Showing posts with label Trump. Show all posts
Showing posts with label Trump. Show all posts

January 8, 2026

Trump risked a compromise of his strike against Venezuela

(Updated: January 14, 2026)

On January 3, 2026, the United States conducted a remarkable strike against Venezuela, during which president Maduro and his wife were captured and exfiltrated to New York.

At his private residence Mar-a-Lago, US president Trump monitored this operation from a room that looks hardly secure enough to prevent adversaries from eavesdropping.


Left to right: Hegseth, Ratcliffe, Rubio and Trump at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)


Right after the strike had been absolved, Trump's team released several photos via X (formerly Twitter) and their own social media platform Truth Social. The images show how the US president and his national security team monitored the operation and the communications equipment they used.

Present were president Donald Trump, Secretary of Defense Pete Hegseth, Secretary of State Marco Rubio, CIA Director John Ratcliffe, Chairman of the Joint Chiefs of Staff general Dan Caine, White House Deputy Chief of Staff Stephen Miller, as well as some other staff members.



The communications equipment

Among the communications equipment in the photos we see a Cisco 8832 IP Conference Phone and at least two Cisco 8841 IP phones with a black box attached to their back. All these phones were modified by Advanced Programs, Inc. (API) in order to provide some TEMPEST protection and appliance to the TSG Standards.


However, those technical measures are of little use when a phone is off hook or when the speakerphone is enabled and all kind of people (and antennas) can simply listen in to what is said.


Left to right: Ratcliffe, Trump and Rubio at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)


In the photo below we see Chairman of the Joint Chiefs of Staff working on a laptop which has two yellow labels and is connected with cables that are yellow as well. Yellow is the color code for the classification level Top Secret/Sensitive Compartmented Information (TS/SCI), which indicates that the device is connected to JWICS, the highly secured network for intelligence information and communication.

In another photo we can see that at his right hand, Cain also has another laptop. That one had a red label and was connected with a red cable. Red is the color code for the classification level Secret, which means that laptop was connected to the SIPRNet, which is the primary network for classified military communications.


Left to right: Caine, Ratcliffe and Hegseth at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)


On the wall behind defense secretary Hegseth is a large videoscreen. The bright green bar along the top side shows that it's connected to a military or government network for unclassified information (most likely NIPRNet). At the moment of the photo, the screen showed an internet browser with on three tabs the web interface of X and "Venezuela" typed into the search bar of the front tab.

Note that Hegseth is working on a laptop that has no color label to indicate a classification level, it has only a gray label with some bar codes. This brings to mind the situation of early last year, when Hegseth had a computer in his Pentagon office that was directly connected to the public internet so he could use the Signal app for backdoor communications with the White House.




No SCIF at Mar-a-Lago?

The most remarkable thing about the meeting on January 3, is its location. According to CNN, Trump and his team met in "a discreet of the club, away from guests". The photo below shows that it was a small building with a wooden roof that looks almost like a garage or a storage room, with the area where all the highly sensitive information came in "sealed off" only by very thin black curtains:


Left to right: Ratcliffe, Trump, Rubio and Miller at Mar-a-Lago, January 3, 2026
(White House photo - click to enlarge)


Normally, these kind of meetings should at least take place in a Physically Protected Space (PPS), but preferably in a Sensitive Compartmented Information Facility (SCIF). Such a SCIF can be a room, a suite of rooms or a whole building that is protected in such a way that highly classified information can be stored, processed, viewed and/or discussed without being intercepted by outsiders.



Risks at Mar-a-Lago

Already during Trump's first term as president it was noticed that there was apparently no permanent SCIF at Mar-a-Lago. When on April 6, 2017, the US conducted airstrikes against Syria, Trump and his team sat packed around a narrow table in a small side room, looking at a secured Cisco EX90 video teleconferencing screen, with on the table some devices that were never identified.



Trump and his team of policy makers at Mar-a-Lago, April 6, 2017
(White House photo - click to enlarge)


According to Trump's press secretary at the time, the room used on April 6, 2017 was a SCIF. That wasn't very convincing because everything seemed to be hastily arranged for the occasion. At best, the room was a (temporary) Secure Working Area (SWA), which is an accredited facility "used for discussing, handling, and/or processing SCI, but where SCI will not be stored."

Mar-a-Lago isn't just Trump's private residence, but also a club resort that is open to paying members and ticketed guests, staffed by workers without the same security clearances as White House staff. Although the Secret Service screens guests before they enter, they don't determine who can access the club. All this makes the place vulnerable to infiltration and/or eavesdropping by foreign intelligence.



Precedents

By contrast, when president Barack Obama and his national security team monitored the killing of Osama bin Laden on May 1, 2011, they did so from a small room that was part of the highly secured complex of the White House Situation Room:



President Obama and his national security team watching the killing of
Osama bin Laden in the White House Situation Room, May 1, 2011.
(White House photo by Pete Souza - click to enlarge)


However, when Obama was on vacation at the Blue Heron Farm in Chilmark on the island of Martha's Vineyard, Massachusetts in August 2011, his secure and non-secure telephone equipment was installed in a living room that didn't seem very secure, with doors and windows open when calls were conducted:

> Read more: Obama on vacation


President Obama with John Brennan and some other assistents, August 26, 2011
(White House photo by Pete Souza - click to enlarge)



Much better was the situation under president George W. Bush, who had a special building on his ranch in Crawford, Texas, that was equipped as a SCIF. The space was modeled like a conference room in the White House, with comfortable chairs and all the necessary communications equipment for secure and non-secure phone calls as well as for secure video teleconferencing:



George W. Bush in the SCIF on his ranch in Texas, December 29, 2004.
(White House photo)



Links and sources
- Politico: Who was in Trump’s Mar-a-Lago war room for Maduro’s ouster
- CNN: Mar-a-Lago is a familiar place for Trump to manage high-stakes military operations
- The New York Times: C.I.A. Source Inside Venezuelan Government Helped Track Maduro
- Wikimedia Commons: Photos of Donald Trump monitoring U.S. military operations in Venezuela

September 21, 2022

The highly classified documents found at Trump's residence Mar-a-Lago

(Updated: July 21, 2023)

This weblog is not only about signals intelligence, communications security and top level telecommunications equipment, but also about the US Classification System, which is equally fascinating in all its complexities.

Recently, an unprecedented photo from the FBI provided a unique look at highly classified documents which former US president Donald Trump stole from the White House and stored at his private residence Mar-a-Lago in Florida.

Here I'll provide a detailed explanation of these documents, as well as where they apparantly came from.



Mar-a-Lago and the highest classified documents which the FBI found in Trumps office



Moving to Mar-a-Lago

On January 20, 2021, former president Donald J. Trump left the White House and moved his belongings to his residence Mar-a-Lago in Palm Beach, Florida. The National Archives and Records Administration (NARA) subsequently learned of approximately two dozen boxes of presidential records that had not been returned to it as required under the Presidential Records Act (PRA).

Late 2021, officials at the archives warned Trump's team that there could be a referral to the Justice Department or an alert to Congress if he continued to refuse to comply with the PRA. Apparently, Trump ultimately went through several boxes at Mar-a-Lago himself and late December, his lawyers informed the NARA that they had found 12 boxes of documents and that they were ready for retrieval.


Donald Trump's residence Mar-a-Lago in Palm Beach, Florida, March 2019
(White House photo - click to enlarge)


15 boxes retrieved

On January 18, 2022, the NARA finally retrieved 15 boxes of records from Mar-a-Lago, containing presidential records and other sensitive material, along with various news clippings and other miscellanea. In its initial review of the materials within those boxes, NARA identified classified documents marked up to the level of Top Secret, including Sensitive Compartmented Information (SCI) and Special Access Programs (SAP).

On February 9, NARA told the Department of Justice (DOJ) that the 15 boxes contained highly classified records that were "unfoldered, intermixed with other records and otherwise unproperly identified." President Biden granted the FBI access to the boxes for examination and by May, the bureau had identified classified documents in 14 of the 15 boxes. In total, there were 184 classified documents, 67 of which were marked Confidential, 92 Secret and 25 Top Secret.


Criminal investigation

Former president Trump then attempted to delay the DOJ's review of the materials by asserting executive privilege over the documents. After the Assistant Attorney General for the Office of Legal Counsel rejected this claim, the FBI launched a criminal investigation to determine:

- How these classified documents were removed from the White House;
- Whether Mar-a-Lago was an authorized storage location for those documents;
- Whether additional classified documents had been removed from the White House;
- Which individuals were involved in the removal and storage of the documents at Mar-a-Lago.

A grand jury was installed and the FBI began interviewing several of Trump's personal aides as well as three former White House lawyers who had been among Trump's representatives to the archives.


Classification markings

On May 11, former president Donald J. Trump was served with a grand jury subpoena which ordered him to hand over any and all documents bearing at least the following classification markings:




These classification markings contain a lot of lesser-known abbreviations, which are explained in my earlier overview of the US Classification System. They are, in order of appearance:

- SI = Special Intelligence (intelligence from intercepted communications)
- G = GAMMA (sensitive communication intercepts)
- NOFORN = No Foreign Nationals
- ORCON = Originator Controlled
- HCS = HUMINT Control System (intelligence from human sources)
- HCS-O = HCS Operations (HUMINT operations and methods)
- HCS-P = HCS Product (HUMINT intelligence reports)
- TK = TALENT-KEYHOLE (intelligence from satellite collection)
- TS = Top Secret (release would cause exceptionally grave damage to national security)
- SAP = Special Access Program (non-intelligence equivalent of SCI)
- NF = NOFORN (see above)
- OC = ORCON (see above)
- FRD = Formerly Restricted Data (about nuclear weapons)
- NATO = Releasable to NATO partners
- S = Secret (release would cause serious damage to national security)
- C = Confidential (release would cause damage to national security)

This list may have been based upon the classification markings that the FBI found on the documents in the boxes that had already been retrieved by the National Archives, but according to The Washington Post, the goal of the list was to ensure recovery of all classified records, and not just those that investigators had reason to believe might be at Mar-a-Lago. This becomes clear from the fact that the list contains all possible combinations of the various markings.


Nuclear weapons information?

Therefore the markings in the list don't say whether or not certain kinds of information were present at Mar-a-Lago. That especially applies to press reports saying that among the things that Trump was still hiding were documents about nuclear weapons, which was likely based upon the FRD marking in the list. Given that this marking is only listed once, there may have been only very few if not just one single document with nuclear weapons information, with many more about signals intelligence (SI) and human intelligence (HCS).

In an affidavit from August 5, the FBI listed the statutory authorities upon which it based its application for a search warrant:

- 18 USC 793(e), the Espionage Act
- 18 USC 1519, obstruction
- 18 USC 2071, willfully removing information
- 44 USC 2201, the Presidential Records Act
- 44 USC 3301(a), the Federal Records Act
- EO 13526, the Executive Order governing classified information

Not listed was the Atomic Energy Act (AEA), so apparently the FBI didn't expect to find classified documents about American nuclear weapons. However, on September 6, it was reported that among the thousands of documents which the FBI eventually seized at Mar-a-Lago, there was one document that described a "foreign government's military defenses, including its nuclear capabilities" - which is much less secret and sensitive than information about American weapons.


Secret Service agents stand outside an entrance to Mar-a-Lago, August 8, 2022
(Photo: Terry Renna/Associated Press - click to enlarge)


A misleading statement

On June 3, 2022, the DoJ's Chief of Counterintelligence Jay Bratt and some FBI agents visited Mar-a-Lago where they received 38 additional classified documents, including 17 labeled Top Secret, in "a single Redweld envelope, double-wrapped in tape". One of Trump's lawyers signed a statement asserting that they had conducted a diligent search of the boxes from the White House and handed over the remaining classified material.

The FBI was informed that all of the records from the White House had been kept in one particular storage room and that "there were no other records stored in any private office space or other location at the Premises and that all available boxes were searched." However, government personnel was "explicitly prohibited from opening or looking inside any of the boxes that remained in the storage room."

Updates:

According to court records, the FBI agents and the DOJ counsel who were permitted to see the storage room on June 3, 2022, observed that there were approximately 50 to 55 boxes in that room, besides a coat rack with suit jackets, as well as interior decor items such as wall art and frames.

An unknown number of those boxes may have come from five (later repacked to six) pallets with about 85 document boxes which in July 2021 were shipped from a temporary office space used by Trump's staff in Arlington, Virginia to Mar-a-Lago (2 pallets) and a facility of Life Storage (4 pallets) in West Palm Beach, Florida.


Five pallets of boxes ready for shipment from Virginia to Florida, July 2021
(photo: GSA via FOIA request by Bloomberg)


According to the indictment filed by the Justice Department on June 9, 2023, Trump's aid Walt Nauta started to move boxes out of the Mar-a-lago storage room on May 22, 2022. In the next days, he moved a total of 65 boxes out of the room and on June 2, he moved 30 boxes back. Right after that, Trump's lawyer Evan Corcoran conducted a review to see whether the boxes contained classified documents.


Boxes in the storage room of Trump's residence Mar-a-Lago
(photo from the indictment - click to enlarge)



The search at Mar-a-Lago

On August 5, 2022, a federal judge signed a search warrant for Mar-a-Lago on the grounds that "National Defense Information" (NDI) had been found in the boxes NARA retrieved from Mar-a-Lago and that there was probable cause to believe that additional documents containing such information remained at Trump's estate.

Three days later, FBI agents searched the Mar-a-Lago estate and seized what initially appeared to be 12 boxes of documents. Classified material was recovered from a storage room in the basement and from a container on the floor of a closet in a former dressing room of the bridal suite above the ballroom, which now serves as Trump's office, also known as the "45 office".


Items seized by the FBI

The result of this search is described in a form called "Receipt for Property" which lists 33 items, mostly boxes, which were (discontinuously) labeled A-1 to A-73. Besides the boxes there were also some separate documents, notes and binders of photos. A detailed discussion of these seized materials can be found at the emptywheel weblog.




According to a DoJ filing from August 31, these boxes contained over a hundred classified records spread over 11 boxes. In the receipt they are seperately listed and marked with an additional A, for example: "13 - Box labeled A-18" which contained "13A - Miscellaneous Top Secret Documents", etc.


Highly classified documents

The most sensitive kind of documents, classified as Sensitive Compartmented Information (SCI), were only found in item #2, a "Leatherbound box of documents". These appeared so sensitive that "even the FBI counterintelligence personnel and DOJ attorneys conducting the review required additional clearances before they were permitted to review them."

On August 30, a filing by the Justice Department included an unprecedented photograph which shows the classified documents from the leatherbound box from Trump's office:


Classified documents marked as item #2A spread on the floor of Trumps office in Mar-a-Lago
(Photo via the US District Court for the Southern District of Florida - click to enlarge)


This photo was taken by the FBI in order to document the evidence they found, which explains the ruler and a marker that says that this is item #2A. To counter the impression that he had them lying on the floor like this, Trump said that it had been FBI agents who "took [these documents] out of cartons and spread them around on the carpet".

The documents were spread on a carpet with a classic flower motif, with on the right side a cardboard box with five picture frames, one of which shows a Time magazine cover from March 4, 2019, showing all the Democratic candidates who hoped to challenge Trump in the 2020 election.

On the left there's a small part of fringed dark-blue fabric, probably a curtain, and a white scalloped cabinet, which was identified as a $3679.- Birkdale File Chest - most likely from the time that this room was part of Mar-a-Lago's bridal suite.



Cover sheets

Most eye-catching are the colorful cover sheets for classified information. In the photo we can recognize four types, three of which were never seen before. Already known and publicly available are the standard cover sheets (SF704) with the broad borders in red, which are used to protect documents classified as Secret.


Secret/SCI

In the front of the photo there's a cover sheet which looks brownish but may also be red (or orange) with the text "SECRET//SCI - Contains Sensitive Compartmented Information up to HCS-P/SI/TK". Unlike the common cover sheets for Secret documents, this one was never seen before. It's also more rare, because usually information from an SCI compartment is classified Top Secret.

The cover sheet for a document classified as Secret/SCI
(click to enlarge)


SCI is sometimes called "above Top Secret" but officially that's not correct: SCI encompasses compartments of information that provide additional protection within the level Top Secret. In the same way these compartments can exist within the level Secret and actually a particular SCI compartment may contain information at any classification level:



Top Secret/SCI

In the FBI photo we also see five cover sheets for documents classified as Top Secret/SCI. While the standard cover sheet for Top Secret information (SF703) is also publicly available, this one was never seen before. It has a broad border in yellow, which is the color code for Sensitive Compartmented Information (SCI), and text in orange, which may refer to the color code for Top Secret:

Cover sheets for documents classified as Top Secret/SCI
(click to enlarge)


A White House cover sheet

Finally, there's a fourth cover sheet, which is only partially visible because it's folded back, probably to show the classification marking on the document. On the cover sheet we can only read some fragments, like "THIS", "PLEASE STORE IN" (a GSA Approved Security Container which is depicted right above these words) and "UNAU[THORIZED]".

In the upper right corner it has a seal which can be identified as that of the Executive Office of the President of the United States (EOP), which includes a range of offices and bodies like the National Security Council (NSC), the White House Military Office (WHMO) and the staff of the West Wing.

The custom White House cover sheet
(click to enlarge)


This document is classified Top Secret, but interestingly, the rest of the classification line has been redacted by the FBI. Usually that happens when a particular program or compartment has not been declassified. Given that it has a custom White House cover sheet, the document may be about a sensitive plan or program from the president or the NSC.


SCI compartments

The various cover sheets not only hide the content of the particular documents, but also their mandatory classification line at the top and the bottom of the document. Therefore we don't know which kind of intelligence they contain and how sensitive they actually are.

The cover sheets for Secret/SCI and Top Secret/SCI both have the warning "Contains Sensitive Compartmented Information up to HCS-P/SI/TK", which means the documents may contain information from one, two or even all three of the following SCI control systems:

- HCS-P = Humint Control System - Product (intelligence from human sources)
- SI = Special Intelligence (intelligence from intercepted communications)
- TK = TALENT KEYHOLE (intelligence from satellite collection platforms)

The documents found at Mar-a-Lago at least don't contain the most sensitive human intelligence information, which is protected by the HCS-O(perations) compartment.

It's not clear whether these cover sheets are also used for documents with information from compartments or sub-compartments of these control systems, i.e. even more sensitive and closely guarded secrets.

Update:
On October 21, 2022, The Washington Post reported that among the most sensitive documents seized by the FBI describes Iran's missile program. Others describe highly sensitive intelligence work aimed at China, according to anonymous sources, who also said that many of the more sensitive documents are "top-level analysis papers that do not contain sources' names. But even without individual identifiers, such documents can provide valuable clues to foreign adversaries about how the United States may be gathering intelligence, and from whom."


Dissemination markings

Besides the documents with a cover sheet, the FBI photo shows 12 classified documents without such a colorful protection and therefore they redacted all the content. One document (between the yellow Top Secret/SCI cover sheets) is fully redacted, on the others we see the following classification markings:

- SECRET//ORCON-USGOV/NOFORN and LIMITED ACCESS (2 documents)
- SECRET//ORCON-USGOV/NOFORN (6 documents)
- SECRET with additional markings redacted (1 document)
- SECRET NOFORN (1 document)
- SECRET and something illegible (1 document)
- CONFIDENTIAL and LIMITED ACCESS (1 document)

Distinctive here are the so-called dissemination markings, which are added to the classification level to restrict the dissemination of information among only those people who have the appropriate clearance level and the need to know the information. The dissemination markings seen here are:

- ORCON, which means the originator of the information controls to whom it is released. It allows originators to maintain knowledge, supervision, and control of the distribution of the information beyond its original dissemination. Further dissemination of this information requires advance permission from the originator.

- ORCON-USGOV, which means the information "has been pre-approved for further dissemination without originator approval to the US Government's Executive Branch Departments and Agencies." It's not allowed to use this marking with information classified as SI-G or HCS-O.

- NOFORN, which means the information may not be disclosed or released to foreign nationals, foreign governments, or international organizations of governments without permission by the originator.

- LIMITED ACCESS seems not a registred dissemination marking as it's not part of the classification line and is also not listed in the 2016 manual for the Intelligence Community Markings System nor in the list of CUI dissemination markings from 2021, which suggests that it's an internal White House marking.

This brings to mind US Director of National Intelligence Dan Coats who in February 2018 warned that presidential aides with interim security clearances should only have limited access to classified information. Not much later a bill to the same effect was introduced, but didn't pass the House of Representatives.

Shortly before it had come out that Trump's former staff secretary Rob Porter and his son-in-law Jared Kushner were working under an interim security clearance and more than 30 of Trump's aides had their clearance downgraded from Top Secret to Secret.


In total, the FBI photo of item #2A shows 22 classified documents: 1 Confidential, 14 Secret and 7 Top Secret.



The detailed property inventory

As if the photo of the classified documents wasn't enough, the court also unsealed the Detailed Property Inventory, which happened on September 2, 2022. This inventory lists in more detail all the things the FBI seized at Mar-a-Lago:




Total number of classified documents

In this inventory we see the other documents which the FBI found in the leatherbound box (item #2), showing that it actually contained 1 Confidential and 1 Secret document more than seen in the photo, maybe because some were stacked together. In total, the leatherbound box contained 24 classified documents:

7 Top Secret, of which:
5 with Top Secret/SCI cover sheet
1 with EOP/White House cover sheet
15 Secret, of which:
1 with Secret/SCI cover sheet
2 Confidential

Overall, the FBI seized 103 classified documents: 31 Confidential, 54 Secret and 18 Top Secret, dispersed in 13 boxes from the storage room as well as in the leatherbound box from Trump's office, where one separate classified document (item #1) was found as well.


Empty folders

According to the detailed inventory, item #2 also included 43 "Empty Folders with "CLASSIFIED" Bannners" as well as 28 empty folders labeled "Return to Staff Secretary/Military Aide". These kind of folders are used in the White House to bundle (and cover) the actual classified documents for the president. From Obama's presidency there are several photos of such folders:


A folder holding classified information on president Obama's desk, June 2009
(White House photo - click to enlarge)


There even appeared a photo on Twitter of such an empty folder which is on display among other memorabilia from Trump's presidency in the 45 Wine & Whiskey bar on the lobby floor of Trump Tower in Manhattan:



In total, the detailed inventory lists 48 of these empty folders, so it's possible that they originally contained the 103 classified documents which the FBI found "unfoldered" and scattered among the various boxes. Interesting though, is that 43 of those empty folders were in the box with the (much smaller number of) classified documents in Trump's office.

At the White House such folders and their content had to be returned to the staff secretary, just like how the empty folders for unclassified documents were labeled. However, this didn't bother Trump, who had the habit of simply ripping up(!) any papers he was no longer interested in or had finished reviewing.

He did so with papers ranging "from routine documents to classified material, and leaving the pieces strewn around the floor or in a trash can. Officials would have to rummage through the shreds and tape them back together to recreate the documents in order to store them as required under the Presidential Records Act."

Update:
On September 26, 2022, the Justice Department filed a slightly revised version of the Detailed Property Inventory. It shows small differences in the number of press clippings and unclassified government documents and that in box 33 there were only 2 empty "Return to Staff Secretary" folders and no empty folders for classified documents, so in total there are just 46 instead of 48 empty classified folders.



Trump's boxes

According to the Detailed Property Inventory, the FBI also found a huge number of "US Government Documents/Photographs without Classification Markings" - over 1400 in Trump's office and over 9700(!) in the various boxes from the storage room.

In a dispute about possibly privileged documents, Trump's lawyer claimed that the over 11,000 unclassified documents amount to some 200,000 pages, but later a special master said they only contain 21,792 pages, which is an average of less than 2 pages per document.

Also interesting is that most of the 26 boxes from the storage room contain a mix of:

- Magazines, newspapers, press articles, other printed media (1,673 in total)
- Classified US government documents (103 in total)
- Unclassified US government documents/photographs (11,179 in total)
- Miscellanea (clothing, books, gifts and empty folders)


Trump's way of working

This more or less similar composition can be explained by Trump's routine at the White House, where he used to work in the small dining room near the Oval Office. On the dining table he made piles of paper, which included everything from news articles to highly classified government documents. These were stacked into cardboard boxes, while "staffers kept swapping out the boxes as they filled up."

Trump also had material sent "up to the White House Residence, and it was not always clear what happened to it. He sometimes asked to keep material after his intelligence briefings, but aides said he was so uninterested in the paperwork during the briefings themselves that they never understood what he wanted it for."

The boxes followed him wherever he went as they contained "all the save-for-later items that Trump would spend long flights going through: articles that he wanted to scribble Sharpie messages on before mailing them off to close friends; gossipy stories about West Wing drama that he would hate-read as he sought to identify leakers; and, occasionally, important memos on any number of policy topics or budding crises."



Disorderly piles of paper on president's Trump desk in the Oval Office, January 28, 2017
(photo: Drew Angerer/Getty - click to enlarge)



The boxes that went to Florida

The papers that Trump had accumulated in his last several months in office had been dropped into roughly two dozen boxes, which had apparently been in the White House Residence and thus were packed up with Trump's personal belongings.

As such, they not only contained some highly classified documents, but also several personal mementos, including the "love letters" from the North Korean dictator Kim Jong-un and the letter which former president Obama left on his last day in office.

Although the White House Counsel's Office had told Trump's chief of staff Mark Meadows that these boxes in the Residence needed to be turned over to the National Archives, they were actually shipped to Mar-a-Lago.

Eventually, at least 42 boxes arrived in Florida. 15 of them were retrieved by the National Archives on January 18, 2022, 38 classified documents were handed over to the FBI on June 3, while the rest was seized during the search on August 8.

However, as emptywheel noticed, the press clippings date back to 1995, but there are none that postdate November 2020, which may indicate that the FBI still has not all the documents that Trump took with him.


One of Trump's boxes accidentally turned over, December 7, 2021
(photo from the indictment - click to enlarge)


Update:
On December 7, 2022, it was reported that a team hired by Trump’s lawyers found two additional classified documents in a storage unit where the General Services Administration had shipped Trump's belongings after he left the White House (likely the one in West Palm Beach, Florida). The documents were handed over to the FBI. Besides the storage unit, the team searched Trump Tower in New York, the Bedminster golf club and an office location in Florida.


Overview of the boxes and classified documents found at Trump's properties
(click to enlarge)



Update: The indictment

On June 9, 2023, the US Justice Department filed an indictment against former president Trump, accusing him of mishandling classified documents he kept upon leaving office and then obstructing the government’s efforts to reclaim them.

The indictment provides detailed information about how Trump's boxes were handled and where exactly they had been stored, including several photos of those rooms. Trump is specifically charged with the possession of 31 documents, which the indictment lists with additional details.

A reasonable guess about the contents of some of those documents is provided by PwnAllTheThings, while emptywheel considers that the reason for so many highly classified documents being included in the indictment is because they may have been compromised already.


Boxes stored in a bathroom of the Lake Room at Mar-a-Lago
(photo from the indictment - click to enlarge)


Of the 31 classified documents listed in the indictment:

- 10 documents had been returned to the FBI on June 3, 2022:

- 1 TS // [redacted] / SI / TK // ORCON / NOFORN
- 2 TS // [redacted] // ORCON / NOFORN / FISA
- 1 TS // [redacted] // RSEN / ORCON / NOFORN
- 2 TS // HCS-P / SI // ORCON-USGOV / NOFORN
- 2 TS // SI / TK // NOFORN
- 2 TS // Special Handling

- 21 documents had been seized by the FBI on August 8, 2022:

- 1 TS // [redacted] / [redacted] // ORCON / NOFORN / FISA
- 1 TS // [redacted] / [redacted] // ORCON / NOFORN
- 1 TS // [redacted] / TK // ORCON / IMCON / NOFORN
- 1 TS // [redacted] // ORCON / NOFORN
- 1 TS // SI / TK // NOFORN
- 1 TS // SI // NOFORN / Special Handling
- 1 TS // SI // NOFORN / FISA
- 1 TS // TK // NOFORN
- 1 TS // NOFORN // Special Handling
- 2 TS // Special Handling
- 3 S // ORCON / NOFORN
- 3 S // NOFORN
- 1 S // FRD
- 2 S // REL to USA, FVEY
- 1 no marking


Redacted compartments

For an explanation of all these classification markings, see above. What's interesting is that at least two different codewords have been redacted, which means there are at least two SCI control systems or Special Access Programs (SAPs), the existence of which hasn't been declassified, as is the case with SI, TK and HCS-P.

All the classification lines with the redacted codewords have the Originator Controlled (ORCON) and No Foreign Nationals (NOFORN) dissemination markings, which indicates that the information from these hidden SCI control systems or SAPs is more sensitive than the usual information from the SI and TK control systems.

From the descriptions in the indictment it becomes clear that all documents with information from these redacted compartments are either about (US) military activities in foreign countries or about the military capabilities of foreign countries, including one document "concerning nuclear capabilities of a foreign country".


Some entries of the list of documents in the indictment against Donald Trump
(click to enlarge)


Formerly Restricted Data

One document listed in the indictment is classified as "Formerly Restricted Data" (FRD), which is a classification category for nuclear secrets under the Atomic Energy Act. FRD is primarily related to "the military utilization of atomic weapons".

The term "Formerly" doesn't mean that it has been declassified, but that it has been removed from the category "Restricted Data" (RD). RD contains the more sensitive information about "the design, manufacture, or use of atomic weapons; the production of special nuclear material; and the use of special nuclear material in the production of energy."


Special Handling

Also of interest is SPECIAL HANDLING, which isn't an official marking according to the 2016 Intelligence Community Markings System. In the indictment, all documents marked with SPECIAL HANDLING are described as "White House intelligence briefing", which may refer to the President's Daily Brief (PDB), or otherwise a less-important intelligence briefing.

As far as I know, the SPECIAL HANDLING marking hasn't been seen before, so it's unclear how restrictive it is. Since it's not in the official classification guides, it seems to be an internal White House marking, just like LIMITED ACCESS, which was seen on documents the FBI found in Trump's office during the search at Mar-a-Lago on August 8, 2022:


Document from Trump's office, classified SECRET//ORCON-USGOV/NOFORN
and additionally marked as LIMITED ACCESS
(click to enlarge)


Usage in court

While the FBI seized and received a total of 143 classified documents (35 of which Top Secret and 54 Secret) from Mar-a-Lago, the Department of Justice (DoJ) charged Trump with the illegal possession of only 31 documents (21 Top Secret and 9 Secret).

This is probably because the military or intelligence agency that owns the particular information didn't authorize DoJ to use it in a court case, or DoJ decided itself that the risk to sources and methods and/or other damage to national security outweighed their use and possible disclosure at trial.


On June 13, 2023, former president Trump appeared for an arraignment hearing at a federal courthouse in Miami where he pleaded not guilty.

On July 21, 2023, judge Aileen M. Cannon announced that the trial against Donald Trump for mishandling classified information will start on May 20, 2024 in her courthouse at Fort Pierce in Florida.

To be continued...



Links and sources

- Court Listener: United States v. Trump
- Emptywheel: Trump Document Theft Resources
- Teri Kanefield: Timeline: Trump's Stolen Documents Case
- LegalEagle: Videos about the Mar-a-Lago search case
- Wikipedia: FBI search of Mar-a-Lago

- Emptywheel: “POTUS is very emotional and in a bad place.” Donald Trump’s Classified Discovery (Oct. 10, 2023)
- ABC News: Trump allegedly discussed US nuclear subs with foreign national after leaving White House: Sources (Oct. 6, 2023)
- PwnAllTheThings: Donald Trump indictment: what are the classified documents? (June 9, 2023)
- The New York Times: Burn Bags and Tracking Numbers: How the White House Handles Classified Files (Jan. 30, 2023)
- The Washington Post: Skepticism before a search: Inside the Trump Mar-a-Lago documents investigation (Dec. 21, 2022)
- The Washington Post: Mar-a-Lago classified papers held U.S. secrets about Iran and China (Oct. 21, 2022)
- New York Intelligencer: Trump Was Betrayed by His Diet Coke Valet (Oct. 14, 2022)
- The New York Times: Justice Dept. Is Said to Believe Trump Has More Documents (Oct. 6, 2022)
- Business Insider: Court accidentally unsealed, then deleted, documents from the Mar-a-Lago case describing information the FBI seized from Trump (Oct. 6, 2022)
- Bloomberg: Trump Says US Agency Packed Top-Secret Documents. These Emails Suggest Otherwise. (Oct. 5, 2022)
- The Washington Post: Material on foreign nation’s nuclear capabilities seized at Trump’s Mar-a-Lago (Sept. 6, 2022)
- The New York Times: F.B.I. Found 48 Empty Folders That Had Contained Classified Documents at Trump’s Home (Sept. 2, 2022)
- Lawfare: A Justice Department Show of Force in the Mar-a-Lago Case (Aug. 31, 2022)
- The Washington Post: The photo of classified documents at Trump’s Mar-a-Lago resort, annotated (Aug. 31, 2022)
- Politico: Trump team likely sought to conceal classified docs at Mar-a-Lago, DOJ tells judge (Aug. 30, 2022)
- Indian Express: Inside the 20-month fight to get Trump to return Presidential material (Aug. 28, 2022)
- The New York Times: Another Trump Mystery: Why Did He Resist Returning the Government’s Documents? (Aug. 18, 2022)
- The Guardian: FBI searched Trump’s Mar-a-Lago home for classified nuclear weapons documents (Aug. 12, 2022)
- CNN: Former White House officials describe Trump’s habit of ripping up documents and haphazard record-keeping (Febr. 8, 2022)
- US State Department: Storing and Safeguarding Classified Material (Febr. 24, 2022)

October 29, 2019

The communications equipment in Trump's Situation Room photo


Last Sunday, October 27, the White House released a photo showing president Trump and his national security team in the Situation Room of the White House.

The photo caused some discussion because people suggested that it might be staged, but here the focus will mainly be on the communications equipment.



President Trump and his national security team in the White House Situation Room, October 26, 2019
(White House photo by Shealah Craighead - click to enlarge)


The people in this photo are (from left to right): National Security Advisor Robert O’Brien, Vice-President Mike Pence, President Donald Trump, Secretary of Defense Mark Esper, Chairman of the Joint Chiefs of Staff US Army General Mark A. Milley, and Brig. Gen. Marcus Evans, Deputy Director for Special Operations on the Joint Staff.

According to the press secretary, they were monitoring developments as US Special Operations forces closed in on the compound of ISIS leader Abu Bakr al-Baghdadi in Syria. Baghdadi eventually killed himself (and three of his children) by detonating a suicide vest. Some 14 hours after the raid, Trump announced Baghdadi's death.



Telephone equipment

In the photo released by the White House we also see several different telephone sets: left of president Trump, at his right hand, is a Cisco IP phone (either the 8841, 8851 or 8861), which is part of the internal White House telephone network and can be used for all non-secure calls.

On the back of this phone is a black metal box, which is a modification by Advanced Programs, Inc. (API) in order to meet Telephone Security Group (TSG) standards, including measures to prevent the handset and the speakerphone from picking up and transmitting audio when the phone is on-hook.




A close-up of the telephones in the White House Situation Room
(White House photo - click to enlarge)


A similar Cisco IP phone can be recognized at the left side of Trump, in front of the Chairman of the Joint Chiefs of Staff. This telephone doesn't have the additional box on the back, but does have a bright yellow faceplate, which is the color code for the highest classification level: Top Secret/SCI.

Therefore, this telephone is for secure calls, through the dedicated Executive Voice over Secure IP-network, which connects the US president with all major decision makers. The phone itself has no encryption capability, as it's connected to a central network encryptor, probably from General Dynamics' TACLANE familiy.


The secure telephone is almost hidden behind an older Cisco 7975G IP phone. This phone seems to have the standard silver faceplate, but there's a red label on the handset, which often indicates a secure line. Maybe it was installed especially for this operation as in the White House these old Cisco phones should have been replaced by newer ones from the 8800-series




Computer equipment

Besides the telephones, there are also some computers in the Situation Room: a tablet computer and three black laptops, one of which has two yellow labels, showing that the device may be used for classified information up to the level of Top Secret/SCI.

In the middle of the table there's a mess of network cables, many of them color-coded according to the classification level of the network they may connect to: red for Secret and yellow for Top Secret/SCI networks. Given that the meeting was about a military operation, they probably used:
- SIPRNet for military information at the Secret level
- JWICS for Top Secret/SCI military intelligence.

Both networks also have Voice-over-IP and video streaming capabilities. The audio and video in the conference room can be controlled by the small AMX touchscreen right in front of the president.



Close-up of the AMX audio and video control panel on the conference table
(still from a White House video - click to enlarge)


Was the photo staged?

Immediately after its release there were speculations about whether the photo was staged. On twitter, former White House photographer Pete Souza initially wrote: "The raid, as reported, took place at 3:30 PM Washington time. The photo, as shown in the camera IPTC data, was taken at “17:05:24”."

The latest press reports however say the attack in Syria took place after midnight local time in Syria, which corresponds to 6:00 PM in Washington. President Trump had been out golfing and arrived back at the White House at 4:18 PM, well in time to be in the Situation Room around 5:00 PM - which would mean the photo was taken before the two-hour operation started.

The photo of Trump's Situation Room reminds of the one showing president Obama and his national security team following the operation in which Osama bin Laden was killed on May 1, 2011, a scene that is generally assumed to look more realistic:



President Obama and his national security team following the
mission against Osama bin Laden, May 1, 2011.
(White House Photo by Pete Souza - click to enlarge)


In the Obama photo most officials aren't wearing suit jackets and no one is looking at the camera. Everyone was focused on the dramatic events on the video screen of the room (which is one of the smaller meeting rooms, next to the main conference room seen in the Trump photo).

By contrast, Trump and his ministers are fully dressed up with the president himself right in the center. Everyone looks, or is supposed to look right into the camera, which means the photographer stood right in front of the main video screen as can be seen in an earlier photo of the room taken from another angle:



President Trump meets with Republican and Democratic leaders, January 2, 2019.
(White House Photo by Shealah Craighead - click to enlarge)


So it seems that just before the operation against Abu Bakr al-Baghdadi started, president Trump took the opportunity to have pictures taken showing him and his national security team in the way he likes it - which is opposite to Obama's much more informal style.



Links & sources
- Der Spiegel: The Hunt for the World's Most-Wanted Terrorist
- The Independent: Anomalies in Trump situation room photo spark online conspiracy theories it was staged
- Business Insider: Trump’s al-Baghdadi raid Situation Room photo has one big difference from Obama’s Osama bin Laden picture ⁠— and it tells you everything about their styles
- CNN: Photos highlight stark differences in Trump and Obama approaches


Some older articles on this weblog that are of current interest:
In Dutch: Volg de actuele ontwikkelingen rond de Wet op de inlichtingen- en veiligheidsdiensten via het Dossier herziening Wiv 2017