Report of Investigation Agency Access to the Ssci Shared Drive on Rdinet

Read from the scan by GLM-OCR; expect the odd misread word.

## UNCLASSIFIED/DRAFT ATTORNEY-CLIENT PRIVILEGED

of times. I reported this finding to and the DCIA. I advised the Director of the importance of determining the full facts surrounding this matter before discussing it with the Committee or the WH, and he directed me to pursue all available options to determine how the documents came to be on the SSCI side of the system, as a necessary predicate to any broader discussions. I noted for him that I did not run an investigative organization, but that I could ask the ODA team to try and explore how SSCI could have achieved access to the documents.

Saturday afternoon, Jan. 11, I took a call at home from the Director, who informed me that he had discussed the possible security breach with WH COS Denis McDonough. The Director reiterated his desire to inform the Hill of the breach as soon as possible, and emphasized that I was to use whatever means necessary to answer the question of how the documents arrived on the SSCI side of the system so that his communication with the Hill could occur. I viewed those instructions as authorizing me to gather the necessary Agency personnel and components who would normally be involved in such an effort. He also tasked me to generate a set of draft talking points for that meeting with Committee leadership. I cautioned that discussing this matter with the WH, at this stage, was problematic, as it could later be viewed as WH interference in a potential criminal investigation. He thanked me for my efforts, and reiterated that he wanted answers as soon as possible...meaning days, not weeks.

On the morning of Jan.13,2014,after informing elements of Agency leadership of the issue, I was called to a meeting chaired by the EXDIR. Also in attendance was C/CIC, (b)(3) D/OPA, D/OCA, and others. (b)(3)

attended briefly. During the meeting I described the events to date and the Director's instructions. I indicated that neither I nor ODA had any capability to conduct the sort of forensic work necessary to answer the DCIA's question concerning the provenance of the SRT documents. C/CIC explained how (b)(3)would be able to perform the work. No one in attendance voiced any objection to (b)(3)aking on the assignment; indeed, there were unanimous expressions of support for the proposition that the Agency needed to determine whether the documents had been intentionally taken or if there was some more innocent explanation for their presence on the SSCI side, prior to discussing the matter with the SSCI. I advised that the matter should be placed under the control of the Office of Security. I also stressed that this work should be done without reference to the content of any documents on the SSCI side; that no substantive review of any document had been performed, should not be performed, and need not be performed in order to conduct thi(b)(3) activity.

Later that evening, the aforementioned group met with the Director to discuss status of efforts to determine the provenance of the documents. Before we could begin a substantive discussion, the Director expressed irritation that CIC was involved in the effort, stating that the "optic" of CIC performing the (b)(3) work was poor. Several attendees attempted to explain that (b)

but the Director continued to focus on the "optics." I informed the Director of my view that the conduct in question could be criminal, and that the Agencybased solely on its current understanding, that unauthorized documents existed