. Department of Justice Office ofthe Inspector General ABBREVIATED REPORT OF INVESTIGATION SuBIECT CASE NUMBER Unidentified AIS OUGISI OFFICE CONDUCTING INVESTIGATION DOJ COMPONENT Cyber Investigations Office Unknown DISTRIBUTION sTaTus 1) Fedomee cio WU OPEN _)_OPEN PENDING PROSECUTION _[X) 1) ateiny PREVIOUS REPORT SUBMITTED: ou oYEsS 1) Component Date of Previous Report usa Uther SYNOPSIS This DOJ Office of the Inspector General (OIG) investigation was initiated based on a complaint submitted to the OIG Hotline in April 2013 by Sharyl Attkisson, a private citizen and CBS News Correspondent at the time. Attkisson alleged that in December 2012 her personal Apple iMac computer and two CBS News laptop computers used by her were remotely compromised by an unknown intruder in order to obtain information relating to her reporting on events such as Operation Fast & Furious and the terrorist attack on the U.S. compound in Benghazi, Libya, Attkisson alleged that special software was used for the intrusion that is only available to the Federal Bureau of Investigation (FBI) and other U.S. Government Intelligence Agencies. Attkisson claimed that former White House Associatc iI directed cither the FBI or an Intelligence Agency to monitor her computers. Attkisson further reported to the OIG that a technician hired by CBS News came to her residence on February 2, 2013, and examined her personal iMac for a period of time. She stated that the CBS technician told her there was evidence of “remote access” on her personal iMac. Attkisson also informed the OIG that CBS News hired a computer forensic examination company. [I fo examine she CBS News laptop computers that had been used by Attkisson, Attkisson told the OIG that the, st port concluded her CBS News laptop computers were compromised. At the OIG’s request, the FBI searched its case management system to determine whether Attkisson was the subject of any FBI investigation. The FBI informed the OIG that Attkisson was not and had not previously been under investigation by the FBI. Before issuing this report, the OIG confirmed with FBI that there was no change to Attkisson’s status. DATE January 23, 2015 SIGNATURE PREPARED BY SPECIAL AGENT DATE — January 23, 2015 SIGNATURE Jha _fpe > APPROVED BY SPECIAL AGENT INCHARGE Keith A. Bonanno o1 (05) Portions ofthe Report of lavstigation maynot he exept under the Fredo of Information Ae (S USC 552) and the Privacy At (5 USC 582‘The OIG asked Attkisson for consent to image and analyze her personal iMac, and for consent to contact CBS News regarding her allegations so that we could request from CBS News a copy of the forensic report prepared by| _a.: access to the two CBS News laptop computers used by Attkisson. In early June 2013, shortly after receiving Attkisson’s consent, the O1G’s General Counsel contacted an attomey for CBS News to inform her of the complaint that the OIG received from Attkisson and to request access to Attkisson’s laptop computers at CBS News and for any forensic report that CBS News possessed. The CBS News attorney took the request under consideration and said she would let us know the company’s position. ‘On June 14, 2013, shortly after the OIG contacted CBS News, CBS News issued a public statement reporting, among other things, that a cyber security firm hired by CBS News “has determined through forensic analysis. that Sharyl Attkisson’s computer was accessed by an unauthorized, extemal, unknown party on multiple occasions in late 2012. Evidence suggests this party performed all access remotely using Attkisson’s accounts, While no malicious code was found, forensic analysis revealed an intruder had executed commands that appeared to involve search and exfiltration of data. This party also used sophisticated methods to remove all possible indications of unauthorized activity, and alter system times to cause further confusion.” In January 2014, CBS News advised the OIG that it was declining the OIG’s request that it voluntarily enable the OIG to examine and analyze the CBS News laptop computers used by Attkisson. CBS News also informed the OIG that it was declining the OIG’s request that it voluntarily provide the OIG with a copy of i! forensic examination report. In December 2013, in response to a request made by the OIG about six months earlier, Attkisson contacted the OIG to inform us that she would agree to provide the OIG with her personal iMac computer so that the OIG could conduct a forensic examination of it. The OIG thereafter received the iMac computer from Attkisson in January 2014 and performed a forensic analysis of it. The OIG's forensic examination of Attkisson’s personal iMac located numerous artifacts indicating that a live search of the iMac’s system logs had been conducted on February 2, 2013. This was the same date that Aitkisson told the OIG a technician hired by CBS News conducted a forensic examination of her iMac computer. The OIG’s forensic examination further found what appeared to be searches and queries performed by an examiner with knowledge of computer logs; however, it appeared that the searches and queries were conducted while the computer was in operation and without write protecting the hard drive, which altered file information. This method of forensic examination is not forensically sound nor is it in accordance with best practices. This activity also could have deleted and overwritten log data on the iMac, which could have obscured potential evidence of unauthorized access. The OIG computer forensic analysis of Attkisson’s personal iMac computer did not find evidence of remote or unauthorized access. The analysis determined that the computer's system logs that we were able to examine were complete and unaltered except for time and date changes that occurred in February 2013, approximately two weeks after the live examination was performed. Further, the OIG’s analysis found that the time and date changes were executed by a user who had physical access to the computer, and were not done remotely. Page 2 Case Number: 2013-00619! Date: January 23, 2015In order to determine what actions may have been taken by the forensic examiner while analyzing Attkisson’s iMac computer, the OIG contacted counsel for CBS News in February 2014 to see if it would provide the OIG with a copy of only that portion of the forensic examination that related to Attkisson’s personal iMac computer. Counsel for CBS News informed the OIG that it would take the OIG’s request under consideration. The following month, the OIG was contacted by counsel for CBS News and advised that CBS News did not have any forensic work performed on Attkisson’s personal computer, so its forensic report would not contain any information relevant to our inquiry. Attkisson, however, continued to stand by her statement to the OIG that CBS News sent a technician to her house to examine her iMac computer on February 2, 2013. Attkisson told the OIG that she hired a forensic technician who also conducted an examination of her personal iMac computer and claimed that this forensic examination found that the iMac contained evidence of remote access. Separate from the DOJ OIG’s interactions with Attkisson, we were contacted by the EEE about an allegation, resulting from a finding of the forensic technician hired by Attkisson, that an Internet Protocol (IP) address registered to the Ca responsible for the unauthorized access into her onal computer, which the NIN as investigating pursuant to a request from Senator Tom Coburn. — el the DOJ OIG that it determined the IP address identified by Attkisson’s technician was never an active IP address on the [iinetwork. [IINIIINIIMH requested DOJ OIG to search for the IP address as well as any IEEEIEIIP addresses on Attkisson’s personal iMac computer. Our search of Attkisson’s iMac computer did not locate the IP address identified by Attkisson’s technician. Other IP addresses assigned to the [iB that we located on the computer appear to have come from common, non-suspicious sources such as internet cookies, Google searches, and web access to the [JM shipping web site. No references to the IP addresses were found in logs or other areas on Attkisson’s iMac computer that would record remote access originating from ‘he ior otherwise. In June and July 2014, the OIG requested that Attkisson provide the OIG with a copy of the report completed by the technician she hired to examine her iMac computer, or to allow the OIG to speak with Attkisson’s technician, After consulting with her attorney, Attkisson told the OIG that “My attorney says our material isn’t yet in a form that’s ready to share.” The OIG requested a copy of this report again in October 2014. Attkisson responded that she would ask her attorney, but we have received no further communication from her regarding this request and it remains outstanding, Attkisson did provide the OIG with recorded videos showing the screen of her CBS News issued laptop, which she stated were evidence of alleged unauthorized access. One video showed what was determined to be a standard error prompt. A second video showed text of a document she was drafting on a Macbook laptop being deleted without any apparent action by the user of the computer (Attkisson). However, the video of text being deleted from a document appeared to be caused by the backspace key being stuck, rather than a remote intrusion, Lastly, Attkisson reported to the OIG that a “suspicious” cable was attached to her Internet Service Provider's connection box installed on her house. She opined to the OIG that perhaps this cable was being used to “tap” her house. Further investigation by the OIG revealed that the cable was a common cable used by the provider and could not be used to monitor or otherwise affect the phone or internet service at her residence. Page3 (Case Number: 2013-006191 Date: Sanvary 23, 2015Conclusion Attkisson told the OIG that forensic examinations of computers used by her by technicians hired by her and separately by CBS News had determined that these computers were remotely compromised. Attkisson and CBS ‘News have not permitted the OIG to review the reports of their respective forensic examiners, and CBS News has declined to allow the OIG to forensically examine the CBS News computers that Attkisson used during her employment. The O1G’s forensic examination of Attkisson’s personal iMac computer found no evidence of remote intrusion although we did find numerous artifacts indicating that a live search of the Mac’s system logs had been conducted by a technician on February 2, 2013. This activity also could have deleted and overwritten Jog data on the iMac, which could have obscured potential evidence of unauthorized access. The OIG’s investigation was not able to substantiate the allegations that Attkisson’s computers were subject to remote intrusion by FBI, other government personnel, or otherwise. The OIG has completed its investigation into this matter and it is now closed, subject to reopening in the event additional information or materials are made available for our review. Page 4 (Case Number: 2013-06191 Date: January 23, 2015