huh-nu-i-u?nru-uu-n-p .. . Doc ID: 6595176 NATIONAL SECURITY SECURITY .SERVICE . -5K2W??wmtc- "?aunt?? INSPECTOR GENERAL REPORT OF INVESTIGATION 9 January 2014 IV-11-0073 Unauthorized SIGINT Tasking This is a PRIVILEGED DOCUMENT. Further dissemination of this report outside of the Of?ce of Inspector General, NSA, is PROHIBITED without the approval of the Assistant Inspector General for Investigations. 3 - P.L. 86?36 Ii i I Classi?ed By. I Derived From: - Dated: 20140109 Deciasmfy 011110390109? WW fur. R3: .1951 Sir: b?y' 1?3 57.3.31 4:31: 10?02 -2{]17 Cast-2 71333 ?51 [1 ?663}? Release: 2017-10 Doc ID: 6595176 - -. -. IV-II-0073 ibii3 tbit6 I. (U) SUMMARY - P.L. 86-36 P.L. 86?36' (Ufl?FeHe-jl This investigation was court .10th 1n response to ?arefenal alleging that - nited States Navy (USN) while deployed with United States FDIOESP Ir (USFI), queried a telephone number belonging to a U. S. person through the without authorization (Ill/F639) A local audit of the system revealed heartened a telephone number'belongingto a U. S. on on 4 June 201 1 The que M: eds through [system whilel has assi?ed to thei I The query sought data from May to 4 June ?201 1. No infonnation was retrieved as a remit of this query due to system safeguards. ?An Intelligence- Related Incident Report was completed by a local system auditor and provided to the NSAICSS Signals Intelligence Directorate Oversight and Compliance of?ce and to the Of?ce of the Inspector General (GIG). This matter was investigated by the 016 and the Navy Criminal Investigative?Serviee. The OIG concluded that : deiiberateiy and without authorization queried a telephone number belonging to a US. person. Her actions violated Executive Order 12333, USSID 18, 5 C.F.R. ?2635.704, and Department of Defense Regulation 5240.1-R, Procedures 2 14. A Navy Criminal Investigative Service investigation is pending. (U) Copies of the 010 report will be provided to the NSAICSS Associate Directorate for Security and Counter Intelligence, the Of?ce of General Counsel and NCIS for review and appropriate action. NSA: 00002 Release: 2017-10 w-vnnuna- - - WW I V-11-0073 ll.(U) BACKGROUND (U) Introduction lb} {61 131(31 - P.L. 86-36 [(13113) P.L. J.I - a p?I' I (unset-.195 0n 9 Jul}: 201 a local audit of the SIGINT system was cond cted a This audit discovered that on 4 - _.[11ne.2011 [queried a telephone number belonging to a U. S. person. The query was made th cash the __database search engine which uses the Idatahase. (111156361 Tit-sitei'asued an Intelligence- hRelated Incid?nt-Repon documenting: query of a This report was provided to the Signals efntelli?gence Directorate Oversight and Compliance of?ce and the Office of the Inspector General. Since the incident involved an active duty sa1 tor, the Navy Criminal Investigative _Service (NCIS) also opened an investigation The results of the (b NCIS irmestigation is pending. to the NSA SIGINT system 1 started on 4 June 201 1. Her access to stem was revoked on 10 July 2011. She remained at tiled site until August 201 1, serving in an administrative position She returned to her home port of San Diegocurrently assigned to titd and does. not have access to SIGINT systems. UH The OIG initially received information thatl:l Navy chain of command had conducted an investigation into this matter. It was later determined that an investigation had not been conducted. The OIG Opened its investigation after notifying NCIS. NSA: 00003 Release: 2017?10 Doc ID: 6595176 1V-11-0073 (U) Applicable Authorlties (U) The investigation looked at possible violations of the following authorities. See Appendix A for the ?ll citations. - (U) Executive Order 12333 United States Intelligence Activities II (U) United States Signals Intelligence Directive 18 (USSID 18) I (U) DOD Regulation 5240.1-R, Procedures Governing the Activities of Intelligence Components that Affect United States Persons 0 (U) Standards of Ethical Conduct for the Executive Branch, 5 C.F.R. ?2635.704, Use of Government Property NSA: 00004 Release: 2017-10 Doc ID: 6595176 IV-II-0073 111. (U) FINDINGS (UIIFQUG) oral deliberately and without authorization query a U.S. person?s telephone number in the SIGINT system for non-foreign intelligence purposes? (0/5999; couc'wsmu: Substantiated. Th of the evidence supports the conclusion thrill lquen'ed a 3. person 's telephone number in the em 1' non-foreign intelligence purposes. Her actions violated Executive Order 1233, 18, Don Regulation 5240. 1-R, and R. ?2635. 704. (U) Documentary Evidence - (U) Agency Training Records - P.L. 86-36 Agency training records showtha (b (6) success?illy completed the Legal Compliance and Minimization 11:: 'Procedpres training course (OVSC 1800) on 7 March 2011. This 1 j~ . ?course coveis indeiail the rules against targeting United States Agency training records also show marl: successfully completed the Overview of Signals lute igence "Authorities training course (OVSC 1100) on 7 March 2011 (U) Intelligence-Related Incident Report (131(3) M- 86-36 On 4 June 2011 :Imade one database query of a U. S. person' telephone number. The database query reQuested data from SIM/lay to 4 June 201 I. No results were retumcd as a result of this query. The query did not involve FISA data The query was discovered daring a local audit on 9 July 201115111 information related to this query was purged locally (Appendix B) . (U) United States Navy non-punitive counseling record (Ul@avy supervisor athsued non-punitive, correcnve counseling letter to her on 2 September 201 for conducting an ?unauthorized database query on an NSA system? (Appendix C). 4 NSA: 00005 Release: 2017-10 -. .. .. .. -- Doc ID: 6595176 [17-11-0073 (U) Tostlmonlal Evldonca Petty Of?cerl I (WW: U. SgNavy, was interviewed on 15 August 2013 regarding the allegation that she had misused a U.S. SIGINT system'io targe" non-foreign intelligence purposes. Special Agent Naval Criminal Investigative ServicefNCIS) also participated in the interview. The interview was e'onducted in NCIS spaces,: 3?405. Welles Street, San Diego, CA aived her right to counseLbefore the interview provided the following sworn - testimony (6) (3) P.L. 86?36 (Ur/reamr?Iis- currently assimiedtotheEI lSan Diego CA (Ulent TDY to NSA to approximately 201?] to receive trainingonthe use of SIGINT systems bfeib're being deployed to the] .1: in" - brogram. The training consisted power point presentation after another. She learned that a U. S. 6 person could not be targeted through SIGINT, unless there was a 1 legitimate reason and permission was received from management. (Ll) was deployed to United States Forces Iraq as part of th program from 4 June to August 2011. The only collection System she recalled having access to was ANCHORY. (WES-H6) On abouts Jone 2011':Iwas being trained on the SIGIN collection system by a U. S. Army enlisted soldier. She could not recall this soldier?. sname. The soldier trained all new arrivals for thel:lprogram. The soldier was standing behind ?her while she received step~by~step training on the system As training progressed. she typed in the telephone number of a cellular telephone that belonged to her boyfriend?s son. it was her decision to input this particular telephone number into the collection system. The number was to a pre-paid phone purchased ata~ . Walinart in San Diego, CA. In addition to her boyfriend?s son boyfriend, her daughter and her sister also used this pro-paid phone. She inputted the number into the SIGIN system because it was the only telephone number she could think of at the time. She could not explain why this telephone number came to mind instead of her own telephOne number or any other number. The training also required her to put in search parameters and she 5 NSA: 00006 Release: 2017-10 - P.L. 86?36 P.L. 86-36 IV-11-0073 selected 5 May to 4 June 2011. She was then told to move on to another computer screen and keyboard and did so without clearing the telephone number and dates she had already entered. At some point she pressed the ?enter" key on the second keyboard and both monitor screens displayed a bright red warning sign- She saw nothing more than the bright red screens after pressing the ?enter? key. She did not see any data related to her query and did not know if actual telephone calling data was displayed as a result of her query. She became panicked and asked her training of?cer what had just happened. She was told not to worry and to clear out the various ?elds she had ?lled in and to clear both screens. She thought her training of?cer would report this incident, but he did not. She did not report this incident to her management. - - . tux/Feats; in approximately August 201 asked to meet or managers after she had completed a shift'She was asked if she had ever hii?sused the collection system and, after sohie? thought. recalled making the query on the cellular phone helongingtoh?ihoyfriend?s son. She explained to her management?that the hicideri?haplyed a training mistake. However, she was removed from the llection unit and reassigned to JESTR headquarters, which was in a different building. ?She spent the remainder of her detail at headquarters. She was required to conduct a one-time training course on the proper use of the SIGINT systems as part of non? . .punitive counseling. She completed the training in September 201]. She was not allowed back into the collection site or given access to the SIGINT system. She departed Iraq in October 2011 and returhedto San Diego, CA. not know why she was not allowed to access the SIGINT systems after explaining to her management that her targeting of a U.S. person was the result of a training accident She did not know why there have not been other instances of similar training accidents because the same U.S. Army enlisted person trained all newEarrivals. After making the query on the telephone belonging to her boyfriend?s son, she made no further mistakes by targeting U.S. persons. She swore that her actions were merely a training mistake. She denied intentionally targeting the telephone belonging to her boyfriend?s son. NSA: 00007 Release: 2017-10 Doc ID: 6595176 1-0073 (U) Analysis and Conclusion P.L. 86-36 (3) - P.L. 86-36 (13) (6) By her own admission,l was trained on the to use of NSA SIGINT systems before dep oying to the taehment. A ency records document this training was given tol Ibefore- he'r deployment. Despite this training :conducted a query on a telephone number belonging to a U.S. person. Her actions were discoveredtl?irough a local audit of the SIGINT system on 9 July'2011 and'document?d in the NSAJICSS Intelligence?Related Incident, report: . (WIT-9365 On several occasions dmilted to . :of?ciais that sh_e_had entered the telephone number of a U.S. 1, person into'the SIGINT system and made a query on that telephone number. Her admissions are documented on the 12 September 201 1 Navy counseling letter and during her interview with the 01G and NCIS on 15 August 2013. i .by saying her unauthorized query of a US. person was the result of attaining accident. Her argument does not change the facts that she?had been trained on the proper use of the SIGINT system before deployment, entered the speci?c telephone number of a US. personinto the SIGINT system, and conducted a query of a US. person without preper authorization. (UH-13999) reponderance of the evidence, we conclude that onducted a query of a U. S. person?s telephone number in the US. SIGINT system for a non- intelligence purpose. NSA: 00008 Release: 2017-10 Doc ID: 6595176 - IV-11-0073 V. (U) RESPONSE TO CONCLUSION (13} (3) (6) P. L. 86-36 Tentative cenclusions were not sent She no longer has access to NSA SIGINT Systems and is not under NSA command authority. NSA: 00009 Release: 2017-10 Doc ID: 6595176 WW I V-II-0073 VI. (U) Based upon the preponderance of the evidence, the 010 concluded that [:Eyeliberately and without authorization queried a telephone number longing to a .8. person. Her actions violated Executive Order 12333, USSID 18, 5 {52635304, and Department of Defense Regulation 5240.1-R, Procedures 2 l4. - P.L. 86-36 NSA: 00010 Release: 2017-10 Lynn, ea,? - 25.7: - --.- - .. . Doc ID: 6595176 I V-II-0073 Senior Investigator (3) suL. 86?36] Assistant Inspector General for Investigations 10 NSA: 00011 Release: 2017-10 Doc ID: 6595176 I V-I 1-0073 Appendix A - Applicable Authorities (U) Executive Order 12333 United States Intelligence Activities (U) Part l, 1.7 intelligence Community Elements. . .. c. The NATIONAL SECURITY AGENCY. The Director of the National Security Agency shall: (1) Collect (including through clandestine means), process, analyze, produce, and disseminate signals intelligence information and data for foreign intelligence and counterintelligence purposes to support national and departmental missions; (2) Establish and operate an effective uni?ed organization for signals intelligence activities, except for the delegation of operational control over certain operations that are conducted through other elements of the Intelligence Community. No other department or agency may engage in signals intelligence activities except pursuant to a delegation by the Secretary of Defense, after coordination with the Director; (3) Control signals intelligence collection and processing activities, including assignment of resources to an appropriate agent for such periods and tasks as required for the direct support of military commanders; (4) Conduct administrative and technical support activities within and outside the United States as necessary for cover arrangements; (5) Provide signals intelligence support for national and departmental requirements and for the conduct of military operations; (6) Act as the NatiOnal Manager for National Security Systems as established in law and policy, and in this capacity be responsible to the Secretary of Defense and to the Director; (7) Prescribe, consistent with section 102A(g) of the Act, within its ?eld of authorized operations, security regulations covering operating practices, including the transmission, handling, and distribution of signals intelligence and communications security material within and among the elements under control of the Director of the National Security Agency, and exercise the necessary supervisory control to ensure compliance with the regulations; and (8) Conduct foreign liaison relatiOnships in accOrdance with sections and l.10(i) of this order. (U) Part 2, 2.3 Collection of Information. Elements of the Intelligence Community are authorized to collect, retain, or disseminate informatioo concerning United States persons only in accordance with procedures established by the head of the Intelligence Community element concerned or by the head of a department containing such element and approved by the Attorney General, consistent with the authorities provided by Part 1 of this order, after consultation with the NSA: 00012 Release: 2017-10 Doc ID: 6595176 IV-11-0073 (U) United States Signals Intelligence Directive (USSID 18) (U) Section 3 Policy, 3.1. The policy of the is to TARGET or COLLECT only COMMUNICATIONS. The will not intentionally COLLECT communications to, from or about US. PERSONS or persons or entities in the US. except as set forth in this USSID. If the inadvertently collects such communications, it will process, retain and disseminate them only in accordance with the USSID. (U) Section 4 Collection, 4.1. Communications which are known to be to, ??Om or about a US. person or non?diplomatically immune visitor to the US. will not be intentionally intercepted, or selected through the use of a selection (U) Regulation Procedures Governing the Activities of Bob Intelligence Compenents that Affect United States Persons (U) Procedure 2 Collection of Information About United States Persons, C. Information that identi?es a United States person may be collected by a intelligence component only if it is necessary to the conduct of a function assigned the collection component, and only if it falls within one of the following (U) Procedure 14 Employee Conduct, Employee Responsibilities. Employees shall conduct intelligence activities only pursuant to, and in accordance with, Executive Order 12333 and the Regulation. In conducting such activities, employees shall not exceed the authorities granted the employing intelligence components by law; Executive Order, including E0 12333, and applicable directives. (U) Standards of Ethical Conduct for the Executive Branch, Title 5, Code of Federal Regulations, ?2635.704 Use of Government Property (U) Standard. An employee has a duty to protect and preserve Government property and shall not use such property, or allow its use, for other than authorized purposes. (U) Title 18, United States Code, 2511 Interception and disclosure of wire, oral, or electronic communications prohibited. (U) (1) Except as otherwise speci?cally provided in this chapter any person who Intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication; Intentionally uses, endeavors to use, or procures any other person to use or endeavor to use any electronic, mechanical, or other device to intercept any oral communication; Shall be punished as provided in subsection (4) or shall be subject to suit as provided in subsection (5). NSA: 00013 Release: 2017-10 Doc ID: 6595176 I V-11-0073 APPENDIX NSAICSS INTELLIGENCE-RELATED INCIDENT REPORT NSA: 00014 Release: 2017-10 Doc ID: 6595176 (133(3) (133(6) - P.L. 86-36 .-. mama's-ugh s4: uwmkwu. unr? a, ?x 'F-r -- - WW. Han71'3? 15's St;- {'page (U) IntelligencewRelated Incident Report NSA: 00015 Release: 2017?1 0 Doc ID: 6595176 P.L. 86?36 (bl 1"ij 95?" PET/ji?sl?t?i? ?41} MSA: 00016 Release: 2017-10 Doc ID: js??sh (3) (6) - P.L. 86-36 JeWZ/?hgumm? NSA: 00017 Release: 2017-10 Doc ID: 6595176 av Egg -3: I (b1 - P.L. 86?36 (6) 00018 Release: 2017-10 Doc ID: 6595176 JLL [Lk rm 86?36 (103(6) 00019 Release: 2017-10 Doc ID: 6595176 I V-11-0073 APPENDIX COUNSELING LETTER NSA: 00020 Release: 2017-10 Doc ID: 6595176 DETAILED REASON OR COUNSELING: This corrective counseling is being administered til in correct a de?ciency and should NOT be viewed upon as a punitive action. On June 5, 2011 kond?ucted an unauthorized database query on an NSA system. Her actions although not found m: be malicious or intentional, were in violation of Executive Order 12333 (Section 2. 3). Department of Defense (Doll!)~ Regulation (Chapter 2, Paragraph (32. 3. 1; Chapter 5 Parag'aph C5 ..3 3. IICS. 3. 3. 3. 2. 1; Chapter 5 Paragraphs C5. 6 through C5. 6. 7 .3), and Anny Regulation (AR) 318-10. . It is the intent of this counseling to maki Inware of the violations, to reinforce the importance of the above mentioned regu ations, and to crop Esire h_er responsibility?to the United States government while conducting the SIGINT mission. . . OTHER AGENCIES INDIVIDUAL REFERRED TO FOR COUNSELINGNone . - - Zr. Jr SOLUTION DEVELOPED T0 PROBBEM AND PRECLUDE, FURTHER INVOLVEMENT: .: . :acknowledged her negligence and that she ha to adhere to ALL er access to these safe guarded systems. 'll coordinate with complete ALL annual Information Assurance training by COB 1 ISEPDS rmore. w: coordinate with leadership, crestet?ra'ming slides. schedule a tram 3 site. and conduct training on the above mentions to time and USSID 18 SPDOIS) fed Deteciunent personnel on VBC. This training' 15 to be completed by COB on i I (M) INDIVIDUALS RESPONSE TO 171-115 COUNSELING SESSION: .. HUME Fir ??ns ?rst?? I .- (3) P.L. 86-36" we I Cn?bm Hawki- fez ?gs-.23 ?amass .4- 9,1 mum: I A'l? WIDATE NSA: 00021 Release: 2017-10 Doc ID: 6595176 . RECORD OF COUNSELING 1510-45 (REV 3-91) INSTRUCTIONS FOR 'l'lIl-L COMPLETION OF THIS FORM l. The coumeling session should be In private and slmuld respect the rights of the individual. 2. The statement, upon completion. should be tevietved very carefully in order to ensure cwmselee understands all comments. 3. Provide counselee copy of this report iflte/shc so desires. P.L. 86?36 4. Ensure report is ?led with Division Of?cer?s Notebook in It looked desk orsat?e. 6 PRIVACY ACT . Authorization to request dte in this form its derived from HEW regulations. Purpose of this fem is to provide Ilia Division Of?cer with readily accessible data ouroernitlgpemonnel En his?her division. 'I?Ite infomuion mod by the Division Of?cer to may: nod "(minister hisrher persmnei, to tab: action: regarding or misatkhetorry performance. Ditelosure of the following item ofini?ottmiiert is voluntary. The indivldual being documented has the tight to amine Ind copy this down-rotation related to trimmer: have the to ieviow and discuss the issue: in order to resolve them: have tlterisbtto 10.1": modi?cation of. misdoerroem. Myotntement made out and may bomodegnim himm-er in a court of law. . 0138M Manor. 1 I DISEPII I gist? . . NAMF- . - REASON FOR COUNSELING SESSION (NOTE: Insert (P) for Positive . (N) for Negative or (I) for informative A PROFESSIONAL KNOWLEDGE: JOB TECHNICAL KNOWLEDGE a APPLICATION RESPONSIBILITY at QUALITY OF CAREER RESPONSIBILITY ON THE JOB TRAINING PROGRESS QUALITY OF WORK: TEAMWORK: STANDARD OF VALUE OF END PRODUCT CONTRIBUTIONS TO TEAM BUILDING TEAM RESULTS EQUAL OPPORTUNITY: 1 LEADERSHIP: RESPECT FOR HUMAN WORTH ORGANIZING. INC AND DEVELOPING DOMESTIC RESPONSIBILITY MILITARY BEARINGICHARACTER: 1 OTHER: TO CORE CONDUCT COMMUNITY CONFLICT .ETC . DRESS A: APPEARANCE: PHYSICAL FITNESS NSA: 00022 Release: 2017-10