Showing posts with label Classification. Show all posts
Showing posts with label Classification. Show all posts

December 30, 2024

Treaties on the exchange and protection of classified information

(Updated: February 6, 2025)

According to parliamentary records from The Netherlands, almost all western countries have signed, or plan to sign treaties on the exchange and protection of classified information. While many of them are public now, they replace secret agreements which date back to the 1960s.




Sources

For The Netherlands these treaties can easily be found via a new open source viewer called OpenTK, which builds upon an API provided by the staff of the Second Chamber (Tweede Kamer) of the Dutch parliament.

The most recent one is the "Treaty between the Kingdom of the Netherlands and the Kingdom of Sweden on the exchange and mutual security of classified information" that was signed in Stockholm on January 18, 2024. In November it was sent to the Second Chamber of parliament for silent ratification.

For the United States, some similar agreements can be found on the website of the Office of Treaty Affairs of the State Department. One example is the "Agreement Concerning Security Measures for the Protection of Classified Information" between the US and the Slovak Republic from May 13, 2022.


Purpose

The purpose of these treaties is to ensure that when classified information is exchanged, it gets the same level of protection in the country of the recipient. Thus they provide a safeguard for cooperation between government agencies (including law enforcement, intelligence and security services as well as the armed forces), but also between governments and corporations, for example when the government of one country grants a classified contract to a company in the other country.

The actual cooperation, whether a long-term partnership, temporary project or military procurement, is regulated by a multitude of treaties, agreements and contracts, which are often classified or at least confidential. For example, the collaboration between the NSA and other signals intelligence agencies is governed by secret bilateral Memorandums of Understanding (MoU), with details that can vary from country to country and from time to time.


Origin

A Dutch parliamentary document shows that bilateral treaties on handling classified information apparently go back to the 1960s: an agreement on this topic was concluded with the United States on August 18, 1960, which was supplemented on April 6, 1981. However, at the request of the US, they were kept secret and were therefore not submitted to the Dutch parliament for ratification.

In 2017, the US agreed to declassify these earlier agreements, partly because The Netherlands no longer saw a compelling reason for keeping them secret. They were replaced by a new, public treaty that was signed on June 22, 2018. The aforementioned treaty with Sweden from January 18, 2024 also replaced a previous agreement that was signed on October 29, 1984.


Contents

All these treaties, both from The Netherlands and from the United States, contain more or less similar provisions, including:

- Classified information has to get a level of protection which is at least equal to the protection in the originating country.
- Each party designates an agency that acts as its "National Security Authority" (NSA) which is responsible for the implementation of the treaty.
- A comparison of the national classification levels, which in almost all western countries follow the British/American system of Restricted, Confidential, Secret and Top Secret.
- Access to classified information has to be limited to people with a need-to-know and a proper security clearance.
- Classified information shall not be released to a third party without explicit prior authorization by the originating country. This is the so-called "third party rule".
- Requirements for the transmission of classified information, whether in hard copy or electronic form.
- Classified information shall be stored in properly secured facilities, only accessible by authorized personnel.
- Verification of the security measures implemented by the other party and informing the other party about security standards.
- Inform the originating party about any loss or compromise of its classified information.
- How to conduct in case of classified contracts.

All these provisions are in rather general terms, further details can be agreed upon by the respective National Security Authorities.


Bilateral treaties

According to parliamentary records from the past 15 years, The Netherlands has made preparations for treaties on handling classified information with at least the 22 countries listed below. When the treaty has already been signed, its date has been added:

- Albania
- Australia
- Belgium (November 5, 2019)
- Brazil (October 9, 2023)
- Bulgaria
- Cyprus
- Czech Republic
- Estonia
- Finland (February 22, 2022)
- Latvia
- Luxembourg
- Malta
- Norway (November 7, 2023)
- Ukraine (February 5, 2024)
- Poland (February 10, 2023)
- Portugal
- Romania
- Slovakia
- Slovenia
- Spain (November 23, 2021)
- Sweden (January 18, 2024)
- United States (June 22, 2018)

This list contains most of the member states of the European Union and NATO, except for Brazil which is of course a member of neither, but does have a considerable defence industry. In 2022, for example, the Dutch Armed Forces ordered new military transport aircraft from the Brazilian manufacturer Embraer.

Interestingly, the United Kingdom, Germany, Denmark, France, Italy, Greece, Turkey and Israel are not included in the list, despite the fact that they are important countries when it comes to military and intelligence cooperation. Given the long and close relationship with most of these countries, it seems not likely that negotiations have not yet started, so maybe the treaties with these particular countries are still classified.


International organizations

Besides the bilateral treaties between states, there are also ones between states and international and supranational organizations.

On August 19, 2002, for example, the countries that participate in the European Space Agency (ESA) signed an agreement with the ESA for the protection and the exchange of classified information. Undoubtedly there will be a similar agreement with NATO and one is also being prepared for the OCCAR, a European organization for collaborative armament programs.

The European Union has decided to sign "Agreements on security procedures for exchanging and protecting classified information" with 17 non-member states, ranging from Russia and the United States to Iceland and Liechtenstein(!). There's even such an agreement between the EU and the ESA, which was signed on May 22, 2024.

These international organizations have their own versions of the usual classification levels:
- ESA: ESA Confidential, ESA Secret, ESA Top Secret.
- NATO: NATO Restricted, NATO Confidential, NATO Secret, COSMIC Top Secret.
- OCCAR: OCCAR Restricted, OCCAR Confidential, OCCAR Secret.
- EU: EU Restricted, EU Confidential, EU Secret, EU Top Secret.




Membership of various military and intelligence groups
(click to enlarge)


Update:
On January 21, 2025, president Trump granted interim Top Secret/SCI security clearances for up to six months to incoming White House officials who have not completed the required vetting process. This could lead to the situation that foreign intelligence partners, on which the US relies for much of its intelligence work, will curtail what they share with the US, out of fear that their sources and methods may be put in danger.


September 21, 2022

The highly classified documents found at Trump's residence Mar-a-Lago

(Updated: July 21, 2023)

This weblog is not only about signals intelligence, communications security and top level telecommunications equipment, but also about the US Classification System, which is equally fascinating in all its complexities.

Recently, an unprecedented photo from the FBI provided a unique look at highly classified documents which former US president Donald Trump stole from the White House and stored at his private residence Mar-a-Lago in Florida.

Here I'll provide a detailed explanation of these documents, as well as where they apparantly came from.



Mar-a-Lago and the highest classified documents which the FBI found in Trumps office



Moving to Mar-a-Lago

On January 20, 2021, former president Donald J. Trump left the White House and moved his belongings to his residence Mar-a-Lago in Palm Beach, Florida. The National Archives and Records Administration (NARA) subsequently learned of approximately two dozen boxes of presidential records that had not been returned to it as required under the Presidential Records Act (PRA).

Late 2021, officials at the archives warned Trump's team that there could be a referral to the Justice Department or an alert to Congress if he continued to refuse to comply with the PRA. Apparently, Trump ultimately went through several boxes at Mar-a-Lago himself and late December, his lawyers informed the NARA that they had found 12 boxes of documents and that they were ready for retrieval.


Donald Trump's residence Mar-a-Lago in Palm Beach, Florida, March 2019
(White House photo - click to enlarge)


15 boxes retrieved

On January 18, 2022, the NARA finally retrieved 15 boxes of records from Mar-a-Lago, containing presidential records and other sensitive material, along with various news clippings and other miscellanea. In its initial review of the materials within those boxes, NARA identified classified documents marked up to the level of Top Secret, including Sensitive Compartmented Information (SCI) and Special Access Programs (SAP).

On February 9, NARA told the Department of Justice (DOJ) that the 15 boxes contained highly classified records that were "unfoldered, intermixed with other records and otherwise unproperly identified." President Biden granted the FBI access to the boxes for examination and by May, the bureau had identified classified documents in 14 of the 15 boxes. In total, there were 184 classified documents, 67 of which were marked Confidential, 92 Secret and 25 Top Secret.


Criminal investigation

Former president Trump then attempted to delay the DOJ's review of the materials by asserting executive privilege over the documents. After the Assistant Attorney General for the Office of Legal Counsel rejected this claim, the FBI launched a criminal investigation to determine:

- How these classified documents were removed from the White House;
- Whether Mar-a-Lago was an authorized storage location for those documents;
- Whether additional classified documents had been removed from the White House;
- Which individuals were involved in the removal and storage of the documents at Mar-a-Lago.

A grand jury was installed and the FBI began interviewing several of Trump's personal aides as well as three former White House lawyers who had been among Trump's representatives to the archives.


Classification markings

On May 11, former president Donald J. Trump was served with a grand jury subpoena which ordered him to hand over any and all documents bearing at least the following classification markings:




These classification markings contain a lot of lesser-known abbreviations, which are explained in my earlier overview of the US Classification System. They are, in order of appearance:

- SI = Special Intelligence (intelligence from intercepted communications)
- G = GAMMA (sensitive communication intercepts)
- NOFORN = No Foreign Nationals
- ORCON = Originator Controlled
- HCS = HUMINT Control System (intelligence from human sources)
- HCS-O = HCS Operations (HUMINT operations and methods)
- HCS-P = HCS Product (HUMINT intelligence reports)
- TK = TALENT-KEYHOLE (intelligence from satellite collection)
- TS = Top Secret (release would cause exceptionally grave damage to national security)
- SAP = Special Access Program (non-intelligence equivalent of SCI)
- NF = NOFORN (see above)
- OC = ORCON (see above)
- FRD = Formerly Restricted Data (about nuclear weapons)
- NATO = Releasable to NATO partners
- S = Secret (release would cause serious damage to national security)
- C = Confidential (release would cause damage to national security)

This list may have been based upon the classification markings that the FBI found on the documents in the boxes that had already been retrieved by the National Archives, but according to The Washington Post, the goal of the list was to ensure recovery of all classified records, and not just those that investigators had reason to believe might be at Mar-a-Lago. This becomes clear from the fact that the list contains all possible combinations of the various markings.


Nuclear weapons information?

Therefore the markings in the list don't say whether or not certain kinds of information were present at Mar-a-Lago. That especially applies to press reports saying that among the things that Trump was still hiding were documents about nuclear weapons, which was likely based upon the FRD marking in the list. Given that this marking is only listed once, there may have been only very few if not just one single document with nuclear weapons information, with many more about signals intelligence (SI) and human intelligence (HCS).

In an affidavit from August 5, the FBI listed the statutory authorities upon which it based its application for a search warrant:

- 18 USC 793(e), the Espionage Act
- 18 USC 1519, obstruction
- 18 USC 2071, willfully removing information
- 44 USC 2201, the Presidential Records Act
- 44 USC 3301(a), the Federal Records Act
- EO 13526, the Executive Order governing classified information

Not listed was the Atomic Energy Act (AEA), so apparently the FBI didn't expect to find classified documents about American nuclear weapons. However, on September 6, it was reported that among the thousands of documents which the FBI eventually seized at Mar-a-Lago, there was one document that described a "foreign government's military defenses, including its nuclear capabilities" - which is much less secret and sensitive than information about American weapons.


Secret Service agents stand outside an entrance to Mar-a-Lago, August 8, 2022
(Photo: Terry Renna/Associated Press - click to enlarge)


A misleading statement

On June 3, 2022, the DoJ's Chief of Counterintelligence Jay Bratt and some FBI agents visited Mar-a-Lago where they received 38 additional classified documents, including 17 labeled Top Secret, in "a single Redweld envelope, double-wrapped in tape". One of Trump's lawyers signed a statement asserting that they had conducted a diligent search of the boxes from the White House and handed over the remaining classified material.

The FBI was informed that all of the records from the White House had been kept in one particular storage room and that "there were no other records stored in any private office space or other location at the Premises and that all available boxes were searched." However, government personnel was "explicitly prohibited from opening or looking inside any of the boxes that remained in the storage room."

Updates:

According to court records, the FBI agents and the DOJ counsel who were permitted to see the storage room on June 3, 2022, observed that there were approximately 50 to 55 boxes in that room, besides a coat rack with suit jackets, as well as interior decor items such as wall art and frames.

An unknown number of those boxes may have come from five (later repacked to six) pallets with about 85 document boxes which in July 2021 were shipped from a temporary office space used by Trump's staff in Arlington, Virginia to Mar-a-Lago (2 pallets) and a facility of Life Storage (4 pallets) in West Palm Beach, Florida.


Five pallets of boxes ready for shipment from Virginia to Florida, July 2021
(photo: GSA via FOIA request by Bloomberg)


According to the indictment filed by the Justice Department on June 9, 2023, Trump's aid Walt Nauta started to move boxes out of the Mar-a-lago storage room on May 22, 2022. In the next days, he moved a total of 65 boxes out of the room and on June 2, he moved 30 boxes back. Right after that, Trump's lawyer Evan Corcoran conducted a review to see whether the boxes contained classified documents.


Boxes in the storage room of Trump's residence Mar-a-Lago
(photo from the indictment - click to enlarge)



The search at Mar-a-Lago

On August 5, 2022, a federal judge signed a search warrant for Mar-a-Lago on the grounds that "National Defense Information" (NDI) had been found in the boxes NARA retrieved from Mar-a-Lago and that there was probable cause to believe that additional documents containing such information remained at Trump's estate.

Three days later, FBI agents searched the Mar-a-Lago estate and seized what initially appeared to be 12 boxes of documents. Classified material was recovered from a storage room in the basement and from a container on the floor of a closet in a former dressing room of the bridal suite above the ballroom, which now serves as Trump's office, also known as the "45 office".


Items seized by the FBI

The result of this search is described in a form called "Receipt for Property" which lists 33 items, mostly boxes, which were (discontinuously) labeled A-1 to A-73. Besides the boxes there were also some separate documents, notes and binders of photos. A detailed discussion of these seized materials can be found at the emptywheel weblog.




According to a DoJ filing from August 31, these boxes contained over a hundred classified records spread over 11 boxes. In the receipt they are seperately listed and marked with an additional A, for example: "13 - Box labeled A-18" which contained "13A - Miscellaneous Top Secret Documents", etc.


Highly classified documents

The most sensitive kind of documents, classified as Sensitive Compartmented Information (SCI), were only found in item #2, a "Leatherbound box of documents". These appeared so sensitive that "even the FBI counterintelligence personnel and DOJ attorneys conducting the review required additional clearances before they were permitted to review them."

On August 30, a filing by the Justice Department included an unprecedented photograph which shows the classified documents from the leatherbound box from Trump's office:


Classified documents marked as item #2A spread on the floor of Trumps office in Mar-a-Lago
(Photo via the US District Court for the Southern District of Florida - click to enlarge)


This photo was taken by the FBI in order to document the evidence they found, which explains the ruler and a marker that says that this is item #2A. To counter the impression that he had them lying on the floor like this, Trump said that it had been FBI agents who "took [these documents] out of cartons and spread them around on the carpet".

The documents were spread on a carpet with a classic flower motif, with on the right side a cardboard box with five picture frames, one of which shows a Time magazine cover from March 4, 2019, showing all the Democratic candidates who hoped to challenge Trump in the 2020 election.

On the left there's a small part of fringed dark-blue fabric, probably a curtain, and a white scalloped cabinet, which was identified as a $3679.- Birkdale File Chest - most likely from the time that this room was part of Mar-a-Lago's bridal suite.



Cover sheets

Most eye-catching are the colorful cover sheets for classified information. In the photo we can recognize four types, three of which were never seen before. Already known and publicly available are the standard cover sheets (SF704) with the broad borders in red, which are used to protect documents classified as Secret.


Secret/SCI

In the front of the photo there's a cover sheet which looks brownish but may also be red (or orange) with the text "SECRET//SCI - Contains Sensitive Compartmented Information up to HCS-P/SI/TK". Unlike the common cover sheets for Secret documents, this one was never seen before. It's also more rare, because usually information from an SCI compartment is classified Top Secret.

The cover sheet for a document classified as Secret/SCI
(click to enlarge)


SCI is sometimes called "above Top Secret" but officially that's not correct: SCI encompasses compartments of information that provide additional protection within the level Top Secret. In the same way these compartments can exist within the level Secret and actually a particular SCI compartment may contain information at any classification level:



Top Secret/SCI

In the FBI photo we also see five cover sheets for documents classified as Top Secret/SCI. While the standard cover sheet for Top Secret information (SF703) is also publicly available, this one was never seen before. It has a broad border in yellow, which is the color code for Sensitive Compartmented Information (SCI), and text in orange, which may refer to the color code for Top Secret:

Cover sheets for documents classified as Top Secret/SCI
(click to enlarge)


A White House cover sheet

Finally, there's a fourth cover sheet, which is only partially visible because it's folded back, probably to show the classification marking on the document. On the cover sheet we can only read some fragments, like "THIS", "PLEASE STORE IN" (a GSA Approved Security Container which is depicted right above these words) and "UNAU[THORIZED]".

In the upper right corner it has a seal which can be identified as that of the Executive Office of the President of the United States (EOP), which includes a range of offices and bodies like the National Security Council (NSC), the White House Military Office (WHMO) and the staff of the West Wing.

The custom White House cover sheet
(click to enlarge)


This document is classified Top Secret, but interestingly, the rest of the classification line has been redacted by the FBI. Usually that happens when a particular program or compartment has not been declassified. Given that it has a custom White House cover sheet, the document may be about a sensitive plan or program from the president or the NSC.


SCI compartments

The various cover sheets not only hide the content of the particular documents, but also their mandatory classification line at the top and the bottom of the document. Therefore we don't know which kind of intelligence they contain and how sensitive they actually are.

The cover sheets for Secret/SCI and Top Secret/SCI both have the warning "Contains Sensitive Compartmented Information up to HCS-P/SI/TK", which means the documents may contain information from one, two or even all three of the following SCI control systems:

- HCS-P = Humint Control System - Product (intelligence from human sources)
- SI = Special Intelligence (intelligence from intercepted communications)
- TK = TALENT KEYHOLE (intelligence from satellite collection platforms)

The documents found at Mar-a-Lago at least don't contain the most sensitive human intelligence information, which is protected by the HCS-O(perations) compartment.

It's not clear whether these cover sheets are also used for documents with information from compartments or sub-compartments of these control systems, i.e. even more sensitive and closely guarded secrets.

Update:
On October 21, 2022, The Washington Post reported that among the most sensitive documents seized by the FBI describes Iran's missile program. Others describe highly sensitive intelligence work aimed at China, according to anonymous sources, who also said that many of the more sensitive documents are "top-level analysis papers that do not contain sources' names. But even without individual identifiers, such documents can provide valuable clues to foreign adversaries about how the United States may be gathering intelligence, and from whom."


Dissemination markings

Besides the documents with a cover sheet, the FBI photo shows 12 classified documents without such a colorful protection and therefore they redacted all the content. One document (between the yellow Top Secret/SCI cover sheets) is fully redacted, on the others we see the following classification markings:

- SECRET//ORCON-USGOV/NOFORN and LIMITED ACCESS (2 documents)
- SECRET//ORCON-USGOV/NOFORN (6 documents)
- SECRET with additional markings redacted (1 document)
- SECRET NOFORN (1 document)
- SECRET and something illegible (1 document)
- CONFIDENTIAL and LIMITED ACCESS (1 document)

Distinctive here are the so-called dissemination markings, which are added to the classification level to restrict the dissemination of information among only those people who have the appropriate clearance level and the need to know the information. The dissemination markings seen here are:

- ORCON, which means the originator of the information controls to whom it is released. It allows originators to maintain knowledge, supervision, and control of the distribution of the information beyond its original dissemination. Further dissemination of this information requires advance permission from the originator.

- ORCON-USGOV, which means the information "has been pre-approved for further dissemination without originator approval to the US Government's Executive Branch Departments and Agencies." It's not allowed to use this marking with information classified as SI-G or HCS-O.

- NOFORN, which means the information may not be disclosed or released to foreign nationals, foreign governments, or international organizations of governments without permission by the originator.

- LIMITED ACCESS seems not a registred dissemination marking as it's not part of the classification line and is also not listed in the 2016 manual for the Intelligence Community Markings System nor in the list of CUI dissemination markings from 2021, which suggests that it's an internal White House marking.

This brings to mind US Director of National Intelligence Dan Coats who in February 2018 warned that presidential aides with interim security clearances should only have limited access to classified information. Not much later a bill to the same effect was introduced, but didn't pass the House of Representatives.

Shortly before it had come out that Trump's former staff secretary Rob Porter and his son-in-law Jared Kushner were working under an interim security clearance and more than 30 of Trump's aides had their clearance downgraded from Top Secret to Secret.


In total, the FBI photo of item #2A shows 22 classified documents: 1 Confidential, 14 Secret and 7 Top Secret.



The detailed property inventory

As if the photo of the classified documents wasn't enough, the court also unsealed the Detailed Property Inventory, which happened on September 2, 2022. This inventory lists in more detail all the things the FBI seized at Mar-a-Lago:




Total number of classified documents

In this inventory we see the other documents which the FBI found in the leatherbound box (item #2), showing that it actually contained 1 Confidential and 1 Secret document more than seen in the photo, maybe because some were stacked together. In total, the leatherbound box contained 24 classified documents:

7 Top Secret, of which:
5 with Top Secret/SCI cover sheet
1 with EOP/White House cover sheet
15 Secret, of which:
1 with Secret/SCI cover sheet
2 Confidential

Overall, the FBI seized 103 classified documents: 31 Confidential, 54 Secret and 18 Top Secret, dispersed in 13 boxes from the storage room as well as in the leatherbound box from Trump's office, where one separate classified document (item #1) was found as well.


Empty folders

According to the detailed inventory, item #2 also included 43 "Empty Folders with "CLASSIFIED" Bannners" as well as 28 empty folders labeled "Return to Staff Secretary/Military Aide". These kind of folders are used in the White House to bundle (and cover) the actual classified documents for the president. From Obama's presidency there are several photos of such folders:


A folder holding classified information on president Obama's desk, June 2009
(White House photo - click to enlarge)


There even appeared a photo on Twitter of such an empty folder which is on display among other memorabilia from Trump's presidency in the 45 Wine & Whiskey bar on the lobby floor of Trump Tower in Manhattan:



In total, the detailed inventory lists 48 of these empty folders, so it's possible that they originally contained the 103 classified documents which the FBI found "unfoldered" and scattered among the various boxes. Interesting though, is that 43 of those empty folders were in the box with the (much smaller number of) classified documents in Trump's office.

At the White House such folders and their content had to be returned to the staff secretary, just like how the empty folders for unclassified documents were labeled. However, this didn't bother Trump, who had the habit of simply ripping up(!) any papers he was no longer interested in or had finished reviewing.

He did so with papers ranging "from routine documents to classified material, and leaving the pieces strewn around the floor or in a trash can. Officials would have to rummage through the shreds and tape them back together to recreate the documents in order to store them as required under the Presidential Records Act."

Update:
On September 26, 2022, the Justice Department filed a slightly revised version of the Detailed Property Inventory. It shows small differences in the number of press clippings and unclassified government documents and that in box 33 there were only 2 empty "Return to Staff Secretary" folders and no empty folders for classified documents, so in total there are just 46 instead of 48 empty classified folders.



Trump's boxes

According to the Detailed Property Inventory, the FBI also found a huge number of "US Government Documents/Photographs without Classification Markings" - over 1400 in Trump's office and over 9700(!) in the various boxes from the storage room.

In a dispute about possibly privileged documents, Trump's lawyer claimed that the over 11,000 unclassified documents amount to some 200,000 pages, but later a special master said they only contain 21,792 pages, which is an average of less than 2 pages per document.

Also interesting is that most of the 26 boxes from the storage room contain a mix of:

- Magazines, newspapers, press articles, other printed media (1,673 in total)
- Classified US government documents (103 in total)
- Unclassified US government documents/photographs (11,179 in total)
- Miscellanea (clothing, books, gifts and empty folders)


Trump's way of working

This more or less similar composition can be explained by Trump's routine at the White House, where he used to work in the small dining room near the Oval Office. On the dining table he made piles of paper, which included everything from news articles to highly classified government documents. These were stacked into cardboard boxes, while "staffers kept swapping out the boxes as they filled up."

Trump also had material sent "up to the White House Residence, and it was not always clear what happened to it. He sometimes asked to keep material after his intelligence briefings, but aides said he was so uninterested in the paperwork during the briefings themselves that they never understood what he wanted it for."

The boxes followed him wherever he went as they contained "all the save-for-later items that Trump would spend long flights going through: articles that he wanted to scribble Sharpie messages on before mailing them off to close friends; gossipy stories about West Wing drama that he would hate-read as he sought to identify leakers; and, occasionally, important memos on any number of policy topics or budding crises."



Disorderly piles of paper on president's Trump desk in the Oval Office, January 28, 2017
(photo: Drew Angerer/Getty - click to enlarge)



The boxes that went to Florida

The papers that Trump had accumulated in his last several months in office had been dropped into roughly two dozen boxes, which had apparently been in the White House Residence and thus were packed up with Trump's personal belongings.

As such, they not only contained some highly classified documents, but also several personal mementos, including the "love letters" from the North Korean dictator Kim Jong-un and the letter which former president Obama left on his last day in office.

Although the White House Counsel's Office had told Trump's chief of staff Mark Meadows that these boxes in the Residence needed to be turned over to the National Archives, they were actually shipped to Mar-a-Lago.

Eventually, at least 42 boxes arrived in Florida. 15 of them were retrieved by the National Archives on January 18, 2022, 38 classified documents were handed over to the FBI on June 3, while the rest was seized during the search on August 8.

However, as emptywheel noticed, the press clippings date back to 1995, but there are none that postdate November 2020, which may indicate that the FBI still has not all the documents that Trump took with him.


One of Trump's boxes accidentally turned over, December 7, 2021
(photo from the indictment - click to enlarge)


Update:
On December 7, 2022, it was reported that a team hired by Trump’s lawyers found two additional classified documents in a storage unit where the General Services Administration had shipped Trump's belongings after he left the White House (likely the one in West Palm Beach, Florida). The documents were handed over to the FBI. Besides the storage unit, the team searched Trump Tower in New York, the Bedminster golf club and an office location in Florida.


Overview of the boxes and classified documents found at Trump's properties
(click to enlarge)



Update: The indictment

On June 9, 2023, the US Justice Department filed an indictment against former president Trump, accusing him of mishandling classified documents he kept upon leaving office and then obstructing the government’s efforts to reclaim them.

The indictment provides detailed information about how Trump's boxes were handled and where exactly they had been stored, including several photos of those rooms. Trump is specifically charged with the possession of 31 documents, which the indictment lists with additional details.

A reasonable guess about the contents of some of those documents is provided by PwnAllTheThings, while emptywheel considers that the reason for so many highly classified documents being included in the indictment is because they may have been compromised already.


Boxes stored in a bathroom of the Lake Room at Mar-a-Lago
(photo from the indictment - click to enlarge)


Of the 31 classified documents listed in the indictment:

- 10 documents had been returned to the FBI on June 3, 2022:

- 1 TS // [redacted] / SI / TK // ORCON / NOFORN
- 2 TS // [redacted] // ORCON / NOFORN / FISA
- 1 TS // [redacted] // RSEN / ORCON / NOFORN
- 2 TS // HCS-P / SI // ORCON-USGOV / NOFORN
- 2 TS // SI / TK // NOFORN
- 2 TS // Special Handling

- 21 documents had been seized by the FBI on August 8, 2022:

- 1 TS // [redacted] / [redacted] // ORCON / NOFORN / FISA
- 1 TS // [redacted] / [redacted] // ORCON / NOFORN
- 1 TS // [redacted] / TK // ORCON / IMCON / NOFORN
- 1 TS // [redacted] // ORCON / NOFORN
- 1 TS // SI / TK // NOFORN
- 1 TS // SI // NOFORN / Special Handling
- 1 TS // SI // NOFORN / FISA
- 1 TS // TK // NOFORN
- 1 TS // NOFORN // Special Handling
- 2 TS // Special Handling
- 3 S // ORCON / NOFORN
- 3 S // NOFORN
- 1 S // FRD
- 2 S // REL to USA, FVEY
- 1 no marking


Redacted compartments

For an explanation of all these classification markings, see above. What's interesting is that at least two different codewords have been redacted, which means there are at least two SCI control systems or Special Access Programs (SAPs), the existence of which hasn't been declassified, as is the case with SI, TK and HCS-P.

All the classification lines with the redacted codewords have the Originator Controlled (ORCON) and No Foreign Nationals (NOFORN) dissemination markings, which indicates that the information from these hidden SCI control systems or SAPs is more sensitive than the usual information from the SI and TK control systems.

From the descriptions in the indictment it becomes clear that all documents with information from these redacted compartments are either about (US) military activities in foreign countries or about the military capabilities of foreign countries, including one document "concerning nuclear capabilities of a foreign country".


Some entries of the list of documents in the indictment against Donald Trump
(click to enlarge)


Formerly Restricted Data

One document listed in the indictment is classified as "Formerly Restricted Data" (FRD), which is a classification category for nuclear secrets under the Atomic Energy Act. FRD is primarily related to "the military utilization of atomic weapons".

The term "Formerly" doesn't mean that it has been declassified, but that it has been removed from the category "Restricted Data" (RD). RD contains the more sensitive information about "the design, manufacture, or use of atomic weapons; the production of special nuclear material; and the use of special nuclear material in the production of energy."


Special Handling

Also of interest is SPECIAL HANDLING, which isn't an official marking according to the 2016 Intelligence Community Markings System. In the indictment, all documents marked with SPECIAL HANDLING are described as "White House intelligence briefing", which may refer to the President's Daily Brief (PDB), or otherwise a less-important intelligence briefing.

As far as I know, the SPECIAL HANDLING marking hasn't been seen before, so it's unclear how restrictive it is. Since it's not in the official classification guides, it seems to be an internal White House marking, just like LIMITED ACCESS, which was seen on documents the FBI found in Trump's office during the search at Mar-a-Lago on August 8, 2022:


Document from Trump's office, classified SECRET//ORCON-USGOV/NOFORN
and additionally marked as LIMITED ACCESS
(click to enlarge)


Usage in court

While the FBI seized and received a total of 143 classified documents (35 of which Top Secret and 54 Secret) from Mar-a-Lago, the Department of Justice (DoJ) charged Trump with the illegal possession of only 31 documents (21 Top Secret and 9 Secret).

This is probably because the military or intelligence agency that owns the particular information didn't authorize DoJ to use it in a court case, or DoJ decided itself that the risk to sources and methods and/or other damage to national security outweighed their use and possible disclosure at trial.


On June 13, 2023, former president Trump appeared for an arraignment hearing at a federal courthouse in Miami where he pleaded not guilty.

On July 21, 2023, judge Aileen M. Cannon announced that the trial against Donald Trump for mishandling classified information will start on May 20, 2024 in her courthouse at Fort Pierce in Florida.

To be continued...



Links and sources

- Court Listener: United States v. Trump
- Emptywheel: Trump Document Theft Resources
- Teri Kanefield: Timeline: Trump's Stolen Documents Case
- LegalEagle: Videos about the Mar-a-Lago search case
- Wikipedia: FBI search of Mar-a-Lago

- Emptywheel: “POTUS is very emotional and in a bad place.” Donald Trump’s Classified Discovery (Oct. 10, 2023)
- ABC News: Trump allegedly discussed US nuclear subs with foreign national after leaving White House: Sources (Oct. 6, 2023)
- PwnAllTheThings: Donald Trump indictment: what are the classified documents? (June 9, 2023)
- The New York Times: Burn Bags and Tracking Numbers: How the White House Handles Classified Files (Jan. 30, 2023)
- The Washington Post: Skepticism before a search: Inside the Trump Mar-a-Lago documents investigation (Dec. 21, 2022)
- The Washington Post: Mar-a-Lago classified papers held U.S. secrets about Iran and China (Oct. 21, 2022)
- New York Intelligencer: Trump Was Betrayed by His Diet Coke Valet (Oct. 14, 2022)
- The New York Times: Justice Dept. Is Said to Believe Trump Has More Documents (Oct. 6, 2022)
- Business Insider: Court accidentally unsealed, then deleted, documents from the Mar-a-Lago case describing information the FBI seized from Trump (Oct. 6, 2022)
- Bloomberg: Trump Says US Agency Packed Top-Secret Documents. These Emails Suggest Otherwise. (Oct. 5, 2022)
- The Washington Post: Material on foreign nation’s nuclear capabilities seized at Trump’s Mar-a-Lago (Sept. 6, 2022)
- The New York Times: F.B.I. Found 48 Empty Folders That Had Contained Classified Documents at Trump’s Home (Sept. 2, 2022)
- Lawfare: A Justice Department Show of Force in the Mar-a-Lago Case (Aug. 31, 2022)
- The Washington Post: The photo of classified documents at Trump’s Mar-a-Lago resort, annotated (Aug. 31, 2022)
- Politico: Trump team likely sought to conceal classified docs at Mar-a-Lago, DOJ tells judge (Aug. 30, 2022)
- Indian Express: Inside the 20-month fight to get Trump to return Presidential material (Aug. 28, 2022)
- The New York Times: Another Trump Mystery: Why Did He Resist Returning the Government’s Documents? (Aug. 18, 2022)
- The Guardian: FBI searched Trump’s Mar-a-Lago home for classified nuclear weapons documents (Aug. 12, 2022)
- CNN: Former White House officials describe Trump’s habit of ripping up documents and haphazard record-keeping (Febr. 8, 2022)
- US State Department: Storing and Safeguarding Classified Material (Febr. 24, 2022)

September 12, 2019

A document about the UKUSA partnership with unknown classification compartments

(Updated: September 13, 2019)

A highly sensitive document about the intelligence sharing relationship between the United States and the United Kingdom reveals the existence of three classification compartments that were previously unknown.

The assessment was declassified in September 2018 after a FOIA request by Privacy International and Yale Law School's Media Freedom & Information Access Clinic (MFIA). The document has no date, but must be from somewhere before the NSA's internal reorganization in the year 2000.


First page of the assessment of the UKUSA relationship
(click to enlarge)



Classification markings

The classification marking at the top of the document reads:

TOP SECRET VRK11 TK AG DC MC
N O F O R N

This rather long and complex marking consists of three separate parts. First there's the actual classification level:

- TOP SECRET
This is the highest level of classified information, which would cause "exceptionally grave damage" to US national security if it were disclosed unauthorized.

Then there are several Sensitive Compartmented Information (SCI) control systems and compartments which further restrict the access to particularly sensitive information:

- VRK11
VRK stands for Very Restricted Knowledge and was a sub-control system to limit access to uniquely sensitive COMINT activities and programs. It contained compartments or categories which had an identifier of one to three alpha numeric characters, so in this case the document contains information from VRK compartment 11.
Shortly before 2004, VRK was succeeded by a new system called Exceptionally Controlled Information (ECI).

- TK
TK stands for TALENT KEYHOLE, which is a combined control system for products of overhead collection systems, such as spy satellites and reconnaissance aircraft.

- AG
Unknown.

- DC
Unknown.

- MC
Unknown. (Update: On Twitter, Bill Robinson said that MC is the abbreviation for MERCURY, a series of satellites for COMINT, SIGINT and ELINT collection, which were operated from Menwith Hill in the UK)

Finally, there's a dissemination marking which adds additional restrictions:

- NOFORN
This stands for No Foreign Nationals and is applied to any information that may not be released to any non-US citizen.

The classification of the document is remarkable and interesting in various ways. Not only because it contains VRK11 and TK information - this applies to some other declassified documents - but because it has three additional markings (AG, MC and DC), which seem to show up here for the first time.

These markings clearly look like abbreviations of code words, but that's also a bit strange because in an overall classification line, code words should be written in full. And if we assume that these markings stand for additional control systems or compartments, it's remarkable to see three that were not known before.






Benefits for the US

Although the term UKUSA is often used for the 5-Eyes partnership between the US, the UK, Canada, Australia and New Zealand, this documents uses the term in its original sense, being the relationship between the signals intelligence agencies of the United States (NSA) and the United Kingdom (GCHQ).

As this is a highly sensitive issue, the document is almost entirely redacted: 11 out of 14 pages are witheld in full, while of the remaining 3 pages also large portions have been redacted. The remaining portions are still interesting however, also because they confirm things we learned from the Snowden-revelations.

The text starts with saying that the UKUSA relationship is of "inestimable value to NSA and cannot be abandoned". But there are some weaknesses and understanding them would make NSA better able to "make some hard decisions about the future of the relationship." These weaknesses are of course redacted, but the main benefits for NSA are still readable:

- A "unique collection from GCHQ conventional sites, freeing US resources". This seems to be about data collection from undersee fiber-optic cables, which NSA also uses and therefore hasn't to invest in its own accesses to these kinds of data streams.


- NSA can also use something from the UK "where the US has none", but what exactly this is, is redacted. However, another declassified document says: "The UK has sites at strategic locations for collection that otherwise would be unavailable to the US." Some GCHQ accesses even exist "solely to satisfy NSA tasking".


- The "compatibility and interoperability of US & UK SIGINT systems" which makes it faster and easier to exchange content data, metadata and end products.


- A "strong analytic workforce, with a capability for independent interpretation of events" which saves US resources by division of efforts.

- An "especially competent cryptanalytic workforce". Another declassified document adds: "GCHQ is NSA's only peer in the field of cryptomathematics and virtually all major advances within the field of cryptography have occurred as a result of our mutual sharing."

- The "pooling of resources on key technical projects during austere fiscal periods" - again financial reasons, showing how much NSA is apparently bothered with money issues despite their annual budget of over 10 billion US dollar in 2013.

- And finally, as the perhaps most important benefit the document says that the UK has "a record of supporting the US as an ally in confronting world problems".


According to another unredacted part of the document, NSA worried about the large numbers of integrees that NSA and GHCQ exchanged, who took on more and more tasks and responsibilities. GCHQ for example wished to place an integree in G2/SA (a unit in the former NSA division responsible for non-communist countries), but this was rejected "as it would give GCHQ insight into certain sensitive operations we do not share."

Another unredacted part makes clear that the Americans were also concerned about the increasing number of electronic communications interfaces between NSA and GCHQ, which had been established "based on a myriad of decisions at various levels within NSA". The question was asked: "Should there be a common NSA position on the number and kind of electronic interfaces between NSA and GCHQ? Should the number be driven by NSA design or by GCHQ needs?"




The UKUSA partnership

The same FOIA request by Privacy International and MFIA also resulted in the declassification of a larger batch of documents related to the US-UK relationship, including ones that date back to the early 1950s and recall the origins of this unique intelligence partnership.

It began with the UKUSA Agreement, which was signed on March 5, 1946 by Col. Patrick Marr-Johnson, British Army General Staff, for and in behalf of the London Signal Intelligence Board (LSIB), and by Lt. Gen. Hoyt S. Vandenberg, GSC, Senior Member, for and in behalf of the State-Army-Navy Communications Board (STANCIB).

Canada had hoped to be a third signatory of the UKUSA Agreement but that didn't happen. Eventually a separate CANUSA agreement between Canada and the United States was "presumably signed in 1949" after the British LSIB saw no objection.*

After a first tripartite conference was held with the Australian Defence Signals Branch (DSB) in September 1953, Appendix J (about the "collaboration with commonwealth countries other than the U.K.") and Annexure J1 of the UKUSA Agreement were revised and these were signed by New Zealand in January 1956 and by Australia in May 1956.

The relationship between these five partner agencies continued to be governed by the original UKUSA agreement from 1946, supplemented by a range of appendices and an array of Memoranda of Understanding (MoU) and Divisions of Effort (DoE). However, NSA was apparently not able to locate, let alone produce, most of these additional documents.

The various kinds of data and intelligence that NSA and GCHQ exchange under the UKUSA partnership are listed in yet another declassified document:


Exchange of intelligence between NSA and GCHQ
(click to enlarge)


In November 1993, the NSA's Deputy Director of Operations (DDO) initiated a review of the UKUSA Exchange Agreement "to include a list of what is not currently exchanged with the British, what we should not exchange in the future, and new things that should be exchanged in the future".

Finally, a document from the Snowden trove says that in the same year, the original bilateral relationships between the US and the individual Second Party countries were turned into a "group (5-EYES) partnership" which in 1998 got a coordinating body called the Joint Executive for SIGINT Operability (JESI).




Links
- Lawfare: Newly Disclosed NSA Documents Shed Further Light on Five Eyes Alliance (March 2019)
- Privacy International: Privacy International v. NSA et al. (US 5EY FOIA)
- NSA FOIA: UKUSA Agreement Release


August 13, 2017

Do NSA compliance reports point to an unknown classification compartment?

(UPDATED December 9, 2017)

On July 12, the American Civil Liberties Union (ACLU) published two Top Secret NSA compliance reports, which were obtained after declassification under the Freedom Of Information Act (FOIA). Here we will take a look the classification marking of these reports, of which one part has been redacted:




Both documents are quarterly reports from the NSA to the Foreign Intelligence Surveillance Court (FISC) on compliance under Section 702 of the FISA Amendments Act (FAA), which governs both the PRISM and the Upstream collection efforts. One of the reports is from March 2014, the other one from March 2015.

More about the content of these two compliance reports can be found in this article by The Hill, as well as in this posting on the weblog EmptyWheel.net. Here we will take a look at the classification of these reports.



Classification marking

The classification line of both reports is: TOP SECRET//[...]/SI//ORCON/NOFORN, which stands for:

- TOP SECRET: the highest classification level
- [...]: an unknown SCI control system
- SI: the SCI control system "Special Intelligence"
- ORCON: the dissemination restriction "Originator Controlled"
- NOFORN: the dissemination restriction "No Foreign Nationals"

As we can see, the double slash behind TOP SECRET is followed by a short space that has been redacted. Then comes a single slash, followed by SI for the control system for Signals Intelligence (SIGINT), which was formerly denoted as COMINT. This means that the redaction also hides a so-called control system, used for protecting national intelligence information concerning sources and methods.

The semiannual Section 702 FAA compliance reports, like this one from 2015, which are prepared by the Attorney General and the Director of National Intelligence, don't have the redacted marking and are just TOP SECRET//SI//NOFORN.

UPDATE:

Meanwhile, a reader suggested that the redacted part of the classification line might hide HCS, which is the abbreviation for HUMINT Control System. HUMINT stands for Human Intelligence, and therefore, HCS is the control system that protects intelligence from the CIA. And indeed, it appears that "HCS" fits the redacted space perfectly:



HCS itself isn't classified, so the reason why this marking appears redacted here, is probably that NSA only declassified its own part and redacted everything related to the CIA. Analysts of the CIA request and receive information from 702 FAA collection, but the scope of their involvement remains classified.

With HCS being the most likely option for the redacted space in the 2014 and 2015 compliance reports, please read the following with that in mind!


STELLARWIND

Another option that comes to mind is the STELLARWIND compartment, which was created in October 2001 to protect NSA's new collection methods as authorized by president George W. Bush. This is officially known as the President's Surveillance Program (PSP) and more popular as the "warrantless wiretapping".

For classification purposes, the abbreviation of STELLARWIND is STLW, which is too long for the redacted space in the marking on the compliance reports. The STELLARWIND classification guide from January 2009 does provide an interesting alternative though, where it says:

"The markings "TSP" and "Compartmented" were at times used in briefing materials and documentation associated with the STELLAR WIND program. "TSP" and "Compartmented" were used primarily by the National Security Agency (NSA) Legislative Affairs Office (LAO), NSA Office of General Counsel (OGC), and the Executive Branch in briefings and declarations intended for external audiences, such as Congress and the courts. The term "TSP" was initially used in relation to only that portion of the Program that was publicly disclosed by the President in December 2005. These markings should be considered the same as the STELLARWIND marking, but should not be directly associated with the program."

In several documents that had been presented to the FISA Court and meanwhile have been declassified by the US government, we can see this TSP marking:



Classified declaration of NSA director Alexander, April 20, 2007.


The two recently declassified compliance reports from 2014 and 2015 were also meant for the FISA Court, and if we try out "TSP", it fits the redacted space remarkably well:


 


PSP/TSP collection (2001-2007)

Under the President's Surveillance Program (PSP), as protected by the STELLARWIND compartment, it became possible for NSA to not only collect fully foreign communications, but also those with just one end foreign - the express aim was to find foreign terrorists with connections inside the US. Under the PSP the following data were collected (with their succeeding legal authorizations):

- Telephony content (since 2008: Section 702 FAA Upstream collection)
- Internet content (since 2008: Section 702 FAA Upstream collection)

- Telephony metadata (2006-2015: Section 215 (BR/FISA) bulk collection)
- Internet metadata (2004-2011: Section 402 (PR/TT) bulk collection)


The bulk collection of internet metadata was brought from the president's authority under that of the FISA Court (FISC) in July 2004, and the same happened with the bulk telephone metadata in May 2006.

The collection of both telephone and internet content became also authorized by FISC orders as of January 2007, which was temporarily replaced by the Protect America Act (PAA) in August 2007 and then permanently by Section 702 of the FISA Amendments Act (FAA) in July 2008.


Section 702 FAA is also the legal foundation for PRISM collection, which started in September 2007 with data being provided by Microsoft. Until October 2012, another eight internet companies had followed. While Upstream collection, at major telecom switches, only provides future communications in transit, PRISM gives access to stored data from a target's past too.

After revelations by the New York Times in December 2005, president Bush admitted that NSA was collecting the one-end foreign telephone and internet content and named it the Terrorist Surveillance Program (TSP). Bush stayed silent though about the other part of the PSP, which involved the bulk collection of domestic metadata.

The latter was first published about in May 2006 by USA Today, but it only became a big issue after June 2013, when Snowden provided the Verizon order to the press.



Another option

As we have seen, the TSP marking fits the redacted space in the classification line of the compliance reports very well, but of course it's always possible that a different abbreviation might be hidden there. In documents that have been declassified earlier, "TSP" was not redacted, so strictly spoken, it shouldn't have been redacted here.

And there's indeed another option: on September 6, 2014, the US Justice Department released a declassified version of a 2004 memorandum about the STELLARWIND program. The classification line of this document has a similar short redaction right after "Top Secret", just like in the compliance reports:



Classification marking of the 2004 DoJ memorandum about STELLAR WIND


Interestingly, "TSP" would also fit the redacted space here - but this wouldn't make much sense, as TSP was meant as a replacement for STELLARWIND for audiences who didn't have a need-to-know for the STELLARWIND cover term - and "STELLAR WIND" is in the classification line here too. Also, the name Terrorist Surveillance Program probably didn't exist in 2004, as it was apparently first used by President Bush in a speech on January 23, 2006.




So, it's not very likely that "TSP" is the marking that was redacted in the 2004 memorandum, but position and length of the marking indicate that it's very well possible that it's actually the same control system as in the classification line of the compliance reports from 2014 and 2015 - with an abbreviation of almost exactly the same length as "TSP".

Regarding the status of this mysterious marking: in the 2004 document it's shown between double slashes, which is strange, because according to the official classification manuals, there cannot be something between two double slashes in that position (see the chart below).

If this double slash is correct, then we would have a complete new category which isn't in the (public) classification manuals. This reminds of the UMBRA marking, which also appeared unexpectedly between double slashes in a classification line.

Another option is that the double slash behind the redacted marking is actually a mistake and there should have been just a single slash, just like in the classification lines of the 2014 and 2015 compliance reports. In this case, the marking represents a normal control system like SI, HCS, and several others mentioned in the classification manuals.



Overview of the categories and formatting for the US classification and control markings
From the Intelligence Community Classification Manual 6.0 from December 2013
(click to enlarge)



Some older articles on this weblog that are of current interest:
In Dutch: Volg de actuele ontwikkelingen rond de Wet op de inlichtingen- en veiligheidsdiensten via het Dossier herziening Wiv 2017