AL L INFORlLll.lION CONT AIHED HEREHI IS UHCL.ASSE IEC DATE 1 0-23-:;:Ql 7 BY J3 7 J 8 5T 94 USICC- F0-)40 (Rev. 4-1 1--0J) File Number J-----------.1 OCJ b7E field Qfficc Acquiring Evidence _W_-F-V _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ Serial # of OrlginaClng Document _ _ _...,lo_C)_._____________ _ Datt Received (Address) (City iind St:lle) b7C To Be Returned 0 Yes fl)No Receipt Given 0 Yes ~ No Grand Jwy Material - Disseminate Only Pursuant to Rule 6 (e) federal Rules of Criminal Procedure Yes federal Tax.payer Information (FTI) ~No Yes (lt,,.. ,.o: ~~i r: .1 I ~*~ti :- ~~f,:(. FEDERAL BUREAU OF INVESTIGATION Electronic Communication (U) Subfile Opening Document Title: From: Date: 02/12/2 16 CYBER DM-TOU b7C b7E Contact: Approved Drafted By: Case ID #:I Synopsis: By:I - - - -j ~:u , ~CYB E~ )(.; 1-Nti MIDYEAR EXAM; MISHANDLING OF CLASSIFIED; UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) To open CYBER subfile Details: Writer requests that a subfile be opened titled CYBER, to store all Cyber investigative analysis . H C-10198 DECLASSEIED BY: HSICG C.87W44B73 OH 01-25-2018 FD-1057(Rev. 5-8-10) --~~~~~~--~CYB~R Serial 14 --- -- b7E ---- - !.~. ~.~~J!~~~-~ l t- ~/-NOPOMf All ~.ir :. ~- .,,.:1111e t.;1 i:.. ~, ;~1119r. > ,.,, c-.:.1.~: Y~!,..~ --- FEDERAL BUREAU OF INVESTIGATION Electronic Communication (U//~) Title: Searches From: lA Document forl ...._~~~~--- Date: 03/24/2 16 CH I CAGO CG-CY-1 Contact: Drafted b7E b7C b7E By:~I~~~~~~~-- Case ID #: ....-------~CYBEW) )(;AW) MIDYEAR EXAM; Synopsis: MISHANDLING OF CLASSIFIED; UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) (U//FOtffi.1 Submits lA document to the file for~I~~~~~ b7E searches conducted in this investigation. Reference:~l~~~~~~--~CYBER b7E Serial 13 Enclosure(s): Enclosed are the following items: (U)I lsearch documentation. b7E Details: (U/11eee-) This communication submits to the file the lA document that is associated with the above reference serial (13) in the CYBER sub file. H C-10199 ...._~~~~~~---~CYBER b7E Serial 14 ~ /NO!eftft fo~ ! searches Re: ~~~~~~~-~CYBER, 03/24 /_2_0_1_6~~~__, Title: (U//.POUE)-1 b7E lA Docume.nt ~/MOP91Ql H C-10200 ALL INFORlr.A1IOH CONTAHTED HEREIN I S UNCLASSEIEC DATE 01- 25-:;:018 .3Y C87 il44B73 ~ISICG ~nysica l tr.NCLASSIFI ED//~ lA/ lC Cover Sheet for Serial Expor t b7E Created Prom: Package: Stored Location: Summary: Serial 14 lAlO None (U//~ ) provide for Acquired By: Acquired OD: Attachment: Documents 2016-0 3 - 24 (U) documen t at ion. searc hes b7C b7E Isearch H C-10201 FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1353814-0 Total Deleted Page(s) = 6 xxxxxxxxxxxxxxxxxxxxxxxx Deleted Page(s) No Duplication Fee X For this Page xxxxxxxxxxxxxxxxxxxxxxxx DECLASSEIED BY: HSICG C.87W44B73 OH 01-25-2018 1-----.....- FD-IOS7 (Rev. S-8-10) --- -- -~b7E ~~. ;,~~. ~!-!!:~!~ J - - ---................. ...- .............. . ~//N6PORN l\t !.. ;; :.::oo -~.,:> !>o&~ ,\. fY.ii: b) ,. <:Pr.{ 1:; ttl :. -ll I) S ~ .. ~ FEDERAL BUREAU OF INVESTIGATION Electronic Communication (U//~ Title: From: Submit lA Date: 05/18/2 16 WASHINGTON FIELD WF-CI13 Contact: b7C Approved By:._I_ _ _ _ _ _ _ ___. Drafted Case ID b7E BY~.__ _ _ _ _ _ _ _ _ _] !U, #: ... ~oc~ ~//..f+F) I _______ MIDYEAR EXAM; MISHANDLING OF CLASSIFIED; UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) Synopsis: (U//~ To submit to the file a lA associated with seria 62 of the sub OCA file. l________,~OCA Reference: ... Serial 62 b7E Enclosure(s): Enclosed are the following items: (U/ /POl-:10) LHM submitted to USSS on 5/17 /2016 Details: (U/ ~89~ This communication submits to the file a lA associated with Serial 62 of the captioned case and subfile . ~/H0PeRN H C-10204 ALL FBI nrroru.!A1IOH COMT.AINEI: HEREIN IS UUCLASSI!.IEC DATE 01- 2~ - 2 018 ACG ~nysical UNCLASSIFIED/ /10$ C87~44B73 lA/lC Cover Sheet for Serial Export b7E Created Prom: Package: Stored Location: Summary: Acquired By: Acquired On: Attachment: Serial 64 1A40 None (U//PeYO.) LHM submitted to USSS on 5/17/2016 b7C 2016-05-17 (U//FOt10} LHM submitted to USSS on 5/17/2 016 H C-10205 FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1353814-0 Total Deleted Page(s) = 35 Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; xxxxxxxxxxxxxxxxxxxxxxxx Deleted Page(s) No Duplication Fee X For this Page xxxxxxxxxxxxxxxxxxxxxxxx FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1353814-0 Total Deleted Page(s) = 10 Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; Referral/Consult; xxxxxxxxxxxxxxxxxxxxxxxx Deleted Page(s) No Duplication Fee X For this Page xxxxxxxxxxxxxxxxxxxxxxxx DECLASSEIED BY: HSICG C.87W44B73 OH 02-12-2018 -------------~CYBER rn-1057(Rev. 5-8-10) Serial 41 0FFICJ~L !!ECORD . b7E ::.;....:. ., : ;;.1t: : ..1,:<: ,.~ ... 1!:::.1:...,::s.: 11: ,;. ~r,1:1 1. ..i; , ~4,;: ,.,,. i.... I.) ~/NO!OM ...-: ! ;.~ :e, :;1. >:!I~;,. FEDERAL BUREAU OF INVESTIGATION Electronic Communication (U//~o~g~ Title: From: Case Support Request Date: 11./09/2016 CYBER Contact: Approved Drafted b7C b7E By:~I~~~~~~~~~.... By:~I~~~~~~~~~~~ Case ID # : __,kYBER 9(1 lf\Hi.:J MIDYEAR EXAM; MISHANDLING OF CLASSIFIED; UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) . _ I_ _ _ _ _ _ This info.:::mat.:..on j_s the property of t~e ~RI and rr.ay be dist:-i bu led to state, tribal, or local govcrnrae~t law enforcement officials wi:h a need-to-knew. Further distributior. w...thout cBI authorizaLi or.. is prohibited. Precautior.s shou id be lakeP. to ensure !.his i.nformat.1 on is s:::ored and/or destroyed in a manner that prucl~des unauthorized access. Synopsis: identified (U//~) WFO/CI-13 requests intrusion analysis of the Detai1s: * Indicates required information. HRC-10255 ..._~~~~~~--~CYBER b7E Serial 41 ~//MePeRN Title: Re: (U/ctfflt2l Case Support Request _.~CYBER, 11/09/2016 b7E . _ I_ _ _ _ _ b7C ,phone #: i:1 *Request POC ]E-mail Address: IU1 Service Requested 2.1 *Describe your goal or what you want this support to provide, e.g., Review media provided for evidence list any information or questions :.of intrusion. you wish to specifically answer as a; result of this review. 2.2 *Specify any particular service or analysis you would like performed. N/A Evidence or Materiai Format 3.1 *If any material to be analyzed is marked as or suspected to be Material is potentially up to classified, provide the ~//.HOPef:r~. classification level. Where suspected only, please explain. ~//NO~ HRC-10256 ~CYBER - - - - - - - -.... b7E Serial 41 Title: (U//~) Case Support Request Re: _ _ _ _ _ _ _ _kYBER, 11/09/2016 b7E 3.2 *Provide a complete list of evidence or material available for this review (e.g. hard drives and . Image of one hard drive from a OS, portable media, tablet PCs, log files, malware). Please indicate if ]laptop computer. additional material is anticipated throughout the course of the review.; -- - -- ..___.. ,.,.--.. -- . -- - ... -- - - - - .... - ......... - .......... - - -- 3.3 *Provide any specific handling or safeguards applicable to any material in this review. Media is from a Sensitive .Investigative Matter (SIM) involving :a high level political figure. !wFO/CI-13 is required to keep a list By default, contractor(s) treat all all personnel with knowledge of information as Law Enforcement ithis investigation and, therefore, Sensitive (LES). irequests a list of CyD personnel who ]work on this analysis. ;of - -- -- .. ---~ tUi - - - - ................. - .. ... -- -- . - -- - .... !_... .. .~- -J~I tH!f.. .~~~~--~~-~~=~~~~ 4.1 Case Title 4 ~-2-,.; 5-hort--case -su~-ary/(;ve~~ie~- - . _ --- -- - - .. - - - - -. . - - .. . .. - - -- .. . -- - . . 4.3 List any associated FBI cases. . . . -- - - i MIDYEAR EXAM contact case agent. :--eiease 4.4 *List any previous attempts or e forts to analyze this evidence. None. HRC-10257 ---------~CYBER b7E Serial 41 ~//H9P0ft!t Title: Re: (U//FBHO) Case Support Request _.kYBER, 11/09/2016 b7E ._I_ _ _ _ _ _ 4.5 *List any timing requirements such as expiration of search warrants, deadlines set by DOJ, upcoming indictments, and so forth. Please contact case agent. 4.6 *Of the materials to be provided, specify the processing priority (i.e. specific drives that are more important than others and need analysis first}. Single hard drive. 4.7 *Are there limitations in the search warrant that restrict what analysts can review? If so, please list search criteria . Please contact case agent for a of the warrant. ~copy ...... ., ...-- -- - - -- .. ............ - .........,. . - 5.2 Headquarters Program Manager ........... -...-......-_.... ~--~ ~ --- .... DAD Peter Strzok F!-~~~1~:~~~~-~:~~~~~-~\--~L~:t~~~ J-~:~ I~A1------. 6. (Portion Mark)Additional Information: Use the section below to expand upon the answers provided above. Please identify the topic you are addressing when providing the additional details below. ~/l19P9Mf HRC-10258 b7C .._~~~~~~__,~CYBER b7E Serial 41 ~/FIOBOM Title: Re: (U/ /~) Case Support Request ~CYBER, 11/09/2016 b7E . _ I_ _ _ _ _ _. . . . HRC-10259 DECLASSEIED BY: HSICG C.87W44B73 OH 02-12-2018 FD-10.~6 _ _ _ _ _ _ _ _....~CYBER Serial 42 r ~---- -- - ----- b7E 0FFIC.!A-. RCORD . . : ~lll ~ {,.; -- n.t.;, ;:o:. :.. :: ,....: . r-: .n. ~ ... .,.; ....... v:- :1> ; t;. (Rev 10-16-2009) :t>:.~ Ill ~ ~ ....., .-;;;,. -.. :... FEDERAL BUREAU OF INVESTIGATION Import Form Form Type: DEL-REX Title:(U//~ Approved By: Drafted Date: 01/04/2017 Cyber Division TAU Technical Analysis Report SSA~I__________. b7C b7E By:~I__________. Case ID # l.__________.~CYBER IU) ~//MP) MIDYEAR EXAM; MISHANDLING OF CLASSIFIED; UNKNOWN SUBJECT OR COUNTRY; SENSITIVE INVESTIGATIVE MATTER (SIM) Synopsis: (U//~ Analysis of computer intrusion or malware infection on a laptop hard drive belonging to Anthony Weiner . HRC-10260 DECLASSEIED BY: HSICG C.87W44B73 OH 02-12-2018 ~fl Reference: (Communication Enclosing Material) Description: Original notes re interview of p~~\,~.r~ HRC-2864 ;._LL FBI mrDRllATION CONTAINED HEREIN IS mJCLASSifIEC DATE 12-06-201 BY J7tiJ18lSO NSICG CORRESPONDENCE; :1f~fui- : ...tti>~J.it~. . .: :_ 1@/~wio>m .... :_. . ... . .. ::~::Dxesw:u:a prcW irru/~@i :< .._ 8/6/15 W&C/DOJ Intent re: Voluntary Production 8/7/15 W&C/DOJ Revised Ltr re: Intent re: Voluntary Production/ Server Equipment 8/10/15 DOJ/W&C Voluntary Production/ Server Equipment/Limited Account 8/31/15 DOJ/W&C Cooperation/appieara nee 9/10/15 DOJ/Wilmer Agreement re: removal of Personal & Business files .9/21/15 DOJ/W&C Post Voluntary Production/ Server Equipment 9/22/15 W&C/DOJ Response to 9/2~. W&C Letter 9/24/15 DOJ/Wilmer Agreement re: voluntarily provided equipment &review of files 9/25/15 DOJ/W&C A. Attorney Cliernt Privilege/Medical list/Individuals, etc. B. Consent to Search 9/29/15 W&C/DOJ Response to 9/25/15 W&C letters/Filter 9/30/15 DOJ/BS&F Consent to access back-up files 10/1/15 W&C/DOJ A. Attorney Client Privilege /Medical list/Individuals, etc. B. Consent to Search 10/2/15 IDOJ/W&C 10/4/15 7:37 am 10/4/15 7:39 am W&C/DOJ F~llow-up W&C/DOJ Follow-up Ltr re: Agreements/ Production Stages/ Addresses/Equiprment 10/5/15 DOJ/Wilmer Turnover of equipment, securely deleted items and remaining files 10/7/15 DOJ/L&W Grant of Limited Consent to Take Possession of Personal Electronic Information 10/9/15 W&C;L&W/DOJ Correction of email address listed in Footnote 10/14/15 DOJ/W&C Identifying equipment or devices that might contain or might have contained emails from 1/21/09 to 2/1/13 HRC-2865 :: . : ~ Response to 10/li/15 W&C letters/Filter Ltr re: Summary on Voluntary Productions 10/16/15 DOJ/ W&C Consent to search files dated 1/21/ 09 to 2/ 1/13 that may be located on equipment provided by the FBI 1--~-+-~~~-t-~~~~~~+-~~~~~~~~~~~~~~~~~~~~~~---f 10/ 16/ 15 DOJ/ Wilmer Emails produced. Equipment with 3 page summary attached 10/ 28/ 15 Wilmer/ DOJ Confirming receipt of spread sheet and status of 30 emails 10/28/15 DOJ/ W&C Supplement to letter dat ed 9/25/15 concerning back-up files and consent to search 11/9/15 W&C &L&W/DOJ Clarification of letter dated 10/4/15 11/25/15 DOJ/ Wilmer Per 9/10/15 agreement, voluntarily providing FBI w/1 WD HD 12/14/15 DOJ/ Wilmer Back-up files relating to 2 BlackBerry devices not belonging to HC. 12/ 17/ 15 Wilmer/ DOJ Confirmation of marked files relating to 2 BlackBerry devices not belonging to HC. 1/ 8/ 16 PWRWG/ DOJ Request for voluntary interviews 1/11/16 W&C/Wilmer Production of Retention Data from Copper {previously given to FBI on 9/24 & 10/5/15) 1/11/16 WCPHD/DOJ Agreements made on 1/16/16 & 1/10/16 re: back-up copy of files retained my Cooper, Wilmer may transfer retention data under conditions 1/11/16 DOJ/Wilmer Per 9/10/15 agreement, voluntary providing to FBI SanDisk thumb drive; authorization to review Cooper materials 1/11/16 DOJ/ Wilmer W&C is maintaining ret ention data re: Cooper and assumes responsibility for responding to future DOJ request 1/ 12/ 16 DOJ / PWRWG Response to request for voluntary interviews of Mills and Samuelson 1/ 12/ 16 DOJ/ PWRWG Response to request for voluntary interviews of Sullivan 1/ 14/16 PWRWG/DOJ Clarity, defined scope and duration re : request for voluntary interviews of Sullivan 2/9/16 W&C/DOJ List of equipment or devices that may contain emails relating to email domain per FBI 2/22/16 DOJ/Wilmer Cooper item production & Kroll s/Shred Its process . HRC-2866 .}afoi . ;,. :.iD ia!.i e . . :: 101.f we>m; . .,.. ,. ,,, . - . . :.;.. , ,_\ :. :~- ..~ . .. ..~.. -~ ..; .> . :IQie~ ~ ri~~ioro/~oies Response to 2/9/16 DOJ Ltr re devices & equipment 1!> :.:\.- t . . ( ~ : . .. 2/22/16 DOJ/ W&C 2/22/ 16 DOJ/W&C 2 Inquiries by DOJ re: W&C seria ~ nos for laptops & 1/ 21/ 09-2/ 1/ 13 emails ~/23/16 DOJ/W&C IPad re: emails for 1/21/09-2/1/13 & forensic analysis HRC-2867 HRC-2868 (./ HRC-2870 HRC- 2872 HRC-2874 LAW OFFICES WILLIAMS & CONNOLLY LLP 725 TWELFTH STREET. N.W. DJ\ VID E. KENDALL WASHINGTON, D. C. 20005-5901 (202) 43<1 5145 d=cmlall@wc.com t~.4\R.b -~TT ~MS U920-1~88> PAUi. ~ CON>lOt.lY 0022 11>.18) (202} 434-5000 FAX (202} 434-5029 August 31, 2015 BY EMAIL AND FIRST CLASS MAIL I Omted States Department I of Justice b6 Per NSD b7C Per NSD National Security Division 600 E Street, ~ Washington, DC 20530 I ____. b6 Per NSD b7C Per NSD Dear... As you may know, the former Secretary of State has repeatedly stated that she will cooperate with your inquiry in whatever way she can. Accordingly, she would be happy to appear voluntarily to answer questions, if that would be helpful in achieving as expeditious a resolution as possible. She does have scheduling commitments, but Im sure we can work around those. Z/;. Kendall DEK/bb HRC-2875 - - - ()1 HRC-2876) ( __ / HRC-2880 ____ _____ ....._.. - - - .... -..- - -...-.. ~= ~- LAW OFFICES WILLIAMS 8 CONNOLLY LLP 725 TWELFTH STREET, NW. DAVID E. KENDALL (202) 434 5145 WASHINGTON, D. C. 20005 5901 !l::NVAkD B~NN2TT WJU.lAM$ (1Q20 1 1$8J >AUL R... CONNOU.l (l.,22 .. 11l>76) C202) 434 5000 dkendall@wc.com FAX (202) 434 5029 September 21, 2015 BY EMAIL AND FmST CLASS MAIL United States Department of Justice National Security Division 600 E Street, NW Washington, DC 20530 . Dea.rl.__ ___. b6 Per NSD b7C Per NSD b6 Per NSD b7C Per NSD On behalf of former Secretary of State Clinton, I want to reiterate our desire to facilitate the security inquiry we unde.rstand the Department is conducting at the behest of the Intelligence Community Inspector General into the storage of r~ently-classified emails anhe hdr22@clintonemail.com address. As you know, shortly after this inquiry was announced, we voluntarily provided a thumb drive (and copies) and the server equipment which supported th.is email account during the Secretarys tenure at the State Department. I also shared with you that the Secretary would voluntarily answer any questions you might have~ Should you need to assess the successor server which for a time hosted this address and the successor hrodl 7@clintonemail.com address, we also would be happy to assist you in that regard, consistent with maintaining the privacy of other e~mail accounts that are not part of your inquiry. In short, we want to facilitate the efficiency of this security inquiry and look forward to learning from you if there are ways of which we can be of assistance. DEK/bb HRC-2881 --J HRC-2882 A.LL FBI IlffORU:ATION CONlA.HIED HEREIN IS UNCl..ASSIEIEO CAlE 12 -06 -201; BY J76J18T80 NSICG U.S. Department of Justice National Security Division WasJ1ing1on, D.C. 20530 David E. Kendall; Esq. Williams & Connolly LLP 725 Twelfth Street, N.W. Washington, DC 20005 September 22, 2015 Dear Mr. Kendall, We are in receipt of your letter dated September 21, 20 I 5, which offers, among other things, access to what you have referred to as a successor server to the server equipment previously produced to the FBI on August 12, 2015 . Based upon the FBI s investigation, we understand that this successor server is in the custody of, and is being operated by, Platte River Networks and that it, at least for some time, contained emails to or from Secretary Clintor1s@clintonemail.com account. We are concerned that, notwithstanding your repeated statements in oral and written co1Tespondence regarding your and your.clients wiltingness to eooperate in this matter, you had not raised the existence of the successor server or offered access to it prior to your September 2.l letter. We remind you that this server is covered by the preservation letters delivered to Williams & Connolly LLP on July 31, 201 5, and Platte River Networks on July 30, 2015, and we request that you ensure that this server remain operational with a continuous power source (i.e., that it is not unplugged or its operation otherwise intenupted) until further notice. We also reiterate that the aforementioned preservation letters cover any other equipment or devices, whether or not previously disclosed, that contain or contained emails to or from the domain account @clintonemail. com, including all equipment related to the server voluntarily produced to the FBI on August l 2; the successor server and all related equipment; any other server and all related equipment that received or sent emails for this domain account; and all backup devices, including backup hardware purchased from or maintained by Datto, Inc. While we will seek to proceed in a manner that causes the least amount of disruptjon to otherwise unrelated accounts and activities, we will take all necessary and appropriate step:; to obtain any and all such equipment and items. Sincerely, b6 Per NSD b7C Per NSD _ . cc: Kenneth Eichner, Esq . HRC-2883 l . HRC-2884 --- J. J ....... ,../ HRC-2888 . ! __ .tf c- 2892 ... U.S. Department of Justice National Security Division Wasliing1011, D.C. 20530 BY EMAIL David E. Kendall, Esq. Wil liams & Connolly LLP 725 Twelfth Street, N.W. Washington, DC 20005 September 29, 2015 Dear Mr. Kendall, This letter confirms receipt of two letters you sent me on September 25, 2015. Regarding your letter providing a list of individuals and entities with whom Secretruy Clinton may have communicated in a privileged context, when deemed necessary we will be using a filter process to account for the possibility that records may contain p1ivileged infonnation. During the filter process, we will detennine what privileges may apply and how best to identify privileged.information, utilizing as appropriate the list of individuals and entities you provided. C>. b6 per NSD b7C per NSD HRC-2893 .._. :Ir HRC-2894 September 30, 2015 VIA ELECTRONIC MAIL b6 per NSD b7C per NSD ........,U ...,. S-. D __e_ par _ tm _ en _ t -of- .... Juscice Na.cional Securit:y Division 905 Pennsylvania Avenue, N.W. Washington, DC 20530 o~--- b6 per NSD b7C per NSD Pursuant to our con ersacion on September 29, 2015, this letter provides the Depamnem of Justice consent to access the back-up files associated with Ms. Hu.ma Abedins email account for the purpose of your security inquiry. We request that the historical email content from Ms. Abedins account dated February 2, 2013 to the present be migrated to the new server and associated equipment acquired by Platte Jm,e.r Nerworks in conjunction with your inquiry . Thank you for your co:ilsideracion. Very r:ruly yours, Ut~ f\.figuel E. Rodriguez Bryan Cave LLP 1155 F Street, .NW Washington, DC 20004 /s/ Kar.en L. Dunn Karen L. Dunn Boies, Schiller & Flcxner lLP 5301 Wisconsin Ave. NW Washington, D C 20015 HRC-2895 Jiiiooi . i HRC-2896 LAW OFFICES WIT..UAM5 B CONNOLLY llP 725 TWELFTH STREET, N. W. D/\ VID E. KENDALL (20 2) 43d-5145 dkendallCwc.com WASHINGTON, D. C. 20005-5901 ED.A.AD BENWETJ OV1U.1AMS (1920-ISJB8) PAJ.Jl.. k.. C~OU..Y (J922-J978) (202) 434-5000 FAX (202) 434-5029 October 1, 2015 BY EMAIL AND FIRST CLASS MAIL U.S. Department of Justice National Security Division 905 Pennsylvania Avenue NW Washington, DC 20530 b6 per NSD b7C per NSD l write regarding the Department of Justices security inquiry in response. to a referral from the Inspector General of the Intelligence Community. Pursuant to our conversation, I understand that your security inquiry may involve review of Secretary Clintons e-mails for evidence relevant to that inquiry. As discussed, her e-mails include materials covered by attorney-client, marital, or medical privileges. I provide the following list of individuals and entities with whom Secretary Clinton may have communicated in a privileged _context. Attorneys lwilliarns & Cormolly ~LP l\iiilliams & CoIIDolly LLP David Kendall, Williams & Connolly LLP IUtrecht, Kleinfeld, Fiori, Partners (f/k/a Ryan, Phillips, Utrecht & MacK.innon) Che I Mills in her capacity as personal counsel on prior matters) f-------...JWilliams & Connolly LLP ~------=-- r ogan Lovells Katherine Turner, Williams & Connolly LLP ,___ _ ___.~trecht, Kleinfeld, Fiori, Partners (f/k/a Ryan, Phillips, Utrecht & MacKinnon) b6 per NSD b7C per NSD Doctors b6 per NSD b7C per NSD HRC-2898 WIWAMS S CONNOU:.Y LLP October l , 2015 b6 per NSD b7C per NSD Marital President William Jefferson Clinton Personal Aides to President Clinton or form,er Secretary Clinton/Conduits ofMarital b6 per NSD b?C per NSD Personal {?olnfi,u>r b6 per NSD b7C per NSD r rsonal Financial Consultant b6 per NSD b7C per NSD HRC-2899 -----------------------------------~--..m - WILLIAMS 8 CONNOLLY LLP IOctober 1, 2015 b6 per NSD . b7C per NSD We request and anticipate that at the conclusion of your inquiry you will return to us the former Secretarys non-federal record, personal e-mails. f!!Jt?~ Davi~ l. Kendall HRC-2900 HRC-2901 U.S. Department of Justice National Security Division Washington, D.C. 20530 BY EMAIL David E. Kendall, Esq. Williams & Connolly LLP 725 Tweifth Street, N.W. Washington, DC 20005 October 2, 2015 Deal Mr. Kendall, This letter confirms receipt of two letters you sent me on October I, 2015. Regarding your Jetter providing a list of individuals and entities with whom Se::retary Clinton may have communicated in a privileged context, when deemed necessary we will be using a filter process to account for the possibility that records may contain privileged information. During the filter process, we will determine what privileges may apply and how best to identify privileged information, utilizing as appropriate the list of individuals and.entities you provided. b6 per NSD b7C per NSD HRC-2902 HRC-2903 HRC-2907 HRC-2910 1i. HRC-2915 ,.... HRC-2918 U.S. Department of Justice National ~ecurity Division Washington. D.C. 20530 David E. Kendall, Esq. Katherine M. Turner, Esq. Williams & Connolly LLP 725 Twelfth Street., N.W. Washington, DC 20005 b6 per NSD b7C per NSD Latham & Watkins LLP 555 Eleventh Street, N.W. Suite 1000 Washington, DC .20004 October 9, 201 5 Dear Mr. Kendall, Ms. Turner, an4._______. b6 per NSD b7C per NSD In reference to my letter of October 4, 2015, I write to provide clarification of a minor factual error contained therein. The email address associated :with the nam~ set forth in subparagraph 2 and footnote 3 on rage 2 of the letter, was incorrectly provided as The correct email address for the account is ~-~~~~~~~~~ b6 per NSD b7C per NSD cc: Miguel E. Rodriguez, Esq.; Karen L. Dunn,. Esq. HRC-2919 HRC-2920 HRC-2923 HRC-2931 HRC-2933 ALL FBI INFORMA.T I ON CC:HTAINEC H:EREI H IS UNC L...~SSIFI ED DATE 12-0 6- 20115 BY Ji6 J18 T80 HSICG LAW OFFICES WILLIAMS & CONNOLLY LLP 725 TWELFTH STREET, N.W. WASHINGTON, D. C. 20005-5901 DAVID E. KEN DALL BE.NN~ Wfl.l..l M~ tl9 20 J0 68) PAU C.. fl... CON~ OLt..Y (1922 t $.78) JltNhk O (202) 434-5000 (202) 434- 5145 dkend all@wc.com FAX (202) 434-5029 October 28, 2015 b6 per NSD b7C per NSD U:S. Department ofJustice N ational Security D ivision 905 Pennsylvania Avenue NW Washington, DC 20530 DeaJ...._ ___, b6 per NSD b7C per NSD As discussed, this Jetter supplements m y September 25, 2015 letter to you concerning the back-up files of former Secretary Clinton, and gives the. Department of Justice consent to search, for evidence relevant .t o your security inquiry, all content contained in those back-up files. Fwther, we note that we provide this consent with the understanding that, as stated in your October 4, 2015 letter pnd me, all items voluntarily produced will be returned to the owners or disposed of consistent with FBI policies and procedures at the conclusion of the investigation. Sincerely, .b6 b7C (7~,&? f. ~ D avid E. Kendall HRC-2934 HRC-2935 U.S. Department of Justice National Security Division Washington. D.C. 20530 David E. Kendall, Esq. Katherine M. Turner, Esq. Williams & Connolly LLP 725 Twelfth Street, N.W. Washington, DC 20005 b6 per NSD b7C per NSD Latham & Watkins LLP 555 Eleventh Street, N.W. Suite 1000 Washington, DC 20004 November 9, 2015 Dear Mr. Kendall, Ms. Tumer, an~.__ _ _ _ __. b6 per NSD b7C per NSD In reference to my letter of October 4, 2015, I write to provide clarification of an additional minor factual error contained therein. The letter stated in subparagraph 2 and footnote 3 on page 2 that all of the email content in certain accounts, with the exception of six (6) identified emails that may reside in the accounts, could be transferred to the New Server. These email a in the letter as ~ndan_ accountontll sn tedinm October 9, 2015 letter the cor1-ect email address for the ___...... The account on th........ For both th ema1 actually appeared twe ve ( , not six ( times, an t iere ore w 1en e content of these accounts was transferred to the New Server, all content was transferred with the exception of these twelve (12) emails. ,.....__, ______ b6 per NSD b7C per NSD Sincerely, b6 per NSD b7C per NSD cc: Miguel E. Rodriguez, Esq.; Karen L. Dunn, Esq. HRC-2936 HRC-2937 HRC-2941 A.LL F3I nr.rORMAlIOl:l CONTAINED HERE.I H IS UNCLASSIFIED CATE 12-06-201 BY J76J 18T80 NSICC . WILMERHALF b6 per FBI, NSD b7C per FBI, NSD r------------. December 14, 2015 INational Security Division Department of Justiee Washingtop, D,C. 201 530 !_________ ay Email: ... b6 per NSD b7C per NSD ___.I ..oeaj.__ ___,J .. . As you know, we previously .Provided the FBI one Apple brand MaeBook Pro laptop computer, serial Nwnber W89361H6644 (MacBook Pr9), ~done Apple brand MacBop).< Air laptop. computer, Seri~Numl:>d lcMacBook Air) (collectively, laptQpS), that belonged to Justin Cooper: We provided botldaptops for the purposes ofDOJ/FBI.s investigation .ofSecretary Clintons personal email accounts. b7C As agreed, at the time of theirdelivery t.}1e laptops contained Mr. Coapers emaiis to and from $ec.r etary Clintoti during her tenure as Secretary of State extracted from his email files. The laptops also contained back:--UP copies of a Siackberty device,(or devices) that we un9erstood belonged to sedretaiy Clinton. , As you know we have since determined that baek-up copy qf a Blackberry device th~t remained on each of the MaeBook Pro and MacBook Air 9id not belong to Secretar) CHnton: Those n1es were .labeled as follows: .MacBook Pro; lterQ. 4, filename HR BlackBerry Bold.9900.ipd .MacBook Air, Item 5., filename HR ~Ja:ckBerry Bold ~900.ipd . As we have discussed, ~e ~k that you (1) reriiove all :copies (digital and hard copy) of these tWo files fr9tn.anyU.S. government review cycle and that they not be reviewed; (2) qestroy or. . . otherwise ~ndet them inaccessible; and (3) send written ronfirtnation of the same. Thank you for your atten tioii to this. matter. Sincerelv vours b7C Wilmer Cutler Piclcering Hale: and Dorr L\..I, J 8,15 P~nnsylvania Avenue NW, Washington, Beijing Berlin Boston Brusseis Denver Frsnkfun London Los . Angeles New York . Odord DC 20006 . . Palo Alto . Washington HRC-2942 . - N -....I HRC-2943 ALL .FBI I NFORU.ATION CONTAINED REREIH IS U1~C~SIFIED DAfE 1 2-0o -20 115 BY J76J l8T80 HSICG U.S. Department of Jus.tice National Security Division Wo:hlng/011, D.C. 20530 Wilmer Cutler Pickering Hale and Dorr LLP b7C 1875 Pennsylvania Ave. N.W. Washington, DC 20006 December J7, 2015 . b7C Th is letter confinns receipt of the letter you sent me on December 15, 2015, identifying a back-up copy of a Blackberry device present on two computers produced to the Federal Bureau oflnvestigation (FB[) by Mr. Cooper that did not meet our agreed-upon cri~eria for production. As we have discussed, the FBI will mark the back-up files identified in your letter such that, going forward, they will not be reviewed on any image of the materials that is in the possession of1the FBI. b6 per NSD b7C per NSD HRC-2944 HRC-2945 U.S. Department of .Justice National Security Division Wa1hingto11. D.C. 20530 January 8, 2016 BY EMAIL Beth A. Wilkinson, Esq. Paul, Weiss, Rift.ind, Wharton & Garrison LLP 2001 K Street, NW Washington, DC 20006-1047 ... ......._,..,..-;-- .. - -..... ....... - ----: ~ -: -- ~-- .----- --- -- -- ~ --- - ..... -- ---~ -- -~ - ---- ____ __ .. .... ,, ........ , ,_. - - ~ ____ ......... -- ~-: :--:-: :: ~ :-:-- - :- :- - - Dear Ms. Wilkinson: I am writing to reiterate our previous request, which you have declined thus far, to conduct voluntary interviews with your clients Cheryl Mills, Heather Samuelson, and Jake Sullivan. If you are willing to make these individuals available for voluntary interviews, please advise us as soon as possible. Sincerelv b6 per NSD b7C per NSD HRC-2946 ---- HRC-2947 ALL fBI IlUORHAfION COHl.l>,.INEC 3Z~Hl I S um::L..ASSIFIED DA i::: 12-06 -2 016 Bl J7 6J1 8T80 NSICG WIIMERHALE January 11, 2016 b7C David Kenda14 Esq. Katherine Turner, Esq. Williams & Connolly 725 Twelfth Street, NW Washington, DC 20005 Dear Mr. Kendall and Ms. Turner: As we h~ve agreed, (1) today we are giving you certain data (hereinafter retention data) 1 from Justin Coopers Apple MacBook Air laptop and Apple MacBook Pro laptop that were provided the FBI on September 24, 2015, and October 5, 2015, respectively, and (2) you will retain the retentio data until such time that you reach an agreement with DOJ that the retention data no longer need b~ retained. DOJ may request that you provide files from the retention data as part of the DOJ/FBI security inquiry of Secretary Clintons personal email accounts. You have assumed responsibility for responding _to any such future DOJ requests. We have made clear to DOJ that Mr. Cooper will not interpose any objection to DOJ possessing and reviewing files from the retention data that are responsive to such requests, and that Mr. Cooper has otherwise relinquished his ownership of and rights to the ~tet?-tion data Best re ards, b7C nc osures cc:I b6 per NSD b7C per NSD --~------ We have enclosed our Jetter agreement with DOJ specifying what constitutes retention data. Wilmer Cucler Pickering Hale and Dorr U.P, 1875 Beijing Berlin Boston Bru$sels Denver Fren\cfurt Pcnnsylvani~.b.!~!-:1.t Nw. London Los Angeles Washington, DC 20006 NlW Yori: Palo Alto Wa;hington HRC-2948 (.H HRC-2949 ... Al.L FBI H lFORMAlION CONTAINED HERE IN IS UNCLAS SifIEO CATE 12- 0~-201 EY J76J 18180 NSICG U.S. Department of Justice National Security Division Washington. D.C. 20S30 January 11, 2016 BY EMAIL _ _ _ _ _____.I b7C Wilmer Cutler Pickering Hale and Dorr LLP 1875 Pennsylvania Avenue, N.W. Washington, DC 20006 Dear Mr. Zebley: ... .... ............---:- .-- -..- - ---- - -- - -.... ---- -- - - ___ ___________ __.... --- ---.. - - - ---- - - ..._____ .._.,._________ .................... - .. ........., , _,,,, ,_,. ~.- .. ; As we agreed on January 6, 2016, WilmerHale (or other counsel, as later agreed between WilmerHale and DOJ) will maintain a back-up copy of all personal and business files present on the Mac Book Air (provided to the FBI on September 24, 2015) and, separately, the Mac Book Pro (provided to the FBI on October 5, 2015), whether or not retained by Mr. Cooper, containing: (I) any communications that include an@clintonemail.com email address; (2) any reference to the establishment or maintenance of the@cHntonemail.com domain, including but not limited to references to any server(s) on which that email domain was maintained, stored, or operated; (3) any communications that include Bryan Pagliano; and (4) any communications that include an @state.gov email address dated December 1, 2008, or later (collectively the retention data). Mr. Cooper.and WilmerHale (or other counsel, as later agreed between WilmerHale and DOJ) need not retain back-up images of the MacBook Air and the MacBook Pro. As we discussed and agreed on January 10, 2016, WilmerHale may transfer the retention data to other counsel on the conditions that (1) you provide me the name and contact infonnation of the other counsel, and (2) the other counsel must agree to retain the retention data until such time that he/she reaches an agreement with DOJ that the retention data no longer need be retained. b6 per NSD b7C per NSD HRC-2950 HRC-2951 HRC-2954 ALL fBI IHFCRH..C..TIDH COHlAINED HEREIN I S UNCUSSIFIED DATE 12 -0 6 - 2 0 16 BY .176 Jl8T8 0 NSICC WlIMERHALE b7C January 11, 2016 b6 per NSD b7C per NSD National Security Division Department of Justice 950 Pennsylvania Avenue, NW Washington, D.C. 20530 ByEmail: ~I~~~~~~____. Deail,__ ___, As requested, Williams & Connolly (points of contact: David Kendall and Katherine Turner, (202-434-5000)) is maintaining all files that remained in our possession from Justin Coopers Apple MacBook Air laptop and Apple MacBook Pio laptop that meet the criteria set forth in your letter to us dated January 11, 2016 .(hereinafter retention data). Williams & Connolly has agreed to retain the retention data until such time that it reaches an agreement with DOJ that the retention data no longer need be retained. As the owner of the retention data, Williams & Connolly has assumed responsibility for responding to future OOJ requests made for the retention data in the DOJ/FBI security inquiry of Secretary Clintons personal email accounts. Mr. Cooper.will not interpose any objection to DOJ possessing and reviewing files that are responsive to such requests, and has otherwise relinquished his ownership of and rights to the retention data. Best b7C Wilmer Cutler Pickering Hale and Dorr tu, 1875 Pennsylvania Avenue NW, Washingron, DC 200o6 Beijing Berlin Boston Brussels Derwer Frenldurt London Los ArQele~ New York Pa\o Alto Wsshington HRC-2955 HRC-2956 PAUL, WEISS. RIFKiND, WHARTON f$ GARRISON LLP .200.1 K STR.EET. NW TE\.E.PHON WASHINGTON. D.C 2000~-1047 12oi1 n~ ?300 UNIT 380, OFF1C iOWER A, 8 1.JING FORTUNE: PLA.ZA NO, 7 OONGSANHUAN Z.HONGLU CHA.OYA.NG o snuc:T etCtJ ING 0002:0 DEO~L. $ RE.PUSL e 0,. Cl-4 1114.A. TEl.Et-t0N . 486 10 1 5628 &300 SETM A.. WILKINSON 2.TH FL..cioft. MONG KoNG CLue aurLotNG 3A CHA.TER ROAC, Ce:NTRAL HONC KONC U\.E O!E: 1202) 223-?34C> F4CSIMIL.t 1202) 204 7395 rtLEPl-40NE. C8S2) 2.806 0300 A.L.O~R CASTL . 0 H09l.t SiREET LONOON EC2V 7JU. U.K. i LEPHOE f.44 Z.OJ .,:)~7 600 FUKOKU SEIM El BUI L.ClNJ; 2 2 UCH15AIWAICHO 29CH0ME CHfYOOA. >AN January 12, 2016 TELIEPMON (8 l~SJ 3~9.,. 8 lOt TOAONTO DOMtNION C:~NTRe: 17 K1NC SJAf:ET W!.ST, SUITt;: 3100 f.o. eox 2z.6 TOAONTO. ONTARIO MSlI. tJ3 TELEPMONE 14 6J SOA1 0520 2001 I( STAEE.T. NW WASHINGTON, De 2.0006>1047 T LEPHONE l202> 2 2.l.1300 . VIA Electronic Mail 500 OELAWA11:E AVENUE. SUlff.:200 POST OF~JCE eox 32. WILMIHGTO~, 0 19899 0032 iELEPMONE C302.) 6SS-4410 b6 per NSD b7C per NSD Counterintelligence and Export Control Section National Security Division U.S. Department of Justice b6 per NSD Dew!.__ ____, b7C per NSD I am writing on behalf of Cheryl Mills and Heather Samuelson in response to your January 8, 2016 request that they submit to a volun~ interview. Ms. Mills and Ms. Samuelson serve as attorneys for Hillary Clinton. Accordingly, they each are bound by ethical rules and obligations not to discuss privileged or confidential information within the scope of their legal representation of former Secretary Clinton. See D.C. Rule of Professional Conduct 1.6. We therefore are not in a position to consent to a voluntary interview of either Ms. Mills or Ms. Samuelson. Sincerely, --g~ 4/_.4_ //.%-g& Beth A. Wilkinson HRC-2957 ,. -- - . HRC-2958 PAUL, WElss: RIFKIND, WHARTON & GARRISON LLP 2001 K STREET, NW T~~EPHONE WASHINGTON, DC 20006 1047 C2:02:J 2:23-7300 UNli 3601. OFFLCE TOWEii! A., BE.tJtNG Ft>RTUNE Pl..AZA NO. 7 OONGS ..NHUAN ZHONGl.U CHA.OYANG DISTRICr D JJINC 0002.0 Pe:CPl.($ RE.PUBl.IC OF CHtrU. TEt..EPHONE t8f.-1 O S82&-6300 SETH ... wn.. KINSON i2TH PL00R. HONG 1(0NG C:t.UB BUl~DING :u. CH4TE.R RQAD. CENTFtAt. MONC KON . TELE:lHONE 1202) ZZ3 7340 A=SlMl\.E TE-.EPHONE t852) 28 6..0300 (:!02) 204 7395 A.LC R C:ASTl.E E.-M,IUL~ 10 NOBL STRE. T bwHlunsonOpa1Jlwe 1s:s.com LONDON E.C2V 7JU. U.K. lE!..EPHONE C46 ~OJ 7::167 160C u.as A.V NUE OF TM AM RICAS NEW YORK, NEW YORK 1 ()011 60&4 lEL PH0NE fZ 2 3.,3 ><:00 January 12, 2016 FUICOKU SE:IM 1 51UIL,QlG i. i UCHS$AIWAICHO 2 CHOM CHtYOO KU, TOl(YO 100 0011, .JAPAN TELEPHONE c81 !J 35il, 8101 iDRONTO~DOMINION CEWTRE. ;,ic. NG STREET WE5T, SUITE >100 J.Q. 80X Z26 .TORONTO. ONTARIO M5t( 1 Jl TE.l.EPHON E 14 S&J ~04 0S20 VIA Electronic Mail $00 O&:l..AWARE: AY NUE, SUJTE 200 POSi 0 FfICE 80)( 32 Wl1.M~1GTON, 0 19899-00$2 T LE.FHONE. 1302.) c5SS 44 I 0 b6 per NSD b7C per NSD Countennteibgence and Export Control Section National Security Division u.s. Department of Justice De~..__ ___. b6 per NSD b7C per NSD I am writing on behalf of Jake Sullivan in response to your Ja.n~ 8, 2016 request that he submit to a voluntary interview. In light of our discussions with you to dat.e about the parameterS of such an interview, I cannot recommend to my client that he do so at this time. If you are able to clarify and define the scope and duration of the interview, we are certainly willing to further discuss your request. Sincerely, ]?~ L./__:L._//Tf;J 11 Beth A. Wilkinson HRC-2959 HRC-2960_/ U.S. Department of Justice National Security Division Wasllington. D.C. 10530 January 14, 2016 BY EMAIL ............. Beth A Wilkinson, Esq . . Paul, Weiss, Rifkind, Wharton & Garrison LLP 2001 K Street, NW DC _20006-1,._..._ 04....... 7 .......... ...._.-...... ..........- ....._...___,,__,__,,.._ , ......... ..Washington, ___ _____ -.. ~ -- __ ___ _______ ................. ,_......... ..,. Dear Ms. Wilkinson: I am writing in response to your letter of January 12, 2016 in which you indicated your willingness to further discuss providing your client, Jake Sullivan, for a voluntary interview if the government was able to clarify and define the scope and duration of such an interview. In an effort to provide such clarification, we can inform you that the subject areas to be covered during the interview would be: Mr. Sullivans knowledge and understanding of the former Secretarys use of a private email system; his knowledge of email communications regarding sensitive or classified information sent to and/or forwarded to the fonner Secretary; and his knowledge of the handling and transmission of classified information during his tenure at the State Department. Although it is only an estimate, we anticipate that an interview of Mr. Sullivan would require approximately six hours. If you would like to discuss making Mr. Sullivan available for a voluntary interview, please advise us as soon as possible. Sincerelv. b6 per NSD b7C per NSD HRC-2961 HRC-2962 /~- HRC-2965 ~.LL FBI INf.ORMATION CONlAIHED HEREIN IS ffi-lCLASSIFIEC CATE 12-06-2016 BY J76J18T80 NSICG WILMERHALE b7C February 22, 2016 ......... Nabona... i Sec...... urtfyD~1vision Department of Justice Washingt~n, D.C. 20530 b6 per NSD b7C per NSD :rw1j As you know, pursuailtto written agreements with you, Justin Cooper vollintarily provided the FBI with two laptop computers and certain other media, and Williams & Connolly is retaining certain -other data that was previously in Mr~ Coopers possession. l write now to describe the status of hardware used .to process data in connection with those productions and Williams & Connolly s retention of data. Certain. ata was perlodically saved to external drives in order to search for, isolate, and/or save data for production or retention. Kroll Inc. (Kroll) has degaussed and shredded (using a thirdparty vendor called Shred It in Patsippany, New Jersey) all: such extei:nal drives, except as . follows: (-1) drivescontaini;ng,rete~tiori data held by Wrllialils& Connolly; (2) seven drives .that were wiped and remain in WilmethHale s possession pending direction from you on a fmal disposition . (Note, Kroll also ctegaus~ed _and shredded (u!ii~g the same vendor) the drive known as the Seagate drive.) . . Certain data was proce~ed using s~dalone computers. At the. ~onClusi9n of our work on this matter; alFCfata wa8wiped from those drives, tl;:e drives were reinov. q from t:qeir ~~chines; and . the drives were securely stored .periding dire~tio_nJrom you on a final disposition. Wilm~Hale is .. holding. tWo and Kroll is holding the remaining nine drives. . 6fthose dHve5,, . . Pleas~ let me know if you have any questions. .. . b7C Wilmer Cutler Pickering Hal~ and Dorr LLP, 1875 Pennsylvania Avenue NW, Wa~hingcon, D~ 20006 Beijing Berlin Boston Brussels - ~envar Franl::turt London Los Angeles New York Palo Alto Washingion HRC-2966 HRC-2967 HRC-2969 HRC-2971 ~\Ui CLF-SSIFIED BY: NSICC EASON: 1_4 D:E:C~.SSI!i .i76.J18TBO (C} OH: 1:2-31-2041 DATE: 12-01-201 ~-LL rm:oru.LATION CONTAINED HEREIN IS mrCLll,.SSUIED EXCEPf hHE~ s:ra~~1 l OTHERWISE FD-)40~.R_ev.4, 11-01 1-_Jo-z. File Number - - - - - - - : - - - - -..............:....,....----:------___;--- b7E W./-.-. Flcld.Ottlec Atqulrlog Evidence .... - - - - - - - - - - - - - - - - - S rlal # ofOrlglnat,nc ~ 7. meat 6( 0 _ ZDI6 Da.te tletelnd . . F~om --1-#~e~cnr~~/J11..;.:rlJ!~ler:\: ~ ..- -.:-;::-~ ~(NameofConlrib~!orllnlcrviewee) /ftJ/) J1// ffPlf /i/t) J,1e T.!.....,....._ _ _ ___,.._ __ : /, JJ_~~-~l_______ _m_ _ _ c rr--~---------,.-~ ay __ z___ To Be Returned b7C ~No Yes ReceiptOiven 0 Ye~ . Gr No Grand Jmy Material - Disseminate Only Pl suant to Rule 6 (e) :)J Federal Rules of Criminal Piocedure. . . :.J . ~No D Yes. ..1 Federal-Taxpayeflnf~rmation (FTI) o:. Y~s Rererence: c:rNo. ]DZ ----~-~-------....:....---------~ (Communicalion Enclosing Material) ~esmptlon: d ... Original no~e re intervi~ of ~ fo1tJ.e1i.i !e/ler{J; ~..= HRC-2013 .J- FD-S97 (Rev. 4-13-201 5) of _ __ UNITED STA TES DEPARTMENT OF JUSTICE FEDERAL BUREAU OF INVESTIGATION Receipt for Property ALL n-iroRHAnDH coNlAINED HEREIN IS UNCLASSifIEC DATE 12-01-20145 :3Y Case ID: On (date) Ji~ J 1818 0 NSICC Dbfio/20Jb item (s) listed below were: Collected/Seized ~ Received From RetumedTo Released To (Name) (City) Description ofltem (s): ani b7C ~A( (1 b7C Receind By: HRC-2014 ALL IBI ~REIH IHF~U..TIOH CONl.UNE:i::: IS T.mCL..Z\.SSIFIED DATE 12-01-2016 BY J76Jl8T80 HSICG WILKINSON 1900 M STREET, NW SUITE800 WASHINGTON, DC 20036 WALSH ESKOVITZ WASHINGTON, D.C. WWW.WILKDISONWALSH.COM A LIMflED LIABIUTY PARnmRSHIP LOS ANGELES June 10, 2016 VIA Electronic Mall b6 Per NSC b7C Per NSC U.S. Department of Justice National Security Division 950 Pennsylvania Avenue NW Washington, DC 20530 b6 Per NSC b7C Per NSC Deat...._ ___. This letter provides consent, in connection with the Department of Justices investigation into the use of a private server by former Secretary of State Hillary Clinton, to search the Lenovo Yoga 2 Pro (Serial No.I j(hereinafter the Device) belonging to my client, Heather Samuelson, who is Secretary Clintons attorney, pursuant to the terms described below. The Device is being provided to the Federal Bureau of Investigation (FBI) solely for the purposes of this Department of Justice investigation, and for the Departments use in connection with the investigation. In vol~ntarily providing the Device, Heather Samuelson. does not relinquish ownership or control over the Device,. except for the FBIs limited investigative use as specified by . this agreement. The FBI does not assert custody and control over the Device or its contents for any other purpose, including any requests made pursuant to the Freedom of Information Act, 5 552. b7C u.s.c. 1) You have confirmed that the sole purposes of the search are: (1) to search for any .pst files, or .ost files, or compressed files containing .pst or .ost files, that were created by Platte River Networks (PRN), after June l, 2014 and before February l, 2015, in response to requests for former Secretary Clintons e-mail from her tenure as Secretary of State, (hereinafter the PRN Files), including in an intact but deleted form; (2) to attempt to identify any e-mails from, or remnants of, the PRN Files that could potentially be present on the Device; (3) to identify any e-mails resident on the Device sent to or received from the following e-mail accounts: hdr22@clintonemail.com; hrodl 7@clintonemail.com; hrlS@att.blackberry.net; and hrlS@mycingular.blackberry.net (hereinafter the Relevant Accounts), for the period -1- HRC-2015 of January 21, 2009 through February 1, 2013 (hereinafter the Relevant Period); and (4) to conduct a forensic analysis of the device to determine whether the Device was subject to intrusions or otherwise compromised. 2) You have confirmed that Phase One of your search will proceed as follows: a. Your Tec~nical Team (to include FBI technical personnel only), will review the allocated space (i.e., active files) of the Device to search only for the PRN Files. Neither the Technical Team nor anyone else will review during Phase One the content of any .pst files, or .ost flies, or compressed files containing .pst or .ost files that can be identified as created before June 1, 2014 or after January 31, 2015. b. The Technical Team will review any files identified pursuant to subsection 2(a) above to determine whether they contain e-mails sent to or received from the Relevant Accounts during the Relevant Period. The files that d~ not include such e-mails will not be subject to any further review by anyone for any purpose, unless they meet the criteria identified in Phase Two or for purposes. of an intrusion analysis, both set forth below. c. The PRN Files that include e-mails sent to, or received by, the Relevant Accounts during the Relevant Period will be provided to a Filter Team, which will be limited to two attorneys, one FBI agent, and one FBI analyst: none of whom are members of the investigative team. 1 .d. The Filter Team will review the contents of any file they receive from the process described in subsection 2(c) to identify and remove: (1) any privileged material; and (2) any material they can determine is not an e-mail sent to, or received by, the Relevant Accounts during the Relevant Period. e. You will notify us of the results of Phase One of the search before proceeding to Phase Two of the search. f. You will proceed to Phase Two of your search only in the event that the PRN File containing approximately 62,000 emails from the former Secretarys clintonemail.com account is not identified in the allocated space of the Device. You have confirmed that Phase Two of your search will proceed as follows: a. The Technical Team will search the Device, including the Devices unallocated space, to identify any e-mails, fragments of e-mails, files, or fragments of files: (1) that include e-mails sent to, or received by, the e-mail addresses hdr22@clintonemail.com and.hrod17@clintonemail.com during the Relevant Period or for which the date that the e-mail was sent or received cannot be determined; and (2) that include e-mails sent to, or received by, the e-mail addresses hrlS@att.blackberry.net and hrlS@mycingular.blackberry.net that Should there be an extremely large volume of materials loc:ated on the Devic:e and provided to the Filter Team, we understand that the Department of Justic:e reserves the right to expand the number of Fiiter Team members in order to avoid significant delay in the review proc:ess. If such an expansion were necessary, the Department of Justice has agreed to inform us of this change. HRC-2016 can clearly be identified as having been sent to, or received by, those accounts during the Relevant Period.2 Aside from the intrusion analysis described below, neither the Technical Team nor anyone else will search or review the Device for any other material or for any other purpose. b. The Technical Team will review the results of the foregoing searches for the purpose of removing any file or data that is not an e-mail or a fragment of an e-mail sent to, or received by, the Relevant Accounts dur.ing the Relevant Period. Aside from the intrusion analysis described below, such material will not be further reviewed by the Technical Team or anyone else for any other purpose. c. The remaining results of the search wili be provided to the Filter Team, which will review those results to identify and remove: (1) any privileged material; (2) any material that, upon further review, is determined not to be an e-mail sent to, or received by, th~ Relevant Accounts during the Relevant Period; and (3) any material that, upon further review, is d~termined not to be a work-related e-mail sent to, or received by, the e-mail account hrod17@clintonemail.com. Aside from the intrusion analysis described below, such material will not be further reviewed by anyone for any purpose. 4) You have confirmed that you will also conduct a forensic analysis of the Device to determine whether the Device was subject to intrusions or otherwise compromised, without reviewing the content of any user created files, including .doc, .xis, .pdf, .jpeg, or e-mails not captured in the aforementioned searches. As soon as the investigation is completed, and to the extent consistent with all FBI policies and applicable laws, including the Federal Records Act, the FBI will dispose of the Device and any printed or electronic materials resulting from your search. No part of this letter shall be read to imply the consent to retrieve from the Device any data other than the data described above or to conduct any search or review in any manner other than as described above. Sincerely, Beth A. Wilkinson If a large volume of e-malls from the hrlS@att.blackberry.net and hrlS@myclngular.blackberry.net accounts - for which a send or receive date cannot clearly be determined -- are located. we understand that the Department of Justice reserves the right to discuss further with counsel any additional search efforts that could be undertaken to assess whether such e-mails were sent or received during the Relevant Period. The Department of Justice will not undertake any such search without prior discussions with counsel and an agreement with counsel as to the scope of. and procedures to be used during, that additional search. -3- HRC-2017 ALL !BI mroRMATIOH COHTA.IHED HEREIN IS TJNCLASSIF.IEC CAlE 12-01-201 EY J76J18T80 NSICG WILKINSON 1900 M SlllET, NW WALSH SUITii BOO WASHINGTON, DC ~0036 ESKOVITZ WWW.WlLKJNSONWALSH.COM A LIMITED LIABILITY PARTNERSHIP WASHINGTON, O.C. I LOS ANGELES June 10, 2016 VIA Electronic Mail b6 Per NSC b7C Per NSC U.S. Department of Justice National Security Division 950 Pennsylvania Avenue NW Washington, DC 20530 Dea~.__ __ b6 Per NSC b7C Per NSC This letter provides consent, in connection with the Department of Justices investigation into the use of a private server by former Secretary of State Hillary Clinton, to search the Dell Latitude E6330 (Serial Nol (hereinafter the Device) belonging to my client, Cheryl Mills, who is Secretary Clintons attorney, pursuant to the terms described below. The Device is being provided to the Federal Bureau of Investigation (FBI) solely for the purposes of this Department of Justice investigation, and for the Departments use in connection with the investigation. In voluntarily providing the De.vice, Cheryl Mills does not relinquish ownership or control over the Device, except for the FBls limited investigative use as specified by this agreement. The FBI does not assert custody and control over the Device or its contents for anv other purpose, including any requests made pursuant to the Freedom of Information Act, S U.S.C. 552. b7C 1) You have confirmed that the sole purposes of the search are: (1) to search for any .pst files, or .ost files, or compressed files containing ,pstor .ost files, that were created by Platte River Networks (PRN), after June 1, 2014 and before February l, 201S, in response to requests for former Secretary Clintons e-mail from her tenure as secretary of State, (hereinafter the PRN Files), including in an intact but deleted form; (2) to attempt to identify any e-mails from, or remnants of, the PRN Files that could potentially be present on the Device; (3) to identify any e-mails resident on the Device sent to or received from the following e-mail accounts: hdr22@clintonemail.com; hrod17@clintonemail.com; hrlS@att.blackberry.net; and hrlS@mycingular.blackberry.net (hereinafter the Relevant Accounts), for the period -1- HRC-6462 of January 21, 2009 through February 1, 2013 (her~inafter the Relevant Period); and (4) to conduct a forensic analysis of the device to determine whether the Device was subject to intrusions or otherwise compromised. 2) You have confirmed that Phase One of your search will proceed as follows: a. Your Technical Team (to include FBI technical personnel only), will review the allocated space (i.e., active files) of the Device to search only for the PRN Files. Neither the Technical Team nor anyone else will review during Phase One the content of any .pst files, or .ost files, or compressed files containing .pst or .ost flies that c~n be identified as created before June 1, 2014 or after January 31, 2015. b. The Technical Team will review any files identified pursuant to subsection 2(a) above to determine whether they contain e-mails sent to or received from the Relevant Accounts during the Relevant Period. The files that do not include such e-mails will not be subject to any further review by anyone for any purpose, unless they meet the criteria identified in Phase Two or for purposes of an intrusion analysis, both set forth below. c. The PRN Files that include e-mails sent to, or received by, the Relevant Accounts during the Relevant Period will be provided to a Filter Team, which will be Ii mited to two attorneys, one FBI agent, and one FBI analyst, none of whom are members of the investigative team. 1 d. The Filter Team will review the contents of any file they receive from the process described in subsection 2(c) to identify and remove: (1) any privileged material; and (2) any material they can determine is not an e-mail sent to, or received by, the Relevant Accounts during the Relevant Period. e. You wi!I notify us of the results of Phase One of the search before proceeding to Phase Two of the search. f. You will proceed to Phase Two of your search only in the event that the PRN File containing approximately 62,000 emails from the former Secretarys clintonemail.com account is not identified in the allocated space of the Device. You have confirmed that Phase Two of your search will proceed as follows: a. The Technical Team will search the Device, including the Devices unallocated space, to identify any e-mails, fragments of e-mails, files, or fragments of files: (1) that include e-mails sent to, or received by, the e-mail addresses hdr22@clintonemail.com and hrod17@clintonemail.com during the Relevant Period or for which the date that the e-mail was sent or received cannot be determined; and (2) that include e-mails sent to, or received by, the e-mail addresses hrlS@att.blackberry.net and hrlS@mycingular.blackberry.net that Should there be an extremely large volume of materials located on the Device and provided to the Filter Team, we understand that the Department of Justice reserves the rig ht to expand the number of Filter Team members in order to avoid significant delay in the review process. If such an expansion were necessary, the Department of Justice has ag~eed to inform us of this change. -2- HRC-6463 can clearly be identified as having been sent to, or received by, those accounts during the Relevant Period.2 Aside from the intrusion analysis described below, neither the Technical ream nor anyone else will search or review the Device for any other material or for any other purpose. b. The Tec~nical Team will review the results of the foregoing searches for the purpose of removing any file or data that is not an e-mail or a fragment of ari e-mail sent to, or received by, the Relevant Accounts during the Relevant Period. Aside from the intrusion analysis described below, such material will not be further reviewed by the Technical Team or anyone else for any other purpose. c. The remaining results of the search will be provided to the Filter Team, which will review those results to identify and remove: (1) any privileged material; (2) any material that, upon further review, is determined not to be an e-mail sent to, or received by, the Relevant Accounts during the Relevant Period; and (3) any material that, upon further review, is determined not to be a work-related e-mail sent to, or received by, the e-mail account hrod17@clintonemail.com. Aside from the intrusion analysis described below, such material will not be further reviewed by anyone for any purpose. 4) You have confirmed that you will also conduct a forensic analysis of the Device to determine whether the Device was subject to intrusions or otherwise compromised, without reviewing the content of any user created files, including .doc, .xis, .pdf, .jpeg, or e-mails not captured in the aforementioned searches. As soon as the investigation is completed, and to the extent consistent with all FBI policies and applicable laws, including the Federal Records Act, the FBI will dispose of the Device and any printed or electronic materials resulting from your search. No part of this letter shall be read to imply the consent to retrieve from the Device any data other than the data described above or to conduct any search or review in any manner other than as described above. Sincerely, Beth A. Wilkinson If a large volume of e-mails from the hrlS@att. blackberry.net and hrlS@mycingular.blackberry. net accounts -- for which a send or receive date cannot clearly be determined - are located, we understand that the Department of Justice reserves the right to discuss further with counsel any additional search efforts that could be undertaken to assess whether such e-mails were sent or received during the Relevant Period. The Department of Justice will not undertake any such search without prior discussions with counsel and an agreement with counsel as to the scope of, and procedures to be used during, that addltlonal search. -3- HRC-6464