Report of Investigation Agency Access to the Ssci Shared Drive on Rdinet

Read from the scan by GLM-OCR; expect the odd misread word.

(b)(3)

(b)(6)

(b)(7)(c)

SECRET//NOFORN

(b)(3)

(b)(3)

(b)(6)

(b)(6)

(b)(7)(c)

(b)(7)(c)

a report dated 17 January 2014: Office of Security, told OIG (b)(3)

that she first became aware of the SSCI events on 15 January 2014, when contacted her (b)(6)

at home to inquire what it would take to conduct a security review. OIG confirmed that (b)(7)(c)

was not present at the 14 January 2014 meeting with D/CIA Brennan, and was not (b)(3)

aware of the standdown order. stated that she spoke to who explained to (b)(6)

her that SSCI staff accessed data they were not authorized to access. stated that she (b)(7)(c)

spoke to on 15 January 2014, and that was planning to work with on a joint security review of the RDINet. On 16 January 2014, emailed to request concurrence on the plan of action developed by the Office of Security. Also on 16 January (b)(3)

received an email from stating that they were on "stand down" for a join (b)(6) (b)(7)(c)

security review. On 17 January 2014, responded to request for (b)(7)(c)(b)(3)

concurrence "...there has been a new development" and requested, "If you can come totl (b)(3)

Director’s Office around 8am that would be ideal." OIG did not find any response to (b)(6) (b)(7)(c)

request for concurrence.

42. (U//FOUO(b)(7)(c) sent an email to Higgins and copied on 16 January 2014 and stated that SSCI Chairman Feinstein would be sending a letter to the D/CIA the following day requesting that no forensic examination of the SSCI "network" proceed. On 17 January 2014, Chairman Feinstein wrote to D/CIA Brennan and requested suspension of access to the computers and networks used by the SSCI and any forensic investigation planned by the CIA. Chairman Feinstein explicitly stated in the letter that until she could consider the matter further, D/CIA Brennan did not have her agreement for any investigative activity.

43. (U//FOUO) told OIG that on 16 January she instructed the Cyber Blue Team to review the RDINet stated that she did not seek approval because it was CIA information on a CIA network. further stated that this was a normal function for the Cyber Blue Team, (b)(3) capable of performing such a review. stated that she did not feel that she was out of coordination with CIA leadership at any time. On 16 January 2014, emailed and advised her that the SSCI Chairman was drafting a letter to the Director of the CIA requesting to stop the entire plan of action for the joint review. described the "full plan of action" to OIG as the imaging of RDINet and a full forensic review and stated that she interpreted this as a request to stop the joint forensic investigation. did not believe that the request applied to the review of (b)(3) or that the Cyber Blue Team review was akin to forensic activity.

44. (S//NF) On 17 January, the Cyber Blue Team met with to review the forensic generated by the SSCI staff, including reconstructed emails between SSCI staff on the SSCI side of RDINet. The Cyber Blue Team Report detailed the team's evaluation of RDINet system data surrounding the documents in question. The report stated that a "Congressional user" was able to navigate directly to a "shared directory" and access documents never intended for dissemination to "Congressional users." The report stated that the user first accessed the directory on 9 November 2010, and copied the data contained