Department that leadership is aware of the review process and decision. Mr. Finer asked whether it would be possible for the FB! to Records Management Division provided the enclosed internal FBI >7¢ communications, classified SECRET//NOFORN, referencing three (3) documents passed to the FBI by the State Department on or about April 28, 2015. Insofar as the State Department had identified FBI equities contained in these documents, they were sent to the FBI for classification review. The first email, dated September 16, 2015 was found to contain no classified information and released in full without redactions. The second email, dated October 17 and 18, 2012 was redacted and released in part using the B7(A) and B7(C) FOTA exemptions. The third email, dated October 3, 2012, was redacted and released in part based on the Bl FOIA exemption insofar as it contained non-FBI classified information The enclosure to this record is classified SECRET//NOFORN. owor015 ingion D.C be Investigation on 0807201 8___Washingon, = bIE Filey Date dietated__NiA be CA By sof poe \ oe “This document contains nether recommendations nor eanclusions ofthe FBI. It isthe propery ofthe PBI and is loanod to your agency: and is contents are noo be distributed ourside your agency.FISD BY: NSICS s370e5T96 036 pe (NF)(FBI) Bre From: RMD) (FBI) Sent: “Thursde [5 3:23 PM ‘ To: — eye), [Tavira . Subject: [Documents#2 —-- SECRETHNOFORTT SentinelCaseld: i Ero Classificatio| Classified By! Derived From: Declassity on 20130301 TRANSITORY RECORD Please see attached. Copeceat ve bre Classification: BpeRil//soroneye NSIGG 797088794 (RMD) (FBI) BE bre . (amo) (F80| [OGC) (Fet)] (CTD \FBI), JUPINA, Te MD) SLE, LOUIS HRC emai, FOIA case F-2016-04841 — SECRETHROFORN TRANSITORY RECORD SECRET//NOFORN Classified By: J23J! 32 Derived From: FBI Ni , dated 20120629 Declassify On: 204 TRANSITORY RECORD bs Bre ‘Attached are three new emails from State. The review on these three documents has not been finalized by State, so the ‘markings reflect the status at this time. Thanks! 2 ft DB C05739708paf €05739758paf C05739635 pat Classification: SECRETAA@FoRNDECLASSIFIED BY NSICG oS786794 Eerie (RMD) (FBI) [Jamo ra be Le a o_o ms (coy F SI] |(RMO) (FBI) Subject: 'RE-HRC emails, FOIA case F-2075-04841 -—-SECRETHNOFORN: ‘SentinelCaseld: TRANSITORY RECORD Classification: Classified By: 32309 Derived From: FBI Wi} Deciassify On: 20) dated 20120629 TRANSITORY RECORD Yes, and understand internally at State there was some who agreed with our marking. From: [(CTD) (Fet) 6 Sent Wednesday, April 29, 2015 6:07 PM Be ‘Tos (RMD) (FBI) cel (cToy(Fe1);[—_______ (am) (raf (060) (F815 (CTD)(FBI); JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(FBI) ‘Subject: RE: HRC emails, FOIA case F-2015-04841 --- SEGREFNOFORN- Classification: SEORET//NOFORN Classified By: F4aKs7! Derived From: FBI NS, Declassify On: 204 ted 20120629 TRANSITORY RECORD wl be bre (U} Thanks, we'l take alook at these and get a response back. In glancing at the third e-mai | notice it’s been marked by OS as containing classified information. That might in part explain why they've backed off some of their early resistance to use invoking the b2 exemption. a (RM) (Fat) bs 9, 2015 5:40 PM bre |(CTD) (FBI) (CTO FB!) ro) (Feny,[____oc) (Fa); (CTD)(FBI); JUPINA, MICHELLE A (RMD)(F8I); NEAGLE, LOUISE M (RMO)(FBI) ‘Subject: HRC emails, FOIA case F-2015-04841 --- SEEREHHNORORMDECLASSIFIED BY: NSICG J97985794 RMD) (FBI a . bs bre C____}amo) (Fe) ‘Wednesday. Way 06,2015 12:56 PM (CTO) (F BH (Cc Fk) (FB I) [CTO }FBI), JUPINA, MICHELLE A (RMD) (FBI), NEAGLE, LOUISE M(RMD)(FBI) Sunject: RE: HRC emals, FOIA case F-2015-0464t —-SEERETHNOFERN- ‘SentinelCaseld: TRANSITORY RECORD Classification: Classified By: J2339 Derived From: FBI NS. dated 20120629 Declassify On: 2040 TRANSITORY RECOR! be bre Do you have the status? | need to appease State Thanks Co From: ]RHD) (Fe) Pe ‘Sent: Wednesday, April 29, 2015 5:40 PM BIC or (an Cex (CTD) Ft} (Rm) (Fat (GC) (FBI); [(CTD\F81); JUPINA, MICHELLE A (RMD)(FBL); NEAGLE, LOUISE M (RMD}(FB) Subject HRC emals, FOIA case -SEERETINOFORN Classification: Classified 8: Derived From: PBI NSPG, dated 20120629 Declassify On: 204 TRANSITORY RECORI Co 6 Bic Attached are three new emails from State. The review on these three documents has not been finalized by State, so the markings reflect the status at this time. Thanks! 605739708.pdf >> << File: C0S739758,pdf >> << Fi : €05739635.pef >>DECLASSIFIED BY. usreG saToBDTSA (RMD) (FBI bé bre From: (RMD) (Fen Sent: ft 015 11:26 AM To: \cTD) (FB) ce: L ]iRmo) Bh; y JETD\FBI), JUPINA, TAIGHELLE A(RMO) (FBI, NEAGLE, LOUISE M1 (RMDKFED Subject: RE-HRC emaiis, FOIA case F-2015-04841 —-SECRETHNOFORN SentineICaseld: TRANSITORY RECORD TRANSITORY RECORD ‘Thank you very much, hope you're feeling better. From[ TCT) (Fa) be 05, 2015 10:02 AM BIG 10) (FBI) croyeany (RMD) cFB1);| (Osc) (FBI); [CTD)(FBI}; JUPINA, MICHELLE A (RMD)(FBI); NEAGLE, LOUISE M (RMD)(F8I) SEERETHNGFORN, Derived From: Declassify On: TRANSITORY RECORD vw (U) Sorry for the delay in getting back to you, 've been out sick the last couple days. be BIC (U) CTD is fine with the redactions which DOS recommends and has no requests for further redactions. UI (0) Blessed are they who mointainestice,Cee y Go As BICe ® U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 ALL INECRMATION CONTAINED ESEIN TS UUGLASSTFIED uarz 3-0 Be g57985T94 NsICS July 27, 2015 Custodian of Records Platte River Networks 5700 Washington Street Denver, CO 80216 Re: — Request for Preservation of Records Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all records and other evidence in your possession regarding the domain account @elintonemail.com, pending further legal process, You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete recond, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service 10 the accounts described below, or otherwise alert the subscriber or user of these accounts as 0 your actions to preserve the referenced files and records, please contact Special Agent Jas soon as possible and before taking any such actions, This preservation request applies to the following records and evidence: A All stored electronic communications and other files reflecting communications to or from the requested account. B. The contents of any communication or file stored by or for the account and any associated accounts, and any information associated with those communications or files, such as the source and destination emai’ ddrest sorIF- °° s. C. _ Allzecords and other evidence relating to the st scriber(s), ones hos secu holder(s), of other entity(ies) associated with the ag without limitation, subscriber names, user vanes el: naraes| [sie mailing addresses, residential addresses, busine ‘s other contact information, telephone numbers 0 of identity, billing records, information about the ={¥ jor Be bicIfyou have any questions regarding this request, bless direct all inquiries to Special Agent! services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and times Disconnect date and time; ‘Method of connection (e. Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. telnet, ftp, http); yeeye nS ‘Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. who ean be reached at bs Bre Sincerely, Charles Hf. Kable IV Section Chief Counterintelligence Divisionyale e wee ALL TMFORMATIC CONTATNED HEREIN Is UNCLASSLETEC FATE 11-07-2025 SY S97c987S¢ NSICC U.S. Department of Justice Federal Bureau of Investigat Washington, D.C. 20535-0001 July 31, 2015 Joseph P. Claney Director United States Secret Service 950 H Street., NW Washington, D.C. 20223 Re: — Request for Preservation of Records Dear Director Claney: This letter is a formal request for the preservation of all records and other evidence in your possession, or in the possession of Hillary Clinton, former Secretary of State, regarding the domain account @elintonemail.com, pending further legal process. ‘You are hereby.requested to preserve the records described below currently in your possession, or in the possession of Hillary Clinton, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request until receipt of a legal court order. You are also requested not to disclose the existence of this request, other than as necessary to comply with this, request, as the FBI's investigation may be jeopardized by this type of disclosure. This preservation request applies to the following records and evidence: AL All stored electronic communications and other files reflecting communications to ct from the requested domain account. B. _Allservers, computers, thumbdrives, hard drives, smartphones, or any other digital storage devices in your possession or in the possession of your client, which may contain commiunications to or from the requested domain account. C. All business records and other evidence relating to the establishment of the domain referenced above, including subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types ofhaye any questions regarding this request, please direct all inquiries to Special Agent Yoho ean reached | be services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time; 3. Method of connection (e.g., telnet, ftp, http); 4. Data transfer volume; 5. User name associated with the connection and other connection information, including the Intemet Protocol address of the souree of the connection; Telephone caller identification records; and Connection information for other computers to' which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. Any other business records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced. account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. prc Sincerely, Mw Charles H. Kable 1V Section Chief Counterintelligence Division6 Bic wz eS, =ALL SBE INZORMATION CONYAINED HEREIN TS ONCLASSIFIED TATE 11-07-2016 EY [97085794 WSICG cae coos Ynited States Senate Sosa Satie ee ee ORNATE OW THE RUOIGAEY WASHMGTOR, 96 2060-6775 August 5, 2015 VIA ELECTRONIC TRANSMISSION ‘The Honorable James B. Comey, Jr. Director Federal Bureau of Investigation 935 Pennsylvania Avenuc, NW Washington, D.C, 20535 Dear Mr. Comey: The Judiciary Committee has learned that the Office of Inspector General for the Department of State (State O1G) opened an investigation involving potential criminal conduct by Ms. Huma Abedin while she worked for the Department of State under then-Secretary Clinton, Specifically, the investigation examined the circumstances of Ms, Abedin’s work arrangements, leave status, and conversion from a full-time Department of State employee to a Spe Government Employee (SGE) and Senior Advisor to former Secretary Clinton. During the course of its investigation into this matter, the Committee has learned that the State OIG transmitted a letter, notice, or other similar communication (“letter”) to the FBI in October 2013 placing it on notice that State OIG’s investigation was no longer a preliminary matter but a fullfledged criminal investigation into Ms, Abedin, However, there have been public denials that the information provided to the Committee is accurate.' In order for the Committee to assess the veracity of the information provided in this matter, please provide @ copy of the October 2013 letter from State OIG by no later August 12, 2015. If no such letter exists, please advise the Committee immediately. Ifyou have any questions, contact Josh Flynn-Brown of my Committee Staff at (202) 224- 5225, Thank you for your cooperation, Sincerely, Chk ny Charles B. Grassley Chaieman Committee on the Judiciary S.A. Mills, “Hillery Clinton side Hums Abedin emerges as potential fsbilty for 2016 bid,” WastmsoTON Ties (August $, 15). Accessible at hte washingtonsimes comic ¥s/201 Siayp/ilary-clintonaice-huma-abedimemergesas poten "Ther i no eximieal investigation, and tnete never has beva, To say otherwise i patcely false and grossly inesponsibc, [Ms Abedin’satoeney, Karen L. Duna] said”)ALL DIEORUATION CONTAINED SERED) 1S UNCLASSIEZEC a DATE 11-07-g026 2Y Je7eer9 WSICG FEDERAL BUREAU OF INVESTIGATION FD 3029 (Rev. 19-6-95) Date of transcription _O7S12015. bs On 07/31/2015, at approximately 12:45 p.m., Special Agent served a preservation 7° letter addressed to Joseph P. Clancy, Director, U.S. Secret Service to LS. Secret Service. The preservation letter was served at U.S. Secret Service's office located at 950 H. Street, NW, be rovided his contact information as phone: bre Washington, DC 2022: 3 Investigation on 0791204 whi bre rier [] se » bé Ne A By sal pre Of ~ollll “This doeumesteoatias nliberreeramendatons nor opety ofthe FBI and is loaned o your agency; oO als 4nd its contens are not to be distibured ouside your azeney.Ic-~ Aut EMORATICU CONTAINED MEREDI 7S UNCLASSTFIEC DATE L1-O7-2026 BY Je7se2T=¢ wEICC U.S. Department of Justice Federal Bureau of Investigation Washington, D.C, 20535-0001 Date: August 4, 2015 To: Steve A. Linick Inspector General Department of State From: Charles H. Kable Section Chief Counterespionage Section Counterintelligence Division Subject: Request for copies of ereserved[7 OSOC™~SCSCSY bre On July 6, 2015, the FBI received a Section 81l(c) Referral from the Inspector General of the Intelligence Community regarding the potential compromise of classified information. Pursuant to this referral, FBI respectfully requests for the following be pI TE ‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is ioaned to your agency; it and its contents are not to be distributed outside your agency.be 20 bre a, bre 2 Bi You are also requested not to disclose the existence of this request , other than as necessary to comply ‘with this request, as the FBI's investigation may be jeopardized by this type of disclosure. Ifyou have any questions regar please direct all inquiries to Special Agent |who can be reached a be bre Sincerely, Charles H. Kable IV Section Chief Counterintelligence Division o” ‘This document contains neither recommendations nor conclusions of the FBI. Its the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.pron © To: cp-4 ror so. Re: Date: 08/05/2015 SIFTED SY. NSIUG setsenTsa REASON: 1-8 (0 BECLASSIFY OM 42-S1-2040 DATE: Li-os-z016 Precedence: ROUTINE Date: 08/05/2015 To: CD-4, Counterespionage Section From: CD-4, Counterespionage Section Contact: A/ASC Approved By: reds Drafted By: Case ID #: {U) Fas. Synopsis: (U//reve} To document meeting with the US Secret Service on 07/28/2015. j2W53B30 I NSIC dated 20130301 01231, Enclesure(s): (U//F686) One original copy of notes taken by Counterespionage Section (CD-4) Section Chief Charles iginal copy of notes taken by CD-4 A/ASC| one_original business card from US Secret Service (USSS) a eee) Kable IV; Details: (U//FO86] On 06/28/2015, CD-4 SC Kable and A/ASC met with the USSS 8, Acting Special Agen! Charge, Inspector| and peputy Special Agent in Charge, Inspector] 950 H St. NW, Washington, DC 20223 at USSS Headquarters, U (Spae) Jana were admonished regarding their obligation to not further discuss the investigation and voluntarily executed sensitive case acknowledgement forms. CD-4 requested| and assistance in obtaining USSS informatton related t location, operation, and USSS involvement with the personal e-mail network/server. CD-4 also requeste: Besa) (norone L FBI's wiefin Si b3 BIE bé 7c bt b3 BIE b6 Ic be bre bl BIE3} “Bey oto To: CD-4 From: CD-4 Re: (U}[ sate: 08/05/2015 * assistance in identifying § personnel to be interviewed as part of the Tnvestigation. T @Gr) Jacknowleaged that he understood the FBI's request, but advised that he would need to confer with his managemey that the request dealt with the USSS protectee miostons Lo Jadvised he would only genesa ly infore ais menagenent of the type of information the FS! was seeking and would not iden nagement the specific subject or Seeaiie of she avert gations boo ese the meeting to confer with unidentified USSS managers and indicated he would return to the meeting room with a response. ‘D (Spe) approximately 20 minutes lates, returned to~the“meeting ro: vised that he had conferred with his management chain. advised that his management told him that any FBI request for information or assistance related to this matter would need to come via written request from the Department of Justice to the Department of Homeland Security, which would then forward the request to the USSS. When shea, [+ zeruses to iden: spegifi anager (s] fo ehoTEPOke. Cos savisest———] and 2 the only two USSS officials read-in to the| investigation, they were not permitted to ence ef the FBI's investigation with anyone. [_—___Jana| indicated they understood their obligation Eo protect the investigation. rey b3 TE bi BIE bi b3 b6 pI bi 3 be breoot ae 6 ioe be byeALL TNROMATION CONTAINED FD-202a (Rev. 10-695) HEREIN TS UNCLASSTPIED ce uate 21-07-2016 ev as7985794 uszcc FEDERAL BUREAU OF INVESTIGATION Date of transcription _og/14/2015 08/14/2015, Special Agent] rovided (1) Disc containing 30, $42 email Be records tof Jifice of the Inspector General of the Intelligence Community. ‘as also provided a letter signed on 08/13/2015 from Randall C. Coleman, Assistant Director to. Charles McCullough II which outlined the guidelines for the release of the Disc. Jnvestigation on_ 814/201 st_ Washington, DC ba BIE rice [__] Date dicteed_NIA By sl — bs “This dotament contains nether recommendations nor conclusions of the FBI. Its the property of the FBI and is loaned to your agency: it, © BTS and its contents are not to be distributed outside your agency.FOA087 (Rev 58.10) FEDERAL BUREAU OF INVESTIGATION isi Event Title Speak) wroron Collected Hem Log [| Drafted By: cave 1 [LY sae bl ba MISHANDETNG OF ED; bie UNKNONN SUBJECT 08 COUNTRY; Full Investigation Initiated: Collected From: Receipt Given?: Holding Office: Details Item Type 1s General SENSITIVE INVESTIGATIVE MATTER 07/10/2015 (0) KATHERINE TURNER, ESQ WILLIAMS & CONNOLLY, LLP 325 12H STREET, Mi WASHINGTON, District Of Columbia No WASHINGTON FIELD No Details Provided Description (U) BOX OF EMAIL PAPER DOCUMENTS BOX 2 Collected On: 08/08/2015 Seizing Individual: ba bs BIE 08/14/2018 6 BI (sng cLassrrTEn By: EASON: 1.4 tC) Tare: 11-07-2036 ners sa7vasT9a ALL INPORIATION CONTAINED SEREIN TS IRCLASSIFYED EXCEPT WHERE SHOM CTHERWISE bé Collected By: Location Area: NA Specific Location: NA Se 7c “This document cotaos gir recomsreraatons or Goelusns of i FI is he ope of the FB and is oaned to your gery; ands cone ae nto be dibs ove your agmete] Re: TE7TA/2015 1B General 18 General 18 General AB General 1B General (0) BOx OF EMATL PABER DOCUMENTS, BOX 4 Collected on: 08/06/2015 Seizing Indivi Collected By: Location Area: WE Specific Location: NA (0) BOX OF EMATL PAPER DOCUMENTS BOX § Collected on: 08/06/2015 Seizing Individual: Collected By: Location Area: WA Specific Location: NA (0) BOX OF EMATL PAPER DOCUMENTS. Box 7 Collected on: 08/06/2015 Seizing Individual Collected By: Location Area: 0% Specific Location: NA (0) BOX OF EMAIL PAPER DOCUMENTS. BOK 9 Collected On: 08/06/2015 Seizing Individua collected By: Location Area: NA Specific Location: NA (0) BOX OF MATL BAER DOCUMENTS BOX 10 Collected on: 08/06/2015 Seizing Individual: collected B: Location Area: WE Specific Location: NA “Tape nono 2 ba 3 bre. b6 Ic 6 pyc b6 bre b6 pyc 6 IcSopa srorons 2 Title: BIE 16 1B 1B + 08/24/2015 General General General (0) BOX OF EMAIL PAPER DOCUMENTS. BOX It Collected On: 08/06/2015 Seizing Individual: bs Collected By: 7c nocation Area: NR Specific Location: NA {U) BOX OF EMAIL PAPER DOCUMENTS. BOX 16 Collected On: 08/06/2025 Seizing Individual: bs Collected By: Ie Location Area: A Specific Location: NA (0) BOX OF EMAIL PAPER DOCUMENTS. BOX 20 Collected on: 08/06/2015 Seizing Individual: bé collected By: bye Location Area: A Specific Location: NAFEDERAL BUREAU OF INVESTIGATION POI/EA DELETED PAGE INFORMATION SHEET FOI/Pag 1253814-0 Total Deleted Page(s) = 20 Page 3 ~ Referral /Consult; Page 4 ~ Referral /Consult; Page 11 ~ Referral/Consult; Page 12 ~ Referral/Consult; Page 24 ~ Referral /Consult; Page 25 ~ Referral /Consult; Page 27 = Referral/Consult; Page 45 ~ Referral/Consult; Page 46 ~ Referral/Consult; Page 136 ~ Referral/Consult Page 137 ~ Reterral/Consult Page 138 ~ Referral/Consult; Page 139 ~ Referral/Consult; Page 140 ~ Referral/Consult; Page 174 ~ Referral/Consult; Page 175 ~ Referral/Consult; Page 176 ~ Referral/Consult; Page 177 ~ Referral/Consult; Page 178 ~ Referral/Consult; Page 179 ~ Referral/Consult; YON KKH KNX KHANH X Deleted Page(s) x X No Duplication Fee x X For this Page x HAKKAR ENEARHR HKALL THFORATICH couraArHED @ MEREIN 1s UNCLASSTELED EATE 11-05-2036 BY J7e21eTE0 NSIC FD-302a (Rev. 10-6.95) os FEDERAL BUREAU OF INVESTIGATION Dave of wanseription _oR/O5201 8 oa august, 3, 202s, [decors Fe ° Bre Nanagement Division, Records Information and Dissemination Section, Winchester, Virginia provided the enclosed internal email communications referencing the FBI's classification of a November 18, 2012 State Department email. The enclosure was provided by in support of statements made during a July 30, 2015 FBI interview and documents items discussed at that time. The enclosure has an overall classification of / HOPORIE. »3 Tavesipmion on _o082015__at_ Washington D. bre ries [—__} 94 Date ditaed NVA. be by pre ae This docurrent contains neliber Feeommendations nor conclusions f'the FBI. It isthe property ofthe PBI and is foaned to your agency’ i and its contents are not tobe distrbted outside Your agency.ALL TRFORATION CONTAINED e ELUTE PD-3028 (Rev. 1946-95) ale FEDERAL BUREAU OF INVESTIGATION Date of transcription _O7SL2018 on July 31, 209 receptionist at williams and id Connelly LLP, accepted a preservation letter on behalf of Kathleen pre Turner to preserve records and electronic media related to the @clintonemail.com email server. 3 bE Investigation on 0781/2015 at __Washington, DC Fite > Date dicated ve ays Jo bre icdeoee satire meme omia e Fhe peyote Fd hentnyan ena Soka aga ater Srl 52cuassrrize By: REASCH: 1.4 (0) EECLASSIFY ON: 22-s1-2040 PATE: 11-05-2016 JB morons FEDERAL BUREAU OF INVESTIGATION Collected Hem Log Drafted nsice a7saveTa0 HEREIN FD-108 (Rev $610) Date: case 1D svmeil Full Investigation Initiated: 07/10/2015, Collected From: [U) Katherine Turner, Esq williams & Connolly, LLP 725 12th Street, MW Washington, Gistrict Of Columbia Receipt Given?: No Holding Office: WASHINGTON FIELD Details: No Details Provided Item Type 15 General Description (0) 80x of Paper Documents - gmail - Box 19 Collected on: 08/05/2015 Seizing Indiv: Collected By. Location Area: NE Specific Location: Na “Bei erorer ALL INFORMATION CONTAINED TS ONCLASSIFIED EXCEET WARFE SHOWN OTHERWISE 08/14/2015 bs b7c bi BE (sam) Bs BIC ‘This docamercomias eter ecommendons or eas Oke Fhe propery ofthe FB andi asst vr ageey tari soars re notte tbe aus You ene.ritte: DX Re: 18 General 1B General 1B Genezal 1B General 1B Genezal 1B Genezal, e e Poles 08/14/2015 (0} Box of Paper Documents - Email - Box Box 3 Collected on: 08/06/2015 Seizing Individual: collected By: hocation Area: WA Specific Location: NA (0) Box of Paper Documents - Email - Box 18 Collected on: 08/06/2 Seizing Individua collected ay: Location Area Specific Location: NA (0) Box of Paper Documents - Email - Box 22 Collected on: 08/06/2015 Seizing Individua, Collected 8y: Location Area: NA Specific Location: NA (0) Box of Paper Documents ~ Email - Box 14 Collected on: 08/06/2015 Seizing Individua, Collected By: Location Area: NR Specific Location: NA (U} Box of Paper Documents - Email - Box 21 Collected on: 08/06/2015 Seizing Individual: Collected By. Location Area: NF Specific Location: NA (v) Box of Paper Documents - Email - Box 1 Collected On: 08/06/2015 Seizing Individual: Collected By: Location Area: NR Specific Location: NA “Spore srorenn. 2 bt 23 BIE b6 7c b6 b7c b6 pre bé bie b6 BIC 6 byeTitle . Re: Ta/201s 1B General 1B General 1B General 1B General 18 General e e Bap prorore (0) Box of Paper Documents - Email - Box Collected on: 08/06/2015 Seizing Individua Collected By: Location Area: —™ Specific Location: NA (J) Box of Paper Documents - Email - Box Collected On: 08/06/2015 Seizing Individual: [————___] collected By: Location Area: NA Specific Location: NA (U} Box of Paper Documents ~ Email - Box Collected On: 08/96/2015 Seizing Individual: collected sy: Location Area: NE Specific Location: NA (D) Box of Paper Documents - Smail ~ Box Collected on: 08/06/2015 Seizing Individual: Collected ay: Location Area: Specific Location: NA (0) Box of Paper Documents = Email ~ Box Collected on: 03/06/2019 Seizing Indivi Collected By: Location Araa: WE Specific Location: NA a 12 wv 6 a5 bt b3 BIE 26 Ie b6 Ie bé bie 6 bye b6 7c® ® “Bask prorons bt Title g 3 Re: 08/14/2015 BIE 1B General (0) Box of Paper Documents ~ Email - Box 13 Collected on: 98/06/2015 Seizing Individual bs Collected By: bie Location Are: Specific Location: NA ohue nytotanroon eommanime e say retonerre comae D-302a (Rev. 1046.95) DATE 11-09-2016 BY JT6aLeTEO NICS ae FEDERAL BUREAU OF INVESTIGATION Date of transcription _ 08/13/2015 On August 12, 2015, of Platte River Networks, >& 5700 Washington St, Denver, CO 60216, met with Agents of the FBI at >7¢ the Equinix facility located at 800 Secaucus Road, Secaucus, NJ 07094, to turn over to the FBI a computer server used to host the email system for former Secretary of State Hillary Clinton's @clintonemail.com Internet domain. at spproximtety s:00m4, [—] ez agents, and one cant 2, Forensic Examiner at the parking lot of Equinix (the collocation facility where the server was physically located and operated from} and transferred one (1) Dell Poweredge server to the FBI’s possession described in detail below and on the enclosed FD-941, Consent to Search Computers, and FD-597, Receipt for Property. Item 1: Dell Poweredge 2990, gray color, S/N Ge42PCl Prior to departing,[______] signed the enclosed FD-941, Consent to Search Computers, and FD-557, Receipt for Property. The original 6 was kept by the FBI and copies were made wood for his records. ®7¢ Subsequent to the FBI’s collection of the above, Item 1 was entered into evidence, and given a 1B number by the Washington Field Office, and then transported to the FBI's Forensic Analysis Unit in Quantico, Virginia for storage and evaluation. Copies of the intake sheets and FD-1004 are enclosed with this communication. bs Invesigtion on omnis et_sacauus bre Fie# a Datedvated__1VA bs ass bre “his docamio sonnei evommentions or coniwsons fhe FB. isthe propery fie FB an is foanedo your ag and is cntens ae not be distited ouside your agency. shi “a $6TATE: 11-09-2036 “Separate forms are mandatory for evidence seized on different dates at different locations, by different individuals, for different types of evidence. ‘Type of Evidence being submitted: ‘Warning - special handling Ci General Evidence O Firearms C1 Body Fluids CO other Gi Vatuable Evidence Weapons 0 Whole Blood Evidence Purchase Money) Other DC nazmat D Drug Evidence Cras CO Refrigeration CO Enviro. carr SECRET CLASSIFIED BY: NSICG e@ @ wae a7es18T 80 FEDERAL BUREAU OF INVESTIGATION =. zurcriarion comrarsec EVIDENCE DATA-LOADING FORM = #8518 is usclassirien excert HERE SHOW OTBERKISE 1 iS} : Person, fing Evidences Date Acquired: Fime Acquired: » eM) froze Weta bi Dé BIC DIE Source from which evidence acquired T [Person's nametjob ttlelcompany adress) Peart vec eriwkes/ Ebswrx boo Sehbter Feb Anticipated Disposition: ~] Forfeiture Potential” Bis Ono SanIoy net rane] Winco HY pit wane] Estimated Dollar Value: + Total Drug Package Weight: Complete onal Dee Fowecebae TE TORT BE TET ata Tong Toran OMG, ECT W Oy SGRRa EHS For WHER THe ToMArTON COMEATEN HETEAN Tiss BEN centered into Evidence Data Base, 7c ert* NART 5490168 oe Description: Submitted) ottectd On: Recalpt tem CATSIDH, setae Corts abandonment: 5/22/2015 04:30 none None None Digital Information Type: compute® Sefal umber GB422C attees Chargec: 9 omer Cotected: 1 Colecins by CART: NO Discovery Location sieegnenine (2) seals None Asticipated Disposition long on Rone ‘Storage Information NoldngOfRee: WASHINGTON FIELD cc Five’ By: Location: ercode: 28490198 ‘cain of custody shipeing | Wanster 09 seer aeston Evert OA ‘equation Event Collected From: 7E electronic communications are found. messi) @ You are requested not to disclose the existence of this inquiry, other than as necéssary for compliance, insofar as doing so may jeopardize the confidential nature of the FBI's investigation. If you have ap questiong_regarding this request, please direct bre Sincerely, a Charles 3. Kable IV Section Chief Counterintelligence Division o UNCLASSIFIED//FOe I heither recommendations nor conclusions of the FBI. It is the property of the FEi/and is loaned to your agency; it and ite contents are not to be distributed outside your agency. This document containse Ee Bry mosom wear te TECLASSIFY OM: 42-21-2040 PATE: 1i-os-z016 To: cD-4 From: CD-4 Re: (U) Date: 07/24/2015 3 bTE Precedence: ROUTINE Date: 08/04/2015 To: CD-4, Counterespionage Section From: CD-4 Contact: IA bs Bre Approved By: Drafted By: Case ID #: (U) -P B 7 Ba bre Title: (S/ ANE) Synopsis: (U//O86} To document background research of Platte River Networks. ed 20130301 Sify On: 20401231 Details: {U//#0¥0) A 24 June 2015 lestter from Williams & Connolly LLP to the U.S. Department of State (USDS) Office of Inspector General identified that the server equipment which hosted former Secretary of State Clinton’s @clintonemail.com account during her tenure as Secretary of State is in the custody of Platte River Networks (PRN). The server is allegedly maintained at an unidentified secure data center and is allegedly no longer active. Williams & Connolly believes the server no longer contains data from former Secretary Clinton’s @clintonemail.com account. (u//#986) CD conducted open source and FBT database checks of PRN and associated persons. Results are as follows: (U) ADDRESSES (u//Fe¥e) According to the PRN website (www platteriver.com), PRN recently moved to a new 12,000 ft. office space at 5700 Washington Street, Denver Colorado 80216 Bypakr/ Morons 1e e ‘BBpxGi/ Aeron To: cD-4 From: CD-4 re: (0) [7 _spate: 07/24/2015 b3 Ie According to LexisNexis searches, the following additional addresses are also associated with PRN: . bs bre * 11900 B Cornell Ave Aurora, CO 20014 * 5550 Britton Pkwy Hilliard, O 43026 . bs bic (u/ Ov) The LexisNexis search identified the 11900 E Cornell Ave, Aurora, CO 20014 as a property owned by Platte River Networks for the purposes of “EQUIPMENT FURNITURE ETC.” b6 bre (U) Open source information indicated lis a private residence. uy, xian records indicate Be is listed as a residential address for| bic of PRN. {U) PHONE, FAX, & EMAIL (U/ ewe} The search of LexisNexis also identified PRN’s phone re =255-1941 and taxpayer identification number (TIN) asL_] . \e number is also associated in Experian with bre a former employee of PRN. (U) PRN’s email was identified through open source as crc@platteriver.com and the fax number was listed as 303-474- 3942. “Byer /wovoneTo: Re: (v) (u} e e SBonGq/ /worone cp-4 From: ¢D-4 (u) [7 ates 07/24/2015 b3 bre PRN BUSINESS SCOPE Open source information indicates PRN has approximately 25 employees. According to the PRN website, PRN provides the following services: (U) Managed IT Services - Intuition: Intuition appears to be a business technology associated with network infrastructure (including servers, storage area networks, firewalls, switches, and workstations) which is monitored by PRN’s Intuition Operations Center. Intuition provides network security delivered on premise and through the cloud, including endpoint security for servers and devices, next generatibn firewalls, unified threat protection, monitoring, mobile protection, web and email security. Intuition also provides remote management of mobile devices including remote monitoring, setup, security and vendor management. (J) Technology: According to the PRN website, PRN offers consultations for technology projects, technology procurements, and continuity of business assessments and solutions. PRN has over 25 full-time engineers specializing in integration, virtualization, security, remote access, wireless, mobility, cloud, exchange, server, desktop, firewall, switching, system administration, storage, disaster recovery, business continuity, endpoint protection, archiving, data recovery, power, migration, Office 365, cabling, VoIP, encryption, ISP, voite/data bandwidth, active directory, group policy, and DNS. (J) Cloud: PRN provides cloud computing with expertise in hybrid, public, and private cloud infrastructure. PRN offers desktop virtualization to provide a flexible and secure desktop delivery. PRN’s cloud services provide storage, backup, and disaster recovery, ensuring their clients’ data is always available and protected. PRN maintains cloud security solutions provide up-to-date protection by utilizing the ability to push critical real time updates to all devices on the networks, PRN offers Microsoft's Office 365 to clients, enabling cloud-based Microsoft Office application usage (U) Telecom: PRN claims so represent the top 25 bandwidth providers and provides on-site cabling assessments to BBeRRL/ ‘norent 3Ty e e BaexET/ Atoren To: cD-4 From: CD-4 Re: (U) Date: 07/24/2015 3 BIE determine if clients are equipped with sufficient CAT 5/6 cabling for network, voice and data to perform at top speeds. PRN also offers conference call and web meeting solutions, including hardware, software, and manage services. PRN‘s website advertises business mobility by stating: “Your business must be mobile, including your company workforce. You need to access your company data from all devices, anywhere and anytime. We represent the top carriers from across the country and can procure, monitor and manage all of your mobile devices including laptops, tablets, and smartphones - iPhones, iPads, Droids, and Windows.” (0) FBI OBSERVED COMPROMISES OF PRN CLIENTS (0) In duly 2015, on behalf of FBI San Diezo, FBI Denver cited PRN as providing contract IT services for 2 non-profit business in Denver that was the potential victim of. a! computer intrusion | PRN Dizecter of Consuiting bre Services at Platte River Networks provided log and system files for the victim company’s website to FBI Denver circa 10 July 2025. (S/F) FBI Denver cited PRN as providing contract IT services for a law firm in Denver that was the victim of a computer intrusion in March 2010. The Denver law firm terminated their contract with PRN shortly thereafter. According to the case file, FBI Denver did not contact PRN regarding the computer intrusion. (0) TIMELINE {D) The following is a timeline of key PRN events provided on the PRN website: * (0) 2002: PRN founded * (U) 2004: PRN founding partners hired the first employee * (0) 2005: PRN began offering cloud services * (0) 2008: PRN launched Intuition Bpex/ proven 4“BRON /NezeRn e To: cD-4 From: CD-4 Re: (U) Date: 07/24/2015 bs BIE © (0) 2009: PRN offered full Managed Services * {U) 2010: PRN launched Telecom Division * {U) 2012: PRN launched the Intuition Operations Center and associated Help Desk (U) PRN EXECUTIVE MANAGEMENT (U) PRN’s website identified PRN executive management and provided additional information for each person. (uy OxAME [ POSITION ADDITIONAL INFORMATION bs bre Speaker / A1oFORN° ‘SEDNEY/ /NoFOR e To: cp-4 op-4 Re: (U) Date: 07/24/2015 bs bIE b6 bye 2) 2 aca 6 7c b6 biee e Bagel serorr bs To: cD-4 From: CD-4 BIE Re: (U) Date: 07/24/2015 v6 bre esi soem BI (U) CORPORATE PARTNERS (U) According to their website, PRN maintains hardware partnerships with Dell, Fortinet, Allworx, Datto, CISCO, ADTRAN, HP, EQUALLOGIC, BATON, PowerADVANTAGE, and Synology. (U} PRN’s software partners include Microsoft, Office365, mimecast, WEBROOT, vmware, Dell, Autotask, LabTech, Datto, SkyKick, STORAGECRAFT, VEEAM, and Worldox. (U) PRN’s service partners are Windstrean Communications, CenturyLink, PanTerra, Comcast, Integra, RingCentral, TW Telecom, AT&T, MobileWare, and MHO. (U) PRN’s strategic partners include INGRAM Micro, CUSN, and ‘Trust Alliance. re BEpat/Aroronn6 Nye vo 26 breALL THEORNATION CONTATHED HEREIN 15 UNCLASSITIED DATE 11-08-2018 By J7BI18TSO USTOS U.S. Department of Justice Federal Bureau of Investigation ‘Washington, D.C. 20535-0001 August 18, 2015 bie Re: — Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. bé Ic BIE weavavewne 10 a 2 3 4 15 16 17 18 19 20 a 223 24 25 26 7 28 29 30 a1 32 33 34 35 36 37 38 39 40 a a2 a3 4a 45 45 a7 48 49 50 1 52 53 54 55 56 ‘You are hereby requested to preserve the records described below currently in your ‘possession, including records stored on backup media, in a form that includes the complete record, ‘and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first, This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request, Youre also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disctosure, You are also requested not to close the account of the ‘subscriber, unless requested to do so by the subscriber. {f compliance with this request may result bé pIe BIEin a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and records, please contact Special Agent| as soon as possible bs and before taking any such actions. bic This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. _Allreconds and other evidence relating to the subseriber(s), customen(s), account holder(s), or other entity(ies) associated with the requested account including, without Jimitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subseriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in eleetronic or other form; and C. All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time; 3. Method of connection (c.g, telnet, ftp, tp); 4, Data transfer volume; 5. User name associated with the connection and other connection information, ineluding the Internet Protocol address of the source of the connection; 6. Telephone caller identification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information refates, and all other information related to the connection from ISP or its subsidiaries. 8, Means and source of payment for such serviee (:ncluding any credit card or bank account number) and billing records. D. Any other records and other evidence relating to.de requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person. or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form.any questions regarding this request, please direct all inquiries to Special Agent hho can be reached at] lo eee Sincerely, Mim —— Charles H. Kable IV Section Chief Counterintelligence Division6 pieALL INECRETYON conTAnEE . @ BEREIN IS UNCLESSIEIED DATE 31-09-2016 By 76219780 NSToS U.S. Department of Justice Federal Bureau of Investigation Washington, D.C, 20535-0001 August 18, 2018 be 7c Re: Request for Preservation of Records. Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(f), this leter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process, be Bre BIE weyvackuns 10 1 12 13 4 15 16 7 18 1924 2 23 24 25 26 27 28 29 30 a 32 33, 34 35 36 7 ESSSB a2 aa as a7 49 54 52 53 5a 55 56 37 58 59 61 62 63 64 65 66 b6 p7c BIE67 68 69 70 mn 72 3 74 ry 76 7 78 79 al 82 BSSRGRRes 92 93 95 88Rees x 101 102 103 104 105 106 107 108 109 110 a 112 b6 BIC BIE113 a4 115 116 uy 118 9 120 yaa 12 123 124 125 126 127 128 129 130 131, 132 133 134 135 136 137 138 139 140 342 142 143 144 145 146 347 143, 149 150 152 152 153 154 155 156 157 158 be 7c BIE159 160 161 162 163 164 165, 166 167 168 169 170 a7 172 173 174 175 176 7 178 179 180 181 182 183 185 186 187 188 189 190 191 192 193 194 195 196 197 199 200 201 202 203 204 b6 7c IE205, 206 207 208 209 210 21 212 213, 214 215 216 27 218, 219 220 221 222 223 224 225, 226 227 228 228 230 231 232 233 234 235 236 237 238 239 240 2a1 242 243 244 245 246 207 248, 249 250 be 7c BIE251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 a 272 273 274 275 276 27 278 279 280 281 282 283 284 285 286 287 288, 289 290 291 292 293 294 295 296 b6 Ic BIE297 298 299 300 301 302 303 305 307 308 309 310 Bul 312 313 314 315, 316 317 318 319 320 321 322 323 324 325, 326 327 328 328 330 331 332 333 334 335 336 337 338 339 340 341 342, b6 BIC BIE343 345 346 347 348 349 351 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 b6 BIC BIE389 390 392 392 393 398 395, 396 397 308 399 400 401 402 403 404 405 406 407 408 409 410 an 42 413 aia ais 416 a7 418 419 420 42a 422 You ave hereby requested to preserve the records described below currently in your possession, including records stored on backup media, ina form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or unti receipt of « legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new formation that arises after. the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to clase the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise b6 BIC BIEalert the subscriber or user of these accounts as to your actions fo preserve the referenced files and records, please contact Special Agent Jes soon as possibie be and before taking any such actions. ‘This preservation request applies to the following records and evidence: A The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or'files, such as the source and destination email address or IP address. All records and other evidence relating to the subscriber(s), customer(s), account hholder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (¢.g., telnet, ftp, http); Data transfer volume; User name associated with the conneetion and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the idemities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. xe Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person. ot entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form.Ifyou have any questions regardi ‘ho can be reached at his request, please direct all inquiries to Special Agent ri Sincerely, Mw Charles H. Kable 1V Section Chit ‘Counterintelligence Di be 7ceesALL INFORKATION comTaTNED HERETH 13 UNCLASSIFIEC TATE 21-09-2015 BY sTesLeTeD HSTCG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 1@, 2015 BIE Re: Request for Preservation of Records _ Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703({, this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. bs bre DIE weorvaneune 10 a 2 B 14 15, 16 v7 18 19 20 2 223 bs 4 pyc 3 BIE 26 a 28 29 30 You are hereby requested to preserve the records deseribed below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days., or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. ‘You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to vour actions t the referenced files and records, please contact Special Agent| 15 soon as possible 2 _ and before taking any such actions, This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any informat associated with those communications or files, such as the source and destination email address or IP address. B. All: records and other evidence relating to the subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including Connection date and time; Disconnect date and time; Method of connection (e.g., telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and veer 27. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8 Means and source of payment for such service (including any credit card or bank account number) and billing records. D. Any other records and other evidence relating to the requested account, Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, ‘whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this request, please direct all inquiries to Special Agent ea Sincerely, Min Charles H. Kable 1V Section Chief Counterintelligence Division Ic(ae BreALL INEOR@TICN CCHTAINED . @ BREIN 13 INCLASST wos DATE 11-08-2016 U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 18, 2015 IE Re: — Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703({), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process, b6 bre BIE wavausune 10 a . 2 2B 14 15 16 7 18 19 20 2 2223 24 25 26 a 28 29 30 a1 32 33, 34 35, 36 a7 38 39 40 al 42 43 45 46 a7 49 50 st 82 33 54 55 56 7 58 59 60 61 62 63 65, 67 be 7c BIE6 70 n n az} 14 75 76 W 78 79 80 a1 82 83 85 86 87 88 89 a1 92 93 95 96 97 98 99 100 101 102 103 104 105 106 107 108 208 110 aa 112 113 14 be 7c BIE115 bé us Ie iw TE 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135, 136 137 138 139 140 241 142 143 144 145 146 147 148, ag 150 151 152 153 154 155 156 157 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record,and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary 10 comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to pres referenced files a record pleas conte Spec gen ne ee posible ms. and before taking any such actions. ‘This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscriber(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without Jimitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g. telnet, fip, http); Data transfer volume: User name associated with the connection and other connection information, including the Intemet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or emtity to which such connection information relates, and all other information related to the connection from ISP or its subsidiacies. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. whepe te D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with orrelating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this ss please direct all inquiries to segs Agent rho can be reached at] or| be 7c Charles H. Kable IV Section Chief Counterintelligence Division.Cas bé Je bre ee ofALL TNPOREATION e BERET TS UNCLASSI DATE 11-08-2016 BY o769L9780 SIC U.S. Department of Justice Federal Bureau of Investigation ‘Washington, D.C. 20535-0001 August 18, 2015 Re: — Request for Preservation of Records Dear Custodian of Records: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. wCovaueenn 10 n 2 B 14 15 16 7 18 19 BIE bé b7e IE.20 2 2 23 24 25, 26 a 28 29 30 31 32 33 34 35 36 37 38 39 a a2 43 45 46 a7 48 49 SI 82 53 55 56 37 58 59 61 62 63 65 be 7c BIEseers 7 nm B 4 75 76 7 78 81 82 83 8s, 86 a7 2888 92 93 94 9s 96 7 98 99 100 101 102 103 104 108 106 107 108 109 110 ut b6 7c TE12 113 a4 115 116 7 118 nig 120 121 122 123 124 125 126 Ww 128 128 1230 131 132 133 134 135 136 137 138 1239 140 a 142 143, 144 145, 146 147 148, 149 150 151, 152 153 184 155 156 157 b6 yc BIEws . = me 160 162 164 165, 168 You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for a period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may reswlt in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as 10 your actions to preserve the referenced files and records, please contact Special Agent as soon as possible bs and before taking any such actions. bic ‘This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscriber(s), customer(s), account holders), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: 1. Connection date and time; 2. Disconnect date and time;3. Method of connection (e.g,, telnet, ftp, http); 4. Data transfer volume; 5. User name associated with the connection and other connection information, including, the Intemet Protocol address of the source of the connection; 6. Telephone caller jdentification records; and 7. Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronic or other form. Ifyou have any questions regarding this request, please direct all inquiries to Special Agent pho can be reached [pel be te Sincerely, Charles H. Kable IV Section Chief Counterintelligence Divisione oa oA bé picALL TEE IMDORIATION comTarHED BEREUN Is UNCLASSIEIEC TATE 11-05-2026 ‘veveo NsTeG U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 August 18, 2015 John Kerry Secretary of State USS. State Department 201 C Street, NW ‘Washington, DC 20520 Re: Request for Preservation of Records Dear Secretary Kerry: Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. 10 be bre bE23 24 25, 26 a 28 29 31 32 34 35 36 7 38 39 a1 az 43 45 45 a7 49 50 51 52 53, 54 55, 87 58 59 60 61 62 63 64 65 66 o7 68 6 bs bye BIE70 mn 2 2B 74 br 76 8 79 SRRESREs 88 89 90 on 92 93 95 96 7 98 100 102 102 103 104 105 106 107 108 109 110 11 12 13 14 15, b6 BIC BIE116 17 118 119 120 121 122 123 124 125, 126 127 128 129 130 131 132 133 134 135 236 137 138 139 140 41 142 103 144 145 146 147 148 149 150 151 152 153 154 155, 156 157 158 159 160 161 b6 b7c BIE162 163 164 165 166 167 168 169 170 a7 172 173 174 175 176 17 178 179 180 181 182 183 184 185, 186 187 188 189 190 192 192 193 194 195 196 197 198 199 201 202 203 205 206 207 b6 BIC BIE208 209 210 211 212 23 214 215 226 27 218 219 220 221 222 223, 224 25 226 227 228, 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243, 244 245, 246 2a7 249, 250 251 252 253 254 b6 BIC BIE255, 256 257 259 260 261 262 263 264 265 266 267 268 269 270 am 272 273 274 275 276 27 278 279 280 2a 282 283 284 285, 286 287 288 289 290 291 292 293 294 295, 296 297 298 299 300 b6 Ic BIE301 302 303 304 305 306 307 308 309 310 au 312 313 314 315, 316 37 318, 319, 320 321, 322 323 324 325 326 327 328 329 330 331 332, 333 334 335 336 337 338 339 340 341 342, 343 344 345 346 be 7c BIE347 349) 350 351 352 353 354 355, 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375, 376 377 378 379 380 382 382 383 384 Bese 389 391 392 b6 b7c BIE393 394, 395 396 397 SESEERS 405 406 407 408 409 410 au. a 413 aa as 416 a7 aig, 419 420 a2 422 423, 424 425 426 427 428, 429 430 431 432 433 434 435, 436 437 438 b6 b7c BIE439 440 at 442 443 44s 447 449 450 451 452 453 434 455 456 437 458 439 460 461 462 463 464° 465 486 487 468 469 470 ana an 473 a7a 475 476 a7 478 479 480 481, 482 483, 484 b6 BIC BIE485 486 497 488 439 490 491 492 493 494 495, 496 497 498 499 500 502, 502 503 504 505 506 507 508 509) 510 si. 512 513 514 515, 516 817 518 519 520 521, 522 523 524 525 526 27 528 529 530 bs bic BIE331 532, 533 534 535 536 537 538 539 540 541, 542 543, 5a 545, 546, 547 548, 549, 550 581 552 553 555 556 387 558 559 560 561 562 363 565, 567 568 569 570 S71 572 573 574 575 576 b6 pyc BIE7 578 879 580 sat, 582 584 585 586 587 588 589 590 591 592 593 594 595 596 597 | 598 599 601 BaSa8 607 610 611 612 613 614 615, 616 617 618 619 620 621 622 623 be 7c BIE624 625, 626 627 628 629 630 631, 632 633 635 636 637 638 639 641 642 643 645 646 6a7 64g 650 651 652 653 654 655 656 67 658 659 660 661 662 663 664 665, 666 667 668 669 bé pic BIE670 ert 672 673 674 675, 676 677 678 679 680 681 682 683, 685, 686 687 688 689 690 son 692 693 694 695 696 607 698 699 700 701 702 703 704 708 706 707 708 709 710 van 712 73 714 715 b6 yc BIE716 m7 718 719 720 721 722 723 724 725, 726 72 728 723 730 731 732 733 734 735 736 BT 738 739 740 7at 7an 743 744 745 746 747 748 749 750 751 752 753 754 735 756 787 758 759 760 761 bs bic BIE762 763 764 765 766 767 768 769 770 ™m ™m 773 774 775 716 ™ 778 7793 780 782 783 784 785 786 787 788 789 790 791 792 793, 794 795 796 797 798 799 800 801 802 803 805, 807 b6 BIC BIE809 810 811 812 813 aia 815, 816 817 818 a9 820 821 822 823 824 825, 826 827 228, 829 830 831 832 833, 834 835, 836 337 838 839 840 a1 842 843 845, 846 847 248, 349 aso 851 852 853 854 be 7c BIEass, 856 857 858, 859 860 861 862 863 64 865 866 3867 868 369 870 371, 872 873 874 875, 876 377 378 879 880 881 882 883 884 885 886 887 888 389 890 aor 892 893 394 395 896 997 398 399 be 7c BIEza Be 902 BIE 903 904 * 906 907 908, 909 910 912 ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for aperiod of 90 days, or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these acco eferenced files cy ee and before taking any such actions, This preservation request applies to the following records and evidence: A. The conteuts of my communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and ether evidence relating to the subscribers), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subseriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subseriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All connection logs and records of user activity for the requested account, including: Connection date and time: Disconnect date and time; Method of connection (e.g., telnet, ftp, http); Data transfer volume; eee® a User name associated with the connection and other connecti the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. information, including a D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, ‘whether such records or other evidence are in electronic or other form. Ifyou have any questions regardins m pase acet all inauicisa Sngial Agent Co whe can be reached at| or bé pyc Sincerely, a ‘Charles H. Kable IV Section Chief Counterintelligence DivisionAg es fe bE bic» US. Federal Bureau of Investigation Washi: 3BXEIN IS UNCLASSIFIED uy moranrran eoeraner Department of Justice ington, D.C. 20535-0001 August 18, 2015 Re: — Request for Preservation of Records _ p=] : Pursuant to Title 18, United States Code Section 2703(f), this letter is a formal request for the preservation ofall stored communications, records and other evidence in your possession regarding, the following e-mail accounts, pending further legal process. wevausune 10 a 2 13 14 15 ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, ina form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request for BIE BIE bé Ie DEa period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. ‘You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close thé account of the subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files tind records please contact Special gen Jas soon as possible bs and before taking any such actions. bie This preservation request applies to the following records and evidence: A. The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B. All records and other evidence relating to the subscribers), customer(8), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing re¢ords, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form; and C. All. connection logs and records of user activity for the requested account, including: 1, Connection date and time; 2. Disconnect date and time; 3. . Method of connection (e.g,, telnet, ftp, http); 4. Data transfer volume; 5. Username associated with the connection and other connectior the Internet Eretoco} address of the source of the connection; 6. Telephone eailey identification records; and 7. Connection: formation for other computers to which the user of the above-referenced accounts opanezizé, by any means, during the connection period, including the destination I? address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subscriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from ISP or its subsidiaries. 8. _ Means and source of payment for such service (including any credit card or bank account number) and billing records. formation, including D. Any other records and other evidence relating to the requested account. Such records and other lence include, without limitation, correspondence and other records of contact by any person.or entity about the above-referenced account, the content and connection logs associated with or relating to postings, communications and any other activities to or through the requested account, whether such records or other evidence are in electronie or other form. Ifyou have any questions regarding this request, please direct all inquiries to Special Agent Sincerely, Mie Charles H. Kable IV Section Chief Counterintelligence Divisiona? ae 54U.S. Department of Justice Federal Bureau of Investigation Washington, D.C. 20535-0001 Re: — Request for Preservation of Records Dear Custodian of Records: ALL INFORMATION cowranres BEREIN IS UNCLASSIFIED ERIE 11-09-2016 BY JTeaeTe0 NSICS August 18, 2015 TE Pursuant to Title 18, United States Code Section 2703({), this letter is a formal request for the preservation of all stored communications, records and other evidence in your possession regarding the following e-mail accounts, pending further legal process. eorveaursene 10 u 2 13 14 15 16 wv 18 6 bic BIE ‘You are hereby requested to preserve the records described below currently in your possession, including records stored on backup media, in a form that includes the complete record, and records that may come into your possession from the date of acknowledgment of this request fora period of 90 days , or until receipt of a legal court order, whichever occurs first. This request applies only retrospectively. It does not in any way obligate you to capture and preserve new information that arises after the date of this request. You are also requested not to disclose the existence of this request to the subscriber or any other person, other than as necessary to comply with this request, as the FBI's investigation may be jeopardized by this type of disclosure. You are also requested not to close the account of the ‘subscriber, unless requested to do so by the subscriber. If compliance with this request may result in a permanent or temporary termination of service to the accounts described below, or otherwise alert the subscriber or user of these accounts as to your actions to preserve the referenced files and ecors, please contact Special Agen pesto ag possible be and before taking any such actions. ‘This preservation request applies to the following records and evidence: A, The contents of any communication or for the accounts any associated accounts, and any information associated with those communications or files, such as the source and destination email address or IP address. B, All records and other evidence relating to the subseribex(s), customer(s), account holder(s), or other entity(ies) associated with the requested account including, without limitation, subscriber names, user names, screen names or other identities, mailing addresses, residential addresses, business addresses, e-mail addresses and other contact information, telephone numbers or other subscriber number or identity, billing records, information about the length of service and the types of services the subscriber or customer utilized, and any other identifying information, whether such records or other evidence are in electronic or other form: and C. _Allconnection logs and records of user activity for the requested account, including: Connection date and time; Disconnect date and time; Method of connection (e.g,, telnet, ftp, http); Data transfer volume; User name associated with the connection and other connection information, including the Internet Protocol address of the source of the connection; Telephone caller identification records; and Connection information for other computers to which the user of the above-referenced accounts connected, by any means, during the connection period, including the destination IP address, connection time and date, disconnect time and date, method of connection to the destination computer, the identities (account and screen names) and subseriber information, if known, for any person or entity to which such connection information relates, and all other information related to the connection from [SP or its subsidiaries. 8. Means and source of payment for such service (including any credit card or bank account number) and billing records. peer me D. Any other records and other evidence relating to the requested account. Such records and other evidence include, without limitation, correspondence and other records of contact by any person or entity about the above-referenced account, the content and connection lags associated with or