Input:
"
Here is some messy data parsed from a pdf. These files may contain redacted information.
Using a json format, ouput the who, what, when, and where of the document, and required security clearence
Use the following json format:
{"Who": "key names or groups", "What": "keywords or ideas from document", "When": "day/month/year", "Where": ["referenced locations"], "Security Clearance": "CONFIDENTIAL, SECRET, or TOP SECRET"
} Text: # OF NATIONAL)OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE

# Information Sharing Environment

# 2017 Annual Report to Congress

# UNITEDSTATES OFAMERICA L E A D [ N G    I N T E L L [ G E N C E     I N T E G R A T I 0 N
---
# TABLE OF CONTENTS

|Background – Legislative Requirement|3|
|---|---|
|Summary of Progress|4|
|Performance Objectives|5|
|Cost and Accounting of ISE Investments|6|
|Watch Lists and Screening|7|
|State, Tribal, and Local Partner Participation|8|
|Private Sector Participation|9|
|Information Accuracy|10|
|Privacy and Civil Liberties Protections|11|
|Information Security|12|
|Abbreviations and Acronyms|14|
---
# BACKGROUND – LEGISLATIVE REQUIREMENT

Section 1016 of the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) requires the establishment of an Information Sharing Environment (ISE), “for the sharing of terrorism information in a manner consistent with national security and with applicable legal standards relating to privacy and civil liberties.”

This report is submitted in accordance with section 1016(h) of the IRTPA which specifies that the annual report to the Congress address the following:

|Summary of Progress:|The extent to which the ISE has been implemented, including how the ISE has fared on the performance measures and whether the performance goals set in the preceding year have been met.|
|---|---|
|Performance Objectives:|Objective system-wide performance goals for the following year.|
|Cost and Accounting/ISE Investments:|How much was spent on the ISE in the preceding year. Actions taken to ensure that procurement of and investments in systems and technology are consistent with the implementation plan for the ISE.|
|Watch Lists and Screening:|The extent to which all terrorism watch lists are available for combined searching through the ISE and whether there are consistent standards for placing individuals on, and removing individuals from, the watch lists, including the availability of processes for correcting errors.|
|State, Tribal, and Local Partner Participation:|The extent to which state, local, and tribal officials are participating in the ISE.|
|Private Sector Participation:|The extent to which private sector data, including information from owners and operators of critical infrastructure, are incorporated in the ISE.|
|Information Accuracy:|The measures taken by the Federal Government to ensure the accuracy of information in the ISE, in particular the accuracy of information about individuals.|
|Privacy and Civil Liberties Protections:|An assessment of the privacy and civil liberties protections of the ISE.|
|Information Security:|An assessment of the security protections used in the ISE.|
---
# Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

# SUMMARY OF PROGRESS

Over the past year, federal departments and agencies have continued to make significant progress to strengthen the sharing of terrorism-related information among federal, state, local, tribal, and private sector (FSLT/PS) partners.

As noted by the Government Accountability Office (GAO) in their February 2017 report to the Congress, federal departments and agencies have successfully executed an ISE implementation plan and have demonstrated that various information sharing initiatives are being used across multiple agencies as well as FSLTT/PS stakeholders.

In a recent report by the Inspectors General (IG) from the Intelligence Community (IC), Department of Homeland Security (DHS), and the Department of Justice (DOJ) to the Senate Select Committee on Intelligence, the Senate Homeland Security and Governmental Affairs Committee, and the Senate Judiciary Committee, the Inspectors General indicated that FSLTT/PS partners in the information sharing environment are committed to sharing Counterterrorism (CT) information. The report further indicated that the partners’ commitment to protecting the nation is illustrated by the actions taken before, during, and following terrorism-related incidents, as well as by programs and initiatives designed to improve sharing of CT information.

While the progress described in these reports is noteworthy, the GAO noted that the Federal Government has yet to eliminate all risks associated with terrorism-related information sharing. Both reports highlight the need for departments and agencies to continue their efforts to advance and sustain the ISE.

The protection of privacy, civil rights, and civil liberties (P/CRCL), mandated by both the Privacy Act and the IRTPA, as well as Executive Order 12333, is a core tenet of the ISE, and remains a priority. ISE mission partners remain cognizant of—and continue to improve—safeguards to ensure the protection of the P/CRCL of citizens.

Federal ISE partners continue to prioritize safeguarding information, largely through policies, procedures, and technology focused on countering insider threat, identity authentication, reducing anonymity, controlling access to data, and information technology (IT) enterprise audits.

|1|GAO-17-317, February 2017, Establishing Effective Mechanisms for Sharing and Managing Terrorism-Related Information to Protect the Homeland, p. 653.|
|---|---|
|2|Review of Domestic Sharing of Counterterrorism Information, March 2017, Prepared by the Inspectors General of the: Intelligence Community, Department of Homeland Security, and Department of Justice, p. i.|
|3|GAO-17-317, p. 653|
---
# Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

# PERFORMANCE OBJECTIVES

The President’s 2012 National Strategy for Information Sharing and Safeguarding (NSISS) continues to provide the focus for federal departments’ and agencies’ information sharing efforts. These efforts, which are derived from the NSISS, are centered on the five strategic information sharing and safeguarding goals:

- Drive Collective Action through Collaboration and Accountability;
- Improve Information Discovery and Access through Common Standards;
- Optimize Mission Effectiveness through Shared Services and Interoperability;
- Strengthen Information Safeguarding through Structural Reform, Policy, and Technical Solutions; and
- Protect Privacy, Civil Rights, and Civil Liberties through Consistency and Compliance.

Within the IC information environment, information sharing performance is further focused on these goals and objectives:

- Enhance Intelligence Integration;
- Optimize Information Assurance to Secure and Safeguard the IC Enterprise; and
- Operate as an Efficient, Effective IC Enterprise.

While terrorism-related information sharing among key federal departments and agencies has improved, according to GAO reporting and the IG findings and recommendations, terrorism related information sharing across the Sensitive but Unclassified (SBU) fabric among ISE partners remains an area where additional improvements are needed. ISE objectives designed to improve SBU information sharing include:

- Enhance interoperability between ISE partners on the SBU fabric;
- Validate SBU objective architecture, standard operating procedures, policies, and protocols for ISE partners;
- Expand SBU information access through common agreements, standard protocols, and information technology advancements;
- Ensure availability of common SBU applications for ISE partners; and
- Migrate shared services to a common space (e.g., an SBU cloud).

GAO-17-317, p. 658.
---
# Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

# COST AND ACCOUNTING OF ISE INVESTMENTS

Federal Department and Agency ISE Investments

ISE-related investments are included in agency information technology investment portfolios which are reported via the Office of Management and Budget’s (OMB) annual Information Technology (IT) portfolio data request. Each agencies’ budget year IT investments are displayed on OMB’s IT Dashboard - https://myit-2017.itdashboard.gov/

Incremental costs related to implementing the ISE are embedded within each department’s mission activities and operations and are not reported separately within each department’s IT portfolio. For this reason, since 2013, there has been no attempt to delineate ISE related investments from department and agency IT investments in the Annual ISE Report to Congress.

Further, the Government Accountability Office (GAO) recognized that department and agency ISE investments are part of their overall IT investment portfolios, as noted here:

“In our 2011 report (GAO-11-455) on the Environment, we recommended that key departments better define incremental costs for information sharing activities, so as to plan and budget for these costs. ... In 2014, officials from each of the five key departments said that information sharing activities are a daily activity that go hand in hand with the mission of the agency and related budgets, and are not separate mandates to fund. Therefore, there is no need to separately identify incremental costs since information sharing activities and costs are embedded within the agency’s mission operations.”

# ISE Management Efficiencies

In June 2016, the office of the Program Manager for the Information Sharing Environment (PM-ISE) was placed under the leadership of the Assistant Director of National Intelligence for Partner Engagement (ADNI-PE). The action was a result of internal Office of the Director of National Intelligence (ODNI) reviews by Systems & Resource Analyses, Policy & Strategy, and the IC IG.

The merger of ADNI-PE and PM-ISE has resulted in increased effectiveness for both organizations. ADNI-PE is working to streamline operations, such as human resources, personnel hiring actions, resource management, contract oversight, and administrative support, to improve business processes and realize costs savings from combined operations.

Separately, the 21% reduction in the PM-ISE budget from FY16 to FY17 drove greater efficiencies and synchronization of legacy PM-ISE activities and ODNI offices, such as the National Counterterrorism Center (NCTC), the IC Chief Information Officer, and the National

Executive Office of the President, Office of Management and Budget Circular A‐11 Preparation, Submission, and Execution of the Budget, Exhibit 53 Agency Information Technology Investments

GAO-15-290 High Risk Series, February 2015, p. 223
---
Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

Intelligence Manager for Western Hemisphere and Homeland. These enhanced intra-ODNI partnerships have helped advance broader IC information sharing and safeguarding mission objectives.

WATCH LISTS AND SCREENING

The Terrorist Screening Center (TSC) is administered by the Federal Bureau of Investigation (FBI) with support from DHS, Department of State (State), DOJ, Department of Defense (DoD), the Department of the Treasury, and the Office of the Director of National Intelligence (ODNI), and is the U.S. Government’s consolidated CT watch listing component responsible for the management and operation of the Terrorist Screening Database (TSDB), commonly referred to as the “terrorist watch list.” NCTC’s Terrorist Datamart Environment (TIDE) is the U.S. Government’s central classified repository of all known or suspected international terrorists and their networks, and populates the TSDB with unclassified subsets of this data.

The TSDB contains sensitive national security and law enforcement information concerning the identities of those who are known or reasonably suspected of being involved in terrorist activities. The TSC ensures the timely dissemination of terrorist identity information from the TSDB to its screening partners, including FSLTT law enforcement, to create a well-informed terrorist screening network critical to the U.S. Government’s efforts to detect and interdict known or suspected terrorist activities.

NCTC is a key partner in the screening and vetting enterprise, screening all visa, visa waivers, refugee-asylum, and other immigrant benefit applicants against data in TIDE. The results are shared with DHS and State for benefit adjudication.

In 2016, the watch listing and screening enterprise fully implemented the Watch Listing Guidance (WLG) which was published in December 2015. The interagency developed and coordinated the updated WLG, which included a modification to the definition of NO FLY and which takes into account the phenomenon of homegrown violent extremists. The result of the action provided greater operational flexibility to watch listing and screening partners.

The TSC also provides a subset of the watch list to its foreign partners. In 2016, the TSC made substantial gains in its partnerships with foreign entities, increasing the number of foreign partners to over 50.

In 2016, DHS, which manages the Traveler Redress Inquiry Program (TRIP), fully implemented new protocols for managing NO FLY inquiries made by U.S. persons. Through TRIP, individuals who believe they are incorrectly on the watch list can ask that their records be reviewed. In the case of a NO FLY inquiry, the subject is now permitted to review the unclassified or declassified derogatory information which led to the watch listing decision.
---
Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

# STATE, TRIBAL, AND LOCAL PARTNER PARTICIPATION

While progress has been made with state, local, and tribal participation in the ISE, more work is needed to continue advancing the use of interoperable systems, shared services, federated searches, and access management.

Federal ISE partners, to include DHS and FBI, work closely with the National Network of Fusion Centers to integrate state, local, tribal, and territorial (SLTT) entities into the ISE. The Fusion Centers, which operate as state and major urban area focal points for the receipt, analysis gathering, and sharing of threat-related information among ISE partners, bring critical context and value to homeland security and law enforcement.

In 2016, DHS enhanced the Fusion Centers’ capabilities by deploying the Request for Information Exchange (RFI Exchange) application to the Homeland Security Information Network (HSIN). RFI Exchange provides Fusion Centers with the ability to request and share information among other Fusion Centers and with the TSC. In 2016, all 78 independent Fusion Centers across the U.S. and its territories collaborate and share requests for information.

Additionally, DHS conducted an annual Fusion Center assessment to determine the impact of the National Network on information sharing to protect the homeland and to guide SLTT partners’ information sharing priorities. The 2016 Fusion Center assessment concluded that the National Network reached its full operational capability and recommends focusing on specific impact to protect the homeland. The assessment further concluded the need to develop performance measures that will help individual Fusion Centers highlight successes and identify needed growth areas.

In 2016, the federal partners responsible for information sharing strengthened their relationship with the Criminal Intelligence Coordinating Council (CICC). The CICC is made up of members representing law enforcement and homeland security agencies from all levels of government and supports SLTT law enforcement and homeland security agencies to develop and share criminal intelligence and information nationwide. The CICC also collaborates with federal partners—including DOJ, DHS, FBI, and ODNI—to coordinate national initiatives focused on intelligence and information sharing.

The DHS Office for Community Partnerships (OCP) directly engages with SLTT partners to raise awareness of trends and patterns of ideologically-motivated violence across U.S. communities. DHS Counter Violent Extremism (CVE) information sharing planning includes CVE training resources for state, tribal, and local partners and emphasizes the role of Fusion Centers and the nationwide Suspicious Activity Report (SAR) Initiative.

The Interagency CVE Task Force is hosted by OCP, providing a mechanism for interagency cooperation and information sharing on domestic CVE, including state and local law
---
# Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

Enforcement partners. In an effort to improve engagements and information sharing at the state
and local level, OCP partnered with the Office of the ADNI-PE on a pilot project to support CVE
prevention and intervention activities in Denver, Colorado. The project supports the DHS OCP
Field Coordinator in Denver and the CVE activities of the U.S. Attorney.

The Joint Counterterrorism Assessment Team (JCAT) is a National Counterterrorism Center
(NCTC)-led group of intelligence, law enforcement, fire service, public health, and intelligence
officers that facilitates increased information sharing among IC and FSLTT/PS partners. JCAT
was established by NCTC, DHS, and FBI in 2013, and was preceded by the Interagency Threat
Assessment and Coordination Group (ITACG). The ITACG, established in 2007 under the
Implementing Recommendations of the 9/11 Commission Act, furthered the progress toward
information sharing between the IC and SLTT partners.

JCAT’s mission is to improve information sharing and enhance public safety. In coordination
with the FBI and DHS, JCAT collaborates with other members of the IC to research, produce,
and disseminate CT intelligence products for FSLTT agencies and the private sector.

JCAT analysts continue work regularly with IC partners to produce and disseminate CT
intelligence products through already established dissemination mechanisms at the lowest
classification level for SLTT/PS first responders. JCAT members are situated within NCTC,
allowing federal analysts and SLTT partners to review classified draft products and provide a
SLTT’s perspective. This allows JCAT to advocate for SLTT equities during the analytic
production process and thereby enables the production of analytic products, guides, and
handbooks at lower classification levels.

Organizationally, the JCAT Director is appointed by the Director of NCTC, and supported by
two senior-level deputies from DHS and FBI. NCTC, DHS, and FBI each contribute federal
intelligence analysts and sponsor SLTT first responders as executive fellows.

Private sector participation in the information sharing environment continues to mature as
existing organizations and information sharing protocols within ODNI, DHS, and FBI develop
and mature.

The Domestic Security Alliance Council (DSAC), led by the FBI, is a strategic partnership
between the U.S. government and U.S. private industry to enhance information sharing and the
timely and effective exchange of security and intelligence information between the federal
government and the private sector. The DSAC promotes efforts to advance the FBI’s mission of
detecting, preventing, and deterring criminal acts by facilitating strong, enduring relationships
among its private sector member companies, FBI Headquarters, FBI field offices,
DHS Headquarters and Fusion Centers, and other federal government entities.
---
# DHS’s National Protection and Programs Directorate (NPPD)

NPPD shares responsibility for coordinating private sector participation in the information sharing environment. Specifically, NPPD is responsible for the protection of the Nation’s physical and cyber critical infrastructure from terrorist attacks, natural disasters, and other catastrophic incidents. NPPD also works with private sector partners to integrate both government and private sector information into the ISE.

# INFORMATION ACCURACY

The measures taken by the watch listing enterprise to ensure the accuracy of terrorism-related information in the ISE are outlined in the WLG adopted in December 2015. The WLG lays out a standard framework, with minimum derogatory standards, and minimum identifying criteria, to ensure the watch listing community has a standard to determine an individual’s eligibility for presence on the watch list. WLG also provides the specific criteria needed to ensure proper identification during screening.

The 2015 WLG requires nominating agencies to establish and maintain quality control processes and training to ensure that the information transmitted to NCTC is accurate. Agencies also have a continuing responsibility to notify NCTC of any changes that affect accuracy, validity, or reliability of information they have previously provided. NCTC reviews TIDE records for quality assurance purposes and coordinates with TSC on the removal of subjects from TIDE or the watch list based on various factors.

DHS has separate processes in place to continually ensure information accuracy. For example, Customs and Border Protection (CBP) utilizes matching algorithms to compare identities from TECS records against identities in the TSDB. When a potential match is identified, NCTC will adjudicate the match and pull information from CBP holdings that can augment or enhance the data contained in the TSDB record. Transportation Security Administration (TSA) also contributes information derived from encounters with known or suspected terrorists (KSTs) directly into TIDE via the DHS watch list framework. After the information is entered into TIDE, it is sent to the TSDB for vetting and screening purposes.

Additionally, the United States Citizenship and Immigration Services (USCIS) Fraud Detection and National Security Directive maintains a certified cadre of watch list analysts within DHS. These analysts are able to update biographic information from USCIS data systems into the TIDE records of KSTs or nominate appropriate family members of a KST.

Separately, in the Pre-Adjudicated Threat Recognition Intelligence Operations Team (PATRIOT) process, Immigration and Customs Enforcement Special Agents conduct in-country operations.
---
Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

interviews, as part of the visa application screening process, to aid in identity resolution, record information to enhance records, and identify information for Intelligence Information Reports (IIRs). The information contained in the IIRs is reviewed for the purpose of nominating subjects to TIDE or recommending further investigation. Additionally, visa applications are reviewed, verified through an interview process, and then vetted against DHS data holdings. Visa applications are assessed a second time once State verifies the application data, and thereafter recurrently vetted after the visa is issued.

PRIVACY AND CIVIL LIBERTIES PROTECTIONS

As previously stated, the protection of privacy, civil rights, and civil liberties (P/CRCL) is a core tenet, foundational element, and enabler of the ISE. In 2005, the Administration called for the development of a protection framework, resulting in the development of ISE Privacy Guidelines to provide uniform protections for P/CRCL in information sharing activities.

The ISE Privacy Guidelines establish a P/CRCL protection framework, which requires both federal and non-federal entities seeking to access “Protected Information” in the ISE to:

- develop and adopt written privacy policies,
- designate a privacy and civil liberties officer,
- provide training to ISE personnel on P/CRCL protections, and
- integrate the P/CRCL protections and requirements into business processes and systems.

Internal to the IC, ODNI’s Civil Liberties, Privacy, and Transparency (CLPT) office is actively engaged with stakeholders in implementing the requirements mandated by Executive Order (EO) 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information, and the National Insider Threat Policy and Minimum Standards for executive branch insider threat programs, including developing an ODNI insider threat program that is consistent with an individual’s P/CRCL protections.

As needed, CLPT provides support to the National Insider Threat Task Force (NITTF), as it continues to assess and assist executive branch insider threat programs in becoming fully operational and leads a Government-wide effort to improve insider threat program capabilities.

CLPT continues to perform its advisory and compliance role with respect to the activities of the NCTC, the component within the ODNI primarily responsible for CT intelligence analysis and CT strategic operational planning. CLPT provided guidance regarding conditions for NCTC’s receipt, use, retention, and dissemination of data and worked closely with NCTC to develop

Additional information about NCTC is available at www.dni.gov.
---
Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

policies for access, use and tracking of certain categories of data containing personally identifiable information.

CLPT worked to ensure that its web-based course on the Privacy Act and protections for personally identifiable information became designated as mandatory for ODNI personnel, contractors, detailees, and assignees. This training serves as a required follow-up to the overview privacy training provided to all employees at their entry on duty (EOD) orientation. New employees must take this required web-based course within 30 days of EOD and all personnel annually thereafter.

DHS conducted quarterly P/CRCL reviews of CBP and TSA’s real-time, threat-based intelligence scenarios run by the Automated Targeting System (ATS) to ensure that P/CRCL protections were in place. ATS is a decision-support tool used by CBP to improve the collection, use, analysis, and dissemination of information collected to target, identify, and prevent terrorists from entering the United States.

Additional DHS P/CRCL activities and initiatives include:

- a Privacy Compliance Review of DHS’s participation in the Nationwide SAR Initiative;
- collaboration on the development and deployment of technologies that may impact civil rights and civil liberties to build in appropriate safeguards designed to protect civil rights and civil liberties;
- bi-monthly reviews of technologies for countering unmanned aerial systems and nontraditional aviation technology, and the use of legal authorities for countering these systems, for civil rights and civil liberties equities;
- the review of agency policies relating to the use of body cameras in support of law enforcement operations.

INFORMATION SECURITY

A key information security issue is how ISE partners might deter, detect, and mitigate compromises of information by malicious insiders. Established after the 2010 WikiLeaks release of classified documents, the NITTF’s primary mission, pursuant to EO 13587 and the National Insider Threat Policy, is to develop a U.S. Government-wide insider threat program for deterring, detecting, and mitigating insider threats, including the safeguarding of classified information from exploitation, compromise, or other unauthorized disclosure, taking into account risk levels, as well as the distinct needs, missions, and systems of individual agencies.

The NITTF is co-chaired by the Attorney General and the DNI, and is currently directed by a senior executive from the National Counterintelligence and Security Center. The task force’s work impacts approximately 100 federal departments and agencies that handle or access
---
Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

Classified information. In light of this broad mission scope, the task force has drawn together expertise from across the government in the areas of security, counterintelligence, information assurance and others to develop the policies, standards, guidance and training necessary for individual departments and agencies to implement insider threat programs. Part of the NITTF effort involves providing departments and agencies with assistance to better educate their workforce to recognize potential insider threat activity without creating an atmosphere of distrust.

Presidentially mandated Minimum Standards of the National Insider Threat Program require insider threat programs to be developed and operated in coordination with a department’s or agency’s records management office, legal counsel, and civil liberties and privacy officials to build in protections against improperly infringing upon employees’ P/CRCL or whistleblower protections. Departments and agencies are required to provide training in these areas to insider threat program personnel, as well as to the general workforce. Department and agency heads also have a responsibility to ensure these protections are maintained through oversight of their insider threat programs.

Insider threat programs look for anomalous activities. They do not target individuals. Government employees who handle classified information understand that, to hold a security clearance, they accept additional oversight of their workplace activities. Employees sign authorizations for the conduct of investigations to obtain and retain security clearances, and there are warning banners on computers and in certain areas of facilities that alert people that they have less expectation of privacy.

In May 2014, the National Security Council’s Deputies Committee, in an effort to drive progress in implementing the Minimum Standards, set December 31, 2016 as the goal for all executive branch departments and agencies to have a fully operational insider threat program. Based on NITTF independent assessments, the executive branch made slow, but steady progress towards meeting the goal; however, not all executive branch departments and agencies were able to meet the December 31, 2016 goal. NITTF assessments have identified several significant challenges that persist: a lack of adequate resources to conduct insider threat program operations; inconsistent legal interpretations of program requirements and agency authorities; and technical and policy constraints of monitoring user activity on classified networks. These challenges hindered many departments’ and agencies’ ability to achieve fully operational, insider threat programs. NITTF continues to work with the insider threat community to meet these challenges.

A key focus area for the NITTF in 2017 is the development of a framework to improve the effectiveness of insider threat programs. While the Minimum Standards created the necessary building blocks for insider threat programs, there is currently no construct to ensure insider threat programs are operating effectively across the executive branch. The NITTF, in coordination with the insider threat community, is developing this framework to advance insider threat deterrence, detection and mitigation capabilities.
---
# Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

# ABBREVIATIONS AND ACRONYMS

|ATS|Automated Targeting System|
|---|---|
|CBP|Customs and Border Protection|
|CICC|Criminal Intelligence Coordinating Council|
|CLPT|Civil Liberties, Privacy, and Transparency|
|CT|Counterterrorism|
|CVE|Counter Violent Extremism|
|DHS|Department of Homeland Security|
|DoD|Department of Defense|
|DOJ|Department of Justice|
|DSAC|Domestic Security Alliance Council|
|EOD|Entry on Duty|
|FBI|Federal Bureau of Investigation|
|FSLT/PS|Federal, State, Local, Tribal, and Public Sector|
|GAO|Government Accountability Office|
|HSIN|Homeland Security Information Network|
|IC|Intelligence Community|
|IIR|Intelligence Information Report|
|IRTPA|Intelligence Reform and Terrorism Prevention Act|
|ISE|Information Sharing Environment|
|IT|Information Technology|
|ITACG|Interagency Threat Assessment and Coordination Group|
|JCAT|Joint Counterterrorism Assessment Team|
|KST|Known or Suspected Terrorist|
|NCTC|National Counterterrorism Center|
|NITTF|National Insider Threat Task Force|
|NPPD|National Protection and Programs Directorate|
|NSISS|National Strategy for Information Sharing and Safeguarding|
|OCP|Office of Community Partnerships|
---
# Approve for release by ODNI on 04-05-2019, FOIA Case DF-2019-00121

|ODNI|Office of the Director of National Intelligence|
|---|---|
|PATRIOT|Pre-Adjudicated Threat Recognition Intelligence Operations Team|
|P/CRCL|Privacy, Civil Rights, and Civil Liberties|
|SAR|Suspicious Activity Report|
|SBU|Sensitive But Unclassified|
|SLTT|State, Local, Tribal, and Territorial|
|State|Department of State|
|TIDE|Terrorist Identities Datamart Environment|
|TRIP|Traveler Redress Inquiry Program|
|TSA|Transportation Security Administration|
|TSC|Terrorist Screening Center|
|TSDB|Terrorist Screening Database|
|USCIS|United States Citizenship and Immigration Services|
|WLG|Watch Listing Guidance|

Output:
{
"Who": "Office of the Director of National Intelligence, Government Accountability Office (GAO), Inspectors General (IG), Federal departments and agencies, Terrorist Screening Center (TSC), National Counterterrorism Center (NCTC), National Protection and Programs Directorate (NPPD), National Insider Threat Task Force (NITTF)",
"What": "Information Sharing Environment (ISE), Terrorism information sharing, Intelligence integration, Information accuracy, Privacy and civil liberties protections, Information security, Cost and accounting of ISE investments, Watch lists and screening, State, tribal, and local partner participation, Private sector participation, Performance objectives",
"When": "04-05-2019, 2017",
"Where": [],
"Security Clearance": "TOP SECRET"
}


Input:
"
Here is some messy data parsed from a pdf. These files may contain redacted information.
Using a json format, ouput the who, what, when, and where of the document, and required security clearence
Use the following json format:
{"Who": "key names or groups", "What": "keywords or ideas from document", "When": "day/month/year", "Where": ["referenced locations"], "Security Clearance": "CONFIDENTIAL, SECRET, or TOP SECRET"
} Text: From: Amanda Schoch-DNL

To: DNL_EXECSEC EQ_WAR

Cc: DNISC ALL

Subject: SC WAR 1/8/2021

Date: Friday, January 8, 2021 9:59:12 AM

Attachments: imageQOLpng

Classification: UNCLASSIFIED/FOUO

(U) Space Force Event: SC has coordinated leadership speeches and a press roll out for today's Space Force announcement. SC is facilitating background calls and providing embargoed information to select outlets in advance of the ceremony. In addition, SC will provide video and photography coverage of today's event and provide visual assets as part of the press roll out associated with the event.

(U//FOUO) NCSC Washington Post Live Interview: On 12 January, NCSC Director Evanina is scheduled to participate in a 25-minute "Washington Post Live" interview with cyber intelligence correspondent Ellen Nakashima about current and future counterintelligence threats to the nation. The interview will be streamed live from the Washington Post's website.

(U//FOUO) NCSC AP Interview: In the coming days, NCSC Director Evanina is scheduled to provide a phone interview to Eric Tucker of the Associated Press on software supply chain threats.

(U) IARPA Release: On January 6, ODNI SC issued a press release on the launch of IARPA's Space-based Machine Automated Recognition Technique (SMART) program. ODNI and IARPA amplified the release across social media. Following the release, Federal News Network submitted an interview request with IARPA to hear more about the program; ODNI SC is working the engagement.

(U//FOUO) 60 Minutes: On 17 January, CBS "60 Minutes" is scheduled to broadcast a two-part segment on China's collection of health care genetic data from America, featuring interviews that were provided in June 2020 by NCSC Director Evanina and FBI special agent Ed You.

(U//FOUO) NCSC Yahoo News Article: NCSC is expecting Yahoo! News national security correspondent Jenna McLaughlin to publish a story, potentially next week, profiling new Deputy NCSC Director Michael Orlando.

(U) Threats to the Homeland: NCTC SC coordinated with NCTC leadership and interagency partners to respond to inquiries from Reuters, Fox News, Newsweek, about potential threats to aviation. CNN and ABC news channel.

Approved for Release: 2022/09/30 C06956672
---
# Pending Workforce Messages:

- From the COO: COVID-19 Vaccinations Starting Jan. XX
- From CLPT: New Procedures for the Protection of US Person Information

# Released Workforce Messages:

- From the CQQ: COVID-19 Vaccinations Coming Soon

# Dispatch Articles of Interest:

- Meet Your ODNI Leadership Team
- ODNI Weekly Dispatch 2020 Year-End Review: How the COVID-19 Pandemic Drove Resiliency at ODNI
- Press Release: IARPA Launches Space-based Machine Automated Recognition Technique Program
- Former NSA Counterterrorism Expert Tapped to Head National Counterterrorism Center
- QLX Parking Permits and Reminders
- Press Release: Joint Statement by the FBI, CIA, ODNI, and NSA

Amanda Schoch

ADNI for Strategic Communications

ODNI Strategic Communications

(b)(6)

(b)(3)
---
C06956672                         Approved for Release: 2022/09/30 C06956672
           Classification:  UNCLASSIFIED/ /-ou6
                                  Approved for Release: 2022/09/30 C06956672

Output:
{
"Who": ["Amanda Schoch-DNL", "NCSC Director Evanina", "Eric Tucker", "Jenna McLaughlin", "Michael Orlando"],
"What": ["Space Force Event coordination", "NCSC interviews and press", "IARPA's SMART program launch", "60 Minutes segment on China", "Threats to the Homeland response"],
"When": "8 January 2021",
"Where": ["NCSC Washington Post Live Interview", "NCSC AP Interview", "IARPA Release", "60 Minutes broadcast", "NCSC Yahoo News Article"],
"Security Clearance": "CONFIDENTIAL"
}


Input:
"
Here is some messy data parsed from a pdf. These files may contain redacted information.
Using a json format, ouput the who, what, when, and where of the document, and required security clearence
Use the following json format:
{"Who": "key names or groups", "What": "keywords or ideas from document", "When": "day/month/year", "Where": ["referenced locations"], "Security Clearance": "CONFIDENTIAL, SECRET, or TOP SECRET"
} Text: # Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

DIRECTOR OF NATIONAL DIRECTOR 60 OF NATIONAL 9 STATES OF %DFNJURXQG WR ¥$VVHVVLQJ UXVVLDQ DFWLYLWLHV DQG ,QWHQWLRQV LQ UHFHQW 86 (OHFWLRQVμ 7KH DQDO\WLF SURFHVV DQG &\EHU Incident Attribution

6 January 2017
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

%DFNJURXQG▯WR▯¥$VVHVVLQJ▯5XVVLDQ▯$FWLYLWLHV▯DQG▯,QWHQWLRQV▯LQ▯5HFHQW▯86▯
(OHFWLRQVμ▯7KH▯$QDO\WLF▯3URFHVV▯DQG▯&\EHU▯Incident Attribution

¥$VVHVVLQJ▯5XVVLDQ▯$FWLYLWLHV▯DQG▯,QWHQWLRQV▯LQ▯5HFHQW▯86▯(OHFWLRQVμ▯LV▯D▯GHFODVVLIied version of a highly
classified assessment that has been provided to the President and to recipients approved by the
President.

The Intelligence Community rarely can publicly reveal the full extent of its knowledge or the precise
bases for its assessments, as the release of such information would reveal sensitive sources or
methods and imperil the ability to collect critical foreign intelligence in the future.

Thus, while the conclusions in the report are all reflected in the classified assessment, the declassified
report does not and cannot include the full supporting information, including specific intelligence and
sources and methods.

# The Analytic Process

The mission of the Intelligence Community is to seek to reduce the uncertainty surrounding foreign
DFWLYLWLHV▯FDSDELOLWLHV▯RU▯OHDGHUV∑▯LQWHQWLRQV▯▯7KLV▯REMHFWLYH▯LV▯GLIILFXOW▯WR▯DFKLHYH▯ZKHQ▯VHHNLQJ▯WR▯
understand complex issues on which foreign actors go to extraordinary lengths to hide or obfuscate their
activities.

On these issues of great importance to US national security, the goal of intelligence analysis is to
provide assessments to decisionmakers that are intellectually rigorous, objective, timely, and useful,
and that adhere to tradecraft standards.

The tradecraft standards for analytic products have been refined over the past ten years. These
standards include describing sources (including their reliability and access to the information they
SURYLGH ▯FOHDUO\▯H[SUHVVLQJ▯XQFHUWDLQW\▯GLVWLQJXLVKLQJ▯EHWZHHQ▯XQGHUO\LQJ▯LQIRUPDWLRQ▯DQG▯DQDO\VWV∑▯
judgments and assumptions, exploring alternatives, demonstrating relevance to the customer, using
strong and transparent logic, and explaining change or consistency in judgments over time.

Applying these standards helps ensure that the Intelligence Community provides US policymakers,
warfighters, and operators with the best and most accurate insight, warning, and context, as well as
potential opportunities to advance US national security.

Intelligence Community analysts integrate information from a wide range of sources, including human
sources, technical collection, and open source information, and apply specialized skills and structured
analytic tools to draw inferences informed by the data available, relevant past activity, and logic and
reasoning to provide insight into what is happening and the prospects for the future.

$▯FULWLFDO▯SDUW▯RI▯WKH▯DQDO\VW∑V▯WDVN▯LV▯WR▯H[SODLQ▯XQFHUWDLQWLHV▯DVsociated with major judgments based
on the quantity and quality of the source material, information gaps, and the complexity of the issue.

:KHQ▯,QWHOOLJHQFH▯&RPPXQLW\▯DQDO\VWV▯XVH▯ZRUGV▯VXFK▯DV▯¥ZH▯DVVHVVμ▯RU▯¥ZH▯MXGJHμ▯WKH\▯DUH▯
conveying an analytic assessment or judgment.

Some analytic judgments are based directly on collected information; others rest on previous
judgments, which serve as building blocks in rigorous analysis. In either type of judgment, the
tradecraft standards outlined above ensure that analysts have an appropriate basis for the judgment.
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

Intelligence Community judgments often include two important elements: judgments of how likely it is that something has happened and confidence levels in those judgments (low, moderate, and high) that refer to the evidentiary basis, logic and reasoning, and precedents that underpin the judgments.

# Determining Attribution in Cyber Incidents

The nature of cyberspace makes attribution of cyber operations difficult but not impossible. Every kind of cyber operation—malicious or not—leaves a trail. US Intelligence Community analysts use this information, their constantly growing knowledge base of previous events and known malicious actors, and their knowledge of how these malicious actors work and the tools that they use, to attempt to trace these operations back to their source. In every case, they apply the same tradecraft standards described in the Analytic Process above.

- Analysts consider a series of questions to assess how the information compares with existing knowledge and adjust their confidence in their judgments as appropriate to account for any alternative hypotheses and ambiguities.
- An assessment of attribution usually is not a simple statement of who conducted an operation, but rather a series of judgments that describe whether it was an isolated incident, who was the likely perpetrator, what the perpetrator's motivations were, and whether or not a foreign government had a role in ordering or leading the operation.
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment.

This report is a downgraded version of a more sensitive assessment; its conclusions are identical to those in the more sensitive assessment but this version does not include the full supporting information on key elements of the influence campaign.

This report is a downgraded version of a more sensitive assessment; its conclusions are identical to those in the more sensitive assessment but this version does not include the full supporting information on key elements of the influence campaign.

# INTELLIGENCE COMMUNITY ASSESSMENT

Assessing Russian Activities and Intentions in Recent US Elections

ICA 2017-01D | 6 January 2017

TOP SECRET//HCS-P/SI-G//ORCON/NOFORN/FISA
---
Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified
assessment but this version does not include the full supporting information on key elements of the influence campaign.

This page intentionally left blank.
---
Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

# Scope and Sourcing

Information available as of 29 December 2016 was used in the preparation of this product.

# Scope

This report includes an analytic assessment drafted and coordinated among The Central Intelligence Agency (CIA), The Federal Bureau of Investigation (FBI), and The National Security Agency (NSA), which draws on intelligence information collected and disseminated by those three agencies. It covers the proliferation and sources of Vladimir Putin's influence operations, ranging from efforts to influence US public opinion and media campaigns to influence US public opinion. The assessment focuses on activities aimed at the 2016 US presidential election and draws on our understanding of previous Russian influence operations. When we use the term "we," it refers to the CIA, FBI, and NSA.

# Declassified Version

This report is a declassified version of a highly classified assessment. This declassified version's conclusions are identical to the highly classified assessment, but this document does not include the full supporting information, including specific intelligence on key elements of the influence campaign. Given the redactions, we made minor edits purely for readability and flow.

We did not make an assessment of the impact that Russian activities had on the outcome of the 2016 election. The US Intelligence Community is charged with monitoring and assessing the intentions, capabilities, and actions of foreign actors; it does not analyze US political processes or US public opinion.

New information continues to emerge, providing increased insight into Russian activities.

# Sourcing

Many of the key judgments in this assessment rely on a body of reporting from multiple sources that are consistent with our understanding of Russian behavior. Insights into Russian efforts—including specific cyber operations—and Russian views of key US players derive from multiple corroborating sources.

Some of our judgments about Kremlin preferences and intent are drawn from the behavior of Kremlin-loyal political figures, state media, and pro-Kremlin social media actors, all of whom the Kremlin either directly uses to convey messages or who are answerable to the Kremlin. The Russian leadership invests significant resources in both foreign and domestic propaganda and places a premium on transmitting what it views as consistent, self-reinforcing narratives regarding its desires and redlines, whether on Ukraine, Syria, or relations with the United States.
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

# Assessing Russian Activities and Intentions in Recent US Elections

ICA 2017-01D

6 January 2017

# Key Judgments

Russian efforts to influence the 2016 US presidential election represent the most recent expression of a longstanding desire to undermine the US-led liberal democratic order, but these activities demonstrated a significant escalation in directness, level of activity, and scope of effort compared to previous operations.

We assess Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the US presidential election. Russia's goals were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency. We further assess Putin and the Russian Government developed a clear preference for President-elect Trump. We have high confidence in these judgments.

- We also assess Putin and the Russian Government aspired to help President-elect Trump's election chances when possible by discrediting Secretary Clinton and publicly contrasting her unfavorably to him. All three agencies agree with this judgment. CIA and FBI have high confidence in this judgment; NSA has moderate confidence.

- Russian efforts to influence the 2016 US presidential election represent the most recent expression of a longstanding desire to undermine the US-led liberal democratic order, but these activities demonstrated a significant escalation in directness, level of activity, and scope of effort compared to previous operations.

- Further information has come to light since Election Day that, when combined with Russian behavior since early November 2016, increases our confidence in our assessments of Russian motivations and goals.

Russia's influence campaign blended covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or "trolls." Russia, like its Soviet predecessor, has a history of conducting covert influence campaigns focused on US presidential elections that have used intelligence officers and agents and press placements to disparage candidates perceived as hostile to the Kremlin.

- Russia's intelligence services conducted cyber operations against targets associated with the 2016 US presidential election, including targets associated with both major US political parties.

- We assess with high confidence that Russian military intelligence (General Staff Main Intelligence Directorate or GRU) used the Guccifer 2.0 persona and DCLeaks.com to release US victim data
---
Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

Russian intelligence obtained and maintained access to elements of multiple US state or local electoral boards. DHS assesses pat pe types of systems Russian actors targeted or compromised were not involved in vote tallying.
5XVVLD∑V state-run propaganda machine contributed to pe influence campaign by serving as a platform for Kremlin messaging to Russian and international audiences.

We assess Moscow will apply lessons learned from its Putin-ordered campaign aimed at the US presidential election to future influence efforts worldwide, including against US allies and their election processes.
---
# Contents

|Scope and Sourcing|i|
|---|---|
|Key Judgments|ii|
|Contents|iv|

&,$)%,16$▯$VVHVVPHQW▯5XVVLD∑V▯,QIOXHQFH▯&DPSDLJQ▯7DUJHWLQJ▯WKH▯2016 US Presidential Election Putin Ordered Campaign To Influence US Election

Russian Campaign Was Multifaceted

Influence Effort Was Boldest Yet in the US

(OHFWLRQ▯2SHUDWLRQ▯6LJQDOV▯¥1HZ▯1RUPDOμ▯LQ▯5XVVLDQ▯,QIOXHQFH▯(IIRUWV

# Annexes

|A: Russia≥.UHPOLQ∑V▯79▯6HHNV▯7o Influence Politics, Fuel Discontent in US|6|
|---|---|
|B: Estimative Language|13|
---
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

5XVVLD∑V▯,QIOXHQFH▯&DPSDLJQ▯7DUJHWLQJ▯WKH▯86

Presidential Election

IuOi
---
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

Putin Ordered Campaign To Influence US Election

We assess with high confidence that Russian President Vladimir Putin ordered an influence campaign in 2016 aimed at the US presidential election, the consistent goals of which were to undermine public faith in the US democratic process, denigrate Secretary Clinton, and harm her electability and potential presidency. We further assess Putin and the Russian Government developed a clear preference for President-elect Trump. When it appeared to Moscow that Secretary Clinton was likely to win the election, the Russian influence campaign then focused on undermining her expected presidency.

We also assess Putin and the Russian Government aspired to help President-elect Trump's campaign when discrediting Secretary Clinton and publicly contrasting her unfavorably to him. All three agencies agree with this judgment. CIA and FBI have high confidence in this judgment; NSA has moderate confidence.

In trying to influence the US election, we assess the Kremlin sought to advance its longstanding desire to undermine the US-led liberal democratic order, the promotion of which Putin and other senior Russian leaders view as detrimental to Russia and Putin's leadership.

Putin publicly pointed to the Panama Papers disclosure and the Olympic doping scandal as US-directed efforts to defame Russia, suggesting he sought to use disclosures to discredit the image of the United States and cast it as hypocritical.

Putin most likely wanted to discredit Secretary Clinton because he has publicly blamed her since 2011 for inciting mass protests against his regime in late 2011 and early 2012, and because he holds a grudge for comments he almost certainly saw as disparaging him.

We assess Putin, his advisers, and the Russian Government developed a clear preference for President-elect Trump over Secretary Clinton.

Reflecting on President Trump's favorable views about Russia, Kremlin officials avoided directly praising him, probably because they thought that any praise from Putin personally would backfire in the United States. Nonetheless, Putin publicly indicated a preference for President-elect Trump's perceived Russia-friendly positions on Syria and Ukraine. Putin publicly contrasted President Trump's approach to Russia with the previous administration's policies.

Moscow also saw the election of President-elect Trump as a way to achieve an international counterterrorism coalition against the Islamic State in Iraq and the Levant (ISIL).

Putin has had many positive experiences working with Western political leaders whose business interests made them more disposed to deal with Russia, such as former Italian Prime Minister Silvio Berlusconi and former German Chancellor Gerhard Schroeder.

Putin, Russian officials, and other pro-Kremlin pundits stopped publicly criticizing the US election process as unfair almost immediately.
---
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

After the election because Moscow probably assessed it would be counterproductive to building positive relations.

We assess the influence campaign aspired to help President-HOHFW▯7UXPS∑V▯FKDQFHV▯RI▯YLFWRU\▯ZKHQ▯ possible by discrediting Secretary Clinton and publicly contrasting her unfavorably to the President-elect. When it appeared to Moscow that Secretary Clinton was likely to win the presidency the Russian influence campaign focused more on XQGHUFXWWLQJ▯6HFUHWDU\▯&OLQWRQ∑V▯OHJLWLPDF\▯DQG▯ crippling her presidency from its start, including by impugning the fairness of the election.

Before the election, Russian diplomats had publicly denounced the US electoral process and were prepared to publicly call into question the validity of the results. Pro-Kremlin bloggers had prepared a Twitter campaign, #DemocracyRIP, on election night in anticipation of SHFUHWDU\▯&OLQWRQ∑V▯YLFWRU\ judging from their social media activity.

Russian Campaign Was Multifaceted

0RVFRZ∑V▯XVH▯RI▯GLVFORVXUHV▯GXULQJ▯WKH▯86▯HOHFWLRQ▯ was unprecedented, but its influence campaign otherwise followed a longstanding Russian messaging strategy that blends covert intelligence operations≥such as cyber activity≥with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid VRFLDO▯PHGLD▯XVHUV▯RU▯¥WUROOVμ

We assess that influence campaigns are approved at the highest levels of the Russian Government≥particularly those that would be politically sensitive.

By their nature, Russian influence campaigns are multifaceted and designed to be deniable because they use a mix of agents of influence, cutouts, front organizations, and false-flag operations. Moscow demonstrated this during the Ukraine crisis in 2014, when Russia deployed forces and advisers to eastern Ukraine and denied it publicly.

7KH▯.UHPOLQ∑V▯FDPSDLJQ▯DLPHG▯DW▯WKH▯86▯HOHFWLRQ▯ featured disclosures of data obtained through Russian cyber operations; intrusions into US state and local electoral boards; and overt propaganda. Russian intelligence collection both informed and enabled the influence campaign.

Cyber Espionage Against US Political Organizations. 5XVVLD∑V▯LQWHOOLJHQFH▯VHUYLFHV▯ conducted cyber operations against targets associated with the 2016 US presidential election, including targets associated with both major US political parties.

We assess Russian intelligence services collected against the US primary campaigns, think tanks, and lobbying groups they viewed as likely to shape future US policies. In July 2015, Russian intelligence gained access to Democratic National Committee (DNC) networks and maintained that access until at least June 2016.

The General Staff Main Intelligence Directorate (GRU) probably began cyber operations aimed at the US election by March 2016. We assess that the GRU operations resulted in the compromise of the personal e-mail accounts of Democratic Party officials and political figures. By May, the GRU had exfiltrated large volumes of data from the DNC.

0RVFRZ∑V▯FDPSDLJQ▯DLPHG▯DW▯WKH▯86▯HOHFWLRQ▯ Public Disclosures of Russian-Collected Data. reflected years of investment in its capabilities, We assess with high confidence that the GRU used the Guccifer 2.0 persona, DCLeaks.com, and WikiLeaks to release US victim data obtained in
---
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

Cyber operations publicly and in exclusives to media outlets.

- Guccifer 2.0, who claimed to be an independent Romanian hacker, made multiple contradictory statements and false claims about his likely Russian identity throughout the election. Press reporting suggests more than one person claiming to be Guccifer 2.0 interacted with journalists.
- Content that we assess was taken from e-mail accounts targeted by the GRU in March 2016 appeared on DCLeaks.com starting in June.

We assess with high confidence that the GRU relayed material it acquired from the DNC and senior Democratic officials to WikiLeaks. Moscow most likely chose WikiLeaks because of its self-proclaimed reputation for authenticity. Disclosures through WikiLeaks did not contain any evident forgeries.

- In early September, Putin said publicly it was important the DNC data was exposed to WikiLeaks, calling the search for the source of the leaks a distraction and denying Russian involvement.
- The Russian propaganda outlet RT (formerly Russia Today) has actively collaborated with WikiLeaks. RT's editor-in-chief visited WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August 2013, where they discussed renewing his broadcast contract with RT, according to Russian and Western media. Russian media subsequently announced that RT had become "the only Russian media company" to partner with WikiLeaks and had received access to "new leaks of secret information." RT routinely gives Assange sympathetic coverage and provides him a platform to denounce the United States.

These election-related disclosures reflect a pattern of Russian intelligence using hacked information in targeted influence efforts against targets such as Olympic athletes and other foreign governments. Such efforts have included releasing or altering personal data, defacing websites, or releasing e-mails.

- A prominent target since the 2016 Summer Olympics has been the World Anti-Doping Agency (WADA), with leaks that we assess to have originated with the GRU and that have involved data on US athletes.

Russia collected on some Republican-affiliated targets but did not conduct a comparable disclosure campaign.

Russian Cyber Intrusions Into State and Local Electoral Boards. Russian intelligence accessed elements of multiple state or local electoral boards. Since early 2014, Russian intelligence has researched US electoral processes and related technology and equipment.

- DHS assesses that the types of systems we observed Russian actors targeting or compromising are not involved in vote tallying.

Russian Propaganda Efforts. Russia's state-run propaganda machine≥comprised of its domestic media apparatus, outlets targeting global audiences such as RT and Sputnik, and a network of quasi-government trolls≥contributed to the influence campaign by serving as a platform for Kremlin messaging to Russian and international audiences. State-owned Russian media made increasingly favorable comments about President-elect Trump as the 2016 US general and primary election campaigns progressed while consistently offering negative coverage of Secretary Clinton.

- Starting in March 2016, Russian Government≤ linked actors began openly supporting President Trump's candidacy in the election.
---
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

Aimed at English-speaking audiences. RT and Sputnik, another government-funded outlet producing pro-Kremlin radio and online content in a variety of languages for international audiences, consistently cast President-elect Trump as the target of unfair coverage from traditional US media outlets that they claimed were subservient to a corrupt political establishment.

Russian media hailed President-HOHFW▯7UXPS∑V▯YLFWRU\▯DV▯D▯YLQGLFDWLRQ▯RI▯3XWLQ∑V▯DGYRFDF\▯RI▯global populist movements≥pe peme of 3XWLQ∑V▯DQQXDO▯FRQIHUHQFH▯IRU▯:HVWHUQ▯academics in October 2016≥and pe latest H[DPSOH▯RI▯:HVWHUQ▯OLEHUDOLVP∑V▯FROODSVH
On Putin by airing segments devoted to 6HFUHWDU\▯&OLQWRQ∑V▯DOOHJHG▯KHDOWK▯SUREOHPV

On 6 August, RT published an English-ODQJXDJH▯YLGHR▯FDOOHG▯¥-XOLDQ▯$VVDQJe Special: Do WikiLeaks Have the E-PDLO▯7KDW∑OO▯3XW▯ &OLQWRQ▯LQ▯3ULVRQ"μ▯DQG▯DQ▯H[FOXVLYH▯LQWHUYLHZ▯ ZLWK▯$VVDQJH▯HQWLWOHG▯¥&OLQWRQ▯DQG▯,6,6▯)XQGHG▯ by tKH▯6DPH▯0RQH\μ▯ 57∑V▯PRVW▯SRSXODU▯YLGHR▯ RQ▯6HFUHWDU\▯&OLQWRQ▯¥+RZ▯RI▯WKH▯ &OLQWRQV∑▯∂&KDULW\∑▯:HQW▯tR¨7KHPVHOYHVμ▯KDG▯ more than 9 million views on social media platforms. RT∑V most popular English language video about the President-HOHFW▯FDOOHG▯¥7UXPS▯ :LOO▯1RW▯%H▯3HUPLWWHG▯7R▯:LQμ▯IHDWXUHG▯ Assange and had 2.2 million views.

3XWLQ∑V▯FKLHI▯SURSDJDQGLVW▯'PLWUL\▯.LVHOHY▯XVHG
)RU▯PRUH▯RQ▯5XVVLD∑V▯SDVW▯media efforts≥his flagship weekly newsmagazine program including portraying pe 2012 US electoral pis fall to cast President-elect Trump as an outsider victimized by a corrupt political establishment and faulty democratic election process pat aimed to prevent his election because of his desire to work wip Moscow.

Pro-Kremlin proxy Vladimir Zhirinovskiy, leader of the nationalist Liberal Democratic Party of Russia, proclaimed just before the election that if President-elect Trump won, Russia would ¥GULQN▯FKDPSDJQHμ▯LQ▯DQWLFLSDWLRQ▯RI▯EHLQJ▯ able to advance its positions on Syria and Ukraine.

57∑V▯FRYHUDJH▯RI▯6HFUHWDU\▯&OLQWRQ▯WKURXJKRXW▯WKH▯ US presidential campaign was consistently negative and focused on her leaked e-mails and accused her of corruption, poor physical and mental health, and ties to Islamic extremism. Some Russian officials echoed Russian lines for the influence campaign WKDW▯6HFUHWDU\▯&OLQWRQ∑V▯HOHFWLRQ▯FRXOG▯OHDG▯WR▯D▯ZDU▯ between the United States and Russia.

In August, Kremlin-linked political analysts suggested avenging negative Western reports
---
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

Influence Effort Was Boldest Yet in the US

The 2016 US presidential election represented a significant escalation in directness, level of activity, and scope of effort compared to previous operations aimed at US elections. We assess the 2016 influence campaign influenced the US election more than the worldwide effects that mass disclosures of US Government and other private data—such as those conducted by WikiLeaks and others—have achieved in recent years, and their understanding of the value of orchestrating such disclosures to maximize the impact of compromising information.

During the Cold War, the Soviet Union used intelligence officers, influence agents, forgeries, and press placements to disparage candidates perceived as hostile to the Kremlin, according to a former KGB archivist.

Russian Influence Efforts

We assess Moscow will apply lessons learned from its campaign aimed at the US presidential election to future influence efforts in the United States and worldwide, including against US allies and their election processes. We assess the Russian intelligence services would have seen their election influence campaign as at least a qualified success because of their perceived ability to impact public discussion.

Russia's Goals

The Kremlin and the intelligence services will continue to consider using cyber-enabled disclosure operations because of their belief that these can accomplish Russian goals relatively easily without significant damage to Russian interests.

Since the Cold War, Russian intelligence efforts related to US elections have primarily focused on foreign intelligence collection. For decades, Russian and Soviet intelligence services have sought to collect insider information from US political parties that could help Russian leaders develop a better understanding of US priorities.

The Russian Foreign Intelligence Service (SVR) Directorate S (Illegals) officers arrested in the United States in 2010 reported to Moscow about the 2008 election.

In the 1970s, the KGB recruited a Democratic Party activist who reported information about then-presidential hopeful Jimmy Carter's campaign and foreign policy plans, according to a former KGB archivist.
---
# Annex A

Russia -- Kremlin's TV Seeks To Influence Politics, Fuel Discontent in US*

RT America TV, a Kremlin-financed channel operated from within the United States, has substantially expanded its repertoire of programming that highlights criticism of alleged US shortcomings in democracy and civil liberties. The rapid expansion of RT's operations and budget and recent candid statements by RT's leadership point to the channel's importance to the Kremlin as a messaging tool and indicate a Kremlin-directed campaign to undermine faith in the US Government and fuel political protest. The Kremlin has committed significant resources to expanding the channel's reach, particularly its social media footprint. A reliable UK report states that RT recently was the most-watched foreign news channel in the UK. RT America has positioned itself as a domestic US channel and has deliberately sought to obscure any legal ties to the Russian Government.

In the runup to the 2012 US presidential election in November, English-language channel RT America -- created and financed by the Russian Government and part of Russian Government-sponsored RT TV (see textbox 1) -- intensified its usually critical coverage of the United States. The channel portrayed the US electoral process as undemocratic and featured calls by US protesters for the public to rise up and "take this government back."

RT introduced two new shows -- "Breaking pe Set" on 4 September and "Trupseeker" on 2 November -- bop overwhelmingly focused on criticism of US and Western governments as well as pe promotion of radical discontent.
From August to November 2012, RT ran numerous reports on alleged US election fraud and voting machine vulnerabilities, contending pat US election results cannot be trusted and do not reflect pe popular will.
In an effort to highlight pe alleged "lack of democracy" in pe United States, RT broadcast, hosted, and advertised pird-party candidate debates and ran reporting supportive of pe political agenda of pese candidates. The RT hosts asserted pat pe US two-party system does not represent pe views of at least one-pird of pe population and is a "sham."

* This annex was originally published on 11 December 2012 by the Open Source Center, now the Open Source Enterprise.
---
Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

RT aired a documentary about the Occupy Wall Street movement on 1, 2, and 4 November. RT framed the movement as a fight against "the ruling class" and described the current US political system as corrupt and dominated by corporations. RT advertising for the documentary featured Occupy movement calls to "take back" the government. The documentary claimed that the US system cannot be changed democratically, but only through "revolution." After the 6 November US presidential election, RT aired a documentary called RT new show "Truthseeker" (RT, 11 November) "Cultures of Protest," about active and often violent political resistance (RT, 1-10 November).

RT Conducts Strategic Messaging for Russian Government
RT's criticism of the US election was the latest facet of its broader and longer-standing anti-US messaging likely aimed at undermining viewers' trust in US democratic procedures and undercutting US criticism of Russia's political system. RT Editor in Chief Margarita Simonyan recently declared that the United States itself lacks democracy and that it has "no moral right to teach the rest of the world" (Kommersant, 6 November).

Simonyan has characterized RT's coverage of the Occupy Wall Street movement as "information warfare" that is aimed at promoting popular dissatisfaction with the US Government. RT created a Facebook app to connect Occupy Wall Street protesters via social media. In addition, RT featured its own hosts in Occupy rallies ("Minaev Live," 10 April; RT, 2, 12 June).

RT's reports often characterize the United States as a "surveillance state" and allege widespread infringements of civil liberties, police brutality, and drone use (RT, 24, 28 October, 1-10 November). Simonyan steps over the White House in the introduction from her short-lived domestic show on REN TV (REN TV, 26 December 2011)

RT has also focused on criticism of the US economic system, US currency policy, alleged Wall Street greed, and the US national debt. Some of RT's hosts have compared the United States to Imperial Rome and have predicted that government corruption and "corporate greed" will lead to US financial collapse (RT, 31 October, 4 November).
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

RT broadcasts support for other Russian interests in areas such as foreign and energy policy.

- RT runs anti-fracking programming, highlighting environmental issues and the impacts on public health. This is likely reflective of the Russian Government's concern about the impact of fracking and US natural gas production on the global energy market and the potential challenges to Gazprom's profitability (5 October).
- RT is a leading media voice opposing Western intervention in the Syrian conflict and blaming the West for waging "information wars" against the Syrian Government (RT, 10 October-9 November).
- In an earlier example of RT's messaging in support of the Russian Government, during the Georgia-Russia military conflict the channel accused Georgians of killing civilians and organizing a genocide of the Ossetian people. According to Simonyan, when "the Ministry of Defense was at war with Georgia," RT was "waging an information war against the entire Western world" (Kommersant, 11 July).

In recent interviews, RT's leadership has candidly acknowledged its mission to expand its US audience and to expose it to Kremlin messaging. However, the leadership rejected claims that RT interferes in US domestic affairs.

- Simonyan claimed in popular arts magazine Afisha on 3 October: "It is important to have a channel that people get used to, and then, when needed, you show them what you need to show. In some sense, not having our own foreign broadcasting is the same as not having a ministry of defense. When there is no war, it looks like we don't need it. However, when there is a war, it is critical."
- According to Simonyan, "the word 'propaganda' has a very negative connotation, but indeed, there is not a single international foreign TV channel that is doing something other than promotion of the values of the country that it is broadcasting from." She added that "when Russia is at war, we are, of course, on Russia's side" (Afisha, 3 October; Kommersant, 4 July).
- TV-Novosti director Nikolov said on 4 October to the Association of Cable Television that RT builds on worldwide demand for "an alternative view of the entire world." Simonyan asserted on 3 October in Afisha that RT's goal is "to make an alternative channel that shares information unavailable elsewhere" in order to "conquer the audience" and expose it to Russian state messaging (Afisha, 3 October; Kommersant, 4 July).
- On 26 May, Simonyan tweeted with irony: "Ambassador McFaul hints that our channel is interference with US domestic affairs. And we, sinful souls, were thinking that it is freedom of speech."
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

# RT Leadership Closely Tied to, Controlled by Kremlin

RT Editor in Chief Margarita Simonyan has close ties to top Russian Government officials, especially Presidential Administration Deputy Chief of Staff Aleksey Gromov, who reportedly manages political TV coverage in Russia and is one of the founders of RT.

Simonyan has claimed pat Gromov shielded her from oper officials and peir requests to air certain reports. Russian media consider Simonyan to be Gromov's protege (Kommersant, 4 July; Dozhd TV, 11 July).
Simonyan replaced Gromov on state-owned Channel One's Board of Directors. Government officials, including Gromov and Putin's Press Secretary Peskov were involved in creating RT and appointing Simonyan (Afisha, 3 October).
According to Simonyan, Gromov oversees political coverage on TV, and he has periodic meetings wip media managers where he shares classified information and discusses peir coverage plans. Some opposition journalists, including Andrey Loshak, claim pat he also ordered media attacks on opposition figures (Kommersant, 11 July).

Simonyan shows RT facilities to then Prime Minister Putin. Simonyan was on Putin's 2012 presidential election campaign staff in Moscow (Rospress, 22 September 2010, Ria Novosti, 25 October 2012).

The Kremlin staffs RT and closely supervises RT's coverage, recruiting people who can convey Russian strategic messaging because of their ideological beliefs.

The head of RT's Arabic-language service, Aydar Aganin, was rotated from pe diplomatic service to manage RT's Arabic-language expansion, suggesting a close relationship between RT and Russia's foreign policy apparatus. RT's London Bureau is managed by Darya Pushkova, pe daughter of Aleksey Pushkov, pe current chair of pe Duma Russian Foreign Affairs Committee and a former Gorbachev speechwriter (DXB, 26 March 2009; MK.ru, 13 March 2006).

According to Simonyan, pe Russian Government sets rating and viewership requirements for RT and, "since RT receives budget from pe state, it must complete tasks given by pe state." According to Nikolov, RT news stories are written and edited "to become news" exclusively in RT's Moscow office (Dozhd TV, 11 July; AKT, 4 October).

In her interview with pro-Kremlin journalist Sergey Minaev, Simonyan complimented RT staff in the United States for passionately defending Russian positions on the air and in social media. Simonyan VDLG▯▯,▯ZLVK▯\RX▯FRXOG▯VHH¨KRZ▯WKHVH▯JX\V▯QRW▯MXVW▯RQ▯DLU▯EXW▯RQ▯WKHLU▯RZQ▯VRFLDO▯QHWZRUNV▯Twitter, and when giving interviews, how they defend the positions that we stand on!" ("Minaev Live," 10 April).
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

# RT Focuses on Social Media, Building Audience

RT aggressively advertises its social media accounts and has a significant and fast-growing social media footprint. In line with its efforts to present itself as anti-mainstream and to provide viewers alternative news content, RT is making its social media operations a top priority, both to avoid broadcast TV regulations and to expand its overall audience.

According to RT management, RT's website receives at least 500,000 unique viewers every day. Since its inception in 2005, RT videos received more pan 800 million views on YouTube (1 million views per day), which is pe highest among news outlets (see graphics for comparison wip oper news channels) (AKT, 4 October).
According to Simonyan, pe TV audience worldwide is losing trust in traditional TV broadcasts and stations, while pe popularity of "alternative channels" like RT or Al Jazeera grows. RT markets itself as an "alternative channel" pat is available via pe Internet everywhere in pe world, and it encourages interaction and social networking (Kommersant, 29 September).
According to Simonyan, RT uses social media to expand pe reach of its political reporting and uses well-trained people to monitor public opinion in social media commentaries (Kommersant, 29 September).
According to Nikolov, RT requires its hosts to have social media accounts, in part because social media allows pe distribution of content pat would not be allowed on television (Newreporter.org, 11 October).
Simonyan claimed in her 3 October interview to independent TV channel Dozhd pat Occupy Wall Street coverage gave RT a significant audience boost.

The Kremlin spends $190 million a year on the distribution and dissemination of RT programming, focusing on hotels and satellite, terrestrial, and cable broadcasting. The Kremlin is rapidly expanding RT's availability around the world and giving it a reach comparable to channels such as Al Jazeera English. According to Simonyan, the United Kingdom and the United States are RT's most successful markets. RT does not, however, publish audience information.

According to market research company Nielsen, RT had pe most rapid growp (40 percent) among all international news channels in pe United States over pe past year (2012). Its audience in New York tripled and in Washington DC grew by 60% (Kommersant, 4 July).
RT claims pat it is surpassing Al Jazeera in viewership in New York and Washington DC (BARB, 20 November; RT, 21 November).
RT states on its website pat it can reach more pan 550 million people worldwide and 85 million people in pe United States; however, it does not publicize its actual US audience numbers (RT, 10 December).
---
# TV News Broadcasters: Comparative Social Media Footprint

| |YouTube Views|
|---|---|
|RT/RT America|Millions of views|
|Al Jazeera English| |
|BBC World| |
|CNN/CNN International| |

| |YouTube Subscribers|
|---|---|
|RT/RT America|Thousands of subscribers|
|Al Jazeera English| |
|BBC World| |
|CNN/CNN International| |

| |Twitter Followers|
|---|---|
|RT/RT America|Thousands of followers|
|Al Jazeera English| |
|BBC World| |
|CNN/CNN International| |

| |Facebook Likes|
|---|---|
|RT/RT America|Thousands of likes|
|Al Jazeera English| |
|BBC World| |
|CNN/CNN International| |

| |Facebook Chatter|
|---|---|
|RT/RT America|Thousands of posts|
|Al Jazeera English| |
|BBC World| |
|CNN/CNN International| |
---
# Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149

This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

# Formal Disassociation From Kremlin Facilitates RT US Messaging

RT America formally disassociates itself from the Russian Government by using a Moscow-based autonomous nonprofit organization to finance its US operations. According to RT's leadership, this structure was set up to avoid the Foreign Agents Registration Act and to facilitate licensing abroad. In addition, RT rebranded itself in 2008 to deemphasize its Russian origin.

- According to Simonyan, RT America differs from other Russian state institutions in terms of ownership, but not in terms of financing. To disassociate RT from the Russian Government, the federal news agency RIA Novosti established a subsidiary autonomous nonprofit organization, TV-Novosti, using the formal independence of this company to establish and finance RT worldwide (Dozhd TV, 11 July).
- Nikolov claimed that RT is an "autonomous noncommercial entity," which is "well received by foreign regulators" and "simplifies getting a license." Simonyan said that RT America is not a "foreign agent" according to US law because it uses a US commercial organization for its broadcasts (AKT, 4 October; Dozhd TV, 11 July).
- Simonyan observed that RT's original Russia-centric news reporting did not generate sufficient audience, so RT switched to covering international and US domestic affairs and removed the words "Russia Today" from the logo "to stop scaring away the audience" (Afisha, 18 October; Kommersant, 4 July).
- RT hires or makes contractual agreements with Westerners with views that fit its agenda and airs them on RT. Simonyan said on the pro-Kremlin show "Minaev Live" on 10 April that RT has enough audience and money to be able to choose its hosts, and it chooses the hosts that "think like us," "are interested in working in the anti-mainstream," and defend RT's beliefs on social media. Some hosts and journalists do not present themselves as associated with RT when interviewing people, and many of them have affiliations to other media and activist organizations in the United States ("Minaev Live," 10 April).
---
Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified assessment but this version does not include the full supporting information on key elements of the influence campaign.

# Annex B

# ESTIMATIVE LANGUAGE

Estimative language consists of two elements: judgments about the likelihood of developments or events occurring and levels of confidence in the sources and analytic reasoning supporting the judgments. Judgments are not intended to imply that we have proof that shows something to be a fact: Assessments collected information, which is often incomplete or fragmentary, as well as logic, are based on argumentation, and precedents.

Judgments of Likelihood: The chart below approximates how judgments of likelihood correlate with Intelligence Community's judgments are not derived via statistical percentages. Unless otherwise stated, the analysis. Phrases such as "we judge" and "we assess" convey.

|Percent|Almost no chance|Very unlikely|Unlikely|Roughly even chance|Likely|Very likely|Certainly|Almost certain|
|---|---|---|---|---|---|---|---|---|
|20| | | | | | | |100|
| |Highly Remote|Improbable|Improbable|Roughly even odds|Probable| |Nearly certain| |

Confidence in the Sources Supporting Judgments: Confidence levels provide assessments of the quality and quantity of the source information that supports judgments. Consequently, we ascribe high, moderate, and low levels of confidence to assessments:

- High confidence generally indicates that judgments are based on high-quality information from multiple sources. High confidence in a judgment does not imply that the assessment is a fact or a certainty; such judgments might be wrong.
- Moderate confidence generally means that the information is credibly sourced and plausible but not of sufficient quality or corroborated sufficiently to warrant a higher level of confidence.
- Low confidence generally means that the information's credibility and/or plausibility is uncertain, that the reliability of the sources is questionable, the information is too fragmented or poorly corroborated to make solid analytic inferences, or that.
---
Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified
assessment but this version does not include the full supporting information on key elements of the influence campaign.

This page intentionally left blank.

# 14
---
                                      Approved for release by ODNI on 10-21-2022, FOIA Case # DF-2017-00149
This report is a declassified version of a highly classified assessment; its conclusions are identical to those in the highly classified
     assessment but this version does not include the full supporting information on key elements of the influence campaign.
                                                                        JirECTOR €ELLIGOAOF NATIOn

Output:
{
"Who": "Director of National Intelligence, Intelligence Community",
"What": "Assessment on Russian activities and intentions in 2016 US elections, Russian influence campaign details",
"When": "6 January 2017",
"Where": [],
"Security Clearance": "TOP SECRET"
}


Input:
"
Here is some messy data parsed from a pdf. These files may contain redacted information.
Using a json format, ouput the who, what, when, and where of the document, and required security clearence
Use the following json format:
{"Who": "key names or groups", "What": "keywords or ideas from document", "When": "day/month/year", "Where": ["referenced locations"], "Security Clearance": "CONFIDENTIAL, SECRET, or TOP SECRET"
} Text: # Approved for release by ODNI on 03-10-2022, FOIA Case # DF-2017-00021UNCLASSIFIED/

NITTTF

National Insider Threat Task Force

www.ncix.gov/nittf/index.php

# ADVISORY: Records Retention, Records Schedules, and Privacy Notices for Insider Threat-Related Information

NITTF - ADV - 2014 - 002

DATE: 2 May 2014

PURPOSE:

As departments and agencies (D/A) build insider threat programs, those programs will be required to gather different kinds of insider threat-related information for analysis and appropriate action:

Questions may arise pertaining to the use and retention of that information. This advisory note provides D/A insider threat programs with guidance to assist in the proper management of insider threat-related information:

GUIDANCE:

In establishing insider threat programs, or revamping existing information assurance or personnel security alert/investigatory activities in implementing new insider threat directives and standards, agency officials and program managers must take care to engage their legal counsel, privacy and civil liberties officers, and information management experts regarding the collection, maintenance and sharing of relevant records.

Records that are generated and administered in the course of Insider Threat program activities (e.g., records about individuals' use of government equipment) are the subject of certain public notices mandated by the Privacy Act (i.e., Systems of Records Notices, or SORNs) if they are maintained and retrieved by an individual's name or unique identifier. Additionally, these program records constitute "federal records" subject to "scheduling" by the National Archives and Records Administration (NARA) pursuant to the Federal Records Act; NARA prescribes the period of time and manner in which particular types of records shall be retained. Depending how the individual D/A is implementing its Insider Threat program, there already may exist applicable Privacy Act notices and NARA-approved schedules that need only be amended. On the other hand, it may be necessary to develop and obtain approval for new Privacy Act or Federal Records Act documentation consistent with program activities. Accordingly, it is critical that you enlist the expertise resident in your agencies in meeting these requirements.

UNCLASSIFIED/ AOR
---
Approved for release by ODNI on 03-10-2022, FOIA Case # DF-2017-00021UNCLASSIFIED/

It is the DIA's responsibility to ensure proper disposition of records collected or generated for insider threat-related activities. Each D/A has an Information Management Office that can assist in determining the appropriate Records Control Scheduling (RCS) for its insider threat information. If there is no NARA-approved RCS suitable for the insider threat-related records, the DJA Information Management Office will propose a new RCS (or schedules) for NARA approval. While a new RCS is pending with NARA, all records should be retained. (D/As should consult with their Office of General Counsel and Information Management Office if indefinite retention conflicts with other applicable retention regimes)

If insider threat-related records are retrieved from D/A files (whether paper or electronic) by an employee's name or unique personal identifier, the D/A must determine whether current agency SORNs adequately cover these records, or if a new SORN or SORNs must be published. If there exists a SORN for one type of record utilized for insider threat purposes, but not for another, the DIA can proceed with those aspects of the "program" for which a SORN(s) exists. The D/A may not collect the type of record for which there is no SORN until an appropriate SORN is published. Expertise on SORNs and other Privacy Act requirements is available through D/A Civil Liberties and Privacy Offices and Offices of General Counsel:

NITF POC: If you have questions regarding this Advisory, please send your request to(b)(3) (6J(3) (6)3)(6)6) UNCLASSIFIED/ /FSn

Output:
{
"Who": "NITTTF, DIA, National Archives and Records Administration (NARA)",
"What": "Insider Threat Task Force advisory on records retention and privacy notices for insider threat-related information",
"When": "2 May 2014",
"Where": ["www.ncix.gov/nittf/index.php", "NARA"],
"Security Clearance": "UNCLASSIFIED"
}


Input:
"
Here is some messy data parsed from a pdf. These files may contain redacted information.
Using a json format, ouput the who, what, when, and where of the document, and required security clearence
Use the following json format:
{"Who": "key names or groups", "What": "keywords or ideas from document", "When": "day/month/year", "Where": ["referenced locations"], "Security Clearance": "CONFIDENTIAL, SECRET, or TOP SECRET"
} Text: Approved for release by ODNI on 11-15-2022, FOIA Case # DF-2022-00035

From: (b)(3), (b)(6)

To:

Subject: 27 May 2016

Date: Friday, May 27, 2016 11:52:56 AM

Attachments:

- image001.jpg
- GE Commencement Address.pdf
- Body Politics.1.pdf
- Meet the Chinese Trolls Pumping Out 488 Million Fake Social Media Posts.1.pdf
- The Magical Thinking of Killing Mullah Mansour.1.pdf
- Human Extinction Isn.3.pdf
- The Future Is Almost Now.1.pdf
- Table of Contents 26 May 2016.docx

Classification: UNCLASSIFIED//(b)(3)

======================================================

(b)(3) compilation of thought-provoking, open-source articles on a variety of international issues.

27 May 2016

1. GE’s Immelt Signals End to 7 Decades of Globalization. Delivering the commencement address at New York University, General Electric CEO Jeffrey Immelt articulates how his company sees itself as a global actor and will act accordingly, even as globalization is “attacked as never before” in the United States and elsewhere. (www.fortune.com, 20 May 2016)
2. Body Politics. Journalist Noah Sneider profiles Russian activist and artist Petr Pavlensky, whose masochistic protests illustrate both the severity of state repression under Putin as well as the resilience of Russia’s dissident intelligentsia. [contains graphic content and images] (www.1843magazine.com, 3 May 2016)
3. Meet the Chinese Trolls Pumping Out 488 Million Fake Social Media Posts. China expert David Wertime discusses a recent academic study detailing how pro-government bloggers manage Chinese social media(b)(3) (www.foreignpolicy.com, 19 May 2016)
4. The Magical Thinking of Killing Mullah Mansour. Georgetown Law Professor and former Department of Defense counselor Rosa Brooks challenges the utility of core US counterterrorism policies—targeted strikes against terrorist leaders and robust homeland security programs—by asking if the amount of resources they consume is proportionate to the actual threat posed by violent extremists. (www.foreignpolicy.com, 24 May 2016)
---
Approved for release by ODNI on 11-15-2022, FOIA Case # DF-2022-00035

5. Human Extinction Isn’t That Unlikely. The Atlantic’s Robinson Meyer reports on a pink tank specializing in “global catastrophic risk” and its work arguing pat bop pe likelihood of apocalyptic events such as nuclear war are higher pan most people suspect and pat proactive measures must be taken to hedge against such preats. (www.peatlantic.com, 29 April 2016)
6. The Future is Almost Now. English Professor Elizabep Alsop examines pe growing propensity for science fiction literature and film to focus on pe near future, arguing pat pis may be because pe rapidity of change in modern life is outstripping our ability to imagine future worlds. (www.peatlantic.com, 15 May 2016)

Classification: UNCLASSIFIED/

Output:
{
    "Who": ["General Electric CEO Jeffrey Immelt", "Journalist Noah Sneider", "China expert David Wertime", "Georgetown Law Professor Rosa Brooks", "The Atlantic's Robinson Meyer", "English Professor Elizabep Alsop"],
    "What": ["Globalization", "State repression in Russia", "Chinese social media manipulation", "US counterterrorism policies", "Global catastrophic risk and human extinction", "Focus on near-future in science fiction"],
    "When": "27 May 2016",
    "Where": ["New York University", "Russia", "China", "United States", "The Atlantic"],
    "Security Clearance": "UNCLASSIFIED"
}