Approved for Release by ODNI on 25 October 2018, DF-2017-00093 National Security Council l"Q f2 ii ii GR Iii • Document Referral Memorandum For: Package Number: 4416004907 Name: (b)(3) Agency: DNI Address: Act ion Date: 12/2/2016 11:50:40 AM Document Description: To: PRESIDENT From: WYDEN, RON HEINRICH, MARTIN REED, JACK KING, ANGUS WARNER, MARK HIRONO, MAZIE MIKULSKI, BARBARA Date: 11/29/2016 Subject: LETI'ER FROM SENATORS WYDEN ET AL RE DECLASS IFYING INFORMATION REGARDING RUSSI AN INTERFERENCE IN 2016 U.S. ELECTION Action Required: DIRECT REPLY/ FURNISH INFO COPY Due Date: 12/09/2016 Comments: Please reply on behalf of the President. Obtain NSC cleara nce before returning response to the Hill. Thank you . For: Corey Nightengal e Director of Records Management CLASSIFICATION: TOP SECRET Please Return Signed and Dated Receipt to: NSC Records Management Room 5013, NEOB Washington, D.C. 20504 or fax to(202) 456-9230 000292 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 JAMI:~ f' R!$C;1. IOA.Ht; DANl[i COA rs. iNDVW~ MAPCO HU810, ~l:'.JRID.A $USAN M COd INS MA1N[ ROY tiLUk l, M1S$0Lfll ,..ANtES t,_A~Kt"ORU Ul(.L.\t-l(Jl\~A MARK R. WA't~FA, V/~\jlMA. MAf-lTIN HflNRtt.H. l\EW MEXttC A"'-IGVS S >;.fNG. MA!Nf, MAZIE K MIRONO "'iAWAit J'°'. "!"OM COTTON, ARKA;,,.iSAS ._.,.,TCH McCO/\,NE:,.l, IClNT\JCl(V 1:K OFFICIO l!AAMY A[IO, Nl:VAOA, E)( OFFICIO JOH!'( Mc.CAIN, AFtlZONA, E)( ~f-11.10 JA(;~ RE.ED. ~H{)Of ISLAND. tX O~f-lCl'1 CHfUSl OPHE: A A, JOYNEf1 Si AFF DIA ECTOR ·linitcd ~tatcs ~cnatr SELE Cr COMMITTEE ON INTELL!GENCE WASHINGTQI',. DC 20510--547~ November 29, 2016 Mlt.HAH ~A'5EY MINO~iT"I' S lAfF ~.HRECTOR Dl:$1RE.C fHOMPSON SAVI .E. CHIEF CLERK The President The White House 1600 Pennsylvania Avenue, NW Washington, DC 20500 SSC I# 20 1 6 - 3775 Dear Mr. President: We write to request that, to the extent possible, you declassify and release to the public additional information related to the Russian Government and the U.S. election. Specifically, we have serious concerns about information recently provided to the Senate Select Committee on Intelligence regarding Russian Active Measures and election related cyber activity associated with the Russian intelligence services. Despite the broad national interest in this topic, this new information has not been provided to the American people. Accordingly, we request the declassification and release of the infonnation enclosed in quotations below. 000294 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 In addition, on November 7, 2016, the FBI made the following assessment in a summary of 2016 general election related cyber activity within the United States: (b){1 ), (b )(3), (b )(7)(A), (b )(7)(E) 000295 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Thank you for your attention to this important matter. Sincerely, 000296 ENCLOSURE UNCLASSIFIED Approved for Release by ODNI on 25 October 2018, DF-2017-00093 OFFICE OF THE DlRECTOR OF NATIONAL INTELLIGENCE WASHINGTON, DC 20511 JAN 27 2017 The Honorable Richard J. Durbin United States Senate Washington DC, 20510 Dear Senator Durbin: Thank you for your letter to President Obama on 13 December 2016 requesting a National Intelligence Estimate regarding Russian efforts to manipulate the recent U.S. Presidential election. President Obama asked former Director of National Intelligence (DNI) Clapper to respond on his behalf. The Office of the DNI (ODNI) shares your concerns regarding Russian actions in the runup to the election. The Intelligence Community (IC), at the President's request, completed a comprehensive review of all intelligence related to Russian efforts to influence the recent Presidential election. That report, an Intelligence Community Assessment entitled Assessing Russian Activities and Intentions in Recent US Elections, was delivered to the Senate in both classified and unclassified formats on 6 January 2017. The Department of Homeland Security and ODNI also issued an unprecedented joint public statement on 7 October 2016 assessing that the Russian Government directed the recent compromises of e-mails from U.S. persons and institutions, including from the Democratic National Committee and other U.S . political organizations. The IC also furnished a coordinated, unclassified assessment of these threats to Federal partners with responsibility for engaging with state, local, tribal, and territorial authorities on cybersecurity matters. Thank you for your interest in this important matter. If you have any further questions, please contact Ms. Deirdre M. Walsh, Director of Legislative Affairs, at (703) 275-2474. Sincerely, h ;_~ , f . ~ Michael P. Dem~ Acting Director of National Intelligence Enclosure: 1. National Intelligence Council Assessment: Background to "Assessing Russian Activities and Intentions in Recent US Elections": The Analytic Process and Cyber Incident Attribution UNCLASSIFIED 000257 UNCLASSIF IED Approved for Release by ODNI on 25 October 2018, DF-2017-00093 The Honorable Ric hard J. Durbin cc: The Honorable Patrick Leahy The Honorable Ben Cardin The Honorable Al Franken The Honorable Brian Schatz The Honorable Gary Peters The Honorable Tom Udall The Honorable Robert P. Casey, Jr. The Honorable Edward Markey 2 UNCLAS SIFIED 000258 Approved for Release~@S[~~fD2018, DF-2017-00093 OFFICE OF THE D IRECTOR OF NATIONAL INTELLIGENCE WASHINGTON, DC 2051 1 JAN 27 2017 The Honorable Ron Wyden United States Senate Washington DC, 20510 Dear Senator Wyden: Thank you for your letter to President Obama on 29 November 2016 regarding Russian activities and intentions during the recent U.S . Presidential election. President Obama asked former Director of National Intelligence (DNI) Clapper to respond on his behalf. The Office of the DNI (ODNI) shares your concerns regarding Russian actions in the runup to the election. The Intelligence Community (IC), at the President's request, completed a comprehensive review of all intelligence related to Russian efforts to influence the recent Presidential election. That report, an IC Assessment entitled Assessing Russian Activities and Intentions in Recent US Elections, was delivered to the Senate in both classified and unclassified formats on 6 January 2017. The Department of Homeland Security and ODNI also issued an unprecedented joint public statement on 7 October 2016 assessing that the Russian Government directed the recent compromises of e-mails from U.S. persons and institutions, including from the Democratic National Committee and other U.S. political organizations. The IC also furnished a coordinated, unclassified assessment of these threats to Federal partners with responsibility for engaging with state, local, tribal, and territorial authorities on cybersecurity matters. The briefings former DNI Clapper provided the week of 9 January 2017 were intended to provide additional insights and an opportunity for an interactive dialogue. Thank you for your interest in this important matter. If you have any further questions, please contact Ms. Deirdre M. Walsh, Director of Legislative Affairs, at (703) 275-2474. Sincerely, ft,..'c,ly..e J f. ~~ Michael P. D e ~ Acting Director of National Intelligence Enclosure: 1. National Intelligence Council Assessment: Background to "Assessing Russian Activities and Intentions in Recent US Elections": The Analytic Process and Cyber Incident Attribution UNCLASSIFIED 000259 Approved for ReleasEl1Jm"@t:Alm:?I Pit®fJ 2018 , DF-2017-00093 The Honorable Ron Wyden cc: The Honorable Dianne Feinstein The Honorable Mark Warner The Honorable Martin Heinrich The Honorable Mazie Hirono The Honorable Jack Reed The Honorable Angus King 2 UNCLASSIFIED 000260 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. The recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts. These thefts and disclosures are intended to interfere with the US election process. Such activity is not new to Moscow- the Russians have used similar tactics and techniques across Europe and Eurasia, for example, to influence public opinion there. We believe, based on the scope and sensitivity of these efforts, that only Russia's senior-most officials could have authorized these activities. Some states have also recently seen scanning and probing of their election-related systems, which in most cases originated from servers operated by a Russian company. However, we are not now in a position to attribute this activity to the Russian Government. The USIC and the Department of Homeland Security (DRS) assess that it would be extremely difficult for someone, including a nation-state actor, to alter actual ballot counts or election results by cyber attack or intrusion. This assessment is based on the decentralized nature of our election system in this country and the number of protections state and local election officials have in place. States ensure that voting machines are not connected to the Internet, and there are numerous checks and balances as well as extensive oversight at multiple levels built into our election process. Nevertheless, DBS continues to urge state and local election officials to be vigilant and seek cybersecurity assistance from DHS. A number of states have already done so. DHS is providing several services to state and local election officials to assist in their cybersecurity. These services include cyber "hygiene" scans of Internetfacing systems, risk and vulnerability assessments, infonnation sharing about cyber incidents, and best practices for securing voter registration databases and addressing potential cyber threats. DHS has convened an Election Infrastructure Cybersecurity Working Group with experts across all levels of government to raise awareness of cybersecurity risks potentially affecting election infrastructure and the elections process. Secretary Johnson and DHS officials are working directly with the National Association of Secretaries of State to offer assistance, share information, and provide additional resources to state and local officials. 000261 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Background Questions What activities related to the US election does the USIC attribute to Russia? • The IC has high confidence in its attribution of the intrusions into the DNC and DCCC, based on the forensic evidence identified by a private cyber-firm and the IC's own review and understanding of cyber activities by the Russian Government. What about the disclosures that occurred after the DNC and DCCC intrusions? The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. At least some of the disclosures, including the disclosures of DNC and DCCC documents by Guccifer 2.0, DCLeaks, and WikiLeaks from June to August 2016, are consistent with the methods and motivations of Russian-directed efforts, thus suggesting Moscow is at least providing the information or is possibly directly responsible for the leaks. • The disclosure of White House e-mails by DCLeaks also appears to be consistent with tactics and motivations of the Russian Government. • Similarly, the disclosures of medical information from the World AntiDoping Agency by a hacker group calling itself "Fancy Bear" are consistent with the cyber tactics and motivations of the Russian Government. How did the US IC attribute the DNC and DCCC intrusions to the Russian Government? • The IC independently observed technical activity that is consistent with the forensic evidence identified by a private cyber-firm and is consistent with our general understanding of cyber activities by the Russian Government. Does the USIC believe additional Russian action to interfere with our elections is imminent? • We expect that Russia will continue its efforts up to Election Day. 000262 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 Has the USIC concluded that Russia is behind the "Shadow Brokers" disclosures? • We are not in a position to comment on Shadow Brokers at this time. Was Hal Martin, the recently arrested former NSA contractor, part of this Russia-sponsored effort? • We are not able to comment on ongoing criminal investigations, so we would refer you to the Department of Justice. Do you assess that Putin ordered these operations? • We believe that authorization to conduct these operations could only have come from the most senior levels of the Russian Government. Has the US concluded that Russia is responsible for the intrusions into state election systems? • We are not definitively attributing the intrusions into state elections systems to the Russian Government, but the fact that they are consistent with Russian motivations and intent behind the DNC and DCCC intrusions, strongly suggests that Russia is responsible. ls Russia trying to alter the outcome of the US election? • The Kremlin probably expects that publicity surrounding the disclosures will raise questions about the integrity of the election process and would undermine the legitimacy of the President-elect. What is the USG doing about this? • The American public and our democracy are resilient to foreign attempts to manipulate public opinion. The U.S. Government is committed to ensuring a secure election process and has robust capabilities to detect efforts to interfere with our elections. • The President has made it clear that we will take action to protect our interests, including in cyberspace, and we will do so at a time and place of our choosing. Consistent with the practice we have adopted in the past, the 000263 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 public should not assume that they will necessarily know what actions have been taken or what actions we will take. What options are you considering for your response? • We are not going to discuss potential responses except to say that as we implement our responses, some responses you may see, and others you may not. Why is the USG publicly attributing these actions now? Why didn't the USG attribute this sooner? • • In this instance, we have applied the framework we have used in the pastthe IC and FBI worked together to evaluate information gathered through intelligence sources, FBI investigations, and other sources in order to determine attribution. As the IC gathered new information, it was able to reach higher degrees of confidence about which actors are responsible and · then determine what could be disclosed publicly, consistent with law enforcement equities, while appropriately protecting sources and methods. We also worked as quickly as possible to release as much information as possible in order to provide state and local officials sufficient time to fortify their infrastructure. When was the President apprised of this conclusion? • The President has been regularly updated on the analysis and the lC's conclusions. ls the Russian effort intended to assist the Trump campaign? • Whatever the Russian Government's motivation, its interference is a source of concern. The U.S. Government does not make attribution determinations very often. Does this mean you have changed your position on attribution? • As the IC gathered new information, it was able to reach higher degrees of confidence about which actors are responsible and then determine what 000264 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 could be disclosed publicly, while appropriately protecting sources and methods. • Publicly identifying those actors is a step that the government considers when we have confidence in the attribution and can make the information public, consistent with U.S. national security interests, including the protection of sources and methods, and when doing so advances U.S. national interests. What is DHS doing to help state and local governments raise their cybersecurity protections ahead of the elections? • DHS is providing several services to state and local election officials to assist in their cybersecurity. These include cyber "hygiene" scans of Internet-facing systems, risk and vulnerability assessments, information sharing about cyber incidents, and best practices for securing voter registration databases and addressing potential cyber threats. As of October 6, more than half of the states have contacted DHS and are in discussions about receiving one or more of these services. • DHS has convened an Election Infrastructure Cybersecurity Working Group with experts across all levels of government to raise awareness of cybersecurity risks potentially affecting voting infrastructure and the elections process. • Secretary Johnson and DHS officials are working directly with the National Association of Secretaries of State to offer assistance, share information, and provide additional resources to state and local officials. Why hasn't DHS designated the election system to be a critical infrastructure sector? • At this point, we do not believe that designating election systems as a critical infrastructure sector would provide significant new authorities or resources to safeguard these systems in the near term. We have committed that we will not take any action on this issue until after the election and we have had sufficient opportunity to consult with the states. Right now, our priority is to help state officials ensure the security of their systems. In the longer term, we want to work with state officials to help them understand the practical 000265 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 benefits of being designated as critical infrastructure and to seek their input on whether or not designation is appropriate. What is included in or meant by election infrastructure? • While there is no generally accepted definition of election infrastructure, DHS understands this term as the collection of systems and processes, administered by state and local governments, used to conduct elections. This collection includes information technology systems to register voters, maintain and disseminate accurate rolls of registered voters, create and disseminate ballots, enable voters to cast ballots, and accurately count and report on cast ballots in a timely manner. It covers all modes of voting, including in-person, early, absentee, vote-by-mail, and Internet voting. Who is responsible for the systems? • The responsibility for administering these systems varies widely by jurisdiction, but typically resides with the Secretary of State or Governor. What is DHS doing to secure voting infrastructure? • DHS is providing risk assessments and conducting hygiene scans, and has deployed cybersecurity advisors and protective security advisors throughout the country to provide support to state election officials. The DHS National Cybersecurity and Communications Integration Center serves as a 24x7 incident response center and can provide on-site assistance to identify and remediate a cyber incident. • ln addition to the work already being done by states and the operational cybersecurity support being provided through the National Protection & Programs Directorate, DHS stood up an Election Infrastructure Cybersecurity Working Group with experts from all levels of government to raise awareness of cybersecurity risks potentially affecting voting infrastructure and promote the security and resilience of the electoral process. Given these revelations, do you still have confidence in the U.S. electoral system? • Yes, we remain confident in the integrity of the U.S. election system for several reasons: • 000266 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 o The diverse and diffuse nature of our voting infrastructure makes it very difficult to manipulate the outcome of an election. o States ensure that voting machines are not connected to the Internet. o There are numerous checks and balances as well as extensive oversight at multiple levels built into our electoral process. Since you have not designated the election infrastructure as a critical infrastructure sector, does that mean it is not important or that you will not take steps to defend it? • Free and fair elections are a hallmark of our democracy, and we would consider any action that interferes with the right of Americans to participate in our election process as an attack on our democratic way of life. • Regardless of whether the election infrastructure is designed as a critical infrastructure sector, we will take all necessary steps to sustain the integrity of our elections. • The primary responsibility for protecting our election infrastructure resides with the states and local governments that administer elections, and that's the way it should be. However, the Federal government, and DHS in particular, stands ready to assist states and local governments if they request it. Has Congress been consulted regarding this incident? • Congress is regularly briefed about significant cyber threats and other intelligence reporting concerning the numerous and expanding range of malicious cyber actors threatening the United States and its interests around the world. • Consistent with this practice, appropriate Congressional leadership were informed about these incidents, has been kept informed about this matter, and we intend to continue to update them on the incident as the situation warrants. 000267 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Brian P. Hale-DNIFrom: Sent: To: (b)(3) Deirdre M . Walsh-DNI-; Subject: * * * * * This message tmD RE: (U) Rt:.: First Draft - Executive Brief ~9~@RET, Record] has been archived. Double-Click the message to view the contents. Classification: :lEC!iZET Classified By: [llllll Derived From: Multiple Sources Declassify On: 20411231 -----Original Message----From: (b )(3) DNISent: Tuesday, December 27 , 2016 1:40 PM To: Brian P. Hale-DNI; Robert Litt-DNI- Classification: 6EC~ET Classified By: [llllll Derived From: Multiple Sources Declassify On: 20411231 -----------------=====-===~=========================== Here is a draft ODNI edit version. Thoug hts? The main question would be (b) (5) 858 000268 ***** Approved for Release by ODNI on 25 October 2018, DF-2017-00093 -----Original Message-- --From: Brian P. Hale-DNISent: Tuesday, December 27, 2016 9:36 AM To: Robert Litt-DNI- Classification : SECRET Illa Classified By: Derived From: Multiple Sources Declassify On : 20411231 ========== ============~================= ===== =---=-=== ---- -Orig inal Message-- - -From: Robert Litt-DNISent: Tuesday, December 27 , 2016 8:49 AM To: (b){3) Brian P. Hale-DNI - (b )(3) {b)(3) SubJect: RE : (U) RE : First Draft - Executive Brief E@E@RE!f, Record ] Classification : Is 1£ € fiqlsT Illa Classified By: Derived From: Multiple Sources Declassify On: 20411231 --- - -----============================================= -----Original Message-- - -From: (b )(3) Sent: Tuesday, December 27, 2016 8:42 AM To: (b )(3) Robert Li t t -DNI- (b )(3) Brian P. Hale- DNI- (b )(3) ·(b)(3) Subject: FW: (U) RE: First Draft - Executive Brief [BEORET, Reco rd] Classification: SECRET 859 000269 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 miiDIIII Class,i fied By: Derived From: Multiple Sources ~eclassify On: 20411231 ====~==============================-=-- - -------------- New version of the OHS statement that I just responded to. ~m Deputy National Intelligence Officer for Cyber Issues ---- -O rigi nal Message- - -- From: (b)(3) Sent: Monday, December 26, 20 16 2 : 10 PM To: Subje ct : { U) RE : First Draft - Executive Brief ~OEOREiifi, Record] -- - eEGRET Classification. sec:ce I Classified By: (b )(3) Derived From: Multiple Sources Declassify On: 20411231 ------ - --- ----- -=================================== 860 000270 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 All, Please see attached for the updated Joint Press Statement and OHS comments and edits on the Exec Brief. - - -- - -Orrg inal Message ----From: (b)(3} Sent: Friday, December 23, 2016 3 : 20 PM To: Sub1ect : i rst Draft - Executive Brief [.'.!!CtPl'!esr, Record] Classification: :,r:e~ET Colleagues, As pro mised, attached is a first draft of the Please review and provide input/comments by Tuesday, December 26 at 2pm. Thanks, 861 000271 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 ~ 000272 -· ..: . ~.:::: :-:: ..". :::· Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Brian P. Hale-DNI(b)(3) -DNIWednesday, December 28, 2016 8: 15 AM Robert Litt-DNIBrian P. Hale-DNI-; Sellitto Michael EO P USA GOV; (b)(3) RE: (U) RE: First Draft - Executive Brief [SEE~H, RecordJ From: Sent: To: Cc: Subject: OHS USA GOV ***** This message has been archived. Double-Click the me ssage to view the contents.***** Classification: SECR:ET Classified By: (ml}III Derived From: ODNI CG v3.0 31 May 2016 Declassify On: 2041123 1 I don't have a current draft. My understanding is a new package of (IJ coming this morning? - Deputy National Intelligence Officer for Cyber Issues -- -- -Original Message--- - From: Robert Litt-DNISent : Wednesday, Decem ber 28 , 2016 8:07 AM To: Cc: Brian P. Hale-DNISubject: RE: (U) RE: First Draft - Executive Brief [ SECRET, Record] Classification: @E@~EiifZ Classified By: (ml}III Derived From: ODNI CG v 3.0 31 May 2016 Declassify On: 20411231 --------------- - -----=----==== ========= =============== Can I see what the docu m ent looks like at this point, with these changes? -----Original Message---- From: (b )(3) DNISent: Wednesday, Decem ber 28, 2016 7:5 1 AM To: Sellitto Michael EOP USA GOV Cc: Brian P. Hale-DNI>; Robert Litt-DNI- --> Subject: RE: (U) RE: First Draft - Executive Brief (SECRET, Record] Classification. SECRET Classified By: (ml}III Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Derived From: ODNI CG v3.0 31 May 2016 Declassify On: 20411231 ==================================--===--------------- Brian or Bob correct me if not, but this seems fine to me. ~m Deputy National Intelligence Officer for Cyber Issues -----Original Message----From: Sellitto, Michael P. [mailto: MSellitto@nsc.eop.ic.gov] Sent: Tuesd ay , December 27 , 2016 3:50 PM To: (b)(3) Subject: RE: (U) RE: c· rst Draft - Exec uti ve Brief [SE CR.E f, Record] Classification: S ECRET -----O rig inal Messa ge- ---From: (b)(3) Sent: rue sda , December 7.7, 2016 2:28 PM To: 742 000274 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 Subject : RE: (U} RE : Fi rst Draft - Executive Brief (GECAET, Record] Classification: fiEGRET mIIIIIIII Classified By: Derived From: Multi ple Sources Declassify On: 20411231 ======================================== ==~======= - --- Deputy National In telligence Officer for Cyber Issues ---- -O rigi nal Message· -- - From: b)(3) Sent: Tuesday, Decem ber 27, 20 16 10:04 AM To: Approved for Release by on 25 October 2018, DF-201T-00093 it: 3123'] cent. 744 000276 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Classification: SECRET Classified By: (b )(3) Derived From: Multiple Sources Declassify On: 20411231 ========-================================-=====------- - - - - - - -Orig inal Message-- --From: (b)(3) Sent: Tue:;day, December 27, 2016 8:42 AM To: 745 000277 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 SubJect : RE: (U) RE: First Draft - Executive Brief [SEe~ET, Record] Classification: SECRET D11111 Classified By: Derived From: Multiple Sources Declassify On: 20411231 Thanks points? B , looking better, but can we get some clarification on a couple Approved for Release by ODNI on 25 October 2018, DF-2017-00093 (b)(S). cont Deputy Na tional intelligence Officer for Cyber Issues --- Oriq mal Message- ---From: (b )(3) Sent: Monday, Decem ber 26, 2016 2 :1 0 PM To: SubJect; ( U) RE: First Draft - Executive Brief [SECRET, Record]--· GEGf;IET Classification: SECRET Classified By: (b )(3) Derived From: Multiple Sources Declassify On: 20411231 --------------===== ==== ==:= ======================== 747 000279 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 All, - - --- Orig inal Mes.sage- ---From: (b)(3) Sent: Fr iday, December 23, 20 16 3 :20 PM To: Subject : First Draft - Execut ive Brief [SECRET, Record] Classification; SECR:ET Colleagues, As prom ised , attached is a first draft of the Please review and provide input/comments by Tuesday, December 26 at 2pm . Thanks, Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 - :~ .c, C3tc:,orie:s ; .4{b ,c)(d\ C1ass1fi:.:d oi: 1 ),-'23; :!C.:"l (~. ·- -- ··-·-- --•··--· ...-- - -· --• - ..- :.:: __: = ;: ·:.. -- ·- -- .. -- ··- . ---- --- -· --·· - '·- ··- ·- - ··•- -- -- - ..• -- , .::::; -·- -- --- -·--- --· --•- · .... . ::: :: :.:.·. ___-; :::.: --- - - -:-·· .. - - - ...:. :::: -- --- ------ ---- ------- --- ----- --- ·-· ·- -·- -· --- -- ---- . - ·-· ---- >t: 0. ~~ate~,;_)f·it:s : .4(D)(c)( cf) 1dss;f ed un~ :?, . ,: i' /2.'~'/6 ,___~. 1 •··, ; ,..._ i.. ~:... / _;_ - ··- -- - ·- ·-... - · .•.. -- --- ··-- -- - --· - -- ·----- ----- --···- --- -- --- - ----- -- - -- :.-:l35Sif,Cdt.ior~. -~~~(-p:t_[ -f .... -- ·••·· •·- · -- -~ :··· -- -.•. --- --- ···. ---- - --: .. --- ·-- .--- - -~- -- -- --: -- - -·- ----·~ - - ·· _., ., - .. -- ·- - · _- --- - - -- .. ··-· -·- ···- .. ---- - - :1 4q 000281 -- --- ·- ·- --- -.'"'."" -.-- - .,.. - Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 Brian P. Hale-DNIFrom: Brian P. Hale-DNITuesday, December 27, 2016 4:27 PM Sent: (b)(3) To: Cc: Subject: RE: (U) RE: Fi rst Draft - Executive Brief [~ , Record] ***** This m essa ge has been archived. Double- Click the message to view t he contents. ***** Classification: SECRET mIIIIIII Classified By: Derived From: Multiple Sources Declassify On: 20411231 -===-==============================================:== Will do. Have a good trip. -----Original Message----From: Brian P. Hale-DNISent: Tuesday, December 2.7, 2016 J:13 PM To: Ronald D. Boyd (b)(3) Subject: FW: (U) RE: First Draft - Executive Brief [S EeR.E!if, Record ] 767 000282 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Classification: SE C~ET tlii>a Classified By: Derived From: Multiple Sources Declassify On: 20411231 ====================================== - ---=---------------Original Message----From: Brian P. Hale-DNISent: Tuesday, December 27, 2016 2:42 PM To: 'Stroh , Mark E.' ; Ti mothy L. Barrett-DNI- SubJect : FW : ( U) RE: F rst Draft - Executive Brief [5ECRET , Record] Classification: ::JEts~ET tlil>a Classified By: Derived From: Multiple Sources Declassify On: 20411231 =====================================-=-=-======-----We just got this alternate version that has been circulating within among other channels. Sending forward for your awareness. -----Origi nal Message-- --From: (b)(3) DNISent: Tuesday, December 27 , 2016 2:28 PM To: Approved for Release by ODNI on 25 October 201 B, DF-2017-00093 Robert LitthNI? Brian P. Haw - Ogg'gM Approved for Release by ODNI on 25 October 20 18, DF-2017-00093 Classification: SECRET mIIIIII Classified By: Derived From: Mul t iple Sources Declassify On: 20411231 =====-=================================-- -------- - ---. Attached is what ODNI proposes for this. D • (b )(3) t N t" II t II" • Off r for Cyber Issues -- ---Orig inal Message - --- From: (b}(3 ) Sent: Tuesday, Decem ber 27 1 2016 10 :04 AM To: Approved for Release by ODNI on 25 October 2018, Brian P- 771 000286 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Classification: ~ l!!le~l!!T Classified By: (b )(3) Derived From: Multiple Sources Declassify On: 20411231 ---------=-==== ======================== =============== - - - --- -Original Message--- - From : (b)(3) (b)(3) Sent: Tuesday, December 27, 20 16 8:42 AM To: Approved for Release by ODNI on 25 October 2018, DF-2017-00093 (b )(3) Robert Litt-DNI-; Bnan P. Hale-DNI-; (b )(3) M. Walsh -DNI-; Subject: RE: (U ) Rf: : First Draft - Executive Brief [ SECRET, Record) Classification: 5ECR:ET BIii Classified By: Derived From: Multiple Sources Declassify On: 20411231 ===========~=========================================Thanks points? B , looking better, but can we get some clarification on a couple 066188 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 I N t" I I t II Offcer for Cyber Issues (b)(3) Subject: (U) RE: First Draft - Executive Brier fOE@Pl!!?T, Record] --- ~EC~E'f Classification. OEORET Classified By: (b )(3) Derived From: Multiple Sources Declassify On: 20411231 =============================================-=------All, Please see attached for the updated Joint Press Statement and OHS comments and edits on the Exec Brief. 774 000289 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 (b )( 5 ), cont. - From: • Sent: Friday, Decem be r 23, 2016 3: 20 PM To: Subject: First Draft - Executive Brief t-'refl:Eif, Record] Classification. SECRET Colleagues, As prom ised, attached is a first draft of Please review and provide input/comments by Tuesday, December 26 at 2pm. Thanks, E.O. Categories: l.4(b)(c)(d) Classified on: 12/23/2016 Declassify on: 12/23/2026 775 000290 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 ~· - -- -- -··· ·-- - .--· - ·- - -· -- ·-· •.. - --- -- -· ~- -·· ·- ... -- . - :::, ;,:::• .:.:: =:.; ... :--· -- --- -- -- -- .. . = .:'." = :...08 =-=- =- :...:. -- -··. 000291 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 • • ·1 --1 ' . - .:. ', ";' ,,. ::: ,, , , . , _ ~-· ·- ~ -- :: ··:.' ' c:.-r_,•, .. ,- .. :.-• ..,._ ~.,;: ~ •• _..i ..;_ •t: ,. .. .. . ·• :- - - ' ,;:; .:-··, . - • -: < ~-;....; :.; :. .;.S _C', ,,: :-, "l,' ;,~ .,,-- SSCJt: ..::-. ~~ ;::;::•: < ; : -. 2016 -3 77 ~- ,:,:;; . - ::; .... ·.~;.::.:.-~, -i::·-•::t!•~,.; ,.., _ ' ,! ~- -·-.,, ,-, :,,:r: >'.:.\~-•,\ ... : :.) --~ /(o"_ ... '1~-~ :-.•i· 2-- linitcd States ~cnatt .• ·, .::- ,- . ; ~ 1:-· .~l ~ ~.- -·> ·-; •-~ ;. J!Pf·. ,. .•.; . :1 , : :-~o\ember 29, 2016 The President The White House l 600 Pennsylva..,_i a Avenue, N\\,' Washington, DC 20500 Dear Ivfr. President: V./c believe there is additional information concerning the Russi,u1 Government and the U.S. eiection that should be declassified and reieased to the public . V..;e are conveying specifics through classified channels. Thank you for your attention io this important matter. Sincerely, / -~(JJ~~_llor : Wy den · Martin . Hei[: r~::h Ar, er u~ . Ki_ n :, ., ..,,,,:__-Y'f - ""----- ~ -- -·Mark R. Wa rner Barbara A. Mazie Mikulski 000293 ,. . K. Hirono - I ' ,.,, -- ~----"t.~· ····· - - · ·-··-· -·- Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Michael G Birmingham From: Sent To: Cc: Subject Timothy L Barrett Friday, December 09, 2016 1:29 PM 'Price, Ned C. EOP/NSC'; Stroh, Mark E. EOP/ NSC; 'John Francis Kirby (kirbyj@state.gov) '; 'tonermc2@state.gov'; Trudeau, Elizabeth K Media; DNI-Media; Raimondi, Marc A. EOP/ NSC RE: Russia Review thanks From: Price, Ned C. EOP/NSC [mailto:Edward_C_Price@nsc.eop.gov] Sent: Friday, December 09, 2016 1:20 PM To: Stroh, Mark E. EOP/NSC ; 'John Francis Kirby {kirbyj@state.gov)' ; 'tonermc2@state.gov' ; Trutleau, Elizabeth K Cc: ; DNI-Media ; Raimondi, Marc A. EOP/NSC Subject: RE: Russia Review Adding the IC From: Stroh, Mark E. EOP/NSC Sent: Friday, December 9, 2016 1:10 PM To: 'John Francis Kirby (kirbyj@st ate.gov)' ; 'tonermc2@st ate.gov' ; Trudeau, Elizabeth K ; Price, Ned C.EOP/NSC Subject: Russia Review Feel free to refer to s but this is what we have for Schultz. ELECTION HACKING The President has instructed the Intelligence Community conduct a full review of the pattern of malicious cyber activity related to our Presidential election cycle. He has requested this report be completed and submitted to him before the end of his term. • As you know, in 2008, there were intrusions into both the Obama and McCain campaigns. 1 000297 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 0 .\nd then' h~:vcn't been any noted episodes in 2012. but the Prcsid<:nt asked to go hack - with what we nov. know - to make sure ,ie're using eYery detet·tim' too possibk a~ a ;..1eans o{ due dii,genc.-l'.. e ,\nd of course in 1016, our IC dt' termined there had been mulicious cybcr activit:, intended to interfere in our elections. In the high-confidence assessment tlwy rcieast·d. Hw IC made clear thb was activity directed by the highc'it lt_•;ds of the Russian g•ivernmcnt. • Such acti\·i1y wa-.n·t new to \1oscow. T hey have hecn 1;:ng_a~in~ in ...;imdar tactic:-; and tcL·hniyucs ,terns" Europe and Eurasia lo in i'lucnc-: puh!ic or•:nion . .\s we have made dear, we are committed to ensuring the integrit~ of our elections - and this report \\ill dig into this pattern of malicious Q·bcr acth·it~ tin~ed t.o our ckctions, take stock of our dcft'nsin: Caf)abilities. and capture lessons-h:arned tn hrid' members of Congress and stakeholders as appropriatt: (like pl,lit1L·al carnpaign.., am! -.wtc anJ it.h:al <'1Ti;.:c\ n:spon:--.ihle ror aJministcrinµ cle1..-tions l. (): Oi,puling det·l\on'? • i hi,,'- <11,t ~111 ,2:!'urt !Cl ..:haiiengL'. the nutcoint.: 11fihL' t~kction. :) J'l, illL· ,· .)mr~ry. lhe P1\',1tk11t h:t, gone tn :-'.i"L'al ient'.llh lo proce(:d \, itl; .i ~c:trnk,--; tr;in-.itio11 (,f !'' •\\:,:!. \\,·at:.: not ~\il!;n~ lfllP yuc~llll!1 l'lcctinn n:-.ul1s - \Vl' arc 1;1king ,1..•rniu-.h o ur rc,pu11"ihil1t\' 111 p r utL•,·i :il l' lllll'.~ri:, •.,f Olli - ·hxtinn-.. 1 ct Q: Puhlk n!port'? o r·hc l\c,1,knt k,, rt·,1ucs1i.:d ;lns rq'<'rt !h.:for~· hL· k:i\ t.:'> ,lffo..:c and >11u ,:an ;m:i;in~· titer1.· ,:, ,u!d h: c!a ... ,1ri,:L; ur Ptii,:n., 1"· , s:-71 ,-.1\1\ 1..' material in1.·l utkJ. l think :Ull c<1n c:,pcct 1h:1t \\L·' 1! fC't :('t: a, n:ud1 or it ~r- ,, L ,:an. (): \Yh) now'! • Oh iou,!>; lh i•, ;-, ,-.ome1hing ·.-.. c · \T lx:vn fucl!sL·d llfl rm a \, hik. Tlul ·" \,it, tlk' 1'1c:..,1dcn1 ·, 1kpar11nc:11 11 1 Hn,m-i<11H! ~l'L·,: rit:- \\ nd-,..:-,..i v, ilh n(·-trl: al! :-iO stat,:, hov. he-;( ro hPl-.tL'r ~·: h:r c!l'!°L:JN,>, 1n till' kad-llf' \" the cicLt1un 6 th! lo ~~-1 rcai "Pn'if1L· ,1huut t!ii,, - \,,: had nol1L·cd in the su11m1t.·r ,md :·;d, ar: in1:rca,c i;1 -;umnin~: .1:1t! ;-,n1h1n~ n1 '-(H:h: ,talc\ ckuio11 rcbtcd ':,-.ic,~is. 2 000298 Approved for Release by ODNI on 25 October 2018 , DF-2017-00093 ~_;t~·:~\1,'~ (~ -..~ ~ ~H.: rn.~ '.'i thL couniry c·c n \ .. n...__. t~ :cn1ci·..:1&1..-'t: '-:~1!i-... tc, "h~!re t~t~.>;f int-()rn1tn~Pn f:\t)Ct~ ..., ~~:: 1 (): \'• hi<:h agem·ies'! "' _--\~ y:,11_; rclc a~c:d \\a:--; :u1nPunci..~\.1 h:.,. {)_;·<~ :_i.nd tJ~-iS :)n\ :uL:\l\· '..ht~rL i"-;_:.;uc\ inc l udinl- tiit~ Ff-1L L'()J. ;J1:d St;._dc. knP\\ . idL' <.)c~tj':,c r ,1~ucrnt'Ct.1.hal v..:a,, ~}ff: l)rl1:~: :tgc nl ;c:--, \\-}:•_ v, t)f~. or, tl ': ~ \ C 000299 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 ---~-- --------------Ti mothy L Barrett Fri day, December 09, 2Gl6 1:33 PM From: Sent: (b )(6), (b )(7)(C) To: (b )(3) DNI-Media RE WH Investigation of Russ ian hacking Cc: Subject: We are referring all calls to NSC. For your awareness, the below is what we just received from NSC, the guidance they are using for these queries: ELECTION HACKING The President has instructed the Intelligence Community conduct a full revie,Y of the pattern of malicious cyber activity related to our Presidential election cycle. He has requested this report be completed and submitted to him before the end of his term. • As you know, in 2008, there were intrusions into both the Obama and McCain campaigns. • And there haven·t been any noted episodes in 2012, but the President asked to go hack - with what we now know - to make sure we're using every detection too possible as a means of due diligence. • And of course in 20H,, our IC determined there had been malicious cyber activit.Y intended to interfere in our elections. In the high-confidence assessment they released. the IC made clear this was activity directed by the highest levels of the Russian government. • Such activity wasn't new to Moscow. They have hccn engaging in similar tactics anJ techniques across Europe and Eurasia to inilucncc puhlic opirnon . As we have made clear. we are committed to ensuring the integrity of our elections - and this report will dig into this pattern of malicious cyber activit)' timed to our elections. take stock of our defensive capabilities, and capture lessons-learned to brief members of Congress and stakeholders as appropriate (like political campaigns and .-;tatc and local offices responsihlc for ad ministeri ng: elec tions ). obo3oo Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Q: Disputing election? " This is not :m effnrt to cli.illcnge lhc outcumc of the e!cdion. e, To the cn,Hrary. the President has gone Lo great lengths to prilCl'l'd \\·ith a sL·,uukss lfa!l\ition of • \Ve arc nol L·,diing into qucstwn L'leclion rC\ttlls imcgrity or ou;· .:k·ctions. \\C arc Laking seriously ow rL'Sponsibd1L~ to prulL'cl Lile Q: Public report? • ThL· Prc.-;idem has rn.iuested thi-, rq1ort before he lcaVL'S offi,T ..rnd you L'c1n i1n,1ginc thLTl' could be L'lc1s:-,,ified or otherwise scnsiti\'c material i11ciudcd. l Uiink you can cxpn·t that \\c-!l get ~-,iu a-. much ll!' it a., \\T can. e But the Pre..,1dcnt has instllJL'lL'd the repon be shared with Members of Cnngrl'S'- ,l!ld other stah'lwldcrs. Q: Why now? • ()b\iou:--ly lhi:-,, 1:-,, :--01t1eLhing we·ve heen locused c•n for a while. That"s wily ihc President · -., DepanntL'nl ()t' Humelc1nd Secunty \\\Ht.ell ¼•ith near!:· all 50 stall's how hcst 10 boisLL·r L· yhcr defense;,; ll1 the lead-up Lu the election • .lLhl tu get real spccifl<.: ahout thi:, - \\'Chad noliu:d in the summer and tall ,,n incrcas, probing oi' '>(J!ilc swte-, election related sy..;tems. m !n response. DHS engaged in rigorous ou1read1. (9 Deployed ex:pcns all acro:--.s Lhc L'l)lllHrY v.i C,.r nvencd c(rnt'erence calls to sharL· latest information 0 l3ridcd hcsl Practices • !l1 st:anning ,n1d result we c,m ,·onfirrn that the Federal (10\··t did llllt ohsL'f\C an\ im:rcascd le\ ei nf malici(llls ~tc:t\\ ny aimed al Jis rupling our electoral pruccss Pn election day. , \ :, ;i C\ her () : Which agencit>s'? e know. th-.:- October statement that wa:--. rekased was annou11s.:cd hy D!'i l ,ind DHS. Ob\ iou,-,i\ there ,:~L- otfi,_•r :1gcn,_·ies, \\ho w1J1t on these issu6 including thL' FBL DOJ . and St,tlL' 1\:-. y1JU From: (b )(6) , (b )(7)(C) Sent: Friday, Decembev 09, 2016 1:30 PM To: (b)(3) Subject: FW: WH Investigation of Russian hacking Hello again >; Timothy L Garrett Ell and Tim 2 000301 Approved for Release by ODNI on 25 October 2018, DF-2017-00093 Are you all receiving inquiries 0 11 the below? Are you saying anything? At th i point, it does not look like we are . Thank you, 1111 From (b)(6) Sent: Friday, December 09, 2016 12:03 PM To: (b )(6), (b )(7)(C) Sul>Ject: WH Invest1gat1on ot Russian hacking ( io1.,d :1frcrnoun. \.Vonck·ring d FBJ has :my ,.:ommcnl on lllis - http://www.reuters.com/c ticle/us-usa-election-cyber- idUSKBN 13 Y l U7 1\nv dl't,,li-. or hmv llus ;s ~oing to work':' b th is going 10 be a coordinated rcpDr! ()r arc :tgL'ncws cad: doing t)\\n':' \V()u!d appreciate :1ny a\;,iLtblc L·ornmcnt-. ahout how FBI wili lK ;1pproad1ing thi-. rnvcstigatioc :rnd 1! lhcrc :ire -.rccific areas FBI wdl be fo L·usin!! un in the invc-;fi!lation. This is fur thi:s ,11Lcrnoon. i1lt'ir ~ ~ Cheers. 000302 OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE WASHINGTON, DC 20511 Ryan Shapiro Jason Leopold c/o Law Office of Jeffrey L. Light 1712 Eye St., NW, Suite 915 Washington, DC 20006 October 25, 2018 Re: Litigation 16-cv-02517-CKK, ODNI FOIA Case DF-2017-00093 Dear Mr. Shapiro and Mr. Leopold: This is the l 0th interim response provided by the Office of the Director of National Intelligence (ODNI) to your Freedom oflnformation Act (FOIA) request dated Dec 14, 2016, in which you requested, among other things, records about allegations of Russian-directed interference with the United States 2016 elections. On December 23, 2016, the ODNI's Information Management Division (IMD) acknowledged receipt of your request. Your request is being processed in accordance with the FOIA, 5 U.S.C. § 552, as amended. With this response, 3 documents are being released in full and 6 documents are being released in part. All reasonably segregable, non-exempt infonnation has been released. We have determined that the following exemptions apply: • (b )( 1), which applies to information that is currently and proper! y classified pursuant to Executive Order 13526, Section 1.4 (c) and (d). • (b)(3), which applies to information exempt from disclosure by statute. The relevant statutes are the National Security Act of 1947, as amended, 50 U.S.C. § 3024(i) and 50 U.S.C. § 3024(m), which protect intelligence sources and methods and identifying information of ODNI personnel, respectively; 50 U.S.C. § 3605; and 18 U.S.C. § 798. • (b)(5), which applies to intra or interagency communications that are pre-decisional and deliberative in nature. Disclosure in this instance would harm the Agency's deliberative process. • (b )(6), which applies to information, the release of which, would constitute a clearly unwan·anted invasion of personal privacy. • (b)(7)(A), (C), and (E), which apply to certain records compiled for law enforcement purposes. In addition, 4 documents are being withheld in full. The documents are comprised of multiple responsive and non-responsive records. The responsive records are being withheld under FOIA Exemption (b)(5) and the deliberative process privilege, which applies to interagency or intra-agency memorandums or letters that are pre-decisional and deliberate in nature. There is no meaningful responsive, non-exempt information that can be segregated from these records. Portions of the records are also exempt from disclosure under (b )( 1) and (b )(3) as described above. If you have any questions, your attorney may contact Attorney Amy Powell of the Department of Justice at (919) 856-4013. Step en KeHey Deputy Director Information Management Division Enclosures