Replies

https://oig.justice.gov/press/2019/2019-02-12.pdf

FOR IMMEDIATE RELEASE
February 12, 2019
DOJ OIG Releases Procedural Reform Recommendation for the FBI Concerning
the Collection and Retention of Text Messages Sent To or From FBI-Issued Mobile Devices
Department of Justice (DOJ) Inspector General Michael E. Horowitz announced today the
release of a Procedural Reform Recommendation (PRR) for the Federal Bureau of Investigation
(FBI) concerning the collection and retention of text messages sent to or from FBI-issued mobile
devices. The DOJ Office of the Inspector General (OIG) releases PRRs when, through its
investigative work, it identifies a systematic weakness in Justice Department operations,
programs, policies, procedures, or practices, and has a recommendation to address the
identified problem.
Today’s PRR arises out of the DOJ OIG’s work that resulted in the June 2018 report, A Review of
Various Actions by the Federal Bureau of Investigation and Department of Justice in Advance of
the 2016 Election, in which the OIG found significant issues with the reliability of the FBI’s
application for collecting text messages sent to or from FBI mobile devices. The OIG further
described these issues in its December 2018 Report of Investigation: Recovery of Text Messages
from Certain FBI Mobile Devices, in which the OIG stated that it would be submitting today’s
PRR to the FBI.
The PRR released today is available under “Recent Reports” on the OIG’s website and at the
following link: https://oig.justice.gov/reports/2019/i1902.pdf.

Horowitz discovered previously unknown database contained text messages...

DETAILS
The Problem
The OIG requested from the FBI text messages of, among others, two employees in
connection with the Pre-election Review. When the OIG received the text message production
from FBI, there was a time period of several months for which FBI did not produce text
messages for mobile devices used by the two FBI employees. The FBI informed the OIG that it
was aware that there were deficiencies in its collection application and that it was changing the
model of the mobile device issued to FBI employees as part of a regular technical refresh and to
mitigate the problem. However, the OIG later learned that, even after upgrading to new devices,
the data collection tool utilized by the FBI was still not reliably collecting text messages from
approximately 10 percent of more than 31,000 FBI-issued mobile devices.
In addition, during the OIG’s forensic examination of FBI mobile devices that were used
by the two employees, the OIG discovered a database on the mobile devices containing a plain
text repository of a substantial number of text messages sent and received by those devices.

Neither ESOC nor the vendor of the application was aware of the existence, origin, or purpose of
this database. OIG analysis of the text messages in the database compared to ESOC productions
of text messages during the same time periods when the collection tool was functional identified
a significant number of text messages found in the database that were missing from the ESOC
production. Furthermore, the Subject Matter Expert with whom the OIG consulted in connection
with its forensic analysis of the devices identified additional potential security vulnerabilities
regarding the collection application. The OIG has provided these findings to the FBI.

Existing FBI Policy
FBI Policy Directive 0423D, Section 8.5.5 states in part: “if employees need to access e-
communications that, for whatever reason, have not been preserved, they should address requests
to retrieve text messages . . . to the Security Division’s Enterprise Security Operations Center
(ESOC).” Although this directive designates ESOC as the repository for text messages, there is
no specific policy that requires ESOC to collect and retain text messages.
RECOMMENDATIONS
1. Amend the existing FBI Policy Directive to formally designate an entity to be responsible
for text message collection and retention.
2. Conduct additional research and testing of the current collection tool application with the
mobile devices deployed by the FBI or seek by other means, in coordination with the
collection tool’s vendor, to improve reliability of collection and preservation of text
messages sent to and from FBI-issued devices, with a goal of 100 percent text message
collection and preservation, to the extent technically feasible.
3. Conduct additional research and testing, or seek by other means, prior to procurement of
any new collection tool to be used by the FBI to collect and preserve text messages sent
to and from FBI-issued devices, with a goal of 100 percent text message collection and
preservation, to the extent technically feasible.
4. Coordinate with the collection tool vendor to ensure that data collected by the tool and
stored on the device is saved to a secure or encrypted location.
5. Verify and address the security vulnerabilities identified by the Subject Matter Expert
with whom the OIG consulted, which have been provided to the FBI. Current and future
mobile devices and data collection and preservation tools should be tested for security
vulnerabilities in order to ensure the security of the devices and the safekeeping of the
sensitive data therein.