nu". .. ., . A Nun; an?; . t4 445 354:4 [Ir I553, . 4,7; DEE TH RE BEA VICTIM. a ?rig Hm?: :mzNathan Haie - B) Benedict Arnold 0.. ?Judy; 6/12/2014 693000 Jacqui:an across the (9 How manypeople have accesst proprietaryon restricted Informatien compromised Wetlany location: . - Military installation -. US Goverhme?tffacilities ,0 Cleared Defense Contractors 0 Research faeiliiy CollegelUniver'sitym:_ 6/12/2014 Insider Threat- 6 Anyone with legitimate access to information, technology, facilities, or . ll??ll Foreign or anizations. - ianlzed crime nngs, "drug ,carte 5, etc.. all want now: 7 5 Who is the Egl investigating? Cases 0 Whalisthe [?dolng?z Operali'ons a: How does the 5&1 do it? Methods What can the. El do? Cepabiij ?Whasdoes me 551 kngw?e'in I '7 quntermtel?ll?igence G) secunt' '0 IT Security - 20 years in prison - Financial Garn 6/12/2014 A Supervisory SpeCiai A?ent ?1996 - Spied for Soviet U'nioanussia from 1987 - 1992 ?Hall ofShame" {iv Life in prison 7 Ego: Financial Gain; Disgruntled 3? l. Vf? - 155%; Ar *9 . 6/12/2014 FBI ?Halt of Shame? i - Spiede-for'the Philippines frOmf?ZOQOf 10 yea ?ne I Divided Loyalty . 1. Magnum?. p? ?xo. ?u nu an. n. 1. Disgruntled tothe point of wanting retaliate against the government 2. Divided loyalty to a country besides the Rem: . - authorization 5. seeking and/or obtaining clasSi?ed information without a need-to-know ?Um. ?a 9. ,n ?Mu .h -.. mum..- ?a u. n. . b6 b7C 6/12/2014 Espionage indicators (oonf?d) ughorized recordingid 7. Urrineo?ssv A photocopying of classn?edh materials . a Country (or cause) in States my ?a my 6" ?Nu. Is oi??slried Information.? a n?ed-fo?know . I .1 01-26-32 ;rat'w 6/12/2014 .. . a .. awn- a Inwith? ma . I . Raggav.17 fie :1 6/12/2014 .ivrk??r??l'I" Va . . n32; Am? "n gm.? 3 Does NOT ap if the language of the] .contract: 7 - . Ferbids the participation of foreign persons: Gives the sponsor or the other party to the agreementa right to approve pubiica ons resulting from the re ether 7 Otherwise op est'o restrict researchjandj essto .an d' ctgeyr research results -r Both basic and applied research oan_be subject to export controls de endln on the funding sourCe and other de ineate restrictions in'place in a research co 6/12/2014 'l_.data related to cites 7, contract _to develop plasma acuiatcrs for a munitions~ typeIUAV, or ?drone,? to one c?r more foreign nationals,? including a citizen from'the Pecple?s Republic of China." 6/12/2014 6/12/2014 '7 '7 :32 yb?er ThreatAnatyst' '1 25 years old MIT graduate years work experience 7 .tig- Navai Network Warfare Ccmmand, Norfoik. 7 - In '19 days (122E339 0112818) 2* Over 309 contacts an Faceboek, Linkedm, Twitter an Mosw miliiary. in?e?11gance, s?carity - panama}, incia?mg: Gavem m? deamd defame contract ab artists r. Ofiers fa; speaking ,cp?t . van-nuns .n guru .mnew. .. 4; '4 .- 913;;5?: .3 A .41.. .- 4 I: WAS. w? q?om\m?\m 4 up." . i 6/12/2014 b7E .. .7- - . "nu. l-w "2 ?Au-?Win. 1 up ?Hunk-4p .u?iiwa? 1'23;- up . . rem. 12 6/12/2014 N?edtp Km G) Each of us practice "need to everyday in our private lives Bank account numbers . abo'ut'your research befgre you share any with them 0: Don?t just take theirword far" it .gxpensive me}. Eabor inlenslve - "Cutting edge' 7 r? Biggest polemial payoif - new technoiog?les. markets Anywhere we have an advantage; 6 Notjusl military technology 7 - Could be anything from growing food to weath simuialion to . dvanced weapons - ?av?sthe difficult pioblems Mote {Mum mot xpenslvo 13 (B The sogn?r? prebiem is the sooner it can be daalt wiih <9 You s?bgl?i'regcrt any suspici?us activityieccurrences . gaymu.- Qua,? 3m um.? 3.0 v.l 7 'f'inves?gations vanish-m} ounteregpeona'ge Section onnterinte?gence Division . 6/12/2014 $511151: I w. 14 b7E b6 b7C Adjudicative Guidelines (9 Foo-Determining Eligibility for'Access to Classi?ed information (12/29/20 5) Allegianeeto the us. cial Considerations - Altohol Consumption/Drug inVoIvement - Conditions - Climinal Conduct - - Handling Protected lnformalion?f- - qugsidertivities 1 Use Of. Information Technology Systems Of: complete and u_nrs?viierving loyalty 6/12/2014 ll u? Insulin: 1.11m. was?: JWM Af?naimmi" 15 6/12/2014 Drug lmfolvemel rlng) quilted at leasl lwo olher soldlerst paniclpaleln espionage: Rodgtipk ?amsey (pan of lhe Clydo 1p llrecrullEd.ye5.lth 1,4 ,gf ??vle?d ?l'q?rugs, but so mucmna?ra?e 7 Ramsey?Army alreadyshown a propensin lp? violate Army regulations. Anyone In the was willing to lake . . drugs on a regular basis has In be willing l'ol ll som?e?jkfn?d bl riskand has In be willing 10' break lalinns. That's lhe_slarlin 7 ugnr?liable,?or rule-breaking behavior?hand-rs 16 6/12/2014 o'ri 4 Of?ce of'N'a?val' ritelligenc? .1: provided classmed information to Jane?0ften wilt apprbach targets with lucrative - job offers overseas - Consulting hr ?n hum 90v? b7E b7E 17 6/12/2014 v, 7 _of our nationa 7 employees shall be: - Reliable-f". Trustworthy 7 . 0 Of goodIEOnduct and character Of com l" and Unsure 7 . to the U. States - . mWiilbeiimited 7 - - ask b7E Get names in original language (9 Finances (Determine if there are any. issues) '77- it is dif?cult to livelwork overseas for years withouta 7 foreign bank account 7 7 (9 Ask for details on foreign organizations, including: Name of organization intlinglish and original la uage Membership in then 1 ii Foreignintelligenpe services often use orga 00ver, or for i (9 Follow up on foreign-contacts (contact info) 0 ?Includes: email contacts, social networking contacts, etc. 6) Contact with foreign intelligencelpolicelsecurity - - often use police 18 "@174 year sentence 7 PRCEMB spokesman The PRC states it ?never Glenn Shrive' Studied in ha? 9 .Took'Dos'F'so. Mn??iapplied to CIA engages ilseif a tivi?es that?il harm other 7 Guilty plea 1roi201o?(" dhspiracytotranSmit'NQI 6/12/2014 b7E b6 b7C u. u. "hum. b6 b7C b7E 19 Chyu "Ds d' Liu Dow Chemical 5 7? Michael Mitcheii-? DuPont . Meng Hong - DuPont '17 Adversary - Wants the moheylmazerials have now 0 Competitoir'ii 6/12/2014 . Wantsto' ajse away your axis?) 0? a? ?Tech witiuf'ss Used ?as Trade. Show Joint 7 c9 Unsolicited-requests for information (9 Acquisitions -- Unsolicited requests for research assistance 6) lnlemati?ori?al Conventions symposiums 6) Trash -. 7 7 7? Hacking 20 b6 b7C b7E 6/12/2014 0031; of Doing Business Take Responsibility erMany companies View Know what is most Irmiorlanlto your Espionage as ?the cost grin-Ina business". 5 - mammth I I . r. mum Imp-mqu in. the fewer?tile Em?nHEI?-m?gm?u mp number people that J'E'ra access to It companies in: ma than $1 Trillion per-year 0 your company?s the cost too great to bear 1?It'll is what your compelitorswill be after. . Then itwill be too Ialel . ,l "s a? a u??i?4 . vac-1 5v "5 v. ?a D-p?hi?n51.4% adl II I 1- Ird'l' . -.I.I lb In" pull it p- I b7E .. Mingati mg the Th rear (9 Education and training oi workforc- [Ihmnuler banners. am prdiscl?sure .. um: um nuns-n Irl'pmeu gum um. m- - mum-11. rely solely on thes?to'pmtect you "rhi- get what you inspect. not what you expect E. swam must utilize active alerts 21 6/12/2014 b7E 2.. I .. nuun-uAh . .u up .5. Ivawvo- .I (9 Identify "high risk" users: -. Sighi?cant fpreign in?uence - Underrpei'forming (and advised as g. 0 Facing ad Vlnistrativeldisciplinary action 22 6/12/2014 b'7E regarding??l to determine the source of the g??hcy emp'loye and_reco_rds '1 to a Efore?lgn 6) Avoid al?rting subjects to the i- investigation 23 6/12/2014 - Security 7 \?olations A, historicai exam communications 3 aci?c Japanese advance si'n?e Pearl Harb Philippines Malaya Singapore beginning of June, 1942. Dun,? 533? ?'95 ('?dmesm - Japan's planvwas to set a trap fortheU.S. to lure the Thailand . . . I Hong Kong aircraft earners Into reach - to US. diecov?ered Japanese were elanhing another attack G) MichaelAIten ~Navy (-3 Stephen Baba- Navy -r (9 Christopher Boyce Conlracto to Joseph [-ie ch -?Army I 9 Frank Nesbiu?- Air Force" Charles Statten - Army <9 Henry Spade Navy :9 Michael Tobias Navy G) John Waike Navy e, 'Jerry Wh?t Navy 6/12/2014 fiGave; 0mm nioatmn Platue/Teghniques ChariesAn?zalone - USMC - (9 Christopher Boyce Contractor <9 Jeffrey Carney "Air Forcele (9 Jamee Hat! 11! -Army co FranciscoMira ?Air Force G) Frank Nesbilt Force 6) Ronald Pelton - NSA Roderick Ramsay -Army (9 John Walker? Navy 6 Jerry whiiworth - Navy ' 6/12/2014 6) CharlesAhzalone - USMC (Equip. manna-la) Stephen Baba- Navy 1 9 Christopher Boyce ?Contractor (9 Henry Spade Navy (9 Michaeerobias and Francis Pizzo- Navy - -- John Walker? Navy ?I?ve; ne'er?1 thinka abOut yo job_'and what yoiu?re trying to Russia shy Aldrich Ames to Chief of the CIA Mole Tea 26 6/12/2014 Ice-Social Media 9 :fiyou use it, neV?r make .. r? .-. - o'v?s within the gates free!? his .st ,rustling thraughihe alleys! heard in the halls of. *3 . governmentitselg For the traitor'speaks in accent . - fa} itiar to his vf?fims and he week?s their fa garments.24 a?statesm?n MarcusT{was \I?nun?. ru- - Hunk?. . I by Mark Parisi It's a Jungle out therel WA, 9066qu 5"qu BY SPY MLIATEEH 111: pack becam- Iutpklous: The tumour was asking too may quu?anl n'baur tom's hunt 27 NHLJE emuzwr BE AT omens, Lona? In m? Th-u1 Jam-I:- 4 can-1m 26w.? "Look, You had ?ve bones right? Your friend Zooky comes over, stays awhile, then leaves. Now you have four bones, don?t have to Rs??rf?'?f?on ?ghi mCanoonSlod"_ 1 I?Anci jy?thw are we going $11th if every time I buy ea it?" 6/12/2014 28 FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1261025-0 Total Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Deleted Page(s) = 36 4 - b5; b7E; 5 - b5; b6; b7C; b7E; 6 - b5; b6; b7C; b7E; 7 - b5; b7E; 8 - b5; b6; b7C; b7E; 9 - b5; b7E; 10 - b5; b6; b7C; b7E; 11 - b5; b7E; 12 - b5; b6; b7C; b7E; 13 - b5; b6; b7C; b7D; 14 - b5; b6; b7A; b7C; 15 - b5; b6; b7A; b7C; 16 - b5; b6; b7A; b7C; 17 - b5; b7E; 18 - b5; b6; b7C; b7E; 19 - b5; b7E; 20 - b5; b6; b7C; b7E; 21 - b5; b7E; 22 - b5; b6; b7A; b7C; 23 - b5; b6; b7A; b7C; 46 b5; 50 b5; b6; b7C; 106 Referral/Consult; 107 Referral/Consult; 108 Referral/Consult; 109 Referral/Consult; 117 Referral/Consult; 118 Referral/Consult; 187 b5; 191 b5; b6; b7C; 204 Referral/Direct; 205 Referral/Direct; 418 Referral/Consult; 419 Referral/Consult; 443 Duplicate; 444 Duplicate; - b7E; b7D; b7D; b7D; b7E; b7E; b7E; b7D; b7D; b7E; b7E; - xxxxxxxxxxxxxxxxxxxxxxxx X X X Deleted Page(s) No Duplication For this Page X Fee X X xxxxxxxxxxxxxxxxxxxxxxxx :1-\".""..,i ·1:•..,, If°¼ ...... ,.,,, •.,,. • :.,.r, i' ! :,, n 11.,11u ';t ...... ,.~,,,. ,: , 11o':.,•(' :; \J,,iH~:~.,. .j~. '.11ct,f\,~f:l1 ,\U",.=',t~;;:H ..,i-..-i:;,.r•.•W""i t: /\ • (.id~,:,. ,it l,,\._,-,i,E., ~11:,-.:.,it :\,t :-.,1i,',1"•1•\" '·,j.,',,l·.-·t· ,\!,,, ;; "i:l\ ·.\•\:.t ,..:f"i'.''" ·:.,,i1.t,,,,H,.'-,,. 1tit,_JfJL ·:,L·\!,.,_ 1r;,' !·• ,,'l,\t' ~!l'.'i"•t..,,·~ \ ···l, ...1\ 'I\; ,\\?• • ! ~,1,. :,,: !; ; • , ,. '\ ' ~ • h •:.,. •••• ,· :• ..... i:; i :--i·,;.;,., -?-.,1 '\, ,\1: "..\:.', ,:.: ."•,,!~1 :'il't•', 'f \,V, -...~:•to,"'\(I: ·1r 'f,'\,I !f•',, ~Fi ., .... r", -1.•· '!•i.h',·~ ,_sr" . , .....,,..,"~-·,· •• :,J.'-:: :,:. -:cr:~.... ~r hlnitcdStates ,Senate C\Hv1MITH~ (JN iHE .11.li>ll'.i,\H, ll\,, •,, ,i,;',\A,,',, •.' • •, •• ; • ,t: ~ ,,- •• 111•,,,,1 .,, 11 ...... ,,. ,, •••• l't:~ , .• ~·· • ,.: •• , • ~· ......... , .. ,! .. , ••• f Wi\SHIN!lHlN :,•, ;,, ll\. ~llh l\l ti,' I~ , :.• December 17, 2013 VIA ELECTRONIC TRANSMISSION The Honorable James B. Corney, Jr. Director Federal Bureau of Investigation 935 Pennsylvania Avenue, N.W. Washington, DC 20535 Dear Director Corney: On October 28, 2013, I received a letter from the Federal Bureau of Investigation (FBI) in which it indicated that it had collaborated with the Office of the Director of National Intelligence (ODNI) on two training videos about the FBI's :National Insider Threat Program. The videos, titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence Division and ODNI's Office of the National Counterintelligence Executive (ONCIX). The FBI has also produced other insider threat materials, such as the brochure, The Insider Threat: An Introduction to Detecting and Deterring an Insider Spy. 1 As I understand it, the National Insider Threat Program is the result of Executive Order 13587, issued by President Obama in October 2011, which established an interagency Insider Threat Task Force, to be staffed by the FBI and the ONCIX.2 It also directed Executive Branch departments and agencies to develop their own insider threat programs. The President subsequently issued a Presidential Memorandum in November 2012 transmitting the National Insider Threat Policy and setting forth minimum standards for departmental and agency programs.3 These efforts have subsequently received press attention, some of which has focused on concerns about whether the program adequately protects whistleblowers.4 1 Federal Bureau of Investigation, The Insider Threat: An Introduction to Detecting and Deterring an Insider Spy, http://www.£bi.gov/ about-us/investigate/ counterintelligence/insider_threat_brochure. 2 Executive Order 13587 - Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safe~arding of Classified Information, October 7, 2011. Available at http://www.whitehouse.gov/the-press-office/ 2011/10/07 / executive-order-structural-reforms-improvesecurity-classified-networks-. 3 Presidential Memorandum - National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, Nov. 21, 2012. Available at http://www.whitehouse.gov/the-pressoffice/2012/11/21/presidential-memorandum-national-insider-threat-policy-and-minimum-stand. 4 For example, Marisa Taylor and Jonathan S. Landay, "Obama's crackdown views leaks as aiding enemies of U.S.," McClatchy (Jun ..20, 2013), available at The Honorable James B. Corney, Jr. I)ecember 17, 2013 Page 2 of2 As you know, I strongly believe that whistleblowers play an important role in safeguarding the federal government against waste, fraud, and abuse. You too stated in your confirmation hearing that you believe whistleblowers are a critical element of a functioning democracy. Their willingness to come forward contributes to improving government operations. They often put themselves at risk of reprisal from their employers, sometimes being demoted, reassigned, or fired as a result of their actions. Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal employees may not be retaliated against for reporting waste, fraud, and abuse.s Accordingly, some agencies have taken steps to prevent the insider threat program froni. chilling whistleblower communications. For example, the Office of the Inspector General for the Intelligence Community is developing training that integrates whistleblowing into the agency prqcesses, making the Intelligence Community whistleblowing and insider t~reat programs mutually reinforcing. In order to assess whether training materials on the National Insider Threat Program provide adequate guidance on protecting whistleblowers, I respectfully request that you provide me with copies of Betrayed and Game of Pawns, as well as copies of any other training materials regarding the National Insider Threat Program or any FBIspecifiC'insider threat program. I would appreciate receiving these materials by January 14, 2014. I know that you consider transparency to be an important value, and I trust that transparency on this issue will benefit both whistleblowers and our national security. ___ ___ Should you have any questions regarding this letter, please contac1.____ bf my staff 9 I ..... Sincerely, ~~ Charles E. Grassley Ranking Member cc: The Honorable James R. Clapper Director of National Intelligence http:/ /www.mcclatchydc.com/ 2013/06/20 / 194513/ obamas-crackdown-views-leaks-as.html vm VHl. 5 Presidential Policy Directive 19, The White House, October 10, 2012. #. Uccy-- b6 b7C FY 2012 Request to Congre Overview March 24, 2011 ~ECRET/INOFORN Foreign Intelligence bl b3 •----- ------ - bl - b3 ------ b7E - ---- ll If --- -• tnsrder Threat remains the greatest vulnerability to the USG. -------- - to will acquire ·i.wareand related contractor support for initial audit generation, collection, and monitori"ng capabilities. ---- -- 101 uvvc::11 c::, :::,u •This initiative would provide useful analysis on insider threats and can provide early warning signs that can prevent the development of such threats. In addition the resources would allow the FBI to share information with the IC. 7 SECRET#NOFORM Week of August 1 - 5, 2011 Updated: August 5, 2011 (7:00 .::cc:.::"-····- Date · Time · ·Event FBI To.pie Other _·---- ·Participants ... Participants Monday, August 1 9:30 a.m. Senate Select Committee on Intelligence Staff Briefing I I NIA I Insider Threat Study l Security; SC Randy Coleman-CD; I I Monday, August 1 11:30 a.m. Staff Briefing-Senate Homeland Security and Governmental Affairs Committee Community Outreach Efforts/Countering Violent Extremism (CVE) u9 Senate Select Committee on Intelligence Staff Briefing-I I Insider Threat Investigations & prevention coordinated by CD SC Randy Coleman & others DOJIOLA~ DOJ: OLD I 1Civil Rights! I I; CRSI EOUSA/~ 9:30 a.m. I I I I I NIA I DOJIOLAI I I I! I DOJIOLA:I Tuesday, August2 I I I I b6 b 7C I ALL I~TIC!N CONTAINED I U.S. Department of Justice Federal Bureau of .Investigation Washington,D.C. 20535-0001 December 31, 2013 Honorable Charles E.·Grassley Ranking Member Committee on the Judiciary United States Senate Washington,DC 20510 Dear Senator Grassley: This responds to your letter to Director Corney dated December 17, 2013, in which you requested copies of two training videos about the FBI's Insider Threat Program. The videos. titled Betrayed and Game of Pawns, were developedjointly by the FBI's Counterintelligence Division and the Office of the National CounterintelligenceExecutive (ONCIX). The videos are enclosed and are considered law enforcement sensitive for official use only, so we would requt:st that you not disclose the videos further withot1tcontacting us. If I can be of additional assistance in this or any other matter, please feel free to contact me a~ I b6 b7C Sincerely, ~D~ Assistant Director Office of Congressional Affairs Enclosures I - Honorable Patrick J. Leahy Chairman Committee on .the Judiciary United States Senate Washington,DC 20510 1 - Honorable James R. Clapper Director of National Intelligence December 31, 2013 Honorable Charles E. Grassley Ranking Member Committee on the Judiciary United States Senate Washington, DC 20510 Dear Senator Grassley: This responds to your letter to Director Corney dated December 17, 20 I 3. in which you requested copies of two training videos about the FBI's Insider Threat Program. The videos, titled Betrayed and Game of Pawns, were developed jointly by the ·FBI's Counterintelligence Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are enclosed and are considered law enforcement sensitive for official use only, so we would request that you not disclose the videos further without contacting us. If l can be of additional assistance in this or any other matter, please feel free to contact me1._ ___ b6 b7C ____.! Sincerely, Stephen D. Kelly Assistant Director Office of Congressional Affairs i nc osures lkp. Di11.'r'E FA11-Ac1m. 1,\l>·CTICI ---· --· • \l>-t ·-·· nm. _r:·Horiorable Patrick J • Leahy , ~.-·Chairman . ms --·comm1ttee on the Judiciary l"h·inlcll. ___., -··---:-t"ln,,nnis;,;-- · Umted States Senate Crim. hl\". W sh• DC 20510 C\'hcT --- ---, •. -- a ··-1ngton, Finm1cc 1 H-0fl0rable J ameS R. Clapper .lnlh, Res.· -r-·· lnsrc~tinn -- -DireGtorof National Intelligence Ill\, lcch. 1 ::r:-. F.BrExecSec ' Room 6147 (TRIM# 13/00/4459) ·'"'"""'') Oil oft"~~, •11 ... r~h~ffKelly · 1>11.. r~,;;;:;;:1··.: Ms:·Beers tlll' l'uh. ,\llj; .• E)D,A M on.,•f'l'ml: k,.;'i,.~-~:ember ' S FO ]der 1 ,\1>·1111 c11•• : \l>,IJ·S H llir.: -· .\tl111, Sen•. lie'\: Memt. Sl.'\:Urit, Traininµ _.._________ _ on:ofEEOA --- ..------ MAIi.ROOM D U.S. Department of Justice Federal Bureau of Investigation Washington,D.C. 20535-0001 December 31, 2013 Honorable Charles E. Grassley Ranking Member Committee on the Judiciary United States Senate Washington, DC 20510 Dear Senator Grassley: This responds to your letter to Director Comey dated December 17, 2013, in which you requested copies of two training videos about the FBI's Insider Threat Program. The videos. titled Betrayed and Game of Pawns, were developedjointly by the FBI's Counterintelligence Division and the Office of the National CounterintelligenceExecutive (ONCIX). The videos are enclosed and are considered law enforcement sensitive for official use only, so we would request that you not disclose the videos further without contacting us. me aq If I can be of additional assistance in this or any other matter, please feel free to con.tact I Sincerely, ~D~ Assistant Director Office of Congressional Affairs Enclosures I - Honorable Patrick J. Leahy Chairman Committee on the Judiciary United States Senate Washington, DC 20510 I - Honorable James R. Clapper Director of National Intelligence b6 b7C December 31, 2013 Honorable Charles E. Grassley Ranking Member Committee on the Judiciary United States Senate Washington, DC 20510 Dear Senator Grassley: This responds to your letter to Director Corney dated December 17, 2013, in which you requested copies of two training videos about the FBI's Insider Threat Program. The videos. titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence Division and the Office of the National Counterintelligence Executive (ONCIX). The videos are enclosed and are considered law enforcement sensitive for official use only, so we would request that you not disclose the videos further without contacting us. If I can be of additional assistance in this or any other matter, please feel free to contact me a~ I Sincerely, Stephen D. Kelly Assistant Director Office of Congressional Affairs EllC JOStlres llcp. Director FAIMdm. . 1,\1).(;Tl('I ··-··· - •••• \().( nm, .-r::uo,iorable Patrick J • Leahy Chairman • ---committee on the Judiciary l'tn111c11. tf . d S crncon,,;,;1;-· nrre tates Senate l'rim. hw. Cvhcr ___ --- _ ..W __ ash' ...1ngton, DC 20510 l'inm1cc 1 H Info, Res~· ·r-•· -011(:)fable JameS R. CJapper ""rc~rion -- -DireGtor of National Intelligence In, h:ch. '""""'."'.~ :r:.,_EB[ExecSec > Room 6147 (TRIM# 13/00/4459) I )II, ol ( 'e'f~· 1111 ... r~1r~ffKelly t,1un, ,,11.,,nn,,·11. J·:: M:cBeers t >1l.('uh. ,\Iii,.• eaA M b ' F Id on:,11'l'm1:kctp. em er S O er I •\l)-lt1ldl. : \ll-1 I·<: \-,L IJir.: • -__.\dm, S~I'\'. 1·J1s .• ~-'='~- lh.\.'.J\fontt. Sc..:urit, Training_________ ..,__ on:ofEl::OA ___ .,___ _ MAIi.ROOM 0 b6 b7C Congressional Affairs Office Congressional Event Date: Date Entered: Classification Level: I .0~110,?Q.13- j2013-280 Contacts F 9P~~~~ti:'._e____@ ·- Q Brief Type: Member 1 Event Date: !_________ _. Entered By:.. Topic: Other ·---- r 6/6/2013 Unit: r--------,. __l - - -f# of SAC CV ......J Visits: Event Time: r---o l 12:30 PM Division: ____________________ Person. DOJ Contact: Part ici pa~:: u ]cLUI Insider Threat/ Bo Jiang/ Shane Todd OCA Contac -~e~cti::'~__ I ,!:::::::;;::::;::::=::;=----------------1g~b V1~::~t Lisi! _ b6 b7C Attended: Date: 16/6/2013 SC Mark Bartek ......... It ..... o• t Other Participants: ---~------------------------none Comm!ttees /s ubcommittees House Appr~priatlons Subcommittee on Commerce Justice Science and Related Agencies(HAC CJS) Members/Staff: Rep. Frank Wolf, staffel.._____________ _ b6 b7C Executive Summary: !_______ ,Insider Threat' .. I ....,! Details of Event: w,,andstaff·1\ tpslderThreat,m,ramto On06/060013lbeFBInmvided a dassi'edbrieWlA IA Ben Frank Follow Up Action: none Attachment: Q b6 b7C b7E Congressional Affairs Office Congressional Event Date: Date Entered: JUnclassified Classification Level: '03/·121?01'41 L"_QP,r.?ac~y_e _____ o J2014-600 () Hearing ( ) SACOJ () HQ CV O FOC @ other -;:::===::::_____________ -----~Visits: BriefType: Event Date: Entered By: Reactive.·--' ---- ·o Briefing Topic: Contacts ....,r l.________ 3/12/2014 Unit: l # of SAC CV Event Time: jcLU II I that he did Acknowledgement from Grassley staff~ not respond to FBl's offer more than a month ago for a briefing on ·the matter of Insider Threat program, and request for a briefing. b6 b7C Division: _,.==================;;r---------------------__. OCA Contact Person::,._________ DOJ Contact: Date: Attended: FBI Participants: Other Participants: Committees /Subcommittees Members/Staff: ._! ____ __,!Grassley staffer b6 b7C Executive Summary: ,.___ _.re lnside(Threat program brieing Details of Event: Acknowledgement from Grassley staffe~ lhat he did not respond to FBl's offer more than a month ago 'for a briefing on the matter of Insider Threat program. Agent! ! renewed the offer of a briefing,! agreed. Will follow up with prospective date/time. I Follow Up Action: Attachment: b6 b7C Congressional Affairs Office Congressional Event Date: Date Entered: C Classification Level: '04/0.11~Q1~' Briefing (•J Hearing O SAC0/ _fessilled 0 J2014-612 ':'; HQ 0/ 0 Contacts ____ f!!) Reacti~;-· Proactive FOC 0 Other ·---------------~-~-:--_-;;:.::.::.::=-·=::,-~· -Member BrlefType: 3/24/2014 Event Date: #of SAC CV Visits: Event Time: Entered By: Topic: J: ,_! _______ Unit: __. HPSCI FY 2015 Budget OCA Contact Person:,__ _________ ·-! JO 4:30 PM b6 b7C )CLUI , Division: jNSB _. DOJ Contact: )NIA Date: ]4/1/2014 Attended: FBI IEAD McCabe Participants: Other Participants: Committees /Subcommittees joHs-i&l,_ ___ _. b6 b7C House PermanentSelect Committeeon lntelligence(HPSCI) Members/Staff: Miller, King, Schiff, Rooney, Pompeo, Conaway,Nunes, Heck, Himes, Sewell. Bachman Executive Summary: Fiscal Year2015 HPSCI Member brief on FBI budget Details of Event: The brief was held al a classificationlevel that precludes most informationdiscussed from being entered into this log. Mr. Miller acted as Chair and opened the brief with positive remarks and praise for the FBI and a negative openingstatement regardingDHS-INApast performance. He primarily wanted to hear from FBI about the state of ,the InsiderThreat Program and current levels of resources dedicated to Cyber matters. Mr. King left the Hearing immediatelyfollowing roll call and did not participate. Mr. Shiff mainly asked about FBI plans moving forward for 'InsiderThreat c ber and surveillancematters. Mr. Conawa ask d about NSRP. surveillancecapabilities,the FBI All of his questionswere answeredwith no get.,_ac-s-.--r"".H'"'e-c"'k_w_a_s_c_u_( .. 1o_u_s_a,..bo_u..,.t_w.,.h""ic""h-a-re-a-s""t""h-e""B,..u-re-a-u""'is-w-::"!!ilting lo accept risk, in light of decreasingbudget. No get-backsfor Heck. Ms. Bachman'sonly questions were about FBI linguists and were answeredto her apparent satisfaction. No get-backs for Bachman. More details are included in the TS/SCI level IMS. b7E Follow Up Action: For Mr. Miller-Are all FBI computers,both NIP and non-NIP, auditable?! bdvised he would provide answer after confirming. For Mr. Schiff-Wantsspecific percentageof FBI CT work bot.hbefore and after 9/11,! advisedhe would get actual numbers. I Attachment: Q b6 b7C Congressional Affairs Office Congressional Contacts Event Date: f ·.Q5f?9/~014 • Date Entered: Event.Date: Entered By:._!________ d UnClasslfie r--(~~r~5.t~~e ....~~·~ ?~-~=-;ctive }2014·698 Brief Type: Topic: I .fl1cat1on . Level: Class1 4/4/2014 4/4/2014 Unit: __. Event Time: jcLU H •Briefing for Grassley staffers re9arding FBl Insider Threat Program OCA Contact -------------------------------Person:.__ _________ DOJ Contact: Partloipa~~' ~= b6 b7C Division: __, Date: J Attended: 1"1 .._____ _. Other Participants: Committees /Subcommittees Members/Staff: b6 b7C Executive Summary: Briefing for Grassley staffers regarding FBI Insider Threat Program Details of Event: Briefin for Grassle staffers regarding FBI Insider Threat Program. This briefing was coordinated in advance with staffe .._ ___ ..,...wh reques ed a briefing speclficatl on the FBI Insider Threat program - no other topic was propose or requested b o be brtefed. After U • duced himself and noted his role among other things as lotthe Insider Threat Task Force, sta e opened with a remark that FBI videos did not distinguish Insider Threat from whistleblowers. Agen __ .,..... __ _.eminded staffers that FBI was there, per j !request, to brief on the topic of Insider Thre,<3,!.!::12jlrarn. and invited staffers to ask questions regarding the Insider Threat program, and noted lo staffers that Uq__Jwas not there to brief on matters regarding ~blowing. Reference was made to a website that may provide guidance for propspective whistleblowers. UC j__Jloted that. as far as he knew, if someone is a whistleblower then any investigation under Insider Threat is suspended; he further noted that he was not asked or prepared to brief on whislfeblowinq, and was ready, willing, and able to to proceed with briefing on the matter of the Insider Threat program. Staffer~ !efused to keep to the subjec~;fJosiciec Threat program, and instead badgered exclusively for statements regarding whislleblowing. Agefl!_ again reminded staffer nr--1 that they had requested nnh,foeao ,briefing on the Insider hreat program, and Age ...,_...,......,. .. rea to 'flie""sla1ferstbecooreot of staffe[ email that requested a briefing only on the topic o ns1 er hreat program. Agent! further t~rs -=au.·uney want a briefing in the future on whistleblowing, then they should make that request. StaffersL__Jnd efused and continued their badgering with questions unrelated to the Insider Threat program. Grassley _______ ....,...ontinued bad faith rendered the purpose of the instant briefing null. and FBI departed. al 1 1 I ! Follow Up Action: Attachment: •.Q I b6 b7C NSI:CG Congressional Affairs Office Congressional Contacts Event Date: Classification Level: Date Entered: )2011-96 I@Briefing .0 '---· Hearing () Brief Type: Entered By: Topic: SA~ ;;--0-H-Q JciassiReel ~ti~~~---, O_Pr_o_ac_ti_ve ____ CV 0-F-OC-- () Ci; ReacUve _ # of SAC CV ·------.,.--=====::::::::.--·-----'Visits: 3/24/2011 Event Date: l JO Event Time: J·• I Unit: }cLUI Senate Appropriations/Commerce, Justice, Science subcommittee staff briefing, re: FY 2012 Budget Rollout (.;laesiReel~ OCA Contact Person: ._______ b6 b7C ]FD __, !.._ _____ _ DOJ Contact: Division: Date: )3123/2010 Attended: . • FBI :DAD.Janicie La:mbert (FD) JFDt Part1c1pants: I. I .. ~ .. :~. Other Participants: Committees /Subcommittees NIA Senate Appropriations Subcommittee on Commerce Justice Science and Related Agencies(SAC CJS) Members/Staff: b6 b7C .. s=!a:.:.:ffl.!:==::::;=:~I, (majority staff clerk-Sen. Mikulski) (majority staff- Sen. Mikulski) I Executive Summary: Details of Event: ~T/!401'019<1Q (U) SAC/Commerce, Justice and Science (CJS) subcommittee majority staffer were briefed on the FBl's FY 2012 Budget request by FD's DAD and three FD/~B-ud"'"g-e"'"t-s~ta~ffr-. _______ __, · ~The briefing was very well received by the SAC/CJS staffers. The "get backs" from FD to the staffers include ·the following: justification information on the-construction base figures, including the shortfall~ ,construction cuts; a "cheat sheet· version of budget figures for Sen. Mikulski's use; information on the ·Insider Threat" portion of the Foreign Intelligence budget, i.e., Is it a new initiative or included in the base funding figures: a ........--..,,...---...-"l"'"n unclassified version of .request for a demonstration of the ne 1.-------.-...the PPT presentation used for the brie mg; an , a request for a nefing on the proposed closure of several Resident Agencies (RA's), as well as a map of the FBl's Field Offices.~.ii~§'.!'IM8Fefitl4 b6 b7C I b7E Follow Up Action: r 1· Justification information on the construction base figures. including the shortfalls ~onstruction cuts; 2- a ·cheat sheet" version of budget figures for Sen. Mikulski's use; information on the "Insider threat" portion of the Foreign Intelligence budget, i.e., is ii a new initiative or included in the base funding figures; 3- a request for a an unclassified version of the PPT demonstration of the nef ahd,5-a request tor a bnehng on the proposed closure of several Resident presentation used for thl! bfleling; ,Agencies (RA's). as well as a map of the FBl's Field Offices. !4· Attachment: 1 b7E Congressional Affairs Office Congressional Contacts Event Date: Classification Date Entered: Level: )unclassified 0 }2011-244 Proactive !0 Briefing Brief Type: Event Date: Entered By: Topic: n._ _________ ., ] 5/25/2011 Unit: Event Time: jcLU II 1BoslonSAC Richard Deslauriers Courtesy Visits • Daf 2 of 2 b6 b7C J Division: OCA Contact Person:'"---------DOJ Contact: JNiA Date: J Attended: FBI ]Boston SAC Richard Deslauriers Participants: Other Participants: i-,.,.-----------------------------None Committees /Subcommittees Members/Staff: b6 b7C Executive Summary: Details of Event: I SAC Deslauriers conducted courtes epresentalives, Senators and·lheir corresponding staff: Rep Michaud (D • 2nd ME._ __ ,...,......,...,..--......,,,....... Rep Keating (D - 10th MA)/Garreli I Senator Ayotte (NH)/Samantha o erts o n awrence; Rep Langevi . Hake & Christopher ~ Rep Keating (D • 1oth iRep Olver (D -1st M Sen Scott Brown (MA)/ en J. Reed (Rlj ~:; lCJbilebruse (RI.~.,.___ ..,..-._en John Rep Mic au requested that the , Rep McGovern (D - 3rd SAC cons'"u""t-w"'"1t ......,..a ..m-e',_s_.Attorney to review the States repoiroowmg an officer-involved shooting at a VA hospital which resulted in the death of one of Rep Michaud's constituents (constituent's family, also constituents, are petitioning for a federal review). It was fun lo note that Rep Keating's office was once occupied by John F. •Kennedy. Senator Ayotte was extremely supportive.of the FBI and very knowledgeable about FBI-related issues (such as the Patriot Act). She expressed strong support to help the FBI achieve its mission. She mentioned a visit she had earlier in th~ day with an executive with Microsoft who explained to her that Microsoft has developed a new imaging technology that could be used to combat child pornography. Microsoft would like lo offer this software to Mlt MAI : v~:~~i~:~::: cont;,I ._J ::lelpful. Sen Ayotte's office provided.the followi;a ~hefede~algove~nmentfor free ifth 1 mtm:at100 at Mtcrosoft for folloW·Ufl ------· ..._Microsoft Federal Government Affa1rsJ __ ! • microsofl.com. Repe 1 , 1edthat his career aspiration as a young man etore 1s accien( was to ecome an FBI Agent. His staffers had follow-up issues regarding Cyber threats and Cyber ·security. Specifically mentioned was the recent Cyber IG report that was critical of the FBI, yet the staffers' interaction with the private sector implied great confidence in the FBl's abilities to investigate intrusions. The other slaffej jwanted to know what more the FBI is doing or could do to prevent future problems like "Wikileaks". The re uested a " e back" re ard·ng the National Insider Threat Program and SAC Deslauriers mentioned tha.._ .........,......,......,--,,,,....,-.,.,,..,.....,.,.might be good choices for that. Sen Whitehouse mentioned that he wlll be sponsoring leg1slal1onwit Sen Kyladdressing "Cyber Security Public Awareness" and wanted to know more about what the FBI does in that arena. Sen Whitehouse's biggest concern right now is that when someone becomes a victim online (e-mail, Internet, etc.) they don't know where to tum for help. Sen Whitehouse wants to make sure that the government has solutions to offer the public when they find themselves as online victims AND he wants the.public to know (public awareness campaign) immediately where they should turn to find that help. All visits were friendly and pleasant. A~t up appoi~r SAC Deslauriers with Representatives Neal (D- 2nd M~ !(D- 8th MA1.,_j' • 1St ME)'L__J' • 1st NH) and Senators Snowe (ME) and b6 b7C Congressional Affairs Office Congressional Contacts Shaheen {NH) were unsuccessful. Rep Frank (D - 4th MA) declined an invitation to meet with SAC Deslauriers in 'D.C. because they have met each other on several occasions previously. Follow Up Action: None. Attachment: Q IJKCLASSIFIED rn 03-01:J-2016 BY NSIICG lr22M4.15KB!5 Congressional Affairs Office Congressional Contacts Event Date: bate Entered: 1 8/ /2011 QP.r9acti~-- 8/1/2011 Event Date: Entered By: Topic: L__ Jk',:-;o""'s ...,.1 ...2""'r?.-O_-j,1'""'r,..,..~ J2011-341 Brief Type: j ~- - 1,1.i;sifled- Classification Level~-·- ,,,;- .J. ... Unit: .I --·- - .·. .. 0 ~~~!i_':'.e __ ·-r Event Time: jcLUI Insider Threat Study Division: JsECD OCA Contact..--------,.----------------------Person:L--------' .===-==-~r------FBI Jue _.jSC Patrick Reidy Participants: DOJ Contact: 1..I Other Participants: Date: j7t27/2011 b6 b7C Attended: ___ N one Comm!ttttees Senate Select Committee on lntelligence(SSCI) /s u bcomm, ees Members/Staff: L.! ____________ _. Executive Summary: b6 b7C Details of Event: :(U) The brief was requested by slaffe~,,11,._____ Audit and Oversights Staff of the ssd1. _.~s part of the Insider Threat Study being conducted by the )() Ucc::::::}rovided a comprehensive overview of the Enterprise Security Operations Center's (ESOC)programs and capabilities of detecting and recording unauthorized access to the computer systems of the FBI. The programs used and future plans forthe ESOC to address the insider threat were discussed, Cooperation and interaction wilhin the FBI and the intelligence community were described. Follow Up Action: (U) Staff requested the Circular number for one 0MB circular regarding encryption Attachment: Q b6 b7C b6 b7C Congressional Affairs Office Congressional Contacts Event Date: Date,, Entered: I (Q8/,1Y~9f1: .] · . Classification r·.--·-)2011-340 ; .Staff 0 Event Date: HQ 01 O FOC } Reactive O I to __________ ..._-_---.-..-------8/2/2011 Unit: Entered By: ): , Topic: 0 Proactive i-------- C-) Bri~fi;--o Hearing O SAC01 [------------------- Brief Type: Jc1ass111ea Level: Other __, # of SAC CV Visits: J v Event Time: )CLUJ Insider Threat Study Division: Jco OCA Contact Person.------DOJ Contact:..=======::::;"'----FBI Participants: lsc Other Participants: Randall Coleman, Date: )7127/2011 " Attended: 'j AS9~ ____ Pc l... _____ .. b6 b7C - N one Comm!ttttees Senate Select Committee on lntelligence(SSCI) /s u b comm, ees Members/Staff: b6 b7C Executive Summary: Details of Event: .(U) The brief was requested by staffert Ias part of the Insider Threat Study being conducted by the Audit and Oversights Staff of the SSC!. ~SC Coleman outlined the Counter Intelligence Division's (CD) approach to combali~g the insider threal problem, :both within the FBI and the intelligence community (IC)as a whole. He discussed the outreach and education program including the use of the movie "Betrayed" and training programs. The cooperation between agencies in prevention, deterrence and investigation was described. Coleman also detailed the CD's role in carrying out investigations of unauthorized disclosure and espionage throughout the IC. The staff asked a variety of questions relating to the topic. Follow Up Action: (U) Staff requested the statutory language relating to a SS00,000 reward for information leading to arrests in counter intelligence investigations. They also requested the workinq title to an Executive Order relating to Insider Threat. Attachment: Q b6 b7C Congressional Affairs Office Congressional Contacts Event Date: Classification Level: )unclassified - I__ Date Entered: ,_J O_P_ro_a_ct_iv_e __ __,._@_!l_~~a~ti'I_: !() Br;i'~g Q Hearing () SACOJ O HQOJ -@-~O~ - - ()Oth;r--i ,--------------·---;:::===::.::.::.::.-:.-:.-:..-:.,-------' Brief Type: Event Date: j Topic: JO Visits: 8/31/2011 Unit: # of SAC CV Event Time: JFO Senator Johnson staff visit to FBI Milwaukee · Division: JFo OCA Contact )BEERS. ELIZABETH Person: DOJ Contact: ln·one Date: J Attended: FBI ISAC Nancy McNarnera Participants: Other Participants;-----------------------------None /Sub~~~~:~;::: Senate Appropriations Subcommittee on Commerce Justice Science and Related Agencies(SAC CJS) Members/Staff: !,__ ____ __. b6 b7C Executive Summary: Details of Event: Staffer requested support from Finance Division to stop by the MW FO during a scheduled visit to the state. ttaffs Sen. Johnson (R-WI) who sits on our appropriations subcommittee. SAC McNamara met with the ·staffer and provided a backbriefto OCA. Overall! hiessage was that the Senator is very supportive of the FBl's mission and wants to restore any funds that the FBI is slated to lose. However, the Senator is also concerned about overlapping missions throughout the USG. In addition, he is interested in Cyber and whether is USG is efficiently meeting that mission requirement. SAC McNamara highlighted three issues that she briefed: 1) ·responding to Cyber concerns, SAC focused on the insider threat issue and everything that the FBI is doing lo lock ·down our systems and address vulnerabilities. She is going to talk with CD DAD Anderson about providing the :staffer with a copy of the movie "Betrayed" produced by CD. 2) SAC spoke specifically about cost savings ·measures in MW • i.e. they've parked cars. She also talked about the RA closings and how. more than just saving ·rent money. it's abiut gaining efllciencies via the consolidation. 3) Finally, they talked about HIDTA and the SAC advised! • hat based on her experience in MW, it is an area where there may be some mission overlap. She was clear lo say that she didn't speak for the HIOTA program, but only about her experience in MW. I Follow Up Action: •None. Attachment: Q b6 b7C Congressional Affairs Office Congressional Event Date: Date Entered: Classification 1,1/.17/201~ I@Briefi_n_g-- () ]2011-479 Staff Entered _By: ) . Topic: L.I 0.,. -· Reactive - -·· .._l 0Proact~v: _____ _ Event Date: ____.r ____ J;...unclassified __ I c~···-(5" ~Qcv--()-;;~·-· ___O_o_tt,;r---1 # of SAC cv --- ..---_-_-,:_-_-_-_-_-_-----.:;------·· .J Visits: H;ring_Q_s;c i---·------------· Brief Type: Level,..= __ Contacts 11/16/2011 Unit: Event Time: JO 10:00 AM jcLU II ·Congressional staff visit to Defense Security Service · Division: b6 b7C OCA Contact Lr------..1 Person: DOJ Contac-------,.------- Date: FBI IFBI-Phila; SA! Participants: s11 ...____ Other Participants: . Committees /Subcommittees J J11110/2011 Attended: __. . . . Defense Security Service staff: Center for Development of Security Excellence (COSE) Other Members/Staff: Staff for; Sen. Chris Coons Sen. Frank Lautenberg ·Rep. Frank LoBiando Executive Summary: 'FBI Phila participated in a DSS presentation on insider threats and defensive briefing for govt contractors and Congressional staffers. Details of Event: sie:::::]and s1 information and Follow Up Action: None Attachment: l !introduced FBI video "Betrayed''. followed by slides about most significant threats to contractors and personnel. ecamy mceo by government b6 b7C CQ CONGRESSIONAL TRANSCRIPTS Congressional Hearings Feb. 10, 2011 - Final House Select Intelligence CommitteeHolds Hearing on WorldwideThreats ROGERS: · We'll call the committee and we'll come to order. I want to welcome Director Clapper and our other witnesses this morning. They are very busy people. And I appreciate you all taking the time today away from that important work from your agencies to participate in today's hearing. Please pass along our thanks and appreciation to the men and women in your agency for their commitment and dedication in the defense of the United States. We are eternally grateful for their sacrifices. I also want to welcome Dutch Ruppersberger as the committee's new ranking member. He is a solid leader. His dedication and talent will serve the committee and country well. Dutch is also a friend, and I look forward to working with him to foster the strong bipartisan energy that we're going to need to lead this committee to our oversight responsibilities and to keep America safe. And of course it never hurts to have a former prosecutor on your side. I'm looking forward to the discussion of threats in the witnesses' statements this morning, and the questions and answers that follow. Before we get to that, I want to talk a moment about where I would like the committee to go in the new Congress. And we've had the opportunity to talk with each of you about that direction, from reasserting oversight to taking a strong evaluation of the 10 years wher~ the budget has grown exponentially and changed significantly; the budget, cyber issues, leaks and many others. On reasserting oversight, it's a profound honor and a tremendous responsibility to assume the role of the HPSCI chairman in such an important juncture in our nation's history. The U.S. intelligence community is vital to defending our nation from many threats that we face. I have no doubt that the hard work of our intelligence professional is one of the primary reasons there has not been a successful major attack in the homeland since 9/11, despite numerous failed and disrupted plots and Al Qaida's unrelenting efforts to attack the United States. I don't believe it's been deployed on every nod~, but I will get back to you on that for the record, sir. LANGEVIN: Director Mueller? MUELLER: I would say that what has been in place for a couple of years it called the National Cyber Investigative Joint Task Force, is a hub of identifying an early -- attributing attacks, big, larger or small. You have all of the relevant agencies there and the expertise and the tie-in into the rel~vant agencies. If it -- if it turns out to be an attack by your -- your high school student down the street, then we obviously would take it'd be a crime. More particularly that, it goes to the question of stopping an attack, depending on the -- from whence the attack originates, you would have people at the table there who have the capability of doing it. If it originates overseas, certainly NSA, CIA, and others. If it originates in the United States, we would have jurisdiction. If it comes to the -- in putting a wall on between the attackers and particular entities within the United States, DHS would have a role. But we have a focal point that identifies immediately the attack and then immediately tries to deterring the focus of that -- that attack and utilize all of the capabilities we have to address it, regardless of whether it's in the intelligence side or the -- or the law enforcement side. LANGEVIN: Let me tum quickly to some of the things we're talking about, especially with respect to protecting dot-mil and -- and -- and dot-gov, our perimeter defenses. What is our level of progress in being able to protect against -- and dealing with the insider threat, as it relates to cyber? CLAPPER: Well, that's -- that is -- that issue has -- has come to the fore and been reaffirmed by the WikiLeaks disclosures. And certainly within the intelligence community, at least, we -- we have, I think, a strategy and embarked on an improvement program to attend to the insider threat, whether it's WikiLeaks or any -- any sort of insider threat through better identification of people who are on networks, controlling movable media, and most importantly -- and this applies for -to several purposes -- auditing and monitoring. · And we're -- our progress is uneven to this point. And we've embarked on a campaign to -- to police that up, particularly within the intelligence enterprise. :.,\'.1,.~• •1:~ .. - • ..,.~,i· ! ,'.•H<\ti(' ~ lJ -'\. • ... \•;u~, i ·~ ·~:i: • -..l'i>"\,~ ••,· h ',\•f !ii :-?'•-'•it'!,) '\:,,:,\\',\ ,\,:•,11,·,.,. ; .., lt !1,.\ih ,J,•;th·:.c,•l ':t : .. 1t,},,- !._ i' ,,,f ''-''-u'-l~: .... 1•t 11 1.,-,'i• •(it.!f;t~ ·:,1,..,V.,.. l,\~• ~it I•, ,•!,\t" ~.,1•+•.,.t,\"!\ ~;•,~t..l\i·,.,,l'li AH=',.:'l.i--,11:n ., •.-,~r\,ll'Ml,t:A Utl',:-- tl lH,\i~~:. v.,,;,;ih'! ;t.~t-..!;'.:'•:,\ ~·,t,"\i(•,···:. \!;,~ •; ••,U{I~.,•- ,,.',,f,,,\: ,,;-.:·~;f ?T'f, ' I· •t,1itt• ('' ,')••, • ;,•11\;\.t .-.n '. •'. ". ., :,i.•-:, '•" If~,:,,_ 'If '"r\ ;t.\,l :1,•• l:lnitrdiStatesSenate f\lMl\fllTTH: ~.,, , .... , : • • • i,:., _-'!,t: • ~ -\_'t•',if1!lJ'(•!, '\11•to~"\iJ; .v:,. },;. • ,t'i ,tf'l1 t ,,.,,,,._,., ii,• ... l(', ,,.,,t-..t~t~• ;,;,, ;, • .,.,.,. ON IHE ,IUi>ICit',H, W1\SHIN1;10N Dt tilhh) nV~• December 17, 2013 VIA ELECTRONIC TRANSMISSION The Honorable James B. Comey, Jr. Director Federal Bureau of Investigation 935 Pennsylvania Avenue, N.W. Washington, DC 20535 Dear Director Comey: On October 28, 2013, I received a letter from the Federal Bureau of Investigation (FBI) in which it indicated that it had collaborated with the Office of the Director of National Intelligence (ODNI) on two training videos about the F~n's National Insider Threat Program. The videos, titled Betrayed and Game of Pawns, were developed jointly by the FBI's Counterintelligence Division and ODNI's Office of the National Counterintelligence Executive (ONCIX). The FBI has also produced other insider threat materials, such as the brochure, TheInsider Threat:An Introduction to Detectingand Deterring an Insider Spy.1 As I understand it, the National Insider Threat Program is the result of Executive Order 13587, issued by President Obama in October 2011, which established an interagency Insider Threat Task Force, to be staffed by the FBI and the ONCIX.2 It also directed Executive Branch departments and agencies to develop their own insider threat programs. The President subsequently issued a Presidential Memorandum in November 2012 transmitting the National Insider Threat Policy and setting forth minimum standards for departmental and agency programs.3 These efforts have subsequently received press attention, some of which has focused on concerns about whether the program adequately protects whistleblowers. 4 1 Federal Bureau of Investigation, TheInsider Threat:An Introduction to Detecting and Deterring an Insider Spy, http://www.fbi.gov/about-us/investigate/counterintelligence/insider_threat_brochure. 2 Executive Order 13587 - Structural'Refoi:ros to Improve the Security of Classified Networks and the Responsible Sharing and Safegµarding of Classified Information, October 7, 2011. Available at http://www.whitehouse.gov/the-press-offi~e/2011/10/07/executive-order-structural-reforms-improvesecurity-classified-networks-. 3 Presidential Memorandum - National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, Nov. 21, 2012. Available at http://www.whitehouse.gov/the-pressoffice/2012/11/21/presidential-memorandum-national-insider-threat-policy-and-minimum-stand. 4 For example, Marisa Taylor and Jonathan S. Landay, "Obama's crackdown views leaks as aiding enemies of U.S.," McClatchy(Jun.20, 2013), availableat The Honorable James B. Corney, Jr. December 17, 2013 Page2 of2 As you know, I strongly believe that whistleblowers play an important role in safeguarding the federal government against waste, fraud, and abuse. You too stated in your confirmation hearing that you believe whistleblowers are a critical element of a functioning democracy. Their willingness to come forward contributes to improving government operations. They often put themselves at risk of reprisal from their employers, sometimes being demoted, reassigned, or fired as a result of their actions. Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal employees may not be retaliated against for reporting waste, fraud, and abuse.s Accordingly, some agencies have taken steps to prevent the insider threat program from chilling whistleblower communications. For example, the Office of the Inspector General for the Intelligence Community is developing training that integrates whistleblowing into the agency processes, making the Intelligence Community whistleblowing and insider threat programs .mutually reinforcing. In order to assess whether training materials on the National Insider Threat Program provide adequate guidance on protecting whistleblowers, I respectfully request that you provide me with copies of Betrayed and Game of Pawns, as well as copies of · any other training materials regarding the National Insider Threat Program or any FBIspecific insider threat program. I would appreciate receiving these materials by January 14, 2014. I know that you consider transparency to be an important value, and I trust that transparency on this issue will benefit both whistleblowers and our national security. d hould you have any questions regarding this letter, please contact! fmystaffat! I . . ...._ __ _, Sincerely, ~~ Charles E. Grassley Ranking Member cc: The Honorable James R. Clapper Director of National Intelligence http:/ /www.mcclatchydc.com/2013/06/20/194513/obamas-crackdown-views-leaks-as.html#.Uccy-vmVHl. 5 Presidential Policy Directive 19, The White House, October 10, 2012. b6 b7C SECRETHNOFORN Responses of the Federal Bureau of Investigation to Questions for the Record Arising fro~ the April 14, 2011, Hearing Before the House Permanent Select Committee on Intelligence Regarding the FBl's Fiscal Year 2012 National Intelligence Program Budget Questions Posed by Chairman Rogers 1. How much does a surveillance team cost? Please provide the costs of various sized teams and armed vs. unarmed teams? Response: ~~ In Fiscal Year 2011 it costs approx,_im=at'""e_.l .-....-----' armed surveillance team and approximatel unarmed surveillance team. to establish a new to establish a new bl b3 rn,..... 2. During the heari:rtl fstated that the FBI can currently surveiBargets on a 24x7 basis. What is the FBI's goal for the number of targets it is able to cover on a 24x7 basis? How many additional positions and how much additional funding· would be required to meet this goal? b7E bG b 7c Response: ··· ~~Atpresent;the FBlis capable ·ofcoverinBargets on a 24/7 basis. Our goal is to build a national surveillance capacity to provide for additional coverage. 3. The FBI requested no enhancements in FY 2012 for linguists. How does FBI plan to handle the increasing volume of documents that requires translation? Response: (U) The demands on the FBI's Foreign Language Program (FLP) fluctuate and priorities are adjusted frequently to meet the greatest need at any given time. The SECRET/1NOFORN A-1 bl b3 8ECRET//NOFORN !U) • bl b3 b7E b. Is the FBI giving sufficient attention to other cou_nterintelligencethreats? How so? Response: (U) ~Because the FBI's National CI Strategy prioritizd !The FBI's bl b3 b7E ith appropriate attention afforded to s 5. Last year, the Ji'BIcreated[]Regional Intelligence Groups (RIGs) to facilitate cooperation among field offices in the same region. a. What specific value-added have the RIGs provided? Response: SECRET//NOFORN A-4 b7E The FBI continually recruits for all necessary languages, and attempts to address all work possible. The chart provided as Enclosure A reflects the hiring in recent years up to 12/31/06 in the critical counterterrorism languages. When the FBI does not have the la,nguage resources for a particularly rare language, we work with contractors and with the National Virtual Translation Center (NVTC) to address those needs. In one situation, the FBI used Department of Defense (DoD) contracts to provide cross-training for FBI Arabic linguists on an unusual dialect of Arabic that was needed. These resources provide a surge capacity in the FBI=s most critically needed languages as well as a pool of linguists in less commonly needed languages that are important to the FBI=s mission. Contract linguists must pass the same language test batteries and security vetting as full-time employees. Their Top Secret clearances, native-level proficiency in the foreign language, high-level of skill in English, and knowledge of the target culture make FBI contract linguists a highly desirable commodity in the IC. Many of the FBI=s contract linguists provide support in languages that the full-time linguist staff does not cover. The FBI depends on the contract linguists and NVTC for a substantial amount of the needed support in many languages critical to the FBI=s mission. While the FBI continues to hire new contract linguists, it is currently converting many of the talented contract linguists hired since 9/11/01 to full-time language analysts, with the goal of maintaining a language workforce composed of one-third contract linguists and two-thirds FBI language analysts. This ratio will enable the FBI to maintain a stable workforce and will provide greater job security and benefits for the linguists proficient in the languages most needed to meet ongoing national security requirements. Since May 2006, the FBI has made a special effort to focus on the backlog and has decreased the unaddressed counterterrorism work in the most critical languages to less than 1,000 hours. While the figures referenced in the May 2006 hearing pertain to counterterrorism cases only, audio backlog continues to be a concern for the FBI. In general, audio collection in the difficult and unusual languages represents only about 1% of the FBI=s total audio collection in the past four years. WHISTLEBLOWERS 17. Whistleblower Mike German has alleged that the FBI failed to investigate a potential terrorist link between white supremacist and Islamic extremists. During our investigation of this case, our staff received two different versions of a crucial transcript. Neither version of this transcript was complete. These responsesare current as o/2/8/07 20 a. Can you explain the apparent discrepancies in the two versions of the transcript? Response: In connection with its investigation of this matter, by letter dated 2/3/06 the Committee requested from the DOJ OIG copies of documents the OIG relied upon in preparing its reports. The document request included the transcript of the 1/23/02 tape-recorded meeting between members of the foreign and domestic terrorist groups, which German had provided to the OIG in February 2003, and any other transcripts made of that meeting. By letter dated 7/27 /06, the FBI provided the Committee with copies of the FBI documents responsive to this request, including copies of two transcripts of the 1/23/02 meeting. One version of the transcript, identified with the text marking A037eb01.t3@ at the top left of each page, was obtained from German on 2/12/03 during his interview by investigators from DOJ=s OIG and FBI. German produced and referenced portions of this transcript in support of information he provided in his signed, sworn statement, and this version was attached to and made a permanent part of German=s sworn statement. This version of the transcript is a rough draft of the transcription of a consensually monitored conversation that occurred on 1/23/02; it contains several.instances of Aunintelligible@ conversations on the recording and abruptly ends on page 126. On page 49, the construction of this document changes from a rough draft format to FBI FD-302a format, and continues sequentially but displays the page number starting at 46. This Acombination@ document submitted by German contains duplicative pages of the rough transcription and the FD-302a, so that pages 46, 47, 48, and 49 are misnumbered yet sequential. It is unknown why German provided to OIG and FBI interviewers only 126 pages of a total 167 pages or why this document has a combination of transcript formats. The second version of the transcript, identified with the marking AFD-302a@at the top left of each page, represents the draft of the entire ·transcription in the official FD-302a format. Because the header and footer on each page of an FD-302a reduce the remaining printing surface, the pages of this FD-302a draft do not line up exactly with the pages of the rough draft portion of the version obtained from German. In the FD-302a draft, many, though not all, of the Aunintelligible@ portions that appear in the rough draft have been clarified. This FD-302a version is a complete transcription of the 1/23/02 conversation at 167 pages, or 31 pages more than the version provided by German. These responses are current as o/2/8/07 21 b. Which of the two transcripts do you consider most accurate? Response: For the reasons discussed above, the version identified with the FD-302a marking at the top left of each page is the most accurate. c. Will you provide the committee with the tape that this transcript is based on, in its complete form? If not, why not? Response: The Committee has not previously requested a copy of the tape in connection with its oversight investigation of this matter. Should we receive a Committee oversight request from the Chairman regarding this matter, we would be pleased to consult with DOJ as to the appropriate response. Questions Posed by Senator Grassley AMERITHRAX INVESTIGATION 18. a. Why was Richard Lambert removed as the head of the Amerithrax investigation? Response: Richard Lambert served as the Inspector in Charge of the Amerithrax investigation from 9/20/02 to 9/16/06. On 5/22/06, he applied for promotion to the position of Special Agent in Charge (SAC) of the FBI's Knoxville Division. The Senior Executive Career Board reviewed the qualifications of the interested candidates and recommended Richard L~bert for selection. On 6/16/06, Director Mueller announced the selection of Mr. Lambert as the Knoxville SAC. b. Was it related in any way to disagreements between him and others working on the investigation about the proper scope and focus of the FBl=s inquiry? If so, please explain. Response: Mr. Lambert applied for and was selected as Knoxville SAC based on his qualifications for the position. These responses are current as of 2/8/07. 22 and effectively collecting, sorting, and examining relevant data, the FBI will be able to rapidly identify indicators of misuse and other inappropriate activity. Along with these technology-driven innovations, the FBI will continue to use regular personnel reinvestigations, including reviews of employees= financial circumstances, to detect willful and/or potentially criminal misconduct. d. What guidelines and training govern how agents deal with potential informants who may be engaged in trading or short-selling securities or may be selling information to hedge funds? Response: The FBI has instituted a new comprehensive informant validation process for use by field offices and FBIHQ. The validation process includes quarterly SSA reports addressing the sources= motivation, access, timeliness, corroboration, and history. As discussed above, AG Guidelines address unauthorized criminal activity by confidential sources. These AG Guidelines are covered in the New Agent core-training received at the FBI Academy and reinforced through regular legal training provided in field offices during the remainder of an SA=s career. e. In October of this year, a former FBI agent Jeffrey A. Royer was sentenced to six years in prison for racketeering and securities fraud. According to witnesses at trial, the agent provided non-public FBI information to an outside party who used the information to spread negative publicity about companies and profit from short-selling their stock. What lessons can the FBI learn from this case? Response: In response to a recommendation in the March 2002 Webster Commission report, the FBI's Security Division (SecD) developed and implemented a comprehensive security awareness, education, and training program for all persons with access to FBI information. This comprehensive approach included the development of a professional cadre of highly trained Chief Security Officers, who now provide FBI personnel with the most up-to-date security policy, training, lessons learned, and best practices. SecD uses a variety of educational methods, to include formal classroom training, web-based training, written guidance, and mentoring, to enhance the security awareness and education of the entire FBI population. Formal classroom instruction has included: the authorized procedures for releasing information to These responses are current as of 2/8/07 33 the public; refresher courses on establishing an information recipient=s "need-to-know"; and the potential penalties for deviating from established procedures. Instruction is also provided in the form of ANon-disclosure and Releasability briefings,@ during which all personnel execute a "Classified Information Non-disclosure Agreement" and "FBI Rules of Behavior" form acknowledging their responsibility to protect and properly handle FBI information. SecD also provides a host of additional training opportunities and materials, each of which serves to reinforce security awareness throughout the FBI. While this approach will not stop a trusted insider intent on disclosing information for improper purposes, it ensures the employee is educated on proper .information handling techniques and encourages each employee to report others who violate the rules. In other words, FBI employees now better understand their role in protecting and ensuring the security of FBI information, personnel, and facilities. f. What safeguards exist to prevent agents like Royer from similarly profiting on non-public information about ongoing investigations? Response: Please see our responses to subparts c and e, above. USE OF GOVERNMENT-OWNED OR LEASED AIRCRAFT 36. I understand that the FBI operates a number of executive jets as part of its aviation program for both operational use and for official travel by senior FBI officials. a. Please identify the number, type, and cost of aircraft owned and/or leased by the FBI and used for both operational purposes and travel by senior FBI officials. Response: The FBI reads this question as distinguishing between aircraft used to meet Arnission requirements@ of the FBI and those used for the Aofficial travel@ of Asenior Federal officials@ in the FBI other than to meet mission requirements, as those terms are defined in 0MB Circular No. A-126. 1 While the vast majority of 1 Paragraph 5 of 0MB Circular No. A-126 (5/22/92) includes the following definitions: b. Mission requirements means activities that constitute the These responses are current as of 2/8/07 34 ------- --·-- -------- investigative files implicates significant individual privacy interests because these files discuss allegations against individuals under investigation. DOJ has consistently offered to accommodate Congressional requests for information about OPR investigations through briefings, minimizing the intrusion on the privacy of Executive Branch employees. On 6/21/06 the FBI responded to the Committee's 5/10/06 request for information and documents relatiµg to the FBI's investigation of the suspected murder of Assistant United States Attorney Jonathan Luna. In its response, the FBI advised the Committee that documents concerning OPR matters raise serious privacy considerations, particularly when, as in that instance, there was no finding of misconduct. Consistent with the policy articulated above, Candice Will, AD of the FBI's OPR, provided a 6/30/06 staff briefing that included an overview of OPR's investigation and addressed both the issues raised in the Committee's 5/10/06 letter and all issues raised by the staff. In response to a question from staff concerning the availability of the OPR report, our records reflect that AD Will did not indicate that she had no objection to producing the report, but rather advised that privacy concerns counseled against providing that document to the Committee. FBI WHISTLEBLOWERS. 42. In May, 2006, I asked the FBI for a description of each instance where an FBI supervisor has been disciplined for retaliating against a whistleblower. Two weeks ago, I received a response from your agency advising me that since 1999 no FBI supervisors have been disciplined as a result of their having retaliated against whistleblowers. a. Why haven=t any FBI supervisors been disciplined for having retaliated against whistleblowers? Response: As the FBI has previously indicated in response to Questions for the Record, an Assistant Special Agent in Charge (ASAC) was disciplined for whistleblower retaliation. While that sanction, which was imposed before implementation of the Bell Colwell recommendations, was ultimately vacated on appeal, that case does not indicate that supervisors are not disciplined for retaliation, but instead indicates that the FBI has procedures in place designed to protect the rights· of all employees. Since that response, no all~gations of whistleblower retaliation have reached final adjudication. These responses are current as o/2/8/07 46 b. The DOJ/IG found that Jorge Martinez retaliated against Michael German for protected whistle blowing activity. Has FBI disciplined Martinez? If not, why not? Response: The FBI is well aware of this matter and is in the process of taking appropriate action. Consistent with longstanding Executive Branch policy, our goal in all cases is to satisfy legitimate oversight interests while protecting significant Executive Branch confidentiality interests. As a general matter, the disclosure of information from OPR investigative files implicates significant individual privacy interests because these files discuss allegations against individuals under investigation. c. Since 199~, how many FBI personnel have claimed whistleblower status? How many have claimed retaliation for protected whistleblowing activity? Response: The FBI is not in a position to provide this .information. Pursuant to 5 U.S.C. ' 2303 and 28 C.F.R. Part 27, DOJ=s OIG and OPR serve as Investigative and/or Conducting Offices in FBI whistleblower cases, while the Director ofDOJ=s Office of Attorney Recruitment and Management (OARM) is authorized to adjudicate claims of FBI whistleblower reprisal and to order corrective action subject to appeal to the Deputy Attorney General (DAG). Pursuant to 28 C.F.R.' 27.4, the identity o.f employees who make those claims is not disclosed to the FBI unless there is a recommendation for corrective action. DOJ=s OARM advises that, based on numbers collectively reported by OARM, OIG, and OPR for calendar years 1999 through 200.6, 96 FBI personnel have made allegations of retaliation for claimed protected whistleblowing activity. It is the FBI=s understanding that there is no formalized consolidated record of those who may initially claim whistleblower status because, in the absence of subsequent retaliation based on the whistleblowing, the mere status as a whistleblower does not affect the employees= rights or benefits. REPORTING OF DRUG SEIZURE STATISTICS 43. The staff of the House Committee on Homeland Security, Subcommittee on Investigations, recently released a staff report entitled, AA Line in the Sand: Confronting the Threat at the Southwest Border,@ This report describes, among other things, the These responses are current as of2/8/07 47 NieS developers are receiving daily system logs for further analysis. In addition, the FBI is working in the non-operational environment in an attempt to recreate the outage, but to date these efforts have been unsuccessful. Absent a clear indication of the cause of the outage, the only changes made to NieS as a result of it have been an increase in the shared memory pool and Oracle database cache, which appear to have resolved the issue. The FBI=s ens Division will continue to monitor and analyze the NieS in order to prevent or minimize future outages. b. Does the FBI know how many gun sales were completed without background checks while the system was down? Response: The outage on Sunday, 11/26/06, lasted 45 minutes, and the three outages on Monday, 11/27/06, lasted 34 minutes, 1 hour 24 minutes, and 35 minutes. Even with these outages, NieS processed 17,983 firearms transactions on Sunday (11/26) and 29,867 on Monday (11/27). For comparison purposes, on the Sunday and Monday after Thanksgiving in 2005, NieS processed 14,574 and 28,200 firearms transactions, respectively. The FBI has no reason to believe gun sales were executed during the outage in violation of the legal requirements of the Brady Handgun Violence Prevention Act of 1993. c. What is the FBI doing to make sure that this problem never happens again? Response: The FBI=s ens Division has made all of the changes recommended by the vendors. As indicated in response to subpart a, above, the problem has not recurred, but the ens Division will continue to monitor the system and make any corrections we identify. MIKE GERMAN/ WHISTLEBLOWERS 76. According to the Office of the Special Counsel (AOSC@),the average number of whistleblowers who have filed complaints with the government has increased by 43% since September 11, 2001. Yet, sadly, the number of whistleblowers who have filed reprisal These responses are current as of 2/8/07 90 complaints with the OSC because their employers have retaliated against them for coming forward has also increased by 21 % during the same time period. For example, former FBI special agent Michael German has said that his reputation and career were ruined after he reported concerns about misconduct on the Bureau=s terrorism investigations to his superiors. What is the Bureau doing to protect the rights of whistleblowers within the FBI to come forward and disclose government fraud, waste and abuse? Response: Although the FBI can never completely eliminate an employee's fear of whistle blower retaliation, factors likely to induce such fear can be reduced or eliminated. The anonymous nature of inspection leadership surveys (which are conducted prior to internal FBI inspections to assess management effectiveness), private interviews with the inspection staff during these inspections, and executive managers who promote the proper environment all help to reduce the fear of whistle blower retaliation. If an employee nonetheless believes retaliation has occurred, this may be reported to the Inspection Division's IIS or to DOJ's OIG or OPR. FBI employees are also frequently reminded through FBI-wide emails and other mechanisms that there is a procedure established under law (5 U.S.C. ' 2303) and implemented by regulation (28 C.F.R. Part 27) that provides a formal avenue for an employee to seek corrective action based on a personnel action taken in reprisal for whistle blowing. 77. Many whistleblowers in the intelligence community are discouraged from coming forward because intelligence agencies are exempted from the Whistleblower Protection Act. Would you support legislation to extend whistleblower protections to national security employees? Response: Congress specifically excluded the FBI and other IC agencies from the application of 5 U.S.C. ' 2302 (the government-wide Whistleblower Protection Act) because of the classified and sensitive nature of their work and the fact that any employee may have access to such information. The legislative history indicates that the exceptions for the FBI and the other specified agencies is tied to the intelligence aspect of their missions. See H.R. Rep. 328, 101st Cong., 1989 WL 225002 (Leg. Hist.). We support the Congressional reasoning that underpins these exceptions. Congress has provided separate whistleblower protections for national security employees through the IC Whistleblower Protection Act of 1998 (ICWPA). The These responses are current as of 2/8/07 91 ICWPA provides that an employee may communicate "a complaint or information with respect to an urgent concern" regarding intelligence activities to the appropriate Inspector General (or designee) and thereafter, under specified circumstances, "to Congress by contacting either or both of the intelligence committees directly." Inspector General Act of 1978, 5 U.S.C. Appendix 3, ' ' 8H(a)(l) and (d). ANTHRAX INVESTIGATION 78. The Bureau=s investigation into the 2001 anthrax attacks that killed 5, infected 17 others and terrified millions of Americans is now well into its fifth year. Many believe that the investigation has gone very cold and no arrests have been made in the case. a. What is the current status of the anthrax investigation? b. Do you expect that criminal charges will be brought in the case and if so, when? c. You testified at the hearing that the FBI currently has 17 agents and 10 postal inspectors assigned to the anthrax investigation. Has the number of personnel dedicated to the investigation changed? Will you consider increasing the number of agents and investigators dedicated to this investigation? d. How much money has the FBI spent on the anthrax investigation to date? Response to subparts a through d: Pursuant to the longstanding DOJ policy against disclosing non-public information concerning pending law enforcement and litigation matters, we are unable to provide a response at this time. 79. A frequent criticism of the anthrax investigation is that the FBI has made a number of incorrect assumptions about the source of the anthrax and refused to heed outside expert advice in the case. Will the Bureau be open to new theories about the case and more receptive to outside expertise and criticism going forward? Response: Pursuant to the longstanding DOJ policy against disclosing non-public information concerning pending law enforcement and litigation matters, we are unable to provide a _responseat this time. These responses are current as of 2/8/07 92 FBI SAs, the FI Gs, FBIHQ, and DOJ will all have roles in measuring the value of a source=s operation as well as managing the risks associated with using a human source. Redundancy of review will be an intentional part of the validation process, serving as a check and balance on human source activities, including authorized and any possible unauthorized criminal activities. The BAD of the FBI=s NSB has approved a draft of the Validation Manual, and the FBI is moving toward implementation throughout the FBI. 116. Some critics argue that the FBI often allows agents involved in wrongdoing to quietly retire. What are you doing to ensure future accountability, since most of the FBI personnel responsible for the Leung security breach avoided negative consequences by retiring? Do you believe that the penalties described in your colloquy with Senator Grassley about the Woods allegations are consistent with the recommendations of the Inspector General in the Leung affair? If so, why? Response: As stated above in response to question 93, in order to ensure the accountability of agents who engage in wrongdoing and then attempt to quietly retire, the Director amended FBI policy governing the administrative inquiry process so that, notwithstanding the resignation or retirement of an employee, a disciplinary matter is completed where necessary to protect the institutional interests of the FBI. Obviously, any matters involving criminal allegations are pursued irrespective of an employee's retirement or resignation. 117. In response to a written question from Senator Grassley after our last Oversight hearing, you appear to acknowledge that no one has ever been disciplined for whistleblower retaliation under the FBI=s guidelines. Is that accurate? Can you explain? What is being done to ensure that FBI whistleblowers are being protected from retaliation? Response: That is not accurate. As stated above in response to question 42a, the FBI has disciplined a number of employees for engaging in retaliatory behavior, including whistleblower retaliation. OPR recently suspended one supervisor for 30 days for engaging in retaliation against a whistleblower. Although not final, in another disciplinary matter, OPR has proposed the dismissal of a supervisor for retaliating against a whistleblower. In another, OPR imposed a 3~day suspension on a supervisor who threatened to retaliate against a whistleblower. These responses are current as of 2/8/07 124 118. You also noted that, in the one FBI case where a 3-day suspension was initially imposed for whistleblower retaliation, that decision was later reversed, through an appellate process that the FBl=s General Counsel declared to beAflawed.@ What has been done to fix the appellate process? Response: Upon the completion of the Bell/Colwell Commission's study of the FBI's disciplinary process, the FBI adopted changes recommended by the Commission to improve the FBI's disciplinary process. With respect to the FBI's appellate process specifically, the Commission recommended key changes designed to improve the transparency and fundamental fairness of the appellate process for all FBI employees. These changes were adopted and made effective by the FBI Director on 8/19/05. One such improvement offers non-SES employees the option to choose a mid-level manager, rather than an SES employee, to participate on the three-member Disciplinary Review Board (DRB), which convenes to hear appeals in those cases in which an adverse disciplinary sanction has been imposed by the FBI's OPR. (Previously, the voting members of the DRB's were composed strictly of SES employees.) The advantage of this change is that non-SES employees are now being judged with input from 11one of their own. 11 This concept is especially important in light of past OIG investigations into allegations of disparate treatment in the FBI's disciplinary process. Another important change, recommended by the Commission and adopted by the FBI Director, was elimination of the ability to increase a disciplinary penalty on appeal. This change was made to ensure all employees could take full advantage of the FBI's appellate process without fear of facing additional sanctions. In addition, the Commission recommended that the "de novo 11 appellate standard be replaced with a 11substantial evidence 11 standard, which is now being used to review matters on appeal. This change allows the FBI's appellate authority to continue to serve as an important check and balance on the entire OPR process. In addition to the improvements mentioned above, the FBI's appellate authority will continue to seek the advice of the FBI's OGC when guidance is needed on legal matters. The FBI is dedicated to ensuring the FBI's appellate process continues to operate in a fair, effective, and efficient manner for all employees. Background: In response to questions following the last FBI Oversight hearing about press reports relating to the New York Field Office, you seem to acknowledge that there may be These responses are current as of 2/8/07 125 llmtni.StJtcs.$rnatr January 28, 2014 The Honorable Ede Holder Office of the Attorney General U.S. Department of Justice 950 Pennsylvania Avenue, Nv\7 ·washington, DC 20530-0001 Dear Attorney General Holder: It has nmv been over 15 months since the issuance of Presidential Policy Directive 19 (PPD-19). This directive mandated that the Attorney General deliver a report to the President within 180 clays to assess the efficacy of the Department regulations that implement the Whistleblm,ver Protection Act ("WPA") for Federal Bureau of Investigation (FBI) employees. SJ)ecifically,the provision states: Within 180 clays of the date of this directive, the Attorney General, in consultation with the Special Counsel and Federal Bureau of Investigation employees, shall deliver a report to the President that assesses the efficacy of the provisions contained in part 27 of title 28, Code of Federal Regulations in deterring the personnel practices prohibited in section 2303 of title 5, United States Code, and ensuring appropriate enforcement of that section, and describes any proposed revisions to the provisions contained in Part 27 of title 28 that would increase their effectiveness in fulfilling the purposes of section 2303 of title 5, United States Cocle.1 This report was clue by April 8, 2013. However, to date, there has been no public announcement that the review has been completed. The report appears to be nearly ten months overdue. A comprehensive review is vital to correct the shortcomings of the FBI whistleblower rocess. For years, I have asked the FBI about whistleblowers such as .____,____ ..,OnMarch 15, 2007, the Department's Office of!nspector General found tha..._ _____ vas retaliated against for pointing out fraudulent activities in the FBI. The FBI appealed the Inspector General's findings to Main Justice's Office of AJ;to.i.:.Qey Recrnitment and Management [OARM]. In 2009 and 2010, I asked you aboutl__J I hnd the extremely lengthy amount of time OARM takes to make decisions. Tn response to one of those questions, you replied on March 22, 2010: "OARM has been 1 Presidential Policy Direclive/PPD-19, Section E, p. 5 (Oct. 10, 2012). b6 b7C conducting appropriate and necessary proceedings regardinJ !Request for Corrective Action since it was filed in May 2006. Subject to a change in circumstances, a ruling could be issued by OARM within the next several ni:onths." Instead, OARM did not issue the final ruling until more than three years later, on .July 25, 2013. b6 b7C I !case is just one example that illustrates the dire need for a review of 28 C.F.R. Part 27 and a revision of the processes, an FBI ·whistleblower has to follow in order to be protected. Accordingly, please answer to the following questions: 1. What is the current status of your review pursuantto 2. Why have you failed to issue a report assessing the efficacy of 28 C.F.R. Part 27? b6 b7C Section E of PPD-19? 3. When will the report be complete? 4. When the report is complete, do you intend to provide it to the Judicimy Committee? Why or why not? Thank you for your attention to this matter. I vmuld appreciate a response by Mareh :!. 2014. Should yon have any questions regarding this letter, ~)lease do not hesitate to con tac~ !of my Committee staff at! _ !I look fonvarcl to your response. Charles E. Grassley Ranking Member cc: The Honorable James B. Corney, Jr., Director Federal Bureau of Investigation b6 b7c Week of March 31 - April 4, 2014 Updated: March 31, 2014 (8:00 a.m.) Date Tuesday, April I Friday, April 4 Friday, April 4 Time Event Topic IFinancing Post 9/11 Terrorism 11:00 a.m. HPSCI Staff Briefing 9:00 a.m. Courtesy Visit HPSCI Chairman and Rivi Courtesy Visit Sen. Grasslcy Staff Briefing National lnsider Threat Program 2:00 p.m. FBI Participants, I I DD Giuliano Other Partic~pants I FD b6 b7C TBD NIA NIA DOJ:I Contact I Week of JANUARY 27 .. 31, 2014 Updated: January 29, 2014 (1:00 p,m.) Oate Time Event Topic 'FBI Other Participants Participants Tuesday, Januai)'28 8:00 a.m. Tuesday, January28 9:00 a.m. Wednesday, January29 I 0:00 a.111. House HomelandSecurity CommitteeMember Briefing Senator Whitehouse-Guest Speaker at FBl Cyber Division All Hands Conference SSCI AnnualThreat Assessment Hearing l TSC 10J and Redress PDD Steven Mabeus DirectorPichota TSAl The Future of Cybersecurity DD Giuliano AD Demarest All Cyber LeadershiJJ NIA WorldwideThreats Director Corney Procedures/Process I Contact I I DOJ:I DNTciapper D/CIA Brennan DIA DOS NCTC DOJ:I I I I t I I b6 b7C Thursday, January 30 1:30 p.m. Briefing to HPSCJ Staff Security Clearance, Jnsider '.TIJ1reat Reform -v ~~ .,__ - - , PAl)Br9oks-SecD CID-T:Bll,r . - ! ' . I NCIX I - b6 b7C I Thursday, January 30 4:30 p.m. Joint SSCI HPSCl JRJG Staff Briefing Expansion of JRIG Program AD Velez-Villar DOJ: NIA I DOJ: I I I I !(DO) (FBI) From: Sent: To: .._ ____ ___, (CD)(FBI) Ericla11J:ebC11anL.!lJ 2014 10:26 AM ---~J~~~k~~~~b/J~OO Subject: Attachments: ~r;eo Letter OCA letter2.docx SentinelCaseld: NON-RECORD Classification: b6 b7C UNCLASSIFIED/tpouo ====================================================== Her.eis the letter we'd put together on the three videos. b6 b7C =============================================-=-====-Classification: UNCLASSIFIED//FOUO l From: Sent: To: Subject: I Wednesday, February 19,2014 I 3:03 PM I I Status Update re Proposed Insider Threat briefing b6 b7C D-1 just wanted to touch base with you and let you know that we offered the briefing to Grassley staff Hi regarding the Insider Threat program, but have not heard anything back yet; I'll let you know if they do and perhaps we can work out another date/time that will work for your schedule ... Let me know if you have any questions meantime, IMany t!anks, l b6 b7C !{DO) (FBI) aw From: Sent: b6 b7C BEERS, ELIZABETH RAE (OCA) (FBI) F:b~1arv fc7· 2014 4:54 PM I :1r:dav (DO) (FBI) arltem --- UNCLASSIFIED : ew caen To: Subject: SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED ---=-==--============================================= Did we ever schedule the briefing re the insider threat program? b6 b7C Classification: UNCLASSIFIED .-----------------~----------------------------------- TRANSITORY RECORD Calendar item: Date and Time: Event: Committee/Staff: Location: Topic: f,'BJ Participants: Other participants: Classification: March 11, 2014 at I :30 pm Briefing Staff for Senate Judiciary Committee TBD Criminal HislOJJ}Records and Use ofNon-Crimina/1.Juslice/Civil _r GC and! ! CJIS ,.__ ____ .,_____ _____ Purposes 1 ........a;S""'"EARCH .....SEARCH ._____ _. Compact Council Unclassifiecl b6 b7C OCA Contact: OL/\ Con!acl: =============================================~======== Classification: UNCLASSIFIED ------------=================================---==---Classification: UNCLASSIFIED 1 L-------....l1o_o_} __ (_FB_I_} _________________ .......,.....u=, ..,._.,,,. b6 ,________ ,DO) (FBI) Friday, February 28, 2014 11:03 AM BEERS, ELIZABETH RAE (OCA) (FBI) RE: New calendar item --- UNCLASSIFIED From: Sent: To: Subject: SentinelCasel.d: b7C TRANSITORY RECORD Classification: UNCLASSIFIED ====================================================== I extended to staffer? date and time for a briefing but they have not yet responded or accepted From: BEERS,ELIZABETH RAE (OCA) (FBI) Sent: Thursday, February 27, 2014 4:54 PM To:! DO) (FBI) Subject: RE: New calendar item --- UNCLASSIFIED Classification: b6 b7C UNCLASSIFIED ================================================---=-= Did we ever schedule the briefing re the insider threat program? b6 b7C Classification: UNCLASSIFIED ================================================-----TRANSITORY RECORD Calendar item: Date and Time: March 11, 2014 at 1:30 pm Event: Briefing Committee/Staff: Staff for Senate Judiciary Committee Location: TBD Criminal Hisl01y Records and Use ofNon-Crimina/1.Jus/ice!Civil Purposes Topic: FBTParticipants: Orhcr participants: I I I I I,OGC an.,u.u.;;.l,;IJ,J.,...l,;l.l,;~ DO FBI To: b6 b7C FBI L-,,,,..,........,.....,....------1.........._...,,(DO~)(':"::F~B'.".""l);-r--------"~.1.1...1,1"""'-...,,...,,..,....,.,,=---____J ,__ _______ _.DO) (FBI) Calendar items --- UNCLASSIFIED Subject: SentinelCaseld: TRANSITORY RECORD Classification: UNCLASSIFIED ====================================================== TRANSITORY RECORD Calendar items: Date and Time: Event: Committee/Staff: Location: Topic: FBI Participants: Other participants: Classification: OCA Contact: OLA Contact: April 4, 2014 at 2:00 pm Briefing Sen. Grassley staff Hart 135 I Nc1tionC1l Insider ThreCIIProgrC1111 !UC, Counterintelligence Divfaion 4D (Insider Threat Invcsliguti11H. i None Unclassified b6 b7C Date and Time: Event: Cornmittee/Sta ff: Location: Topic: FB1Participants: April 8, 20 I4 at 2:30 pm Hearing Senate Judiciary Dirksen 226 The Problem of Trade Secret Theft Acting Assistant Director Louis Blade!. Counterespionage Section, Countcrintcllig1;11cl' Division Other participants: Classification: OCA Contact: OLA Contact: TBD Unclassi fiecl b6 b7C ====================================================== Classification: UNCLASSIFIED From: Sent: b6 b7C To: Subject: RE: Insider Threat presentation slide deck It should be treated as PSYQ. but otherwise there is no problem in sharing. Thanks, UCL.I ___ _, b6 b7C Counterespionage Section, FBIHQ Co-Director, National Insider Threat Task Force I I From.__ _________ __. Sent: Monda A ril 28 2014 2:26 PM To: Su!)... Je-c-:___ ....,........,presentation slide deck Hii b6 b7C C bS L.j ________ ..... , i-680;- Thanks as always, CJ l b6 b7C From: Sent: To: Cc: Subject: rammg- ns1 rea bS Thanks. - Stephen Stephen D. l ___ ___.I . 1 b6 b7C From! I[!llilfilQJ Sent: I uesda December31, 20!3 2:29 P""'M,...... ________ T _. udiciary-Rep); CEG(Judi½iary-Rep) ..................... ..,.,...-....... nsider threat videos Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of letter and videos were also hand-delivered to SJCMinority office, Dirksen 152 on December 31, 2013. 2 b6 b7C A compw~v can oa..i;a.. l ncxplriinernmenl opt~ralions. They often put themselves at risk of reprisal from their employers, sometimes being demoted, reassigned, or fired as a result of their actions. Under the Whistleblower Protection Act and Presidential Policy Directive 19, federal employees may nol be retaliated against for reporting waste, fraud, and abuse.s Accordingly, some agencies have taken steps to prevent the insiderthreat program from chilling whistleblower communications. For example, the Office of the Inspector General for the Intelligence Communily is developing training that integrates whistleblowing into the agency processes, making the Intelligence Community whistleblov,•ing and insider thre.1t programs mutually reinforcing. fn order to assess whether. training materials on the National Insider Threat Program provide adequate guidance on protecting whistleblowers, I respectfully request that you provide me with copies of Betrayed and Game of Pawns,,.aswe1Las co,1::>ies,of .any otbert1·a.ining materials r<;lgarding the National Insiclel! Tbreat,Pi'og1,arn. <:?rany F:81-specifieinsiderthreat li)J:ogrnm.H would appreciate receiving these materials by Janua1y 14,. 2014. I know that you consider transparency to be an important value, and I trust tlmt transparency on this issue will benefit both ,•.,histleblowers and our national security. ----ff Should you have any uestions regarding this letter, please contact! my staff at ____ Sincerely, ~~ Charles E. Grassley Ranking Member cc: The Honorable ,James R. Clapper Director of National Intelligence http://www.mcclatchydc.corn/2013/06/20/194513/obamas-cmckdown-views-leuks-as.htmlfl.Uccy-- vmVHI. 5 Presidential Policy Directive 19, The White House, October 10, 2012. __, b6 b7C I From: Sent: To: Subject: I(Judiciary-Rep H b6 b7C I bmsciav,)anuary•09 20142:j':t.s-F,.,1v""1 -------------...1 I RE: Letter re Insider threat videos ! Thank you for the very prompt response to Senator Grasslcy's letter. Ijust got back in the office yesterday after being out on paternity leave, and received the videos then. However, I did want to just check-does this mean that there arc no other trnining materials regarding the National lnsider Threat Progrnm or any FBI-specific insider thrcnt program'? Thanks. I b6 b7C nvcst1ga1tve ounsc Ranking Member Charles E. Grasslcy ll.S. Senate Committee on the Jucliciar, I I . From:! ![mailtoj Sent: Tuesday, December 31, 2013:'"'.2"::":':::2-;:9=-;iP:":'M-:----------.....J To: I !(Judiciary-Rep); CEG (Judiciary-Rep) Subject: Letter re Insider threat videos Letter from FBI, response to Sen. Grassley's of Dec. 17, 2013, requesting copy of videos re: insider threat. Hard copies of letter and videos were also hand-delivered to ~JC Minority office, Dirksen 152 on December 31, 2013. 1 ~, Event Date: - } . . . 1 1/30/2014 Date Entered: Congressional Affairs Office Congressional Contacts Classification Level: junclassified j2014-522 .. () ~~;;fing •. 0-;~;; O~SAC ~-·oHQ;; 6;-;;;---·@Other [ -----------------~::::::::::::.:;-------' Brief Type: 1/30/2014 Unit: · Iadditional Insider Threat training cl_etails. ·. b6 b7C Date: IDivision: ' r--------,1---------------------- DOJ Contact: Event Time: JcLU II '"""-:----:----::-:::-;:::==,Sen. Grassley sta~ffe~ : : : Iinquiry re status of any OCA Contact Person: / 11of SAC CV Visits: Event Date: Entered By~ Top l c • @ Reactive @Proactive l Attended: FBI Participants: Other Participants: Committees /Subcommittees Members/Staff: !_____. 1sen. Grasstey staffer .. Executive Summary: Sen. Grassley staffer .. l ____ _.linquiry re status of any additional Insider Threat training details. Details of Event: :sen. Grassley staffe4 lnquiry re status of any additional Insider Threat training details. Advised staffer . •that additional details may be available, will i:1et!'ack wh~n/if any available. Follow Up Action: Attachment: Q b6 b7C Congressional Affairs Office Congressional Event Date: Classification Date Entered: J2014-552 '.CBriefing () Hearing Brief Type: Entered Byj._ _________ Topic: Level: O Junclassified @ Reactive [@Proactive ~ Other SACCV () HQ CV () FOC ·----=========:;------' Event Date: Event Time: Unit: __. ~ coo~dinatebriefing for Sen..~rassley L__Je Contacts Insider Threat program trammg OCA Contact Person: .._ _______ _J I. #of SAC CV~ _ Visits: jcLU II staffer! ,._ __ _. b6 b7C Division: _. DOJ Contact: Date: j Attended: FBI Participants: Other Participants: Committees /Subcommittees I_____ ... Members/Staff: .. ~taffer for Sen. Grassley (IA) b6 b7C Executive Summary: Steps to coordinate briefing for Sen. Grassley staffd.._ ____ __.~e Insider Threat program training Details of Event: Steps to coordinate briefing for Sen. Grassley staffe! !re Insider Threat program training. Questions .that staffer has do not lend themselves to yes or no answers. so briefing in the format of a Q&A is proposed to staffer through the CD-4D unit. Follow Up Action: Attachment: Q Congressional Affairs Office Congressional Event Date: Classification Date Entered: :.'iO!i'/;16/W1lf, \ \ "-•~---· • Briefing J__________ "____ 1 Brief Type: Topic: I ---------, 1 ~ 0-th;,. SAC CV Visits: J. 0 Event Time: 4/16/2014 Unit: Reactive ·-1ti of ---------~- j r Grassley staffelte sent by AD Kel~ unclassified /~Q;: f-JF~-C---(-~-- ·------·--··· Event Date: Entered By: I (".!)Proactive )2014-627 Hearing ,. l SAC OJ .( ----·-· Level: Contacts jcLU II insider threat video training access link b6 b7C Division: OCA Contact Person: DOJ Contact: Date: J Attended: FBI Participants: Other Participants: Committees /Subcommittees Members/Staff: .. ! ____ _.!Grassley staffer Executive Summary: Grassley stafferc:Jre b6 b7C insider threat video training access link sent by AD Kelly. Details of Event: Grasf'ey staf!erc::Jre Defense Information Security Agency insider threat video training access link sent by AD Kelly claimed unable to access, then later acknowledged ability to access link on computer. Follow Up Action: Attachment: Q b6 b7C