I, Aaron E. Spivack, having been duly sworn by Supervisory

I, Aaron E. Spivack, having been duly sworn by Supervisory Special Agent (SSA) Dannie W. Price, Jr., hereby make the following statement to SSA Price and SSA Matthew A. Zavala on 01/26/2024 and SSA Price and SSA Claudia Dubravetz on 08/08/2024, whom I know to be SSAs of the Federal Bureau of Investigation (FBI), assigned to the Inspection Division (INSD) at the time of my statement. My attorney, Richard J. Roberson, Jr., was present during my statement on both occasions, via telephone . This statement took place over a two-day period. The statement initiated on 01/26/2024, and again on 08/08/2024, after additional allegations were added: I entered on duty (EOD) on 02/21/2006, as an Intelligence Analyst (IA). I EOD on 10/08/2008, as a Special Agent (SA) and I am currently assigned to the New York Field Office (HYPO) that capacity. I understand that this is an internal investigation regarding an allegation that Special Agent Aaron E. Spivack improperly stored digital evidence at his residence in violation of 1.6- Investigative Deficiency- Improper Handling of Property in the Care, Custody, or Control of the Government. On 10/30/2023 the following expanded allegations were added: Special Agent Aaron E. Spivack improperly and stored digital evidence and failed to policy, resulting in a cyber intrusion in in handled, documented, secure CSAM within violation of 1.6- Investigative Deficiency- Improper Handling of Property in the Care, Custody, or Control of the Government and 5.17- security Violation- Failure to Secure sensitive Equipment/ Materials. On EFTA00173481 02/07/2024 the following expanded allegations were added: Special Agent Aaron E. Spivack exceeded the limits of his authority by contracting an outside company to develop computer software on behalf of the FBI in violation of 2.8 Misuse of Position and 5.23 Violation of Miscellaneous Rules/Regulations. I have been further advised of my rights and responsibilities in connection with this inquiry as set forth on a "Warning and Assurance to Employee Required to Provide Information" form FD-645 which I have read and signed. I understand from my review of the FD-645 that should : refuse to answer or fail to reply fully and truthfully during this interview, I can expect to be dismissed from the rolls of the FBI. this here E (EM) EFTA00173482 e issues I occur. I ement ere st of but th ral 0 n I am currently assigned to CT-25, a Domestic Terrorism squad, but assigned to an Enterprise Investigation that is a hybrid of Domestic Terrorism and Child Exploitation violations. I was assigned to squad CY-3 in May 2010 and officially named on the squad in July 2010. This was when the FBI's child exploitation program was referred to as "Innocent Images" and fell under the Cyber Division, while Squad C-20 was the Human Trafficking (HT) squad at the time. I believe it was 2015 when Violent Crimes Against Children (VCAC) and HT programs were combined under the FBI's Criminal Division, which led to the merger of the violations in the NYFO under squad C-20. The Squad is split and has the HT side and the VCAC side, and I was a VCAC Agent. Agents primarily work their assigned violations, but we come together as a squad for operations. I have been with the FBI for over 18 years, having spend the last 16 years as an Agent. I have been one of the FBI's leading Agents in Child Exploitation investigations and to this day, I believe that I am one of, if not the only, Court- EFTA00173483 certified expert witness for the entire FBI for child exploitation. I have personally accounted for aniseem4mately over 60 arrests, 150 search warrants, and have been responsible for rescuing several hundreds of children. cud to INSD and ardect Head•uarters ( ssistant Director in Char •e (AD) (DD) ce EFTA00173484 Assistant United States Attorney's Officc-c (U(AUSA's)I des•it- AUSAs. Last month Eoordinator I believe Digital Extraction Technician (DExT) training was opened to VCAC Agents in 2012. Scott Ledford was my instructor for DExT. As of 2023, I knew Ledford was a Unit Chief (DC) and led the Cyber Action Team (CAT). I believe at least three or four of us initially received DExT training in approximately EFTA00173485 2012, but I think all of us working Innocent Images/VCAC on the squad were eventually trained. However, once the child exploitation program moved from the Cyber Division to the Criminal Division, that changed. The funding we received through the Criminal Division was significantly less than what we received through Cyber Division , so the DExT program was no longer able to put on as many classes and certify as many people as it had before. By the time of the intrusion that forms the basis of this internal inquiry, only about half of the "child exploitation" Agents on my Squad were DExT certified. This is whilc vc wcrc still with CY 3. We got certified because the Computer Analysis Response Team (CART) was long overburdened and not familiar with the nuances of the child exploitation violation, such as the types of programs used by offenders, the vernaculars, etc. It was also known, and something I witnessed personally, that due to the reliance on CART and how long it would take for them to prepare a case for review, "hands-on" offenders were not being arrested in a timely manner. This resulted in the continuation of child victimization at the hands of the offenders the FBI was actively investigating. This was around the same time Agents working other violations began to also see an increase in the collection and reliance upon digital evidence in their cases. As DExTs, we were encouraged, and in some cases I believe required, to assist EFTA00173486 CART with their backlog by conducting DExT extractions for other squads. The other reason was to eliminate the lag time in searching evidence and identifying contact offenders (offenders who physically exploited or physically assaulted children) sooner. VCAC investigations are different than most other FBI investigations since, in VCAC investigations, a search warrant is generally executed in the early stages of an investigation, and the evidence needed to arrest and charge an offender is usually derived from the materials seized during the execution of a search warrant. Whereas other squads, generally speaking, execute search warrants at the culmination of their investigations. Mike Osborn was a UC of the Crimes Against Children Human Trafficking Unit (CACHTU) at FBI HQ Headquarters (HQ) and eventually an Assistant Special Agent in Charge (ASAC) at NYFO. He was a huge proponent of DExT. Being DExT trained allowed us to conduct our own data extractions faster, but more importantly, it allowed for a faster and more efficient way of identifying "contact", or "hands-on", offenders and, thus, rescue child victims of sexual abuse before they could be further victimized. After becoming DExT certified, we received DExT equipment that allowed us to image, process, and better review the digital files. The DExT training allowed us to better use FBI analytical programs to review digital evidence. Being DExT certified allowed us to assist CART by offering an alternative for other EFTA00173487 squads to use for data extractions. At the time, CART was not located in NYFO Headquarters City (HQC). CART was located in Moonachie, New Jersey. It could take an hour to get to the CART lab from the NYFO. CART evidence reviews needed to take place there and it could take all day. CART eventually moved to NYFO, HQC. The volume of data extractions we took on lessened the burden on CART. At least in New York, CART only had one or two examiners who could handle data extractions immediately, and almost certainly none who could respond after hours or on weekends. Since we dealt with child victims, it was, and is, imperative that the digital evidence be processed immediately. In nearly every child exploitation investigation the digital evidence is quite literally the evidence to prove the crime and without a prompt review, there is no probable cause to effect an arrest, putting the lives of child victims in continued danger. it is that very risk, the risk of continued abuse, that has prompted the FBI to enact new policies requiring expeditious investigation into allegations of child exploitation. This includes the expeditious review of evidence. Prior to the DExT training, onsite forensics, was not really a practice. We had to take digital evidence back to the office to view it and we relied more on the post-search interview. After a search, we had to go back and arrest an offender once we found the evidence. This made for a EFTA00173488 significantly more dangerous arrest because the offenders knew we were coming. There was also the potential for offender suicide. We had three offender suicides that I can recall. NYFO SAS Linh Phung, Thomas "Tommy" Thompson, Mitch Thompson, and I were DExT trained. SA Cindy Wolff (aka Cindy Dye) was also DExT trained. Cindy was the last to be trained while our squad fell under Cyber Division. At the time, I was the most junior Agent on the squad. Before being DExT trained, all of our digital evidence was submitted to CART for data extractions, imaging, and processing. We did have access to the Case Agent Investigative Review (CAIR) system, a forensic tool for data review, but the program was slow, not capable of handling large evidence reviews, did not work all that well, and did not do what we in the child exploitation program needed it to do. As a result, rather than using CAIR, Agents on the squad opted to travel to Moonachie, , where CART was located, to conduct their reviews on site versus over the CAIR network. The ineffectiveness of CAIR was no secret and was EFTA00173489 widely known, and one of the reasons for the creation of the autonomous DExT labs. After collecting digital evidence, I would enter the digital evidence into the Evidence Control Unit (ECU) and get a 1B evidence number assigned. I would then enter a CART request with a description of what forensic examinations I needed to be performed and information on the device that needed to be extracted. Then I would submit it to CART. It could take a day or two to get the evidence to CART and the amount of time it would take CART to process the evidence varied. It could take weeks or months. Once it was extracted, CART would process it in the Forensic Tool Kit (FTK). We could review the data on CAIR or go to Moonachie to review it. Everyone on the squad, for the most part, chose to go to Moonachie. CART Digital Forensic Examiners Stephen Flatley and Carlos Koo eventually set up a spot in NYFO, HQC to do data extractions. Even after receiving DExT training, we used CART for things like very large media dumps/extractions and encrypted files. We also used them to help us with understanding what some of the digital evidence was. I believe CART may have provided us digital copies of the data extraction and I think it may have been on DVDs. They would have been accessible on Operational Wide Area Network (OPWAN) aS well . I do not recall what we did with the copies on DVD. CART may have checked them into evidence and provided a working copy. The DExT trained Agents would do data dumps on everything we could like hard EFTA00173490 drives, loose media, and thumb drives. In 2015, generally if it was a device we could image, we would follow this process. We would use write blockers to assure we did not accidentally manipulate the original data. We would create an image of our evidence; sometimes we would use another hard drive. We imaged and processed the data. We had some hard dr4yetdrivesl but I am not sure where they came from. I believe HQ sent us a box of hard drives. I also believe CART may have given us some as well. We used a forensic duplicator called a TD3, and later a TX- 1 as well as FTK Imager, to image a device onto a hard drive and make the derivative evidence. We would then make a working copy image off of the derivative evidence. We would then work off of the working copy. I placed am pretty sure the in the NYFO ECU if derivative evidence was cataloged and that was the policy, but if that was not the policy we would not have done that. The DExT Program provided us with Redundant Array of Independent Disks (RAIDS). These RAIDs were to be used to house our working copy evidence images. I initially advised the interviewing SSAs, once we ran out of hard drives for derivative evidence, we were instructed to use the RAIDs and that these instructions came from either a r my supervisor. This is true, as it was the SSA and the case Agent for our squad's whose responsibility it was to request and receive funding and equipment. Any requests EFTA00173491 that we needed were routed through them, and the case Agent was also one of our DExT Agents who also faced the same issues of not having the hard drives to create derivative evidence. However, I also recall these instructions were provided by HQ, either our Program Manager (PM), the DExT PM, or both. This may have occurred in 2012 when I went through the DExT program and continued over the years. As there has been a revolving door of PMs, I do not recall the names of the people I spoke with at the can provide as many names of PMs who I can recall had been there over the years. Typically, the person running a Group I or Group II Undercover Operation (UCO) investigation and the squad SSA would be the people who communicated with HQ for resources. As an example, I recall in 2015, I sent an email to SA Tommy Thompson, who was the case agent of our squad's Group II, asking for some large capacity hard drives with our remaining Group II funds. This was one of many requests I made, which were generally verbal, for equipment/resources. At the time we were still merged with Cyber. When we moved to the Criminal Division, our funds were nearly wiped out. Sometime thereafter, tinh Phung left NYFO and became a DExT PM at FBI HQ. Shl would often complain about a lack of funding. When we first became DExT trained, it was much easier to comply with the policy since the size of the data was significantly smaller than it is today. For example, telephone dumps then often fit on a DVD, or worst case a Blu-ray DVD. Today, DVDs are nearly obsolete as the size of data collections EFTA00173492 has become enormous, requiring large capacity hard drives which are more expensive and harder to get. To be 100% compliant with the existing policy in—o—etiveri pliieach year, it would likely require C-20 alone to purchase over a hundred hard drives, and this is just one squad in one office. To ensure that everyone in the FBI is compliant 4e—it elven ycareach year, the FBI would likely have to purchase thousands of hard drives, then do this year after year. But the FBI does not do this and the policy it created to cover search warrants decades ago has not changed, despite the fact the environment the policy applies to has. This is one of the several fundamental flaws that I have and continue to voice. If creating derivative igvidence is a requirement, then why does the FBI not automatically rovide the hard drives? How can the FBI enforce a policy without providing the filed with the ability to comply? If, in nearly every search warrant executed FBI-wide electronic media is seized, resulting in the need for derivative evidence hard drives, why is it then incumbent upon each individual squad, in each office, under each program and division, to figure out a way to obtain the funding to purchase them? If the FBI knows hard drives cannot easily be purchased in bulk, and that there are security requirements on where the drives must be manufactured, why does the FBI not just purchase them for us rather than place that nearly impossible burden on us? EFTA00173493 In approximately 2017 I took over as case Agent for our squad's Group -II. As the case Agent I was able to use Group- II funds to make purchases, which were obligated to us .through CACHTU. -I was running out of hard drive space for derivative evidence and of storage space in general. The PMs told us buying hard drives in bulk was a problem. The stores had a capacity limit, but I was advised to try anyway but was not successful. I would purchase the drives on Amazon, like I was instructed to do by HQ, until my covert account was shut down by Amazon since the purchasing of large quantities of hard drives was flagged as suspicious. We were also purchasing hard drives from New Egg, like we were instructed to do by HQ, specifically SSA Heath Graves who was the DExT PM, because they could sell bulk (10 or more) hard drives, but I was later told by someone in the Procurement Unit we could not use New Egg. This left us with very few options for buying hard drives and despite voicing these issues, no one at HQ offered a solution. In speaking with other Agents across the FBI, I learned this was a common problem. I went to CART who gave us what hard drives they could spare. In 2017 I began to gain a voice among many FBI Child Exploitation circles. I took over our squad's Group II UCO, and almost immediately converted it into a Group I. This conversion, EFTA00173494 which allows for the use of sensitive techniques, was done due to my desire to enhance our undercover capabilities and increase our effectiveness by using some of the most robust undercover techniques available at the time. While every undercover operation must be approved every six months in front of the Criminal Undercover Operations Review Committee (CUORC), because ours was now a Group I, it also had to be presented up through CACHTU and approved by the AD. Assistant Director (AD). During the CUORC, I brought up the funding issues. In the funding section we discussed what we spent and what we anticipated to spend. During my time as the case Agent for my squad's Group I, my squad's statistical accomplishments increased exponentially. The number of undercover sessions conducted by my squad increased by 198% in the four years after I took over the NYFO child exploitation program compared to the four years prior. This meant an increase of approximately 2000 undercover sessions in the same four-year span. More significantly, however, was how I tasked undercovers and provided direction to ensure the program worked to identify the most vulnerable of the exploited children; and set out to rescue them. The results cannot be overstated in that the lives of hundreds of children were saved. While I am personally responsible for saving the lives of hundreds, many hundreds, if not thousands more were saved because of how I managed and directed the child exploitation program. EFTA00173495 In 2018 I did a five-week temporary duty assignment (TDY) at CACHTU. My former SSA, Sean Watson, was the UC there. My job was to call every VCAC Group I and Group II UC0 Case Agent and ask questions about the issues they were having and to provide recommendations on how to better the program, how CACHTU could better assist the field, things that needed improvement, etc. I learned a lot about the issues affecting the entire child exploitation program and, while there were some differences in the issues facing some offices over others, there were a number of common issues that impacted every office. These issues largely dealt with lack of guidance, direction, training, equipment, DExT support, funding, and personnel. I drafted a summary of the calls I made and created a section for complaints from the field in reference to provided my assessment to CACHTU leadership. One of the many takeaways was that nearly every office haUe different complying with policy and guidance. a—and EMIS This summary was also provided to the interviewing Agents and I can make it available to whomever needs it. This same assessment, as well as additional details were also provided to Bryan Vorndran, who was the Deputy Assistant Director (DAD) who covered child exploitation, as well as to my immediate supervisor and to the supervisors/PMs at CACHTU. This EFTA00173496 came as DAD Vorndran separately requested a working group of Subject Matter Experts (SMEs) to address the needs of the VCAC program. I explained to him how we had equipment provided my assessment both orally and in several documents. Also in 2018, CACHTU PMs SSAs Michael Deizlak and Matthew Chicantek were presenting to EdeeettEive—Managemen#II on the issues facing child exploitation investigations. SSA Deizlak and SSA Chicantek requested information from me that they wanted to present. I emailed SSA Deizlak and SSA Chicantek, along with UC Sean Watson of CACHTU, the write-up I sent after my TDY as well as a separate, even more detailed summary of the issues. In this three -page summary I talked about the need to appropriate money for equipment, as well as details regarding issues affecting the program, including the DExT, guidance, support, and more. hers nd I m it very Clear to HO that we did not have hard drives Every now and then they would send us COMP and eitertJELAuwtIenthey would send funds, but nothing was consistent. I also informed my SSA of the need for hard drives. I was aware he knew we needed them and there were no funds. Other Agents were dealing with the Same issues. It has been, and continues to be, the pti 0fl g /CACAents to create derivative copies of original evidence if derivative hard drives are available. However, given the long toryofpotreogiving either the hard drives or the funds to purnhAse them, war leftwith Agra:ts have aa t_t_g_ n no alternative store their derivative evidence on local storage. I would sometimes create EFTA00173497 derivative copy of the evidence on the RAID tower, as well as a working copy. If the evidence was a large collection of different computer it was not practical_to store twn Copies (a working copy and derivative cois or the R11.M)mar an. I would only create one. However, I very_plitaft a efl riPriVAtiVP evidence rOpiOC onto either internal nr Pvternal hard drives that were maintained in our lab either as having been resiced igppseth agg l rwro or uired. Since as discussed we did not have a surplus of hard drives nor did we often have the funds to purchase them I used ones I was able to get or hard drives that had been repurpOSed. However, it often was the case where I maintained the derivative evidence of several investigations on a single hard drive. This was due to the , and the fart that I did not want to waste the extra space that was free if a particular case only took up a portion of the hard drive. As reeourree were hard to come by I maximized the resources I did have. These derivative evidence hard drives were separate and apart from the evidence copies maintained on our RAIDS or servers. I was not able to do this for every investigation, due to the limitations discussed, but when feasible it was done. This was my way of going out of my way to create dDerivative eEvidence as often as I could, despite not having the resources. I have located some of these hard drives that are still maintained in the r-20 lab, and phntng A hs of them have been provided o h in rvi wing S$AS. EFTA00173498 When I was unable to create true derivative evidence to be checked into ECU or the derivative evidence described above, I ropidered the working_cOpy of the evidence on my RAID or lerver as the derivative copy. Regardless. III the evidence copies had "hash -verification" logs to ensure the coot' was a bit-for-bi used were designed to prevent changes to the vi n so there was never a possibility that the evidence copies could be Petered I have various correspondence with HQ advising there was a lack of funding. This not only affected us getting hard drives, but also various other things. Phung provided us with more RAID towers for instructed us to use the storage to meet our needs. I do not recall her exact words, but I understood her directions to mean I could use the RAID towers for the creation of derivative and working copy evidence. I also learned funds were available, but not designated for the purchase of the hard drives. Money was either not there or was allocated to something else. I spoke with Heath Graves who was the DExT PM and then Jim Harrison who iS the current DExT PM. In June 2023, I proposed an idea to SSA Seamus Clarke and ASAC Spencer Horn re ardin how to address the issue of handling derivativeevidenre cinre the long -etanding prnrecs of tieing external media to store derivative evidence was no longerCommented (DWI]: I movcd this up DW 2024.10.19 13:34:00 Commented (IDW2J: I movcd this up DW 2024.10.19 13:36:00 EFTA00173499 practical. SSA. Clarke and ASAC Horn liked my idea and encouraged me to reach out to the ECU to find a way to pitch the idea. T reached 011t to Supervisory administrative Specialist (SAS) Arlene McKenna, who the NYFO ECU. SAS McKenna also liked my idea and stated any changes in the evidence guidelines or polity would have to come From the Field Kvidenre Eliggrem (FEP) of the FBI's Laboratory Division (LD). SAS McKenna provided the name of the FEP's Supervisory Management and Erogram_AnalystAIMPAL Adeline Josephi_and_Suggested I rear)) out to her. On 06 07 2023 I spoke with MAPA Joseph via FBINET Skype mall. I discussed with MAPA Joseph the issue with the current process, which was feasible years ago when the size of electronic evidence was significantly 'mailer In_those days, derivative evidence was stored blue-ray DVD or thumb drive. However, in recent years the size Of electronic evidence sei,uros has increased dramatically & requiring hard drives to be able to accommodate the data, ;sp_ sidthlat l„0 xlair ahil I personally have never had an issue Obtaining DVDS, I could not Say the same about hard drives. I PKPleined that while the technical environment the ECU policy/guidance is based cn alachanged, the FBI'S guldrgice/p_ocyndn li rnihnot. This has created the very issue which is part this inability t.4 amide by the guidance/policy T stated that it has become increasing ly difficult for the field to be in compliance with EFTA00173500 the existing guidance/policy since the field no longer has the resources to be compliant. I offered to help figure out another process fox maintaining derivative evidence, as I believed it was a waste of money and resources to purchase expensive hard drives for derivative evidence which will jnet he checked into evidence until the conclusion of an investigation, just to then be destroyed. I spoke with MAPA Joseph about creating reusable virtual derivative storage that was Brand-alone. I suggested the virtual evidence locker could be a server, which could be controlled by the evidence units and that 1g numbers could still be used and assigned to the folders of the derivative evidence aosed the use of an electronic chain of custody procoe.e to docnment the Arreq.e of the electronically stored derivative evidence. I further suggested that since the derivative evidence copies were maintained electronically, there would be no need to waste fnnde on hard drivee that would jnet end up being destroyed anywav 4 and that at the conclusion of an investigation when the evidence iS to be "destroyed", the media would be deleted, thereby freeing up space for new derivative evidence. MAPA Joseph liked th suggestion and stated list2oA.4 would discuss it with her team, s•-cifically her UC whose name I cannot recall. My SSA and ASAC, SSA Clarke and ASAC Horn, were both aware of my idea and conversations and encouraged me to follow-up with MAPA Joseph, which I did via email nn 06/27/2021 This email, which has since been provided to the interviewing SSAs, stated in part: EFTA00173501 "Hey Adeline, A couple eeks_ago we had a disrussion,about authorizing our lab to store DE on our servers, rather than the repeated, costly, an4 wasteful process purchasing tons hard drives to store TIF The Center, which would he seeflre, CSmainacceSSIcagasandatili—seggirea15fOrthe electronically_stored DE, would take the place of the physieal hard drives whir")) would lave money_time, and eliminate the need to waste tons and tons of hard drives. I _was wondering h and if there is anything we can do to get something like this goingl Thanks so much! Aaron" MAPA Joseph responded on 06/30/2023 with the following_ "Good Morning Aaron, Moo All ie well Apolog for tl y i delayedresponse. Jea lw in in- person training this week for evidence tech's. For your awareness, we are working on wrapping up several projects for this fi c ar. I am adding DE idea to our whiteboard to discuss thi amongst the team to include all key stakeholders that wo yow d involved. don't min, I'll send you a calendar invite So that it's on my calendar to cirri.. back with you to discuss what the team decided Kind regards, EFTA00173502 Since this emaill I have not heard back from MAPA Joseph or anyone in her chain of command regarding this issue - I have provided a recent example to the interviewing Agents. In this example, which took place II November 2023, after the intrusion and inquiry, C-20 requested funds for derivative evidence hard drives and were denied. After requesting $2,155.62 for derivative evidence hard drives, CACHTU responded to "Please utilize cart for a resource for this. We are under a CR and are very restrictive on what we can approve". C-20 then went to CART, as directed, who in turn stated they did not have any hard drives to spare and recommended C-20 request funds from CACHTU. This example further illustrates that even despite the intrusion and the negative attention we received regarding derivative evidence hard drives, the squad was again put in the position of being unable to comply with policy because the FBI would not provide the requisite hard drives or funding needed to be compliant. Sometime later C-20 would eventually receive some hard ere then advised by the NYFO Information System Security Officer (ISSO) their hard drives were out of policy and that they could not use them since the hard drives were not manufactured in the United States. This, again, put the squad in an impossible situation with no alternatives being offered. It EFTA00173503 was also quite ridiculous as it is likely that none of our computer equipment is manufactured in the United States. almost immediately converted it into a Croup I. This conversion, to my desire to enhance our undercover capabilities and increase our effectiveness by using some of the m st robust undercover operati n must be approved every nix moatha in fr nt of the Criminal Undercover Operations Review Committee (CUORC), because ^ACWTU and approved by the Assistant Director (AD). During the During my time as the cacc Agent for my squad's Cr up I, my cqual • number of undercover sections conducted by my squad increased by 198% in the f ur years after I took vcr the WYFO chill compa.ed to the Co.- seas Thls meant an increase of approximately 2000 undcrc vcr sc-si no in the same f ur year span. M rc significantly, h 'fever, was h w I worked t identify the m ct vulnerable of the cx1 .tsii that the 11.t.s of 4 Leda of child-ee 4e-e eased. While I am personally responsible for saving the lives of EFTA00173504 I bccaucc of how I mana cd and directed thc child exploitation Agite-gre*ee rege'rdeltrit 3/4-be-seleireee -he-4aet9e-e4-4tafteR4411 lie 1-.01 ele-J -4--ttedet, CC.\ Cla-k- a..J .ICAC lik-J 1-1-e -d en "lebe"reetal -etit-be-Ste-€13/4-£46-ire riteh-t41e-Mee'r ICAC) A-1- - m llL CY70 CCU. CAC ti-X--au lik.A ft, LhS titti.debittee-er-Debberwent441-hemme-ba-ceme-bram-bite-Fielni-Demialemee to•leffi-4•Fis'P.-0.&-sle—r-a•i-s—eberetese seee-4-fr&i- 6.k6—meicea4te 1 •-• Peeerem -Avelts 4-14441,11M-rikeiel'ime -geeePhra terYeek•eel -I--reseet k-- r- rmemr, 11. -11. I d' 3-J -1th Will J---rh ' --tb tb- .eh reeeeee7 .04Seit".04"4rnett4leb4'e'lea. 611319^-00iteri-Ste-041Pe-e'fi earaebistas-embiaiwboasia-M 4rwiamosblet-assaaaw—lor-Okess-eartss e„18---- -ea ste-ed ea DVD- and f scie---s k-s 1-e--e-aLd d-d-at-eally, -in 1.43 b- Si.. Le d-ta. EFTA00173505 I tlai-J4 -Lac I pc„ce..ell) Le.t had a- Jht----.1 DV a, III' ‘eette.r4 th'44a--i-f et‚irli—t4te-42 e494444e rt.. ab.d- be -t-ted th-t .1 Le- h----- • C It • C • C • 1 e. .1 I the e-latl-e I-.J-n--/p-I.e, el-e- tkt f.-Id h-- 1h- le b._ cemplleht. 4 ee elettiapee••••-esaieiefeeer-wiei-ele-•44-1-jeee-kee-Sieekeel-ieete-e•idenee le -Le. ee..1d L. a -hl-h L- be-eseekerwheeeitee# te th- feld--e e£ th deeieetiere—ewieleneee th- -se of e.. ele-t-ealt ei.-1- -f • s 1-...S4 a> ••••• y I (-rat- nhety-et-4 th-t J1L-t thz * L- n-_d te -e-t_ lanai- en hee.d ,h-t ,ea,d 'ant .p h-Lon eLaf...f.A e.t.a -t t6.. e-ttlea.a- sf — EFTA00173506 A-14 L- d-lel-J, th-i-b, fieela. / -p fai . ih- -J -t-e ,,,, •Ninti-t -11. ?1, Jed AC:.47 1...-th nee-- my Id-- -ed me.J 'm 4.el-lem-tte-iereit-tertaire-deeeember-iditere-1-diek-e4e-emmeld-en-46424+242-3m Tela h-a h-„ia th- Ad-l-e-, e -r leL te ete._ DC o eemetriee -seeeete -keer eteed-s't444-eset?u4"Pe'e-4e-fee-ehe ▪ -1 L- J linri -etc thc -c-d te -aete le-es a-d U.rs af heid 4.14-a - , 2 , ;$ ,) ▪ .- es- de te 9-1. 11L- thl- e-1-y? zilleserlee-eee-emielele Ameeid: HIZA Jesa,iph -e OC/30/2023 -ith th- felle -1-, arzottertie44meerieety-Pereemer W- ei- eetri-eti-ey In EFTA00173507 t- d' a tLin amenvo1 th- le :..el-d- all 4terstatekel"ele're -Stet-weal aii". 94"41I4' eeLt""4"freir te-eMeele-rneed-mriee-pett-to-deepettee-whae-eive-heatn-deeededv Eind Jaya mitea LEL, f.em RAN. Ja:A.ph a. 444441 901441.• 2018 : did a fi.e tcmposeet—doey—aaeOgnme.t. ITDY) at CACHTU. My former SSA, Scan Watson, was the UC there. My joie tettetell 4+—everrVeAe —e'rentr÷ —ewtei—Erretr±+ —Uee—ene—helent —Arnti er-INere recommendations on how to better the program, how CACHTU could ednict (die field, things that d,ed,d Inp.evement, etc. : learned a lot about the issues affecting the entire child cxpl itati n program and, while there were some differences in of common issues that impacted every office. These issues largely dealt with lack f guidance, direction, training, equipment., DC P dayea.t, I J-adled e summary of the calls I made and created a section for complaints :rem th, field in refe.e,e, to et, CACHTU lcadcrohip. This summary wan aloe provided to the EFTA00173508 itterviewitragertest-enel-4--eeterritaite-it--aveiaat-le-ltithemever nccds it. e4w4e-perweidad-tre-Drywn-Veehdrehr-whe-wee-the-Depehy-Awleisteet Director (DAD) wh c vcrcd child cupl itati n, as well as t my i-ntmeel-i-atesuperviser-arrel-fre-t+te-strperv+ser-s4-Pi4s-at-C-A ris came an DAD Vorndran oeparately rcqucoted a working group of -ubjcct Matter Experts (SMEs) to address the nccds of the VCAC provided my assessment both rally and in several d cumcnts. Alm, I- 2018, CACHTU PH- CSAa Mlehe-1 D-Irlek e.d Matthew rhicantck were presenting to Executive Management on the issued 4.-atiltg-t+ael--erri-eitte-ieri-rr .vest-i-eset-i-ert-SSA-Bei-r-1-erk-entel-3534 Clekeettsek r-gae-Led -e that th-f present. I entailed SEA Dcizlak and SEA Chi antek, al ng with Ur Geo.. W,.taea of CACHTU, the writ- .p I 9,Lt after my TDY an well as a separate, even more detailed summary of the issues. In this three page summary I talked about the need to appropriate money program, including the DExT, guidance, supp rt, and m re. Ge4eee C.ei, -e- and th-.1 Lh-, -e-ld eL..J L-t ...Ahiaq .40 jerreerrneel-for-reSA-e4-tite-Freed-ier-itted-elereee"—I-"rere-essere-ite-4mew wit.hrtt-ite, hew-Pews . refl..- 4.- EFTA00173509 p-attl-t ef VCAC 7.g-..te te e-eat- de,....-t...--eepeee-ed Hawevers-erevem-thm---le _merheemarred-teet-seeme-v-erreatieter-the-head 4-+Petrl'''S-e'ente€41melg-eceate -s-ekkei~i'v'e -eeere 4-t4te -e RAID t-e..., ae -ell as a -4.1.14 . :C "Pee-q‚e~et"ieerlehe -see're-bwe-etries -ki-weekkPrerectri -efltS t-T.)y) ar. tke AA:D le-e- and : -8-1J emly e-e-te . •- -å J • •.1 :ILL- --It...el e- --I--mal La-d d-1.es th-t -e-- -a--te-./eJ I. egie-4•14"7-e'itiTe riar erstal14‘gmbrniPeersins• Sel".i'PeST i'neerneeeeeee df"4".fe eed ' efl ha .e Ile f-md le p...J..1e- tk , I --Lå :t ette- -ae tIe e-e- -Le-- I th- it-ef-ebiet34-e-nered-elei've•-;24Tie lb44SI II.kii.et" ‚Paet"be —.1'eate—Ste—egebt's~ t-e- :f a pa.LIe-la. t--k ..p a -C II.- 1.--J i • i br. - • -1>e e -e--t-9 T J FkAtee-er-earmare ems-net-elmla-t-e-ée-tha-e-See-evemy -etlep.tlen, d-e Le Ih- :tal' Ltt -h-. EFTA00173510 rwrflmnPe --A • 9 "% >9...•rni ital. to* th -t a ht.I1 - th- C 20 1 b, --J ph-t-g.a rL, I k “q CCha. Scu er the dc.le:Ale- -N.d--e- d-J—ells-ei sissy-, I abseb-reerfrembre ttm•emenee-Mte-eeprwee-e-hrb-fer-irrt paa.:..k. orlimeredm 201' : t_ e- it: Child .1-eet 1--ediet-1„ -e-.e.ted .t 2-te a 0.e-p I. ?Lie e--. dr alle-e is.. th- -e- ef e--eiti.e te-h-lq-es e ..as d-d- d-e eff-eti.--e-e b) sal-, e-m_ ef th- m-et .eL-et -d---e.-r the ti--. WL1I- e.e., -ade.ea.e- 'L- • 44-e-COMI SIIII • CUORC, 1 b.e-qht ..p th- las-e-. I- th- f-Rdi-q e-ctie. iretilipeterreeehmeratt-tre-eperet-ermr-whert-we rrear-re-eperm4 etteigirm esee-Alenb-fier-my-eper ntr-1-7-my-epertetei -Létlistisl EFTA00173511 the Ce-.. aft-- I Leek NY: child mentor ~n we -Led 1.. C.- --et ,-1----L1- ..f th11.1--.., -es-lts r) A A.) 1 W411- I am Ce- the li--- et -c.e ou„(-1 b. • s 1 u T ft 1 /1 •11 When interviewed by INSD, I was asked when the standard practice for C-20 members changed to not adding derivative copies to the ECU. According to INSD, I stated I did not know, but the change did happen. INSD then asserted that I now believe the practice of creating derivative evidence copies onto separate hard drives to be checked into evidence was dependent upon we were provided funds to purchase the drives or the drives themselves. This is not entirely correct and lacks context. The "change" that occurred as somewhat two-fold and started when the FBI moved VCAC from the Cyber Division to the Criminal Division and the funding we received was dramatically reduced. The other contributing factor was, as discussed earlier, the increase in the size of the electronic media seized during search warrants and the subsequent need for significantly larger EFTA00173512 and more expensive media to house the "Derivative 'Evidence. This affected many things, including our ability to purchase hard drives. Sol the "change" that led to our inability to regularly comply with the derivative evidence practice was out of our control. Despite that, I personally voiced this concern numerous times over the years, but it was not an issue many were willing to care about. Early on, when VCAC fell under the Cyber Division, we had regular access to these drives, but when the program was moved into the Criminal Division that changed. Despite repeated requests, as well as having alerted everyone within the chain of command, we were told to figure it out. We had been advised that if derivative hard drives were not available, to store the derivative evidence on our local storage, which is what we did. It may have been in 2016 or 2017 and possibly happened because we did not have hard drives. I believe we were initially getting some hard drives from DExT after completing the certification course. DExT slowly went to no longer providing hard drives to new DExT certified Agents at all. I do not know what they are teaching about digital evidence storage in DExT or how to get drives, but I know from other Agents who have attended the DExT training more recently that guidance has still been to seek funding from CACHTU, who again has been stating they do Until approximately designated ISSO. This is not have the funds. February 2023, the NYFO did not have a a required position, and I think it being left unfilled exacerbated many of the problems that are discussed herein. EFTA00173513 retired Special Agent in Charge (SAC) Nicholas Bouchears who created a timeline and report of his years -long request for an ISSO, which was a requirement that the FBI left unfilled in the NYFO until January or February 2023. The situation was in essence entrapment. We were by policy to create derivative evidence, but we were not the ability to comply. Despite repeated acknowledgements from FBI HQ about the conundrum, solutions were never provided. We were told to adapt and to figure things out, and we did. The result is that we got punished for it, which is quite insane. We should not be held accountable for a problem we could not fix and were not responsible for fixing, When derivative hard drives were not available, we did as we had been instructed by imaging t he original evidence onto the RAID Storage or Network Attached Storage (NAS), and as previously discussed, I even went above and beyond given our limitations by creating derivative evidence copies of multiple cases onto larger internal hard drives so I could ensure I was doing everything within my power to comply with the times I would create a second copy. If I made a second copy, I would use one as the main copy and the other was the working copy. If I did one copy, that one would be used as the working copy. At times I would make multiple working copies EFTA00173514 According to INSD, I advised I had not been making derivative copies of digital evidence and that I now believe I personally made derivative copies and did whenever I was afforded with the requisite hard drives. This is incorrect. From the beginning I have never wavered and have always been adamant that I had been making derivative evidence copies whenever preet4eelpossible. As I have also stated, this was an FBI-wide issue that affected many 'gents, including many in supervisory positions. The issue • not that derivative evidence copies were not always created, the issue is why the field was not always provided with the ability to create derivative evidence copies. The issue regarding derivative evidence that I and other' faced was well known to our supervisors and specifically to our substantive desk at HQ. The question for us in the field was what do we do? Do we stop investigating our cases because wail' hi have a sufficient process for creating and storing derivative evidence? Of course not. Just because I, and others, did not always receive the drives did not mean our VCAC lalglagps till had to adapt and overcome and felt that while II may not have been able to create derivative copies for III the evidence, the reasons for that were well documented and out of III control. Had we, or I, decided not to work cases due to the lack of derivative evidence hard drives or funding for them, we would have been punished for that as well. Aside from neglecting work being itself an offense, there are other policies governing the child EFTA00173515 exploitation program that explicitly require child exploitation Agents to expeditiously conduct their investigations. It is like being stuck between a rock and a hard place, and I, and others, were told by FBI leadership over the years to make do, as long as the cases were being properly investigated, and that is what we did. At no point in time have I ever IMI=Iistored digital evidence at my residence. After the intrusion when the FBI's INSD conducted their interviews, I had been asked about "evidence" and reviewing materials from home. I acknowledged that I, like everyone else, had done some work from home. However, the " evidence" being referred to has always been "working copies" and items that are absolutely covered under policy. At no time had I taken original or derivative evidence home. I believed that I had cleared up any misunderstanding or ainantics over the word "evidence", because tom—that word used without a descriptor is just a generic term for evidence. The word has types, not cmcluaivc to "original" r "derivative" evidence. like a classification to distinguish what the evidence is such as "original", "derivative", and "working copy". Then, there are caveats to the category of evidence such as "digital", "general", "drug", "valuablefinaLciii", etc. For example, when I review subpoena returns, 4B-4e—oppirte—prespeo4B4/I am reviewing " evidence", but that does not mean the evidence is "original" or "derivative", and unless those subpoena returns are in paper form, they are categorized as "digital evidence". Nevertheless, I am authorized to review those from home. that I am reviewing. EFTA00173516 The same applies to Or—chat messages derived_from a devicer or having been included in a lead or Guardian When discussing this with the Inspectors, I was clear that anything I reviewed outside appropriate facilities was working copies. At no point had I ever discussed with anyone that I have taken original and/or derivative evidence home or in any way in violation of policy. Any assertion to the contrary is categorically false. I have recently found a folder that I created on my FBINET computer called "to Take home for baby leave". This folder contained items I planned to take home to work on while still under the work-from -home guidance we received during the pandemic, which is also during the time my wife gave birth to our twin boys. The items in this folder are generally indicative of other files I had reviewed from home, none of which are original evidence, derivative evidence, or CSAM. Other examples that have also been provided to INSD include an email from CACHTU SSA Jordan Hadfield which was sent to all VCAC OCEs. The email was sent during the pandemic when OCEs were working from home and is requesting to know if OCEs were aware of a website contained in the email. SSA Hadfield instructed the OCEs to not use their "HOME COMPUTER" to access the link because it contained CSAM, however SSA Hadfield knew OCEs had their own FBI-issued misattributed laptops and phones that they could access the link on from home. Another example is from my supervisor at the time, SSA Sean Watson, who stated in an email dated 03/25/2020: EFTA00173517 "I will be assigning Guardian lead(s) which can be worked from home or an alternate location. Reminder for 305 leads, do NOT use personal networks to vet out 305 leads. Use covert equipment with an aircard or covert cell phones." Throughout most of its existence the C-20 lab was Internet connected. However, and for clarification, the C-20 lab existed long before the DExT program and the misattributed Internet was connected to our misattributed computers. At the time, work was primarily conducted on computer -based Internet platforms whereas today, the majority of OCE work is on mobile -based platforms. Back then, we used misattributed FBI-issues desktop computers to conduct OCE sessions from the lab and adjusted eutour work hours accordingly. As offenders began using mobile - based applications, OCEs were required to do the same. With the use of mobile applications offenders were now online and chatting throughout the day, versus just when they were on their home computers. Thus, the expectation of OCEs changed to emulate that of the offenders. I do not know exactly when we received FBI-issuede misattributed cellular telephones, but when we did, we also received the authority to take them with us wherever we went if we were engaging with CSAM offenders. In fact, OCEs have long been encouraged to communicate with offenders at random hours of the days and on weekends, to send offenders benign photographs while on vacation, at events, etc.; all to better EFTA00173518 legitimize the OCEs and help to dispel any fear offenders masi have that the OCEs are law enforcement., When we became DExT certified, our computers were not connected to the Internet except when we needed to update software' or some other Internet required task. As the years went on, the need for our DExT computers to be connected to the Internet grew. As discussed, HQ was aware of this and at times even promoted programs that required this. Additionally, two agents from C-20 and our SSA had all gone down to CACHTU to become SSAs and the UC respectively, and they were aware of this practice and need both from having worked on C-20 as well as from their positions at CACHTU. Lastly, as previously discussed, at the time of the intrusion our squad had been participating in a CACHTU pilot program, which included several other VCAC squads from across the FBI and required the computers to be connected to the Internet. Regardless, our lab has always been "stand-alone", meaning none of our computers to any FBI systems. Additionally, our lab was "misattr buted" and able to be used in covert capacities and to access websites that could contain Child Sexual Abuse Material (CSAM) . Initially, in approximately 2012, the C-20 lab was not connected to the Internet, but at the time we had little reason outside of software updates to be connected to the Internet. Several years later that changed as the advancement in our software and capabilities grew, requiring our computers to be Internet -connected. The only guidance or direction we received EFTA00173519 at the time was that our Internet -connected DExT computers not be connected to a FBI netw