Report of Investigation Agency Access to the Ssci Shared Drive on Rdinet

Read from the scan by GLM-OCR; expect the odd misread word.

## UNCLASSIFIED/DRAFT ATTORNEY-CLIENT PRIVILEGED

January 15-27,2014

Memorandum for the Record re: partial timeline of events surrounding discovery of SRT documents on RDI NET

The following is an outline, and does not purport to be complete.

By Jan. 9, 2014, I had developed reason to believe that the SSCI staff performing the RDI review had obtained unauthorized access to classified, draft, pre-decisional, privileged documents resident on the Agency "side" of RDI Net. I was aware of explicit admissions from staff that they "knew something" about the documents (including a comment made by staff member at Caroline Krass' confirmation hearing to the effect that he "have seen [the Agency's] real response" to the SSCI RDI Study), as well as public statements by members of the SSCI to the effect that they had seen the documents. $ ^{1} $ Moreover, I was reminded by my staff that there had once been a "hole" or breach in the firewall dividing the SSCI side from the CIA side of RDI Net (discovered in 2012). At that time, when confronted with a document that should not have been in their possession, SSCI staff members had assured me that they did not inappropriately access any other documents on the Agency side. By January 9, my staff had conducted a check of our logs that chronicle documents the Agency had appropriately provided to the SSCI and found no SRT documents referenced within them. As a result, I had good reason to believe that Committee staffs' 2012 assurance was a misrepresentation.

I am ultimately responsible for ensuring the security of RDI Net system—a CIA owned and operated system, located in a CIA facility and subject to CIA regulations and applicable US laws regarding classified information—and for maintaining the safety of sensitive CIA records placed upon it. As a consequence, I asked IT professionals within the Office of Detainee Affairs (ODA) to determine whether the SRT documents were present on the SSCI side of the system. In so doing, I carefully considered what was known to me regarding the Agency's historical representations to and agreements with the SSCI concerning the general principle of refraining from accessing the SSCI side of the system. Those representations included an explicit reservation of authority for Agency IT officers to access the SSCI side to address precisely these sorts of situations. I was aware that SSCI staff had been briefed on the fact that the Agency would conduct security monitoring of the system. I also was aware that Agency IT officers had repeatedly utilized this authority to confirm that documents had been appropriately placed on the SSCI side of the system, a practice that SSCI had knowledge of and fully and repeatedly consented to. I was mindful that Director Panetta, and others, had clearly stated to the SSCI that our respect for their substantive privacy did not mean that we were abandoning our right to administrative access or an audit capability to ensure the security of the system and to protect CIA information, the latter an obligation imposed by statute. As a consequence, I did not interpret any representation to SSCI as requiring that we turn a blind eye to possible violations of Agency regulations or federal law. To the contrary,

(b)(6)

(b)(7)(c)