Showing posts with label Trump. Show all posts
Showing posts with label Trump. Show all posts

September 21, 2022

The highly classified documents found at Trump's residence Mar-a-Lago

(Updated: July 21, 2023)

This weblog is not only about signals intelligence, communications security and top level telecommunications equipment, but also about the US Classification System, which is equally fascinating in all its complexities.

Recently, an unprecedented photo from the FBI provided a unique look at highly classified documents which former US president Donald Trump stole from the White House and stored at his private residence Mar-a-Lago in Florida.

Here I'll provide a detailed explanation of these documents, as well as where they apparantly came from.



Mar-a-Lago and the highest classified documents which the FBI found in Trumps office



Moving to Mar-a-Lago

On January 20, 2021, former president Donald J. Trump left the White House and moved his belongings to his residence Mar-a-Lago in Palm Beach, Florida. The National Archives and Records Administration (NARA) subsequently learned of approximately two dozen boxes of presidential records that had not been returned to it as required under the Presidential Records Act (PRA).

Late 2021, officials at the archives warned Trump's team that there could be a referral to the Justice Department or an alert to Congress if he continued to refuse to comply with the PRA. Apparently, Trump ultimately went through several boxes at Mar-a-Lago himself and late December, his lawyers informed the NARA that they had found 12 boxes of documents and that they were ready for retrieval.


Donald Trump's residence Mar-a-Lago in Palm Beach, Florida, March 2019
(White House photo - click to enlarge)


15 boxes retrieved

On January 18, 2022, the NARA finally retrieved 15 boxes of records from Mar-a-Lago, containing presidential records and other sensitive material, along with various news clippings and other miscellanea. In its initial review of the materials within those boxes, NARA identified classified documents marked up to the level of Top Secret, including Sensitive Compartmented Information (SCI) and Special Access Programs (SAP).

On February 9, NARA told the Department of Justice (DOJ) that the 15 boxes contained highly classified records that were "unfoldered, intermixed with other records and otherwise unproperly identified." President Biden granted the FBI access to the boxes for examination and by May, the bureau had identified classified documents in 14 of the 15 boxes. In total, there were 184 classified documents, 67 of which were marked Confidential, 92 Secret and 25 Top Secret.


Criminal investigation

Former president Trump then attempted to delay the DOJ's review of the materials by asserting executive privilege over the documents. After the Assistant Attorney General for the Office of Legal Counsel rejected this claim, the FBI launched a criminal investigation to determine:

- How these classified documents were removed from the White House;
- Whether Mar-a-Lago was an authorized storage location for those documents;
- Whether additional classified documents had been removed from the White House;
- Which individuals were involved in the removal and storage of the documents at Mar-a-Lago.

A grand jury was installed and the FBI began interviewing several of Trump's personal aides as well as three former White House lawyers who had been among Trump's representatives to the archives.


Classification markings

On May 11, former president Donald J. Trump was served with a grand jury subpoena which ordered him to hand over any and all documents bearing at least the following classification markings:




These classification markings contain a lot of lesser-known abbreviations, which are explained in my earlier overview of the US Classification System. They are, in order of appearance:

- SI = Special Intelligence (intelligence from intercepted communications)
- G = GAMMA (sensitive communication intercepts)
- NOFORN = No Foreign Nationals
- ORCON = Originator Controlled
- HCS = HUMINT Control System (intelligence from human sources)
- HCS-O = HCS Operations (HUMINT operations and methods)
- HCS-P = HCS Product (HUMINT intelligence reports)
- TK = TALENT-KEYHOLE (intelligence from satellite collection)
- TS = Top Secret (release would cause exceptionally grave damage to national security)
- SAP = Special Access Program (non-intelligence equivalent of SCI)
- NF = NOFORN (see above)
- OC = ORCON (see above)
- FRD = Formerly Restricted Data (about nuclear weapons)
- NATO = Releasable to NATO partners
- S = Secret (release would cause serious damage to national security)
- C = Confidential (release would cause damage to national security)

This list may have been based upon the classification markings that the FBI found on the documents in the boxes that had already been retrieved by the National Archives, but according to The Washington Post, the goal of the list was to ensure recovery of all classified records, and not just those that investigators had reason to believe might be at Mar-a-Lago. This becomes clear from the fact that the list contains all possible combinations of the various markings.


Nuclear weapons information?

Therefore the markings in the list don't say whether or not certain kinds of information were present at Mar-a-Lago. That especially applies to press reports saying that among the things that Trump was still hiding were documents about nuclear weapons, which was likely based upon the FRD marking in the list. Given that this marking is only listed once, there may have been only very few if not just one single document with nuclear weapons information, with many more about signals intelligence (SI) and human intelligence (HCS).

In an affidavit from August 5, the FBI listed the statutory authorities upon which it based its application for a search warrant:

- 18 USC 793(e), the Espionage Act
- 18 USC 1519, obstruction
- 18 USC 2071, willfully removing information
- 44 USC 2201, the Presidential Records Act
- 44 USC 3301(a), the Federal Records Act
- EO 13526, the Executive Order governing classified information

Not listed was the Atomic Energy Act (AEA), so apparently the FBI didn't expect to find classified documents about American nuclear weapons. However, on September 6, it was reported that among the thousands of documents which the FBI eventually seized at Mar-a-Lago, there was one document that described a "foreign government's military defenses, including its nuclear capabilities" - which is much less secret and sensitive than information about American weapons.


Secret Service agents stand outside an entrance to Mar-a-Lago, August 8, 2022
(Photo: Terry Renna/Associated Press - click to enlarge)


A misleading statement

On June 3, 2022, the DoJ's Chief of Counterintelligence Jay Bratt and some FBI agents visited Mar-a-Lago where they received 38 additional classified documents, including 17 labeled Top Secret, in "a single Redweld envelope, double-wrapped in tape". One of Trump's lawyers signed a statement asserting that they had conducted a diligent search of the boxes from the White House and handed over the remaining classified material.

The FBI was informed that all of the records from the White House had been kept in one particular storage room and that "there were no other records stored in any private office space or other location at the Premises and that all available boxes were searched." However, government personnel was "explicitly prohibited from opening or looking inside any of the boxes that remained in the storage room."

Updates:

According to court records, the FBI agents and the DOJ counsel who were permitted to see the storage room on June 3, 2022, observed that there were approximately 50 to 55 boxes in that room, besides a coat rack with suit jackets, as well as interior decor items such as wall art and frames.

An unknown number of those boxes may have come from five (later repacked to six) pallets with about 85 document boxes which in July 2021 were shipped from a temporary office space used by Trump's staff in Arlington, Virginia to Mar-a-Lago (2 pallets) and a facility of Life Storage (4 pallets) in West Palm Beach, Florida.


Five pallets of boxes ready for shipment from Virginia to Florida, July 2021
(photo: GSA via FOIA request by Bloomberg)


According to the indictment filed by the Justice Department on June 9, 2023, Trump's aid Walt Nauta started to move boxes out of the Mar-a-lago storage room on May 22, 2022. In the next days, he moved a total of 65 boxes out of the room and on June 2, he moved 30 boxes back. Right after that, Trump's lawyer Evan Corcoran conducted a review to see whether the boxes contained classified documents.


Boxes in the storage room of Trump's residence Mar-a-Lago
(photo from the indictment - click to enlarge)



The search at Mar-a-Lago

On August 5, 2022, a federal judge signed a search warrant for Mar-a-Lago on the grounds that "National Defense Information" (NDI) had been found in the boxes NARA retrieved from Mar-a-Lago and that there was probable cause to believe that additional documents containing such information remained at Trump's estate.

Three days later, FBI agents searched the Mar-a-Lago estate and seized what initially appeared to be 12 boxes of documents. Classified material was recovered from a storage room in the basement and from a container on the floor of a closet in a former dressing room of the bridal suite above the ballroom, which now serves as Trump's office, also known as the "45 office".


Items seized by the FBI

The result of this search is described in a form called "Receipt for Property" which lists 33 items, mostly boxes, which were (discontinuously) labeled A-1 to A-73. Besides the boxes there were also some separate documents, notes and binders of photos. A detailed discussion of these seized materials can be found at the emptywheel weblog.




According to a DoJ filing from August 31, these boxes contained over a hundred classified records spread over 11 boxes. In the receipt they are seperately listed and marked with an additional A, for example: "13 - Box labeled A-18" which contained "13A - Miscellaneous Top Secret Documents", etc.


Highly classified documents

The most sensitive kind of documents, classified as Sensitive Compartmented Information (SCI), were only found in item #2, a "Leatherbound box of documents". These appeared so sensitive that "even the FBI counterintelligence personnel and DOJ attorneys conducting the review required additional clearances before they were permitted to review them."

On August 30, a filing by the Justice Department included an unprecedented photograph which shows the classified documents from the leatherbound box from Trump's office:


Classified documents marked as item #2A spread on the floor of Trumps office in Mar-a-Lago
(Photo via the US District Court for the Southern District of Florida - click to enlarge)


This photo was taken by the FBI in order to document the evidence they found, which explains the ruler and a marker that says that this is item #2A. To counter the impression that he had them lying on the floor like this, Trump said that it had been FBI agents who "took [these documents] out of cartons and spread them around on the carpet".

The documents were spread on a carpet with a classic flower motif, with on the right side a cardboard box with five picture frames, one of which shows a Time magazine cover from March 4, 2019, showing all the Democratic candidates who hoped to challenge Trump in the 2020 election.

On the left there's a small part of fringed dark-blue fabric, probably a curtain, and a white scalloped cabinet, which was identified as a $3679.- Birkdale File Chest - most likely from the time that this room was part of Mar-a-Lago's bridal suite.



Cover sheets

Most eye-catching are the colorful cover sheets for classified information. In the photo we can recognize four types, three of which were never seen before. Already known and publicly available are the standard cover sheets (SF704) with the broad borders in red, which are used to protect documents classified as Secret.


Secret/SCI

In the front of the photo there's a cover sheet which looks brownish but may also be red (or orange) with the text "SECRET//SCI - Contains Sensitive Compartmented Information up to HCS-P/SI/TK". Unlike the common cover sheets for Secret documents, this one was never seen before. It's also more rare, because usually information from an SCI compartment is classified Top Secret.

The cover sheet for a document classified as Secret/SCI
(click to enlarge)


SCI is sometimes called "above Top Secret" but officially that's not correct: SCI encompasses compartments of information that provide additional protection within the level Top Secret. In the same way these compartments can exist within the level Secret and actually a particular SCI compartment may contain information at any classification level:



Top Secret/SCI

In the FBI photo we also see five cover sheets for documents classified as Top Secret/SCI. While the standard cover sheet for Top Secret information (SF703) is also publicly available, this one was never seen before. It has a broad border in yellow, which is the color code for Sensitive Compartmented Information (SCI), and text in orange, which may refer to the color code for Top Secret:

Cover sheets for documents classified as Top Secret/SCI
(click to enlarge)


A White House cover sheet

Finally, there's a fourth cover sheet, which is only partially visible because it's folded back, probably to show the classification marking on the document. On the cover sheet we can only read some fragments, like "THIS", "PLEASE STORE IN" (a GSA Approved Security Container which is depicted right above these words) and "UNAU[THORIZED]".

In the upper right corner it has a seal which can be identified as that of the Executive Office of the President of the United States (EOP), which includes a range of offices and bodies like the National Security Council (NSC), the White House Military Office (WHMO) and the staff of the West Wing.

The custom White House cover sheet
(click to enlarge)


This document is classified Top Secret, but interestingly, the rest of the classification line has been redacted by the FBI. Usually that happens when a particular program or compartment has not been declassified. Given that it has a custom White House cover sheet, the document may be about a sensitive plan or program from the president or the NSC.


SCI compartments

The various cover sheets not only hide the content of the particular documents, but also their mandatory classification line at the top and the bottom of the document. Therefore we don't know which kind of intelligence they contain and how sensitive they actually are.

The cover sheets for Secret/SCI and Top Secret/SCI both have the warning "Contains Sensitive Compartmented Information up to HCS-P/SI/TK", which means the documents may contain information from one, two or even all three of the following SCI control systems:

- HCS-P = Humint Control System - Product (intelligence from human sources)
- SI = Special Intelligence (intelligence from intercepted communications)
- TK = TALENT KEYHOLE (intelligence from satellite collection platforms)

The documents found at Mar-a-Lago at least don't contain the most sensitive human intelligence information, which is protected by the HCS-O(perations) compartment.

It's not clear whether these cover sheets are also used for documents with information from compartments or sub-compartments of these control systems, i.e. even more sensitive and closely guarded secrets.

Update:
On October 21, 2022, The Washington Post reported that among the most sensitive documents seized by the FBI describes Iran's missile program. Others describe highly sensitive intelligence work aimed at China, according to anonymous sources, who also said that many of the more sensitive documents are "top-level analysis papers that do not contain sources' names. But even without individual identifiers, such documents can provide valuable clues to foreign adversaries about how the United States may be gathering intelligence, and from whom."


Dissemination markings

Besides the documents with a cover sheet, the FBI photo shows 12 classified documents without such a colorful protection and therefore they redacted all the content. One document (between the yellow Top Secret/SCI cover sheets) is fully redacted, on the others we see the following classification markings:

- SECRET//ORCON-USGOV/NOFORN and LIMITED ACCESS (2 documents)
- SECRET//ORCON-USGOV/NOFORN (6 documents)
- SECRET with additional markings redacted (1 document)
- SECRET NOFORN (1 document)
- SECRET and something illegible (1 document)
- CONFIDENTIAL and LIMITED ACCESS (1 document)

Distinctive here are the so-called dissemination markings, which are added to the classification level to restrict the dissemination of information among only those people who have the appropriate clearance level and the need to know the information. The dissemination markings seen here are:

- ORCON, which means the originator of the information controls to whom it is released. It allows originators to maintain knowledge, supervision, and control of the distribution of the information beyond its original dissemination. Further dissemination of this information requires advance permission from the originator.

- ORCON-USGOV, which means the information "has been pre-approved for further dissemination without originator approval to the US Government's Executive Branch Departments and Agencies." It's not allowed to use this marking with information classified as SI-G or HCS-O.

- NOFORN, which means the information may not be disclosed or released to foreign nationals, foreign governments, or international organizations of governments without permission by the originator.

- LIMITED ACCESS seems not a registred dissemination marking as it's not part of the classification line and is also not listed in the 2016 manual for the Intelligence Community Markings System nor in the list of CUI dissemination markings from 2021, which suggests that it's an internal White House marking.

This brings to mind US Director of National Intelligence Dan Coats who in February 2018 warned that presidential aides with interim security clearances should only have limited access to classified information. Not much later a bill to the same effect was introduced, but didn't pass the House of Representatives.

Shortly before it had come out that Trump's former staff secretary Rob Porter and his son-in-law Jared Kushner were working under an interim security clearance and more than 30 of Trump's aides had their clearance downgraded from Top Secret to Secret.


In total, the FBI photo of item #2A shows 22 classified documents: 1 Confidential, 14 Secret and 7 Top Secret.



The detailed property inventory

As if the photo of the classified documents wasn't enough, the court also unsealed the Detailed Property Inventory, which happened on September 2, 2022. This inventory lists in more detail all the things the FBI seized at Mar-a-Lago:




Total number of classified documents

In this inventory we see the other documents which the FBI found in the leatherbound box (item #2), showing that it actually contained 1 Confidential and 1 Secret document more than seen in the photo, maybe because some were stacked together. In total, the leatherbound box contained 24 classified documents:

7 Top Secret, of which:
5 with Top Secret/SCI cover sheet
1 with EOP/White House cover sheet
15 Secret, of which:
1 with Secret/SCI cover sheet
2 Confidential

Overall, the FBI seized 103 classified documents: 31 Confidential, 54 Secret and 18 Top Secret, dispersed in 13 boxes from the storage room as well as in the leatherbound box from Trump's office, where one separate classified document (item #1) was found as well.


Empty folders

According to the detailed inventory, item #2 also included 43 "Empty Folders with "CLASSIFIED" Bannners" as well as 28 empty folders labeled "Return to Staff Secretary/Military Aide". These kind of folders are used in the White House to bundle (and cover) the actual classified documents for the president. From Obama's presidency there are several photos of such folders:


A folder holding classified information on president Obama's desk, June 2009
(White House photo - click to enlarge)


There even appeared a photo on Twitter of such an empty folder which is on display among other memorabilia from Trump's presidency in the 45 Wine & Whiskey bar on the lobby floor of Trump Tower in Manhattan:



In total, the detailed inventory lists 48 of these empty folders, so it's possible that they originally contained the 103 classified documents which the FBI found "unfoldered" and scattered among the various boxes. Interesting though, is that 43 of those empty folders were in the box with the (much smaller number of) classified documents in Trump's office.

At the White House such folders and their content had to be returned to the staff secretary, just like how the empty folders for unclassified documents were labeled. However, this didn't bother Trump, who had the habit of simply ripping up(!) any papers he was no longer interested in or had finished reviewing.

He did so with papers ranging "from routine documents to classified material, and leaving the pieces strewn around the floor or in a trash can. Officials would have to rummage through the shreds and tape them back together to recreate the documents in order to store them as required under the Presidential Records Act."

Update:
On September 26, 2022, the Justice Department filed a slightly revised version of the Detailed Property Inventory. It shows small differences in the number of press clippings and unclassified government documents and that in box 33 there were only 2 empty "Return to Staff Secretary" folders and no empty folders for classified documents, so in total there are just 46 instead of 48 empty classified folders.



Trump's boxes

According to the Detailed Property Inventory, the FBI also found a huge number of "US Government Documents/Photographs without Classification Markings" - over 1400 in Trump's office and over 9700(!) in the various boxes from the storage room.

In a dispute about possibly privileged documents, Trump's lawyer claimed that the over 11,000 unclassified documents amount to some 200,000 pages, but later a special master said they only contain 21,792 pages, which is an average of less than 2 pages per document.

Also interesting is that most of the 26 boxes from the storage room contain a mix of:

- Magazines, newspapers, press articles, other printed media (1,673 in total)
- Classified US government documents (103 in total)
- Unclassified US government documents/photographs (11,179 in total)
- Miscellanea (clothing, books, gifts and empty folders)


Trump's way of working

This more or less similar composition can be explained by Trump's routine at the White House, where he used to work in the small dining room near the Oval Office. On the dining table he made piles of paper, which included everything from news articles to highly classified government documents. These were stacked into cardboard boxes, while "staffers kept swapping out the boxes as they filled up."

Trump also had material sent "up to the White House Residence, and it was not always clear what happened to it. He sometimes asked to keep material after his intelligence briefings, but aides said he was so uninterested in the paperwork during the briefings themselves that they never understood what he wanted it for."

The boxes followed him wherever he went as they contained "all the save-for-later items that Trump would spend long flights going through: articles that he wanted to scribble Sharpie messages on before mailing them off to close friends; gossipy stories about West Wing drama that he would hate-read as he sought to identify leakers; and, occasionally, important memos on any number of policy topics or budding crises."



Disorderly piles of paper on president's Trump desk in the Oval Office, January 28, 2017
(photo: Drew Angerer/Getty - click to enlarge)



The boxes that went to Florida

The papers that Trump had accumulated in his last several months in office had been dropped into roughly two dozen boxes, which had apparently been in the White House Residence and thus were packed up with Trump's personal belongings.

As such, they not only contained some highly classified documents, but also several personal mementos, including the "love letters" from the North Korean dictator Kim Jong-un and the letter which former president Obama left on his last day in office.

Although the White House Counsel's Office had told Trump's chief of staff Mark Meadows that these boxes in the Residence needed to be turned over to the National Archives, they were actually shipped to Mar-a-Lago.

Eventually, at least 42 boxes arrived in Florida. 15 of them were retrieved by the National Archives on January 18, 2022, 38 classified documents were handed over to the FBI on June 3, while the rest was seized during the search on August 8.

However, as emptywheel noticed, the press clippings date back to 1995, but there are none that postdate November 2020, which may indicate that the FBI still has not all the documents that Trump took with him.


One of Trump's boxes accidentally turned over, December 7, 2021
(photo from the indictment - click to enlarge)


Update:
On December 7, 2022, it was reported that a team hired by Trump’s lawyers found two additional classified documents in a storage unit where the General Services Administration had shipped Trump's belongings after he left the White House (likely the one in West Palm Beach, Florida). The documents were handed over to the FBI. Besides the storage unit, the team searched Trump Tower in New York, the Bedminster golf club and an office location in Florida.


Overview of the boxes and classified documents found at Trump's properties
(click to enlarge)



Update: The indictment

On June 9, 2023, the US Justice Department filed an indictment against former president Trump, accusing him of mishandling classified documents he kept upon leaving office and then obstructing the government’s efforts to reclaim them.

The indictment provides detailed information about how Trump's boxes were handled and where exactly they had been stored, including several photos of those rooms. Trump is specifically charged with the possession of 31 documents, which the indictment lists with additional details.

A reasonable guess about the contents of some of those documents is provided by PwnAllTheThings, while emptywheel considers that the reason for so many highly classified documents being included in the indictment is because they may have been compromised already.


Boxes stored in a bathroom of the Lake Room at Mar-a-Lago
(photo from the indictment - click to enlarge)


Of the 31 classified documents listed in the indictment:

- 10 documents had been returned to the FBI on June 3, 2022:

- 1 TS // [redacted] / SI / TK // ORCON / NOFORN
- 2 TS // [redacted] // ORCON / NOFORN / FISA
- 1 TS // [redacted] // RSEN / ORCON / NOFORN
- 2 TS // HCS-P / SI // ORCON-USGOV / NOFORN
- 2 TS // SI / TK // NOFORN
- 2 TS // Special Handling

- 21 documents had been seized by the FBI on August 8, 2022:

- 1 TS // [redacted] / [redacted] // ORCON / NOFORN / FISA
- 1 TS // [redacted] / [redacted] // ORCON / NOFORN
- 1 TS // [redacted] / TK // ORCON / IMCON / NOFORN
- 1 TS // [redacted] // ORCON / NOFORN
- 1 TS // SI / TK // NOFORN
- 1 TS // SI // NOFORN / Special Handling
- 1 TS // SI // NOFORN / FISA
- 1 TS // TK // NOFORN
- 1 TS // NOFORN // Special Handling
- 2 TS // Special Handling
- 3 S // ORCON / NOFORN
- 3 S // NOFORN
- 1 S // FRD
- 2 S // REL to USA, FVEY
- 1 no marking


Redacted compartments

For an explanation of all these classification markings, see above. What's interesting is that at least two different codewords have been redacted, which means there are at least two SCI control systems or Special Access Programs (SAPs), the existence of which hasn't been declassified, as is the case with SI, TK and HCS-P.

All the classification lines with the redacted codewords have the Originator Controlled (ORCON) and No Foreign Nationals (NOFORN) dissemination markings, which indicates that the information from these hidden SCI control systems or SAPs is more sensitive than the usual information from the SI and TK control systems.

From the descriptions in the indictment it becomes clear that all documents with information from these redacted compartments are either about (US) military activities in foreign countries or about the military capabilities of foreign countries, including one document "concerning nuclear capabilities of a foreign country".


Some entries of the list of documents in the indictment against Donald Trump
(click to enlarge)


Formerly Restricted Data

One document listed in the indictment is classified as "Formerly Restricted Data" (FRD), which is a classification category for nuclear secrets under the Atomic Energy Act. FRD is primarily related to "the military utilization of atomic weapons".

The term "Formerly" doesn't mean that it has been declassified, but that it has been removed from the category "Restricted Data" (RD). RD contains the more sensitive information about "the design, manufacture, or use of atomic weapons; the production of special nuclear material; and the use of special nuclear material in the production of energy."


Special Handling

Also of interest is SPECIAL HANDLING, which isn't an official marking according to the 2016 Intelligence Community Markings System. In the indictment, all documents marked with SPECIAL HANDLING are described as "White House intelligence briefing", which may refer to the President's Daily Brief (PDB), or otherwise a less-important intelligence briefing.

As far as I know, the SPECIAL HANDLING marking hasn't been seen before, so it's unclear how restrictive it is. Since it's not in the official classification guides, it seems to be an internal White House marking, just like LIMITED ACCESS, which was seen on documents the FBI found in Trump's office during the search at Mar-a-Lago on August 8, 2022:


Document from Trump's office, classified SECRET//ORCON-USGOV/NOFORN
and additionally marked as LIMITED ACCESS
(click to enlarge)


Usage in court

While the FBI seized and received a total of 143 classified documents (35 of which Top Secret and 54 Secret) from Mar-a-Lago, the Department of Justice (DoJ) charged Trump with the illegal possession of only 31 documents (21 Top Secret and 9 Secret).

This is probably because the military or intelligence agency that owns the particular information didn't authorize DoJ to use it in a court case, or DoJ decided itself that the risk to sources and methods and/or other damage to national security outweighed their use and possible disclosure at trial.


On June 13, 2023, former president Trump appeared for an arraignment hearing at a federal courthouse in Miami where he pleaded not guilty.

On July 21, 2023, judge Aileen M. Cannon announced that the trial against Donald Trump for mishandling classified information will start on May 20, 2024 in her courthouse at Fort Pierce in Florida.

To be continued...



Links and sources

- Court Listener: United States v. Trump
- Emptywheel: Trump Document Theft Resources
- Teri Kanefield: Timeline: Trump's Stolen Documents Case
- LegalEagle: Videos about the Mar-a-Lago search case
- Wikipedia: FBI search of Mar-a-Lago

- Emptywheel: “POTUS is very emotional and in a bad place.” Donald Trump’s Classified Discovery (Oct. 10, 2023)
- ABC News: Trump allegedly discussed US nuclear subs with foreign national after leaving White House: Sources (Oct. 6, 2023)
- PwnAllTheThings: Donald Trump indictment: what are the classified documents? (June 9, 2023)
- The New York Times: Burn Bags and Tracking Numbers: How the White House Handles Classified Files (Jan. 30, 2023)
- The Washington Post: Skepticism before a search: Inside the Trump Mar-a-Lago documents investigation (Dec. 21, 2022)
- The Washington Post: Mar-a-Lago classified papers held U.S. secrets about Iran and China (Oct. 21, 2022)
- New York Intelligencer: Trump Was Betrayed by His Diet Coke Valet (Oct. 14, 2022)
- The New York Times: Justice Dept. Is Said to Believe Trump Has More Documents (Oct. 6, 2022)
- Business Insider: Court accidentally unsealed, then deleted, documents from the Mar-a-Lago case describing information the FBI seized from Trump (Oct. 6, 2022)
- Bloomberg: Trump Says US Agency Packed Top-Secret Documents. These Emails Suggest Otherwise. (Oct. 5, 2022)
- The Washington Post: Material on foreign nation’s nuclear capabilities seized at Trump’s Mar-a-Lago (Sept. 6, 2022)
- The New York Times: F.B.I. Found 48 Empty Folders That Had Contained Classified Documents at Trump’s Home (Sept. 2, 2022)
- Lawfare: A Justice Department Show of Force in the Mar-a-Lago Case (Aug. 31, 2022)
- The Washington Post: The photo of classified documents at Trump’s Mar-a-Lago resort, annotated (Aug. 31, 2022)
- Politico: Trump team likely sought to conceal classified docs at Mar-a-Lago, DOJ tells judge (Aug. 30, 2022)
- Indian Express: Inside the 20-month fight to get Trump to return Presidential material (Aug. 28, 2022)
- The New York Times: Another Trump Mystery: Why Did He Resist Returning the Government’s Documents? (Aug. 18, 2022)
- The Guardian: FBI searched Trump’s Mar-a-Lago home for classified nuclear weapons documents (Aug. 12, 2022)
- CNN: Former White House officials describe Trump’s habit of ripping up documents and haphazard record-keeping (Febr. 8, 2022)
- US State Department: Storing and Safeguarding Classified Material (Febr. 24, 2022)

October 29, 2019

The communications equipment in Trump's Situation Room photo


Last Sunday, October 27, the White House released a photo showing president Trump and his national security team in the Situation Room of the White House.

The photo caused some discussion because people suggested that it might be staged, but here the focus will mainly be on the communications equipment.



President Trump and his national security team in the White House Situation Room, October 26, 2019
(White House photo by Shealah Craighead - click to enlarge)


The people in this photo are (from left to right): National Security Advisor Robert O’Brien, Vice-President Mike Pence, President Donald Trump, Secretary of Defense Mark Esper, Chairman of the Joint Chiefs of Staff US Army General Mark A. Milley, and Brig. Gen. Marcus Evans, Deputy Director for Special Operations on the Joint Staff.

According to the press secretary, they were monitoring developments as US Special Operations forces closed in on the compound of ISIS leader Abu Bakr al-Baghdadi in Syria. Baghdadi eventually killed himself (and three of his children) by detonating a suicide vest. Some 14 hours after the raid, Trump announced Baghdadi's death.



Telephone equipment

In the photo released by the White House we also see several different telephone sets: left of president Trump, at his right hand, is a Cisco IP phone (either the 8841, 8851 or 8861), which is part of the internal White House telephone network and can be used for all non-secure calls.

On the back of this phone is a black metal box, which is a modification by Advanced Programs, Inc. (API) in order to meet Telephone Security Group (TSG) standards, including measures to prevent the handset and the speakerphone from picking up and transmitting audio when the phone is on-hook.




A close-up of the telephones in the White House Situation Room
(White House photo - click to enlarge)


A similar Cisco IP phone can be recognized at the left side of Trump, in front of the Chairman of the Joint Chiefs of Staff. This telephone doesn't have the additional box on the back, but does have a bright yellow faceplate, which is the color code for the highest classification level: Top Secret/SCI.

Therefore, this telephone is for secure calls, through the dedicated Executive Voice over Secure IP-network, which connects the US president with all major decision makers. The phone itself has no encryption capability, as it's connected to a central network encryptor, probably from General Dynamics' TACLANE familiy.


The secure telephone is almost hidden behind an older Cisco 7975G IP phone. This phone seems to have the standard silver faceplate, but there's a red label on the handset, which often indicates a secure line. Maybe it was installed especially for this operation as in the White House these old Cisco phones should have been replaced by newer ones from the 8800-series




Computer equipment

Besides the telephones, there are also some computers in the Situation Room: a tablet computer and three black laptops, one of which has two yellow labels, showing that the device may be used for classified information up to the level of Top Secret/SCI.

In the middle of the table there's a mess of network cables, many of them color-coded according to the classification level of the network they may connect to: red for Secret and yellow for Top Secret/SCI networks. Given that the meeting was about a military operation, they probably used:
- SIPRNet for military information at the Secret level
- JWICS for Top Secret/SCI military intelligence.

Both networks also have Voice-over-IP and video streaming capabilities. The audio and video in the conference room can be controlled by the small AMX touchscreen right in front of the president.



Close-up of the AMX audio and video control panel on the conference table
(still from a White House video - click to enlarge)


Was the photo staged?

Immediately after its release there were speculations about whether the photo was staged. On twitter, former White House photographer Pete Souza initially wrote: "The raid, as reported, took place at 3:30 PM Washington time. The photo, as shown in the camera IPTC data, was taken at “17:05:24”."

The latest press reports however say the attack in Syria took place after midnight local time in Syria, which corresponds to 6:00 PM in Washington. President Trump had been out golfing and arrived back at the White House at 4:18 PM, well in time to be in the Situation Room around 5:00 PM - which would mean the photo was taken before the two-hour operation started.

The photo of Trump's Situation Room reminds of the one showing president Obama and his national security team following the operation in which Osama bin Laden was killed on May 1, 2011, a scene that is generally assumed to look more realistic:



President Obama and his national security team following the
mission against Osama bin Laden, May 1, 2011.
(White House Photo by Pete Souza - click to enlarge)


In the Obama photo most officials aren't wearing suit jackets and no one is looking at the camera. Everyone was focused on the dramatic events on the video screen of the room (which is one of the smaller meeting rooms, next to the main conference room seen in the Trump photo).

By contrast, Trump and his ministers are fully dressed up with the president himself right in the center. Everyone looks, or is supposed to look right into the camera, which means the photographer stood right in front of the main video screen as can be seen in an earlier photo of the room taken from another angle:



President Trump meets with Republican and Democratic leaders, January 2, 2019.
(White House Photo by Shealah Craighead - click to enlarge)


So it seems that just before the operation against Abu Bakr al-Baghdadi started, president Trump took the opportunity to have pictures taken showing him and his national security team in the way he likes it - which is opposite to Obama's much more informal style.



Links & sources
- Der Spiegel: The Hunt for the World's Most-Wanted Terrorist
- The Independent: Anomalies in Trump situation room photo spark online conspiracy theories it was staged
- Business Insider: Trump’s al-Baghdadi raid Situation Room photo has one big difference from Obama’s Osama bin Laden picture ⁠— and it tells you everything about their styles
- CNN: Photos highlight stark differences in Trump and Obama approaches


November 28, 2018

A new secure phone for outside the White House



Last Thursday, Americans celebrated Thanksgiving and traditionally the president addressed members of the military services that are deployed abroad. For Donald Trump this was the second time during his presidency.

The video footage and photos of that address also showed something that is one of the topics of this weblog: a new telephone used for top level telecommunications of the president of the United States:



President Trump speaks to members of the military over the phone
from his Mar-a-Lago resort in Palm Beach. November 22, 2018.
(photo: Mandel Ngan/AFP/Getty Images - click to enlarge)


The telephone set that president Trump used for his conference call can be recognized as a Cisco IP Phone 8841, but with some distinctive modifications.


Top Secret

The first one is that is has a bright yellow bezel around the high-resolution color display, while standard phones have a black or a silver one. As yellow is the color code for information classified Top Secret/Sensitive Comparmented Information (TS/SCI), the bezel shows that this phone can be used for calls at the highest level.

This phone is part of the Executive Voice over Secure IP-network, which connects the US president with all major decision makers, like the secretaries of State, Defense and Homeland Security as well as the Director of National Intelligence. The phones themselves have no encryption capability - they are connected to a central network encryptor, probably from General Dynamics' TACLANE familiy.


Fiber network

The second modification is that the device can be directly connected to a local fiber optic network, instead of the usual connection to a copper cable telephone system through an RJ-14 plug. Because signals traveling over copper cables cause electromagnetic emanations ("TEMPEST"), they are easier to intercept than when there's a fiber optic network.

The new phone was modified by CIS Secure Computing, Inc., which is a small company that provides additional security functions for commercial-of-the-shelf communications equipment. On its website it advertises the Cisco 8841 Fiber Enabled VoIP Phone and in the photo below the company's logo can be recognized on the back side of the device:



President Trump with the new Cisco IP phone seen from the back side. November 22, 2018.
(photo: AP/Susan Walsh - click to enlarge)


It's not known when exactly this new telephone was installed, but it must have been somewhere after Trump's first Thanksgiving address last year. Then we still saw the old phone for highly secure calls. This was a common Cisco 7975 Unified IP phone, which was also modified by CIS Secure Computing, providing it with TEMPEST protection and two 1 Gigabit SC Fiber ports.




Left: the old Cisco 7975 IP Phones in 2017; right: the new Cisco IP Phone 8841 in 2018
(click to enlarge)


White House

In the Oval Office, the old Cisco 7975 for the classified network had already been replaced by a Cisco IP Phone from the new 8800-series by September 2017. However, this phone has no additional security functions (like a fiber optic connection or on-hook disconnection of the handset) nor the yellow bezel.



The Cisco 7975 IP phones for secure calls were introduced in 2007 as part of a general upgrade of the White House communications systems under president George W. Bush. Meanwhile this type of Cisco telephones is about 15 years old, so the replacement may not come as a surprise.

It seems that with the modified Cisco IP Phone 8841 all the old phone sets for secure and non-secure calls, used both inside and outside the White House, have now been replaced by new devices from Cisco's 8800-series.


September 17, 2018

Trump's telephones in the Treaty Room



Under the presidency of Donald Trump, the White House became much less transparant than under previous administrations: most information has been stripped off the White House website and hardly any photos from behind the scenes are published. Therefore we see very little of how the White House rooms and West Wing offices are currently used.

But a new photo, released by the president's social media director a few days ago, now shows a glimpse of the so-called Treaty Room, in which president Trump and vice-president Pence received an update call on the emergency preparedness concerning the impact of Hurricane Florence:



Vice-president Pence and president Trump in the Treaty Room, September 15, 2018
(White House photo - click to enlarge)



The Treaty Room

The Treaty Room is on the second floor of the main building of the White House, the residential mansion, which includes both the ceremonial rooms and the private quarters of the president. The room is named after the peace treaty between the United States and Spain, which was signed here on August 12, 1898, ending the Spanish-American War. The signing is depicted in the large painting by Theobald Chartran.

Previous presidents used the Treaty Room as their private study where they could work during evening hours, as it is on the same floor as their private rooms. The picture below shows president Obama working behind a large table, which president Trump turned into the position it had under George W. Bush, along the wall on the west side. Given how empty the table and the credenza are, it seems that Trump doesn't use the room frequently.



President Obama in his private study in the Treaty Room of the White House. We see two black
Avaya/Lucent 8410 phones, a computer screen and an HP laser printer. March 2009.
(Callie Shell/Aurora Photos - click to enlarge)


The telephone equipment

In the recent photo with vice-president Pence en president Trump we see that on the large table in the Treaty Room there are the following three telephone sets:
- A Cisco 8841 IP phone (with a box on the back) for non-secure calls
- A Cisco 8841 IP phone for secure calls
- An IST-2 red phone


The two Cisco phones are the same ones as on the president's desk in the Oval Office, where they gradually replaced the older Cisco telephones.



Behind the two Ciscos there's a large gray telephone that can be recognized as an Integrated Services Telephone version 2 or IST-2, a device that was designed by Raytheon and subsequently manufactured by Telecore, Inc.

This IST is a so called "red phone", which means that it's connected to the Defense Red Switch Network (DRSN). This is the main secure telephone network for military command and control communications and connects all mayor US command centers and many other military facilities.

A special feature of the IST-2 is that one can make both secure and non-secure calls through this one single device. The phone itself has no encryption capability: any secure calls are encrypted in bulk before leaving the secure building, enclave or compound.

As part of a military telephone network, the IST-2 also has the distinctive 4 red buttons which are used to select the four levels of a system called Multilevel Precedence and Preemption (MLPP). This allows to make phone calls that get precedence over ones with a lower priority.



It's not really clear why there's an IST-2 in the Treaty Room and (at least visibly) not in the Oval Office. The two Cisco IP phones should be sufficient for any secure or non-secure phone calls, but it is possible that for connecting to military commanders it is still easier to use the IST-2 with its many direct line buttons.

> More about the president's IST: The telephone contacts of president George W. Bush


November 27, 2017

Trump's communications equipment outside the White House

(Updated: December 9, 2017)

On the fourth Thursday of November, Americans celebrate Thanksgiving Day and one of the traditions is that the US president addresses members of the military services that are deployed abroad.

President Trump did so for the first time last Thursday, speaking to the five branches of the US military by video teleconference from his residence Mar-a-Lago in Florida.

The press photos released for this occasion offer a clear view of the communications equipment that is used by the president when being outside the White House or travelling.



President Trump addresses the military from Mar-a-Lago, November 23, 2017
(click to enlarge)



Video teleconferencing

The big screen for video teleconferencing (VTC) is the Cisco TelePresence System EX90 with high-definition video screen and camera. The device has been modified for TEMPEST protection by CIS Secure Computing: we can see that the screen has an additional metal encasing with silver labels to prevent and detect tampering. The VTC system includes a smaller touchscreen device which is used to control the video teleconference calls and can be seen right in front of the big screen.

During the videoconference, Trump was connected to members of the military services at oversea bases in Afghanistan, Iraq, Turkey, the USS Monterey at sea, and the US Coast Guard vessel Wrangell in Kuwait. Accordingly, the video screen was divided into six segments, with the President Of The United States (POTUS) himself in the lower middle section, surrounded by a red border. He also has a note that says who's who:



President Trump addresses the military from Mar-a-Lago, November 23, 2017
On the phone displays, the names associated with the direct line buttons were blacked out
(White House Photo/Shealah Craighead - click to enlarge)



Secure telephones

On both sides of the video teleconference screen, there are telephone sets which can be recognized as common Cisco 7975 unified IP phones, which are also modified by the communications security company CIS Secure Computing. Most visible is that instead of the standerd silver bezel or faceplate, these phones have a bright yellow one, which is the color code for the highest classification level: Top Secret/SCI.

This color shows that these phones are part of the highly secure Executive Voice over Secure IP-network, which connects the US president with all major decision makers, like the secretaries of State, Defense and Homeland Security as well as the Director of National Intelligence. The phones themselves have no encryption capability - they are connected to a central network encryptor, probably from General Dynamics' TACLANE familiy.

Also clearly visible is that these Cisco IP phones have a custom molded plastic housing, which provides TEMPEST protection against the leaking of electromagnetic emanations, but also includes two 1 Gigabit SC Fiber ports so the phone can be used in a fiber-optic network. These phones also meet Telephone Security Group (TSG) standards to make sure that they cannot by any means be caused to produce or transmit audio when the handset is on-hook.

The data stream of the video teleconference seems to be routed through the phone on the left, which has no handset and has the red "microphone mute" light on. As can be seen in a high-resolution photo, the VTC screen has an icon that shows that the connection was not encrypted:



Other locations

The same modified Cisco telephone sets can be seen in the photo below, which is from a room in the Lotte New York Palace Hotel, where Trump was staying last September for the UN General Assembly and meetings with leaders from Africa and the Middle East. Additionally, there's a newer Cisco 8841 IP phone, which is modified by Advanced Programs, Inc. (API) to provide on-hook security for the handset and the speakerphone. This phone is for any non-secure calls and is also used in the White House.



President Trump in a phone call with FEMA Director Brock Long regarding
Hurricane Maria's impact on Puerto Rico, September 20, 2017
Note the bulletproof glass plates in front of the windows
(White House Photo/Shealah Craighead - click to enlarge)


When former president Obama was on vacation, the same "yellow" Cisco phones were installed, although without the fiber-optic connections and the TEMPEST-proof encasing:



President Obama talking with his national security advisor Susan Rice following
foreign leader phone calls at Martha's Vineyard, August 11, 2014
(White House Photo - click to enlarge)


When Obama was staying in more hostile environments, these phones for the presidential telephone network were equipped with the additional security features we already saw in the Trump pictures:



President Obama talks on the phone with Russian president Putin while in Riyadh,
Saudi Arabia, with John Kerry and Susan Rice listening in, March 28, 2014
(White House Photo/Pete Souza - click to enlarge)


Update:
During Trump's second Thanksgiving address in November 2018 it appeared that the Cisco 7975 IP phone for secure calls had been replaced by a new modified Cisco IP phone 8841, see: A new secure phone for outside the White House



No Mar-a-Lago SCIF?

For the Thanksgiving photo op, the communications equipment was set up in the large living room of the Mar-a-Lago estate, most likely to provide a grand, if not to say regal decor for the press photos, but it may also indicate the absence of a dedicated secure communications room. At least it seems to show that the White House Communications Agency (WHCA) considers Trump's vacation residence less secure than Obama's.



President Trump addresses the military from Mar-a-Lago, November 23, 2017
(photo: Greg Lovett/The Palm Beach Post - click to enlarge)


Ever since Trump started using Mar-a-Lago regularly as his "Winter White House", there was speculation whether a Sensitive Compartmented Information Facility (SCIF) was created, which means a room that is protected in such a way that classified Sensitive Compartmented Information (SCI) can be stored, processed, viewed and/or discussed without being intercepted from the outside.

In April of this year, the White House press secretary tweeted a photo showing president Trump meeting with his national security staff in a provisionary situation room at Mar-a-Lago, which was apparently intended to look like a SCIF but may actually just have been a temporary set-up. The mysterious devices seen in that photo were discussed here earlier.



Links and sources
- ShallowNation.com: [Video & Transcript] President Donald Trump Thanksgiving Message to the Military via Video Teleconference

Some older articles on this weblog that are of current interest:
In Dutch: Volg de actuele ontwikkelingen rond de Wet op de inlichtingen- en veiligheidsdiensten via het Dossier herziening Wiv 2017