You are on page 1of 100
ALL THEORMATION CONTATHEE FD-302a Rev. 10-6-95) a FEDERAL BUREAU OF INVESTIGATION Dats of transcription _09/21.2015. ») On September 14, 2015, Platte River Networks, date of birth social security numb. intervi bs of investigation (FBI) Special Agent (SA) jand SAI Also present | for the intervie ent of Justice (DON) Attome! attorney at the| being advised of the Weniity OF the imervTewing ageniS and the nature of the interview. rovided the following: (U/POGO) As| ii ldescribed his role at PRN as a general role with the client and not involved with technical details, Jrain concem is the general direction of the business. (U/POES) Platte River Networks (PRN) worked with an individual named] oO identify business opportunities. In early 201 Jbrought them a ctient opportunity who she claimed once worked as a public official. After submitting a bid to do the work, PRN became aware the contract, they were bidding on was for the management of an email server hosting doraains associated with BILL CLINTON, HILLARY CLINTON ane their aides. PRN won the bid for the contract and the account was under the name CESC. (ui PRN wanted to limait the employees working on the CESC server, so it was determi ho thal rly on theca, handled the server fvsite, would be the technical team doing most of the work that PRN picked up an old server from the CLINTON residence and delivered itto Equinix, @ datacenter in Secaucus, New Jersey. PRN ordered and installed new server hardware at Equinix and migrated all CESC email from their old server to the new PRN provided server. Ce aware that PRN maintained a back-up of the server known as a DATTO. The DATTO was located at Equinix and worked ots of the server and maintaining 1 0 days before it was deleted. ieferred, Qt specifi ras also aware of a BlackBerry Enverprise Server managed by PRN, but deferred to| fon the specifics. (U/FO8S) In or around March 2015[_____]was involved in conversations with CESC they requested to know what email they had, where it was, and how it was backed up. lan| handied this request and would know more details. CESC never asked Investignion on 08/1420 __at_Denver, Colorado File 2 + 2, Date dictated _W/A. by { ls Jofizppors ‘This document contains nether recommendations nor conclusions ofthe FBI, Jt isthe propery of the FBI andis loaned to your sgency; it and iss contents arent 1 be eistribuied outside your agency. Bs bre 6 Bre Be 7c bs Bye 6 BIC ba BIE be BIC BD-302a (Rev. 10-6-95) 6 bic Continuation of FD-302 of _Inierview of On 0723/2015, Page __2 for administrator rights to the PRN server or for physical access to the server at Equinix. eee believed CESC was still a PRN client and were operating under the same contract they originally signed, cuneate believe there was a successful intrusion attempt against the CESC email server ran by PRN s c ALL INFORMATION COUTAINED FD-302a (Rev. 10-695) MEREIW 12 WICLASSTSTED le DATE 10-O5-2016 EY Js7seDT94 NSICS FEDERAL BUREAU OF INVESTIGATION Date of transcription 05/26/2016 __ (Uh 2016, date of birth social pe security numbe interviewed by Federal Bureau of Investigation (FBI Special Agent < (SA) jand Sal at the offices of Platte River Revers Ph erat 5700 Washington Streei, Denver, Colorado 80216. Also present for the interview wes| and via speaker phone both attorneys at the| [After being advised of the identity of the interviewing agents and the nature of the interview] Jprovided the following information: (u/Feue) vas not aware of a laptop containing an archive of email belonging to be HILLARY CLINTON that was shipped to PRN around February 2014, lwas not aware bre ‘what became of the foregoing laptop. (weve], ily recently was made aware of a CLINTON email archive file being Bs i ii iv ‘ices Corporation (CESC) around July 2014 and September 2014 pre not aware of the request by CESC, or transmittal by fas not aware of what specifically was requested by CESC or exactly how] fulfilled the request, (U//FEBO)] ot aware of any support PRN provided the CESC client from Bel October 2014 to — Iwas not aware of any CESC request to delete, wipe or shred their email records. As af would not pay attention to technical details of any PRN client (U/POU@) AL this point in the interview, Agents displayed PRN provided records and email from the March 2015 timeframe provided the following information: eel (U/46¥8) In March 2015, when various media outlets reported a private email domain and ‘server was used by HILLARY CLINTON, PRN decided to cre; in “share drive” and control access to only the PRN employees working the CESC account, ited PRN did have back- Be ups of their own servers. PRN never deleted information pertaining to \C client and provided the BTC FBI all records they maintained pertaining to CESC. Investigation on 05232016 __at_ Denver, Colorado Bs bE Fite# oa ~ 46 Die dictated __ NA Bys _____________ bie ‘This document contains nether recommendations nor conclusions of the EBI. Itis the property ofthe FBI and is loaned to your agency; it ‘and its contents are not tobe distributed outside your agency. PD-3028 (Rev. 1046.95) ‘Continuation of FD-302 of. (U/Q40) In March 2015 content, to include where it existed. PRN employe data center in Secuacus, New Jersey where the CESC server equi was not a party iscussion involving CESC’: inye instructions] lid not recall what speci ~ kr equipment. (U/APOUE) After Agents displayed an emai! dated March MILLS discussed preservation of materials, Fould not recall entity to preserve CESC related data, (U/FORO) ‘no recollection of a conference call on March 25, 2015 or March 31, 2015 with CESC. ited CESC never r¢ ‘ir email content by deteted, wiped or shredded. Recently,] yas made aware that| jused Bleachbit software to shred .pst email files containing CESC email content that was transferred to CESC. As understood it] created a “vehicle” to transfer email files from the live mailboxes o| email accounts| then tater used Bleachbit software to shred the “vehicle” but the email ‘content still existed in the live email accounts. (U#PONO]_____ }was unaware of any PRN employee conducting manual deletions of the DATTO device used to back-up the CESC email server. cumexey |was unaware of any successful computer intrusion of the CESC server. (U/FEYE) Notes of the interview and documents displayed td [will be maintained in a FD340 envelope and filed with the captioned investigation. b6 pic Be bre Be bre bs BIC 6 Bre be bre be bre be bre we SQgfbl TNFCRIATION couranaes UNCLASSIFEED/ /O8O “eienei Gs uucunseovine DATE 10-08-2016 BY JS7288T94 NaICS FD-302a (Rev, 1046-95) -- FEDERAL BUREAU OF INVESTIGATION Date of transcription _94/192016 date of bith (DOB)|___] ana social security account nut wed by Federal Bureau of I ion, Agents (SA) at the law offices of located at ‘Washington DC 20005. Also present for the interview were Jattorneys| knd{ After being advised of the identity of the interviewing Agents, and the nature of the interview] provided the following information: (U/FOBQ) On April 19, 2016, is currently th fmet President WILLIAM CLINTO TINTON when he became an (the White House in the fall o After bis served in various positions in the CLINTON White House and continued to work for President CLINTON after his presidency. (U#FOLO) In the years after President CLINTON leit the White House, CLINTON’s staff managed certain details related to the information technology needs of CLINTON’s office. One of those needs required negotiating with an individual who owned several .com domains related to CLINTON’s name. Jrecalled these domains to be presidentelinton.com, clintonfoundation.com, and owjc.com. Ultimately, negotiations were successful and the domains were purchased from the individual. for the office of President CLINTON. COOPER ane had sevcral conversations about reliability isgues related to the previous outsourced server and decided it would be best to have a server under their physical control at the CLINTON’s residence in New York. COOPER handled the procurement and all ts -w accounts or any requests to move email. (UsFEHO) In 2006 or 2007, JUSTIN Santi a private email server (Apple Server) called a conversation wit LABEDIN and COOPER regarding the addition of HILLARY CLINTON to the Apple Server.| ___] thought it was a bad idea, but the issuc had been decided by that point in timé fo believed the addition of HILLARY CLINTON to the Apple Server occurred while she was in the’ jate. CLINTON used BlackBerry devices obtained by COOPER to access her emai not involved in the decision to move to a new server (Exchange Server), but recalled it was located, as was the Apple Server, in the basement of the CLINTON’s New York residence. Investigstion on__ 04/1929) ae hingrom Lt Fue# 2 To Date diciaed_ WIA, _ wel “This docoment contains neither rexormendations nor conclusions ofthe FBI Itis the propery afte Fl snd is Yeaned to your agency, it and is contents are not to be distributed eutside your agency. UNCLASSTFIED/ /PO6e be Bre bs bre be bre Be Ic ba BIE bs BIe “~~ oncnassieiep//poue FD-W2a (Rev. 10-6.95) CCootinustion of FD-302 of ___Intervew af usin Gregory Cooper fon ouppaoi6. Page 2 : . be (wis COOPER notifi {_ few times each year about attempted intrusions of the bre system, bul ould not recall any specie details. They shared a mutual e bad too much private information about the CLINTONS: and may have had access to some of thei ‘communications. (uiFETe) had no knowledge regarding the following topics: Poe © discussio . “o move - ge Server ‘personnel involved it to move to the Exchange Server * domains on 7 Exchange Server © userson + ae © dispositic ofthe Exchange Server after decommissioning classified information on Ap) er or Exchange Server conversations concerning a as it related to the Apple Server or Exchange Server backups of the Apple Server or Exchange Server . Sensitive Compartmented Information Facilities at the CLINTON’s New York or Washington, DC residences did recall Secure Telephone Units in New York and Washington, DC) b6 © Secure fax machines or secure computers at the New York or Washington, DC residences BIC UNCLASSIFIED/ /#O0e © rrcnscrrcsy naps We cnc re 0.3028 (Rey, 106-98) DAME iociscoie av s3Ts@sr3a NSTCG -l- _ “ “ “ FEDERAL BUREAU OF INVESTIGATION ‘Date of transcription _06/09/2016__ (UFOHO) (tune 6 2016 date | social security number| walinterviewed 6 Bureau of Investigation (FED) Special Agent (SA) land Sal lat the FBI Washington Field Office, 601 be 4" Street NW, Washington, DC 20535. Also present for the interview was FBI Intelligence Analyst bie Ati being advised of the identities of the interviewing agents and the purpose of the ilerview, |provided the following information: (UiBeHE) [works for| i of missile, space, and intelligence. In additx Js company focus i isition whic be as several products to i wel ‘Over 60 billion records i ossession, [Dark Horse Data, Inc. (DHD), a company owned by Former Deputy Under Secretary of Defense for Intelligence REGINALD HYDE. DHD works with foreign data, can contract directly with the government, and frequently embeds its personne! with clients. (U/POUO} In June or July 2015, States Senate Committee on the Judiciary, contacted] CLINTON’s email server might end up overseas. Specific: ‘was an intrusion i foreign power. a senior staff member of the United yf ms data from HILLARY ted to determine if there be ‘TON’s server and, if so, whether exfiltrated data fell into the hands of a ere concerned any exfiltrated data could endanger her three sons, who are ‘as a citizen and Senate Staff Member that this situation could occur. iis possible to determine if CLINTON’s server had been is stated Te would have to look for data that was genuine, authentic, and relevant. ejected i0se three terms as follows: ~ Genuine ~ data originating from CLINTON’s server - Authentic — data that had not been altered - Relevant — data from CLINTON’s server that was moved outside of the United States to a place where a foreign actof could access it (U/FOYS} Since] }iid not have funding for ject described above, in August or ®S September 2015 she met with NEWT GINGRICH and asked| brief GINGRICH on the project. 7° Be Imvesgnion on _ 061062016 __at_Washingtan, DC bre Filet sor 41. Date dictated __W/A By be ‘This document connns neither recommendations nor contusions ofthe FI. It isthe propery ofthe FBI andi loaned to your agency: it bre and its contents aze not be distributed euside your agency. UNCLASSIFIED/ /PO8e- UNCLASSTFIED//POe FD-302a (Rev. 1046-95) Continuation of FD-302 of _Interview of On 06/06/2016. Page [J ainenicn, ana were all bothered by the potential that data from CLINTON'S server had been compromised. wanted ers about the project and December 2015, recomm« yeak with| jat Judicial Watch. prietea the project as four phases tol The phases were to determine if: - Phase 1 -CLINTON’s server was directly or indirectly attacked - Phase 2-SIDNEY BLUMENTHAL!’s server was directly or indirectly attacked - Phase 3 —data was exfiltrated outside the United States Phase 4 — data was exposed to a foreign actor ag briefed the project, he raised the question of what the course of action would be if classified information was uncovered. The three discussed it and decided Judi Watch’s legal counsel should be. consulted Inever received an answer, but was of the opinion that if he uncovered data he ‘thought might be classified, he would be obligated to report it to the appropriate authorities. (U/FEHO) In January or February 2016, Judicial Watch’s legal counsel advised the project was feasible, but could not involve accessing any systems without authorization. The project could review open source data following the four phases described above. After these initial discussions with Judicial Watel Jconcluded the motivation of Judicial Watch's actions was not centered on the elections. (U/FE8O} Jadvised there are three potential funding streams for the types of projects his company undertakes. They can be funded by his company, a government contract, or a data arbitrageur. In this situation, the arbitrageur would invest in litigation on the prospect of a judge awarding the arbitrageur attorney’s fees. (U/PEBO} In February or March 2016[______ompany, as given $32,000 by Judicial Watch to proceed with Phase I. Judicial Watch awarded the contract ca confident he understood both the Deep Web and Dark Web. After receiving the contrac to determine the best place to obtain the necessary data for the project. Based on the terms outlined by Judicial Watch's INTO! HAL's respective servers were off limits, as were offshore servers. fumed a former executive at a cyber intelligence company which ingerts wm the Deep Web and Dark Web and, then, indexes the data, By leveragin, co ch the Deep Web and Dark Web without exposing his searches to the Inj ai [82,500 to have Jconduct searches based on search terms provided by se search Terms included, buf were not limited to, HILLARY CLINTON, BLUMENTAL, and an Internet Protocol (IP) address range obtained from an email y Judicial Watch. In retum, the results of those searches to which was the exclusive data source usé for this project. (umee[—_ feviewed the data provided by nd found files from BLUMENTHAL 's server on a server in Romania, believed BLUMENTHAL had a personal UNCLASSIFIED/ F686 be bre BS bre be Bre be bre bs bre be Bre be BIC UNCLASSIFTED//F68e FD-302a (Rey. 10-6-95) Continuation of FD-302 of __I B + On O6/06/2016., Page server because he found some of BLUMENTHALs files on the server in Romania, but not any of BLUMENTHAL’s emails. The Romanian server contained approximately 200 Microsoft Word, Excel, and other file types belonging to BLUMENTHAL. (U/EOBE) In re toaMay 22, ed intrusion of CLINTON’s server appearing in a draft version of a report project{ stated he could not recall where he learned of the hack or the specific date. peculated it was possibly from a public report, but he had looked for the source and could not find It. Therefore [planned to remove the reference from future iterations of the report. (WOO) Durind_____ review of the data obtained b 1 found one sensitive Excel file listing the names of Gown ot suspected jihadists in Libya, added that a portion ofthe file was in Russian, The file did not come from BLUMENTHAL?s server, But contained ay an IP address range that included the IP address of CLINTON’ server. Upon viewing this fle became con d found a classified document and stopped the project. This work completed Phase 1 and lanned to deliver the final report to Judicial Watch soon. (uiFeve) stated some o| were dat ut January 2012, which was the same timeframe wher [contacted] regarding the Libyan Rogue Nation Judgment Recovery Program (LRNIRP). Taimed he was hired ibyan opposition government to recover the assets of the MUAMMAR GADDAFI government. jalso met with TYLER DRUMHELLER regarding the same matter. speculated BLUMENTHAL, if involved in the LRNIRP, could have written the memos as a “shake and bake” tactic, (U/FOBE) A copy of the original interview notes and documents provided to the FBI by|___] during the interview are enclosed in a 1A envelope. UNCLASSIFIED//PEU@ be bre be Bre 7c be BIC BS pre ALL TNFORUATION ConPAnNER BEREIN IS UNCLASSIFIED #D-302a (Rev. 10-695) DATE 10-05-2018 BF 937986794 WSTCG ol FEDERAL BUREAU OF INVESTIGATION Date of transcription _op/2u2015___ On September 14, 201 ‘Networks (PRN), date of birth Fe -au of Investigation (FI) Special Also present for the interview wa ‘partment of Justice (DOJ) Attomey interviewing agents and the nature of the interview, Platte River by ised of the identity of the provided the following: On or about January 2o13f Jo contacted legarding potential busi ye profile former government client. had an existing e relationship with] cause she previously referred other clients from a family wealth asset management firm, The potential client's current email server architecture lost connectivj such as Hurricane Sandy, so they wanted better support than their existing a with the assistance of other PRN personnel, put together a proposal and submitted it lOnce PRN was chosen as one of the three finalists for the contract, PRN was notified the potential client was WILLIAM CLINTON and YY CLINTON, doing busi pany named CESC. on ler role fee primarily with te CESC wanted To Keep the number of individuals ‘WOrKIRg On The project small, so PRN identified three people as the only personnel allowed to work - directly on the CESC proj ivi signed in August 2013 ai s were identified j ent (SLA) ion design), roject mi [Chelp desk. ly 90% of the work for CESC and| imately 10% of the work. le was to help with on-site work at Equinix, whik handled everything else, was ultimately not needed to work on the project. Whi ked 10 revi i) he sent discussing a new émail address for HILLARY C 7 [state lcould not answer the question for attomey-client privilege reasons. A copy of the email is attached To Ths communication in an FD-340, PRN chose Equinix as the datacenter for CESC’s new email server (hereafter, PRN server) specific: it did not go down during Hurricane Sandy. This project was PRN’s first time using Equinix, ransported CESC’s existing equipment (hereafter, predecessor server) and transportea TTT Equinix, so the comtent of the predecessor server could be migrated to the new PRN server. Investigation on _OOMAROTS __st___Denv. Fuee | o_o Date dictwed__N/A. ws ya [_ |eeeus This document contains neither recommendations nor conclusions of the FBI. [Lis the property ofthe FBI and is loaned to your agency; it and its contents are not to be disteibuted outside your agency. be bre be bic bs BIC be bre bs BIE Bre FD-3025 (Rev. 10.6-95) On 0914/2015, Page __2 jstated PRN used an outside firm, MX Logic, for spam filtering, but referred other | filtering, data migration, archives‘backups, and Microsoft Exchange to or| had no knowledge of: + Email servers used by CESC prior to the one transported by PRN to Equinix. * The existence of classified information on either server. ‘© Discussions regarding federal records retention, + Intrusions to the PRN server. be Ic be bre bs pre ALL THEORUATION CoMTATIED e @ Bee seacsrne DATE 10-05-2036 BY 237989154 NSICD FD.302a (Rev. 1046-95) AL FEDERAL BUREAU OF INVESTIGATION Date of transcription 050672016 May 23,2016[ ___] ate of int ____]pocial scanty num was intervie ‘ederal Bureau of Investigation (FBI) Special Agent (SA) and S. at the offices of Platte River Networ t 5700 ‘Washington St do 80216, Also pr intervi eT via speaker een pot attomeys at th ng advised of the identity of the interviewing agents and the nature of the Interview rovided the following information: i had contact with PRN client CLINTON 01 ), His points of contact at CESC were CHERYL MILLS fan (U/FOGO) }was not aware of a laptop containin, il belonging to PS HILLARY CLINT ‘was Shipped to PRN around February 20141 vas not aware what became of the foregoing laptop. (UFORO] Jas not aware of a CLINTON email archive being transmitted to the Ps. (lamas services Corporation (CESC) around July 2014 and September 2014 byf | (UIFFOHE) of any support PRN provided the CESC client from oe October 2014 to January 2015. }was not aware of any CESC request to delete, wipe or shred their email records (U/@U2) At this noint in the interview, Agents displayed PRN provided records and email from the March 2015 timeframe] [provided the following information: oe (U/FOBO) In March 2015, when various media outlets reported a private email domain and server used by HILLARY CLINTON, i idea of hiring a thi yy S to conduct penetration test serve! recommends Bre from a company named| but the testing ultimately did not occur. ba Investigation on _0572372016 ___at_Denver, Colorado Bre File# 2 44 Date dictated _N Be By peo pre {Wis dosnent ens ede econendaon or consis ofthe PA, Ish prope of be PB ands aad you geo | and its contents are not o be distributed outside your agency. FD-302a (Rev, 1046.95) Continuation of F302 of Interior | ____. on o7as20ts. Page — (U/APOY®) In March 2015, recalled PRN employed travelled to the Equinix data center, but did not know the purpose of the trip. (U/POLO) After Agents displ i dated March 09, 2015 where CHERYL MILLS. discussed preservation of materi {could not recall any other request by any entity to preserve CESC related d alled receiving some guidance by PRN attomeys to preserve data, but could not recall specifically. (UeHe: ollection of a specific conference call on March 25, 2015 or March 31, 2015 wi id recall conference calls with CESC that were run by PRN’s attomey. stated CESC never requested their email content by deleted, wiped or shredded. (uiFSGe]__—__ vas unaware of any successful computer intrusion of the CESC server. (U/MO8O) Notes of the interview and documents displayed te ____] will be maintained in a FD340 envelope and filed with the captioned investigation, bé PIC be Bye be BIC be Bre be bre BS bre . ALU TUFDRRATION COUTASHED wy Sof SEREIN Ts (aCLASSTF TED UNCLASSIFIED//Fe0e TATE 10-08-2016 BY 137089794 NSICC FID-302a (Rev. 10-6-95)- oo FEDERAL BUREAU OF INVESTIGATION Date of wanseription 030372016 home addres . ‘was tnterviewed at the law offices of Bryan Cave LLP, 1155 F Washi; feral Bureau of Investigation (FBI) Special Agent ( bs id SAL Department of Justice attorney Jane bre counsel ‘ere also present for the interview. After being advised of the identity oF the interviewing agents and the nature of the intervie PS provizes the following: (Usreee)[__] first met President WILLIAM CLINTON and Hu CLINTON bed {cuINtoN) in 1997 when he was assigns lo The White House as| |At that time, e received a securit ‘ance after a single scope background investigation was conducted. He served in The White House] I (include traveling with the President, until 2001 when President President CLINTON’ EEG TIN TORS bat Keer Weeping an sie on him and would like him to join drove to their Chappaqua Fie then retumed to Chappaqua where but ended up with many more responsibilities. Te primarily focused on| (uiFexe) recalled an Apple server in thé basement of the CLINTON’s Chappaqua be es not remember when it was installed or by whom. It was a big box to the right of e7G ith no external devices attached. however, it had an internal capability to backup data, A ABEDIN| HILLARY CLINTON, JUSTIN COOPER, AND 1ad email accounts under the owje domain housed on the server. also used the Server as 2 workstation, (UsFeHe)| |did not know of plans to install the server constructed by BRYAN 2s 10 at the fime occurred. The server consisted of three thin black boxes mounted in a rack. Te fescribed himself as not technical and, therefore, could not speak to any details regarding this sever, ° bs Investigation on 02047016 _Washinguon. DC De Fit _| 2 ~ 0 Dae dictated _Né By sal pel : bs bre “This docuraent contains neither secommendatiors nor conclusions of the FBI, [tis the property of the FB! and is loaned to your agency, it and its contents are not toe distributed outside your agency UNCLASSIFIED//P686 \ onctasstetan//soue FD-302a (Rev. 10-6-95) Continuation of FD-302 of, ye On 02/04/2015 , Page 2 (uyPORe| fend nara Tecall escorting anyone from Platte River Networks in June 20:3 into the Chappaqua residence to remove the Server described above, (QFOUO) HILLARY CLINTON’ office was on the third floor of the Chappaqua residence. ‘After she became the Secretary of State, the State Department (State) converted it into a sensitive rnted information facility (SCIF). During the installation of the secure lines for the SCIF, tood at the door as an escort for the technicians. After that conversion, CLINTON was the only one whe had the combination to access the office until it was decommissioned one to two weeks after her departure from State. It contained approximately three phones installed by State. believed all secure phones and described them as a black STU phone, a yellow phone, and a white phone, lid not know the differences in the phones. The office al CLINTON’s non-secure desktop computer, a shredder, and a secure fax machine. initially stated he only entered the SCIF once or twice, when CLINTON was present, to remove trash. (umeve_____Jater recalled a procedure established by ABEDIN witl|____h the beginning INS tenure af State for situations when CLINTON needed assistance wih the secure fax. Whe ‘was notified by Stas personnel of an incoming secure fax, he would locate CLINTON, Tallow Fer to the SCIE, oni assist as needed with the incoming fax. He was never in the SCIF to teceive a fax without CLINTON present ard never physically picked up any of the documents received. Ifthe fax was not working, State Would sometimes send th documents or a diplomatic pouch to the Chappaqua residence, On those a escort the courier to the door and the courier would hand the documents or pouch directly to CLINTON. fio also toordinate the repair of the fax when broken. (U#POBO) ABEDIN or CHERYE MILLS would sometimes notifi the Presidential Daily Brief \d be coming via secure fax to the residence. As described above with other secure tee locate CLINTON ith the incoming secure fax. The PDB was also hand carried fo the residence on occasion a a escort the courier to CLINTON. (uie@4e[__lnesigdically ceceived emails from ABEDIN with attached documents intended for CLINTON] would print the documents and give them to CLINTON, but does not know what happened to the documents after CLINTON was finished with them. Last Name Unknown handled similar duties at CLINTON’s residence in Washington, DC. (W/POVE) CLINTON had sev erry devices over the course of time, When had issues with one of them| lwould ask COOPER for advice on how to fix it ieved CLINTON had a State BlackBerry, but did not recall a secure mobile phone. (UiFeB®) did not recall setting up an Apple ID or iPad for CLINTON. (uiteve) joa ‘ot recall a secure phone in CLINTON’s bedroom, UNCLASSIFIED/ /POB® bé bre be BIC be bre be bre bs BIe BS pre bs bre be BIC BS + BIe ALL INPORIATION OOUTAINED. HEREIN 18 ONCLASSLEIED TATE 10-08-2016 BY JS778n796 WSICG ED-302a (Rev, 1046-95) le FEDERAL BUREAU OF INVESTIGATION Date of wanseription _03/23/2016 ] caier Bx ee viewed ab Ais la nt, is and his email address is was advised that the FBI had identified 37 login attempts to the Al uD account of har22@cli mail.com, originating from three | owned IP addresses. was provided with the IP addresses that made the login attempts. After being advised of the identitie: interviewing Agents and the nature of the interview, Do feovrtsca the following information: ag_approximately| employees at their main headguarte iti in other ba locations. The} bs wovide pic has a large customer base Tneluding 7 components. bs rovided the Agents with a demonstration of th on_2 laptop in his oftice | 1 others. That data is then ve bre [[ “Jprovides theiz clients with two basic services: 1) their security platform can be uséd to link and or current social bs media information on the Internet; and 2) can provide on-going >7¢ social media monitoring for their clients explained that the >7E vs ‘investigation on 03/23/2016 al raeo _ Revere ~(Y _ pate dicted wa BS DIE By Sal ‘This document contains neither recommendations nor conclusions of the FBI. Itis the property of the FBI and is loaned.to your agency: it be and is contents are nol to be distributed outside your egency. bie Bé HD-302a (Rev. 106-95) Ie Continuation of 70-302 of _Inerview of ]____. on ppizavz0is. Page ___2 monitoring service rts for new social _media posts be relating to current Additionally, provides that bc same service for all United States Department of Commerce employees, P7E whether they are aware of it or not. Along with searching for ba b6 bre confirmed that two of the three IP addresses shown to him belong to stated that the third IP address may have bee i that it was no 2: be The is assiqned to be bre does not maint: their clients. be BIC then showed the Agents a screen on his laptop, where the username field was displayed without a corresponding password field. To the best of[__] recollectioi as not hired by pe HILLARY CLINTON or anyone on her behal£. etributed the login e to being ed by one of their clients, utilizing. the platform. left 2he interview for a brief moment in order to verify that was not conducting any continuous monitoring services for AM PTOI. "then he returned, confirmed that they are not. stated that he had a co-worker of his search for CLINTON’s nam atform. In order to protect the FBI’s inquiry at had the co-worker search for CLINTON’s name in the system, along with the names of two additional current Presidential candidates. The results were negative on all three searches. ED-302a Rev. 10-6.95) CCostinustion of FD-302 of _ Interview off 3 be bre was then informed that the hdr22@clintonemail.com email account was i in a NEW YORK TIMES article on March 02, 2015, fe the login attempts occurred on the following day. 6 tated that this made sense to hit. Given that information, he theorized that the login attempts were likely made by one of their bre “good guy” clients, possibly to conduct a damage assessment on the jal media footprint associated with that email adc ever, stated that he could not verify his theory, as had no tional data to corroborate it. is amenable to future contact with the FBI. bs BIC ALL INFORMATION OCUTAINED BEREIU 18 UNCLASSIF IEC ERIE 10-08-2036 3Y anne D-B022 (Rev. 1046-95) werce -l- FEDERAL BUREAU OF INVESTIGATION Date of anseription 04/14/2016 , Chief Executive Offic ai is place of employment, telephone number ant his email address is Rise present for this interview was FBI SA as advised bS ure of the interview was to determine whether or not bre had performed any penetration testing on the Glintonemail.com domain. after being advised of the identity of the {nterviewing Agents and the nature of the interview, [__] provided the following information: di perform any penetration testing for the 6 clintonemail.com domain. recalled that the clintonemail.com domain B76 was previously hosted at the PLATTE RIVER NETWORKS (PRN) Tnteryet i i wer, Colorado. is good friends with who is at PAN. Yecalled speaking with| aBOUE doing penetration testing on that domain, approximately six months prior the large media coverage of the private server. jprovided security recommendations for the system; however, actual penetration testing did not ultimately occur. maintains a working business relationship with 6 PRN. Tf a PRN customer wishes to have penetration testing performed on = »7¢ their network, PI that customer to Correspondingly, will refer their customers wish to harden theiz network systems subsequent to a [oo benceracion testing assessment. als: Jeverages technical resources at PRN for other projects, including incident handling and forensic analysis. The two companies compensate one another with commission checks. b6 b7c Investigation on _ 04/12 ce lo Filed be By sal bé “This document contains neither recommendations aor conclusions ofthe FBL. {2 is the propery ofthe FBI and is loaned t9 your agency: it and its contents ae not to be distributed outside your agency. bre D-S02a (Rev, 1046-95) Contination of FD-302 of _Inervicw o| On puI22016. Page __2. bs bie recalled sharing se’ emails with PRN employees regarding Be the clintonemail.com domain PS ositariy dealt end but, pre remembered thap_there were a couple of other PRN employees included on the exchanges. 1 is office and printed out several email between him ant Those printouts are enclosed for the file in a physical 1A envelope. never had access to the clintonemail.com domain, 6 nor do tl any of their company services on PRN networks. The pre extent of interactions with PRN employees, rélated penetration testing, and the clintonemail.com domain are documented in the email exchanges that| provided during this interview. While reviewing thé emails provided by sal ohgentitiea bs public news article, where an individual named bre had utilized a scanning tool called FIERCE to - Tdentify the addresses used for HILLARY CLINTON: - nal email server. provided that the referenced provided that ormerly wanaged an Internet blog where hé posted new h: Exploits on almost a daily basis. A few years ago, however] went dark and discenti publishing his fin D provided that goes by the name of i = hacking community- has known for sever, rs. The two of them share = PS a passion for music. Fecalled that a pre business that put on Targe- Oncerts, which would rival that of a Madonna-sized concert. the i bond. AddieionaTTy| recalled that a blimp company that provided aerial caverage over large public events. ecalled meetin: at a Colorado technical event, be which Téeferred to the event as a leads pre event, which was a technical expo in Colorado where information technology experts d exchange ideas and fork with one another. During that event, spoke_on_a panel with and a US SECRET SERVICE Agent, named During-THerodieticns with one jor to the event, ‘called USSS SA stating to that he had recently served a warrant at PRN. surmised that statement to relate to the on-going investigatio INTCN’ s: email server. Agent Note: A follow-up call to USSS SA identified FD-802a (Rev. 10-6-95) Continuation of FD-302 of Interview of Gn 08/12/2016, Page _3. warrant referenced in that conversation was served in support of different matter. as a “good guy”, who is caught in a bad situation Tas stated his frustrations t regarding the CLINTON email investigation. direct impact on PRN’s business, and that they have joney in legal fees related to the matter. is concerned over the negative publicity Teceived in the news media. Additionally, It has had a spent a large Primarily, that PRN has PRN has been asked to step stated that out of certain requests for proposals (RFP’s) as a result of the investigation. In addition tof 1. [Jas so had limited interactions with PRN" Last Name Unknown (LNU). However, has been primary point of contact at PRN. When asked whether or not utilizes ene social media cyber security product, ated that they do nO [fs amenable to future contact with the FBI. bs BIC bs Bre be Bre bs BIC bs BIC ALL INPORIATION CONTAINED HEREIN 13 UNCLASELTEC EME io-n8-2016 BY ca7sasT4 werce FD-302a (Rev, 106.95) Le FEDERAL BUREAU OK INVESTIGATION Date of transcription 24/2015 6 date of birth (DOB) } was Bre inti Bur i invest icar (FEI) Special agents (sn, and at the law offices of DAY, Tocated at One Canterbury Green, Stamfor: °. resent for the interview were DAY PITNEY attorneys and | After being advised of the identi Tviewing Agents, and the nature of the interview, provided the following information: BS ye is currently employed as at DATTO Tocated_at_ i101 Merritt 7, Norwalk, cT06l and osition for ior to that, was ee worked — ae the DATTO is a company that provides products and services to small businesses related to cloud storage and disaster recovery, DATTO had an established relationship with PLATTE RIVER NETWORKS (PRN) and provided them server back-up and recovery services for some time. DATTO’s relationship with PRN was already established in 2013 when PRN acquired a new contract to manage an email server with a client known to DATTO as CRSC. At the time, DATTO did not know who PRN’s client CESC was. When PRN reached out to DATTO in. May 2013 to provide back-up services for the CESC client server, PRN requested a slightly * different service from DATTO than they normally request. Typically, PRN would request that DATTO back-up remotely to DATTO’s secure cloud. For the CESC client server, PRN requested that the server be backed-up Investigation on 10492015 t__Samind, CF ‘sa ‘bs Pie 302 - 37 Date dictaed_N/a BIE be By ss sal 6 BIC ‘This document caniains neither recommendations nor conclusions ofthe PBL Is the propery ofthe FBI and is loaned to your ageney and ts contents are not to be distibuted outside your agency. PD-302a (Rev. 10-6-95) Contamina st7pst26f tassel] en ats. ae jecally and privately. At the time of this request, it was not only a new request for PRN, but a non-standard process for DATTO. In order to affect the private, local storage needs for PRN's CESC ¢lient, PRN ordered a SIRIS 2000 device from DATTO, but forgot, or did not know, to also order the private node that the data would be routed to and stored on. Because of this, the default on the DATTO configured STRIS 2000 sent the CESC server back-up data remotely to DATTO’s secure cloud and not to a local private node. This default configuration on the SIRIS 2000 has since been changed. be re stated that PRN must have known data was being logged in 2 cloud and not on a local private node. As evidence, stated the partner portal, that PRN had log-in credentials to, ature di! ing backed-up data and options to delete cloud of delete local stated PRN would have seen their back-ups under delete cloud, NdGvETOnally, Ties shown a document provided by b6 DATTO indicating email records were manually deleted from t) pie secure cloud back-ups of the PRN CES¢ server in March 2005 [| stated that it couldn’t have been a DATTO employce that deleted those email records, because there would have been a work ticket indicating as much. Con the IP address: sociated with the March 2015 ba eistions, | f thoughe was the DATTO relay server © ection and Was a local host connection. ee stetes PRN had log-in Credentials on the partner portal that tied to one employee, so he did not know who from PRN logged —ae sent to the DATTO cloud through Secure File Transfer jz2) from the local DATTO device purchased by the client. TO devices, for different. clients, are synced to one node data storage. Each DATTO device is segmented on’ that node tes to a directory paired. with the corresponding device. he servers is partially encrypted and a password would be cess remotely. The DATTO server farm is housed in Pennsylvania, multiple levels underground, in a secure facility. In order to access the facility, you must be a client there and process through security, which includes a biometrics scan. The cages that house the servers are also locked. FD-3028 Rev. 16-6-95) be re Continuation of FD-302 of _Imerviw off DATTO virtualizes systems locally on the DATTO appliance or remotely in the DATTO secure cloud. As part of this process, an automatic test is conducted te verify the virtualization where screenshots of the windows login screen are sent to DATTO clients. Many of DATTO’s clients, to include PRN, would déccasionally get “backup verigic: failure” notices showing their DATTO device was 6 unbostable | indicated this notice occurred very frequently and bre almost alwaYSWSS"an issue involving the virtual environment and not DATTO actually failing to maintain back-ups of the associated servers. This issue was usually resolved with a handful of solutions to include chenging drivers and controllers or lengthening windows for verification. On O8M2/2013. Page DATTO never altered or configured the retention settings vegerdirg the period of time or frequency that the PRN server was backed up. The retention settings are set by the client. On 08/13/2015, after the CESC client was known to DATTO and lawyers became involved regarding the retention, preservation and production of records regarding the CESC client, DATTO shipped a new SIRIS 2000 device to PRN. The impetus to the shipment was the realization that the SIRIS device originally purchased by PRN was not encrypted. The provision of the new SIRIS 4 as initiated by, be DATTO and brokered by their attorney,| DATTO provided the bie device to have increased security while also ensuring continuity of operation on the server, bs [J etatea the DATTO secure cloud is frequently scanned and Bre he has ng Knowledge of any intrusion or deep penetration of their systens. stated the best place to look for network intrusion is the sySteW Togs. be Teer | 20"2 discussed federal records retention or classified BIC info; ‘ith any representative of PRN or CSC. . ALL IRFORNATION CONTAINED PU GORS Rew. 10-698) HEREIN TS IRICLASSTFISD DAME 10-08-2016 BY J3TaBsTOs NSICG FEDERAL BUREAU OF INVESTIGATION Date of eansetiption PRION, Records Management Records Information and Diesemination Section, Winchester, was texviewed at Beadpiexters, Washingron, D.C, After being advised of the identities of the interviewing Agents and the nature of tha intescieus [| proviaed 4 informat iva: . 6 des at Be 2 5 been employed the Records Management Division fox the past Approximately 6 weeks ago, received an emaii fxon[__| of the Depart of State (SATE) Freedon of Information Ret ng (FOIA! saction. email enclosed copies of 5 email commmicabions pre from former Secreuary of State HILLARY CLINTON’s private email account which STATE believed may contain “FBI equities.” STATE requested the FRI conduct an appropriate clasoificatic jew of the smalls pric: to theiy scheduled FOIA public release —- sed these § oma: were tranenit Rin on a clacaified email syecem but were aarked unclassified. recognized that at least 1 of the emails appeared classified and fo the Gounbert 23 bs pre yelayed thase findings bo STATE as par protocol. bs Appre tely i waek later, STATE’s Office of Legai Counsel onc) »7¢ coul@ HOt recall the name of the caller, According to ouc,[ ] 3 does not have an official government and therefore it believed the =I could not classify a document based on the PG caveat. OLC also advised that they, uot the FBI, are the judge of potential harm to welgn governments and therefore the PSE did iat 2 riche classiiy a document based on those conditions. b3 BS pre as guch remained classified at the BECRET//NOFORN level, Eieely sn BIE ‘This Seg PODS Taher rosorammendavians ner conclusions of the FBI, 1Lis he propesty ofthe FDI wade Found i» gous aad i conan are nat to be dsb guts bre PBs (Rew, 1A) Cinna of POD of tog onan fae 2 bre believed, based on IE GREIRIGHGGS an Original Clasaification Authority {CCA}, that the email vas classified properly and accurate. s eatuer, received a call tro of the International cpetations Division (i0b) of the FBI, sug “pressured” Him to change the classified ema! to unclasai indicated he had been contacked by PATRICI oe KENNEDY, Undernecxetary of State, who had asked his assistance in altering the omail’s classification in exchange for a ‘quid pro gua. at, in exchange for marking the email unclassified, STATE would reciprocate by allowing the FSI to place more Agente in countries where they ave presently forbidden Follewing the above exchange, [7] was summoned to an “all agency” ma at STATE to @isctsas matters perta: i elasgification review of pending CLINTON FOIA materials. eEficial fxom STATE, along with representatives £70 es and other government agencies were present, PATRICK KENNEDY over the meeting. During the conversation, a parvici asked whether any of the emails in question were seit aye contact with KENNEDY remarked, “Well, we’}1 believed this was reference to the FBI‘s categorization of SECRET//NOFORN email which KENNEDY was attempting. to influence. In a privat, ing with KENNEDY following the ail agency meeting, KRNNSDY asked whether the FRY “seo their way to marking the email unclassified?” According to KENNEDY spent the next 15 minutes debating the classification oF the ema, \i. attempting fluence the FBI Le change ite markings. Since Ca continued to assert that the email was appropriately marked sud NOFORN, XEBNWEDY asked who ise in the FBE he could epesk with on the matter xeferre! KENNEDY to MICHAEL STEINBACH, Assistant Director of CTD. [EJ was chen present during a conference call involving KENNEI and STEINBACH in which KENNEDY continued to presgure the FBI to change the classified markings om the email to unclassified. STBINBACH be refused to do so. Prior to ending the conversation, KENNEDY asked 7c whether the BI ox STATE would conduct the public stacements on che STRINBACK adviced KENNEDY that the FBI would not comment cly on the matter. The conference call ended and, according to the Associated Dregs {AP} published the stcry within the nex Secretary of State CLINTON appeared in fronts of the pri P-3UBs (Ra 10-695) Continuation of P32 of __ tse shortly thereafe private email server, ae, a to deny having sent classified emails on her believes STATZ has an agenda which involves mini classified nature of the CLINTON emails in erder to prote interests and those of CLINTON. Sisc @ above incidents, received approximately 8 ox 9 wore emails from STATE involving FBZ equities, 1 of which he believes way be clagsified seCRET//NOFORN. bs BIC 6 pre ALL INZORUATIGN CONTAINED eo sma tten 18.98 BERET Tf UNCLASSTSTEE FO-HR6 Re, 1-95} UATE 10-09-2018 BY S37988T94 NSICS “1 FEDERAL BUREAU OF INVESTIGATION Date of rameeription 0995205. (UiPORO) “oderal Bureau of hwestigation (1 re International Operations Division (OD), who is current Siiemeat onf was interviewed in person Is i vial Aus “Agent (S | at 4 tocated at er AL ao ivised of the a OF tie interviewing Agents and the nature of the Tateriew] |provided the following information: bs (UPR) As Jinteracied with PATRICK EB. KENNEDY, US. ee Department of State (DoS) Under Secretary oF State for Management. land KENNEDY’s relationship was professional. The nwo got along, but did not agree on Many manters related to the FHE's role and authority overseas. (UFORO) In late Ma wv fune| Found a note on his desk indicating eo NEDY contacted him. ae SEprINod, as both his Assistant Director (AD) JOHN $ and Executive Assistant Director (EAD) RORERT ANDERSON, bad both been trying to contect KENNEDY Sor months without response. CHEETE) Whea| fcturned KENNEDY’s call, KENNEDY askeal Be assivance ic changing @ claseilicalion of PDI ioformation contained in an ezmail CE provid swith the e-mail, however, he told eeu or FBY's Records Management Division (RMD) as the oné That told KENNEDY the dccument was classified, (Ui/PO80) KENNEDY told that the PBI's cinssification of the e-mail in question Be caused problems for KENNEDY and RENNDDY wanted to classify the document as “B9.”, KENNEDY farther stated that the “9” classification wonid allow him to archive the document in th basement of DoS never to be seen again. waa nat sure of what KENNEDY meant by a “BO” ification [Note; B9 may bea reference tora FOIA exemption). (LUFPOEE) Not yet knowing the e-muil’s content, told KENNEDY ke would look bs inyto she e-mail matter if KENNEDY would provide authority conceming the FBPs request to increase its pre personnel in frag vosigion ORAS ot_ Waist DE bo tig LP a eee Date tated bie ‘Tais dacemom contsins nether secommendaions nar coachasions oF tie EBL. tis the propeny oft and is contents are not tobe distrib guide vouraueney. UNCLASSIIED eS KD 302 (Rev, 1046-98) On gSAOSENS. Page (UFOHE) Followin, uversation with KENNEDY lcontacted| tc discuss the e-mail of concer, oid fhe e-rnail of KENNEDY’ concerns was classified by the FBE Counterterrorism Division (CTD) ‘ks on the US. Consulate in Benghazi. Following his conversation wi yatacted KENNEDY sind infoned him that there was no way he could assist EDY with declassllying the information contained in the e-mail. WH old ANDERSON and BOLES about KENNEDY'S declassify the e-mail and| esponse denying the ability to do so, nowever a] did not discuss the content of the e-mail with them. (UPOHErA gent notes are maintained ina TA envelope. 6 bic 6 pre Bs BTe FD-302a (Rev. 10-6-95) Sol_niromarten covets 4. WEREIU Ts UNCLASSIFIEC DATE 20-05-2026 BY J27285T94 NSICG FEDERAL BUREAU OF INVESTIGATION Date of wanscription 1/19/2016 weau of Investigation (FB) Special Agent ( VFOVO) On December 16, 2015| Owner and Chief ae Also present for the interview was| attomey] ing advised of the identity of the interviewing agents and the nature OF The interview Provided the following: (ur jounsel ale ving in Chicago and currently has a family of approximate Tployees comprised oF Full and part-time employees, as well as subcontractors. In early 2013) a business associate of contacted her about 4 client who needed a new email server. Atte] lexprs interest in the project and understood the clients » were HILLARY AND WILLIAM CLINTON, ut her in contact with CHERYL, A few othe: rsonnel assisted with invoTeing and Technical aspects of the contract, we Na most of the work Herself primary contacts were MILLS and BRYAN PAGLIANO; MILLS helped prodj posal and PAGLIANO assisted in developing the requirements for the server architecture. started the discussion by providing a range of options from low-cost Gmail to a more sophisticated private server. She understood the client’s impetus for the project to be teliability/uptime and security in the wake of a siniation where the client's private server housed in their residence experienced one we ywntime because of a storm, The client selected the private server options provided by Backup systems were planned for Phase 2 of the project, but was not involved in those decisions. (U/FO8O) As part of the initial conversations with PAGLIANO and MI oe at cone point the domains and number of email accounts on the server, but could not recall hose details Additionally Ina xno knowledge of email servers owned or operated by the client prior to the ‘equipment mamntamed by PAGLIANO. (U/FOBO) After the client selected a private serve contacted two firms she had prior experience with: GRAVITAS, a large Information Technoloy nd PLATTE RIVER NETWORKS @ is After the client selected PRN| worked with MILLS, PAGLIANO, and| fo develop the details of the project ]was onty involved in one or wo metas elieved he was curious about the process, PAGLIANO handled the technical Jnvolvement gradually faded out. The client occasionally reached out for assistance an Ip where she could. Payment for her services was billed for the entize task, not houzly, so did not charge any fee for this assistance on project and MILLS handled strategic concerns. As PRN took over day-to-day mat Would hal Investigation on —_12/1672015 at___New York, NY nics [Jno = 4 Date dcuted__ NIA wad fb fron, ‘his document contains neither recommendations nor conclusions of the FBI, Is the property ofthe PH and is logned to your agency: it and its contents are no! to be distributed outside your agency, bs BIe bé bie bs BIC pyc b3 BIE BS pre

You might also like