Explanation of the Nine FOIA Exemptions

The following is a list of FOIA exemptions which apply to Government information in

accordance with 5 U.S.C. § 552(b):

(b)(1) EXEMPTION – Protects Classified Matters of National Defense or Foreign Policy.

This exemption protects from disclosure national security information concerning the national
defense or foreign policy, provided that is has been properly classified in accordance with the
substantive and procedural requirements of an executive order.

(b)(2) EXEMPTION – Internal Personnel Rules and Practices.

This exemption exempts from mandatory disclosure records “related solely to the internal
personnel rules and practices of an agency.” Courts have interpreted the exemption to encompass
two distinct categories of information:
(a) Internal matters of a relatively trivial nature – sometimes referred to as “low2”
information: and

(b)(3) EXEMPTION – Information Specifically Exempted by Other Statues:

This exemption incorporates the disclosure prohibitions that are contained in various other
federal statutes. As originally enacted in 1966, Exemption 3 was broadly phrased so as to simply
cover information “specifically exempted from disclosure by statute.” The new Exemption 3
statute prohibits agencies from releasing under the FOIA proposals,” unless that proposal” is set
forth or incorporated by reference in a contract entered into between the agency and the
contractor that submitted the proposal.”

(b)(4) EXEMPTION – Trade Secrets Commercial of Financial Information.

This exemptions protects “trade secrets and commercial or financial information obtained from a
person (this is) privileged or confidential.” This exemption is intended to protect the interest of
both the government and submitter of information.

(b)(5) EXEMPTION – Privileged Interagency or Intra-Agency Memoranda or Letters.

This exemption protects “inter-agency or intra-agency memorandums of letters which would not
be available by law to a party… in litigation with the agency.” As such, it has been construed to
“exempt those documents, and only those documents, normally privileged in the civil discovery
context.”

(b)(6) EXEMPTION- Personal Information Affecting an Individual’s Privacy.

This exemption permits the government to withhold all information about individuals in
“personnel and medical files and similar files” when the disclosure of such information “would
constitute a clearly unwarranted invasion of personal privacy.” This exemption cannot be
invoked to withhold from a requester information pertaining to the requester.

(b)(7) EXEMPTION – Investigatory Records Compiled for Law Enforcement Purposes.

As amended, this exemption protect from disclosure “records or information compiled for law
enforcement purposes.
 EXEMPTION 7(A) Records of information that could reasonably be expected to interfere
with enforcement proceedings. This exemption authorizes the withholding of “records or
information compiled for law enforcement purposes, but only to the extent that
production of such law enforcement records or information… could reasonably be
expected to interfere with enforcement proceedings.”

EXEMPTION 7(B) Disclosure which would deprive a person of a fair trial or an

impartial adjudication. Records that would prevents prejudicial pretrial publicity that
could impair a proceeding, protect “records of information compiled for law enforcement
purposes (the disclosure of which) would deprive a person of the right to a fair trial or an
impartial adjudication.”

EXEMPTION 7(C) Personal Information in Law Enforcement Records. This exemption

provides protection for personal information in law enforcement records. This exemption
is the law enforcement counterpart to Exemption 6, providing protection for law
enforcement information the disclosure of which “could reasonably be expected to
constitute an unwarranted invasion of personal privacy.”

EXEMPTION 7(D) Identity of a Confidential Source. This exemption provides protection

for “records or information compiled for law enforcement purposes (which) could
reasonably be expected to disclose the identity of a confidential source – including a
State, local or foreign agency or authority or any private institution which furnished
information on a confidential basis – and, in the case of a record or information compiled
by a criminal law enforcement authority in the course of a criminal investigation, or by an
agency conducting a lawful national security intelligence investigation, information
furnished by a confidential source.”

EXEMPTION 7(E) Circumvention of the Law. This exemption affords protection to all
law enforcement information which “would disclose techniques and procedures for law
enforcement investigation or prosecutions, or would disclose guidelines for law
enforcement investigations or prosecutions if such disclosure could reasonably be
expected to risk circumvention of the law.”

EXEMPTION 7(F) Physical Safety to Protect a wide Range of individuals. This

exemption permits the withholding of information necessary to protect the physical safety
of a wide range of individuals. Whereas Exemption 7(F) previously protected records that
“would… endanger the life or physical safety of law enforcement personnel.” The
amended exemption provides protection to “any individual when disclosure of
information about him or her “could reasonably be expected to endanger (his/her) life or
physical safety.”

(b)(8) EXEMPTION – Records of Financial Institutions.

This exemption covers matters that are “contained in or related to examinations, operating, or
condition reported prepared by, on behalf of, or for the use of an agency responsible for the
regulation or supervision of financial institutions.”

(b)(9) EXEMPTION – Geographical and Geophysical Information Concerning Wells.

This exemption covers “geological and geophysical information and data, including maps
concerning wells.”
 CUI
NAVAL CRIMINAL INVESTIGATIVE SERVIC(
RECORDS MANAGEMENT DIVISION
LAW ENFORCEMENT RECORDS
Package ID#: 20240711120--003869

Name: FORT BELVOIR VA UNAUTHORIZED BREACH OF Pi DTUS MEDICAL

RECORDS BY USN MEMBER
AKA:

Social Security Number: Context: lmpers onal Title

Date of Birth: State of Birth: Country of Birth: N/A - Unkno f\'n

Case Number: 27FEB24DCWA000326XNA Dossier:

DCII INDEX CODE: RECORD SERIES #: Date Closed:
H = 30 Years 5000-51 07/05/2024

RECORD SERIES (FILE PLAN)

Law Enforcement Records - NCIS Criminal Investigative Case Files
NCIS Criminal Investigative Case Files
Comments:
(b)(6), (b)(7)(C)

B Polygraph Examination Conducted B Sexual Offender Registl') Completed

B Finger Prints Submitted to Code 23C2 8 Final Disposition Report l o FBI

CIS • I
0 Closed Status 0 Dup Title 0 DupCCN

Disclosure/Accountability Statement: If this investigation is disseminated outside NCIS, complete NCIS Form 009/10-80. and ens, re it is retained in the case file.

I
111111111111
(b)(6), (b)(7)(C)
2 4I 17 04 4
certify that this document has been reviewed and is complete.
Tlped Name of SSA
(~JIA ~'-( (b)(6), (b)(7)(C)
DATE
Unctassified when separated from attachment unless otherwise indicated.

CUI
Privacy Act Statement
Privacy Sensitive -Any misuse or unauthorized disclosure may resuH in both civil or criminal pen allies

000001
 CUI

U . S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

REPORT OF I NVESTIGATION (CLOSED) 05JUL24

SPEC:A~ IN UIRY (II) CONTROL : 27FEB24 - DCWA- 0 032 - 6XNA/F

:/FORT 3ELVO:R, VA ~~AUTHOR:ZE~ BREACH OF POTUS ' ~EDICAL RECORDS B USN

MEMBER

COMMAND/NAVY MEJICINE PEADINESS AND TRAINING COMMAND/68920

~.AJE AT/DCWA RES:SENT AGE~CY WASHINGTON DC (b)(6), (b)(7)(C)

SPEC:AL AGENT

REFERC:NCE(S)
(A) NCI SRA WASHINGTON , DC ROI ( INTERIM) (CONTAINING EXHIBITS
l - 25)/24APR24

EXH:3!T(S)
(26) AC:MINI STRATIVE REMARKS/06JUN24

EXECUTIVE SUMMJ>..RY
1 . )n 27Feb24 , NCISRA Washington , DC was cortacted by (b)(6), (b)(7)(C) SN , MTAC
Watch Officer , NCIS , i n reference co a noti:ication via Navy O?REP 3
regarding an inciden- at Ferr oelvoir , VA . The incident involvea a uspected
unauthori zed access to the President of the Jnited States ' (POTCS) edical
records by a USN member . It was reported that a database (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) was accessed multiple times on 22Feb24 . The alleg d
offender Nas identi : ied as (b)(6), (b)(7)(C) USN , Naval Medicul Rea i ness
and Training Ce~ter (NMRTC) , Fort Belvoir , VA . Multiple witness int rviews
were conducted . Networ~ logs and r e~ords for (b)(6), (b)(7)(C) account w re
rE>ceived and re·✓ 1ewed , whi h showed (b)(6), (b)(7)(C) accessed (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) for " Joseph Bi den " for 20 seconds . (b)(6), (b)(7)(C) was r ad hi s
Article 31b rights , which he waived , and con:essed to searching the medical
re~ords syste~ , (b)(6), (b)(7)(C) for "Joseph Biden" out of curiosity to see i f he
could . On XXJul24 , (b)(6), (b)(7)(C) IJSN , NMRTC , Fort Be l voir , VA, rovided
thE' administrative r emarks page , whi h doc~mented that (b)(6), (b)(7)(C) r ceived a
Non- judici al Punisr.ment (NJP) or. Ob:un24 fo r Article 92 (Derelictio of
Duty) of thP. UCMJ . (b)(6), (b)(7)(C) was awarded forfeiture of half mon-h ' pay per
mc nth for six months , 1eduction in rate co E- 2, and 20 days of e xcr duty .

NARRATIVE
1 . This reactive investigation pertains to suspP.cted vi olations of 8 United
States CodP. 1030 (Fra~d and related activity in connection with
ccr:1puters) .

2 . On 03Jul24 , (b)(6), (b)(7)(C) USN , NMRTC , Fort Belvoir , VA , prov ded the
adminisrracive rema r Ks page , which documented that (b)(6), (b)(7)(C) recei ed a
Non- judi,:ial Pur.ishmer;: (NJP) or "'6Jun24 for Article 92 (Derelictio of
Duty) o: cr.e UC~J . (b)(6), (b)(7)(C) was awarded fo r : 0 iture o: half mon~r. • pay per
montn for six mcnrhs , reduction in rate to E- 2 , and 20 days of extr duty .
Exhibit (26) pertains

PAGE l
WARNI G
THIS DOCUMENT IS THE PROPERTY OF THE NAVAL CR MINA!. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TOP RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM HE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI

000002
 CUI

U. S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA/ F OSJUL24

3 . During the :nve stigation, (b)(6), (b)(7)(C) fingerp r i nt s were not co lected
a nd s ubmi tted t o the Fede r al Bu r eau o f I nvest i ga t ion (FBI ) ; t hus , f inal
d i spos i t i on r eport wi ll not be submi tte d to t he FBI .

4 . On 05Ju l 24 , CAPT Tr a ce y GILES , USN , Commanding Offi c er (CO) , NM TC, For :

Belvoi r , VA; (b)(6), (b)(7)(C) USN , Sta f f J udge Advocate (SJA) , N RTC ,
Bet he sda , MD ; a nd (b)(6), (b)(7)(C) USN , Trial Counsel (TC) , Reg i on Legal
Ser vices O:: ice (RLSO) , ~a s hingcon Navy Yard (WNY) , Washington , DC were
a pprised o: the status o : the investigati on .

5 . This i nvestigac i on i s c l osed .

D:STRIBUTION
NC: SHQ: 0023
I NFO

(b)(6), (b)(7)(C)

PAGE (b)(6), (b)(7)(C)

2 LAST V2 L NN
WAR NG:
THIS DOCUMENT IS THE PROPERTY OF T NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000003
Page 4 redacted for the following reason:
---------------------
(b)(6), (b)(7)(C): Page (4), Exhibit (26) - Remarks
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

REPORT OF INVESTIGATION (INTERIM) 24APR24

SPECIAL INQUIRY (II) CONTROL: 27FEB24 - DCWA- 0032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY USN

MEMBER

COMMAND/NAVY ME)ICINE READINESS AND TRAINING COMMAND/68920

MADE AT/DCWA/RESIDENT AGENCY WASHINGTON DC (b)(6), (b)(7)(C)

SPECIAL AGENT

EXHIBIT (S)
(1) IA : RESULTS OF CONTACT WITH NIWC LANT CSSP PERSONNEL/27FEB24
(2) IA : RESULTS OF CONTACT WITH UNITED STATES SECRET
SERVICE/27FEB24
(3) IA: RESULTS OF CONTACT WITH USN/28FEB24
( 4) IA : RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) USN/28FEB24
(5) IA: RESULTS OF INTERVIEW OF USN/11MAR24
(6) IA: RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C)
USN/11MAR24
(7) IA : RESULTS OF INTERVIEW OF 2MAR24
(8) IA : RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C)
USA/12MAR24
(9) IA : RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C)
CIV/12MAR2 4
(10) IA: RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) CIV/12MAR24
(11) IA : RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) CIV/27FEB24
(12) IA : RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C)
USA/27 FEB24
(13) IA : RESULTS OF CONTACT WITH USN/27FEB24
(14) IA : RESULTS OF CONTACT WITH (b)(6), (b)(7)(C) USA/27FEB24
(15) IA : RESULTS OF DATABASE CHECKS/12MAR24
(16) IA: RESULTS OF SOCIAL MEDIA CHECKS ON (b)(6), (b)(7)(C) 06MAR24
(17) IA : RESULTS OF REVIEW OF (b)(6), (b)(7)(C) OFFICIAL MILITARY
PERSONNEL FILE (OMPF)/04MAR24
(18) IA : RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) USN/28 FEB24
(19) IA : RESULTS OF SCENE DOCUMENTATION/27FEB24
(20) IA: SUBMISSION OF MEMORANDUM REQUESTING USER ACCOUNT
INFORMATION AND LOGS/04MAR24
(21) IA : RETURN OF EVIDENCE/24APR24
(22) IA : RECEIPT OF HEALTH . MIL ACCOUNT PROFILE
(b)(6), (b)(7)(C) /12MAR24
(23) IA : REVIEW OF THE CONTENTS OF THE HEALTH . MIL ACCOUNT
PROFILE (b)(6), (b)(7)(C) /22MAR24
(24) IA: RESULTS OF DIGITAL FORENSIC EXAMINATION OF (b)(6), (b)(7)(C)
DEVICES/18APR24
(25) IA : RECEIPT OF FINDINGS MEDIA/24APR24

EXECUTIVE SUMMARY
1 . On 27Feb24 , NCISRA Washington , DC was contacted by (b)(6), (b)(7)(C) SN , MTAC

PAGE 1
WARNI G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000005
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 24APR24

Watch Officer , NCIS , in reference to a notification via Navy OPREP-

regarding an incident at Fort Belvoir, VA. The incident involved a uspected
unauthorized access to the President of the United States ' (POTUS) edical
records by a USN member . It was reported that a database (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) was accessed multiple times on 22Feb24. The alleg d
offender was identified as (b)(6), (b)(7)(C) USN, Naval Medical Rea iness
and Training Center (NMRTC), Fort Belvoir , VA . Multiple witness int rviews
were conducted . Network logs and records for (b)(6), (b)(7)(C) account w re
received and reviewed, which showed (b)(6), (b)(7)(C) accessed (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) for "Joseph Biden " for 20 seconds. (b)(6), (b)(7)(C) was r ad his
Article 31b rigits , which he waived, and confessed to searching the medical
records system , (b)(6), (b)(7)(C)for "Joseph Biden " out of curiosity to see i f he
could . This investigation is pending judicial/administrative action

NARRATIVE
1 . This reactive investigation pertains to suspected violations of 8 United
States Code 1030 (Fraud and related activity in connection with
computers) .

2. On 27Feb24 , (b)(6), (b)(7)(C) CIV, Division Head and Senior Cyber A visor to
Defense Health Agency (DHA), Naval Information Warfare Ce nter (NIWC
Atlantic (LANT) , Charleston, SC , provided information regarding the audit of
(b)(6), (b)(7)(C) account. Exhibit (1 ) pertains .

3 . On 27Feb24 , NCIS Cyber Field Office was in contact with multiple points
of contact with the United States Secret Service (USSS) regarding t e
captioned investigation. Exhibit (2) pertains .

4 . On 27Feb24 , (b)(6), (b)(7)(C) USN , NMRTC, Fort Belvoir , VA, pro ided
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)information as the person who conducted the unauthorized ccess to
POTUS ' medical records. Exhibit (3) pertains .

5. On 27Feb24 , (b)(6), (b)(7)(C) , NMR C, Fort

Belvoir , VA, was interviewed regarding her knowledge of the caption d
investigation . Exhibit (4) pertains .

6 . On 27Feb24, (b)(6), (b)(7)(C) USN, NMRTC, Fort Belvoir, VA, was

interviewed and stated she spoke with (b)(6), (b)(7)(C) regarding the unau horized
access. (b)(6), (b)(7)(C) told her he did it, but did not provide an answe as to
why . Exhibit (5) pertains .

7 . On 27Feb24 , (b)(6), (b)(7)(C) USN , NMRTC , Fort Belvoir , VA, was

interviewed and advised (b)(6), (b)(7)(C) CIV, Head Nurse , Family Medi ine ,
Fort Belvoir Community Hospital (FBCH) , Fort Belvoir , VA, initially reported
the incident. Exhibit (6) pertains.

8 . On 27Feb24 , (b)(6), (b)(7)(C)was interviewed and relayed (b)(6), (b)(7)(C)

PAGE 2
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAi. CRIMINAi. iNVESTiGATiVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVM. CRIMINAL INVESTIGATIVE SERVICE.

CUI

000006
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 24APR24

CIV , I.±censed N·Jrse , FBCH, Fort Belvoir , VA, reported the incident o her .
Exh¼bit (7) per~ains.

9 . On 27Feb24 , (b)(6), (b)(7)(C) USA, Family Medicine , FBCH , Fort Belvoir ,

VA, was interviewed regarding his knowledge of the captioned invest·gation .
Exhibit (8) percains.

10 . On 27Feb24 , (b)(6), (b)(7)(C) was interviewed and stated she saw (b)(6), (b)(7)(C)
work station computer wi th the medical records for "Joseph Biden " p lled up
after he searched the name . Exhibit (9) pertains.

11 . 0n 27Feb24, (b)(6), (b)(7)(C) CIV, Certified Nursing Assistant,

7reo1c1-ne , PBCH, f orttfelvoir , VA , was interviewed and advised shew
present when (b)(6), (b)(7)(C) searched for POTUS ' medical records, but di
directly see the search . Exhibit (10) pertains .

12. On 27Feb24 , (b)(6), (b)(7)(C)

(b)(6), (b)(7)(C) FBCH , Fort Belvoir , VA, was
interviewed regarding her knowledge of the captioned investigation. Exhibit
(11) pertains.

13 . On 27Feb24 , (b)(6), (b)(7)(C)

Fort Belvoir , VA, was interviewed regarding her knowledge of the ca tioned
111vest1gat1011. !:xltibit (12) pertains.

- ~ -----=:u:::=:Oii--2:Ii'.eoU;::: (b)(6), (b)(7)(C) USN, Staff Judge Advocate (SJA) , NMRTC,

Bethesda , MD, was contacted regarding the captioned investigation. xhibit
(13) pertains.

15 . On 27Feb24 , (b)(6), (b)(7)(C) USA, Deput y Director , White House Medical

nit, Washington, DC, was contacted a nd provided the record access as not a
legitimate electronic health record of POTUS . Exhibit (14) pertains

16. On 27Feb24L database checks of (b)(6), (b)(7)(C) were conducted. Exhib t (15)
pertains
17 . On 27Feb24 , social media checks of (b)(6), (b)(7)(C) were conducted. E hibit
(16) pertaiM_. _

18 . On 27Feb24 , (b)(6), (b)(7)(C) Official Military Personnel File was r viewed.

Exhibit (17) pertains.

19 . On 27Feb24, (b)(6), (b)(7)(C) was read his Arti cle 31b rights, which h waived ,
and confessed to searching fo r POTUS ' medical records out of curios ty to
see if he could . (b)(6), (b)(7)(C) did not print , save, email, or otherwis
document the records . (b)(6), (b)(7)(C) was not directed or told to search for the
records , he did it to see if he could . Exhibit (18) pertains.

P'AGE 3
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAV/'J. CRIMIN/'J. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAV/'J. CRIMIN/'J. INVESTIGATIVE SERVICE.

CUI

000007
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA- 00032-6XNA 24APR24

20 . On 27Feb24 , subsequent to (b)(6), (b)(7)(C) signing a Permissi ve Autho ization

for Search and Seizure (PASS) , (b)(6), (b)(7)(C) barracks room was searc ed for
his electronics and any other potential evidence related to the cap ioned
investigation . ~xhibit (19) pertains.

21. On 04Mar24 , a letterhead memo was submitted to(b)(6), (b)(7)(C)

for accou t
information and logs for the profile, (b)(6), (b)(7)(C) associated ith(b)(6), (b)(7)(C)
. Exhibit (20) pertains .
(b)(6), (b)(7)(C)

22 . On 06Mar24 , an MSI laptop and iPhone , which were previously sei ed as

items of evidence , were returned to (b)(6), (b)(7)(C) Exhibit (21) pertai s.

23. On 08Mar24 , (b)(6), (b)(7)(C) CIV, Cyber Security Service Provid r (CSSP)
Director , NIWC LANT , Charleston , SC , provided the records r elated t the
account , (b)(6), (b)(7)(C) Exhibit (22) pertains.

24 . On 22Mar24, the records related to the account (b)(6), (b)(7)(C) were

reviewed. The records noted on 22Feb24, (b)(6), (b)(7)(C) account logged into MHS
to access the chart belonging to "Joseph Biden ". (b)(6), (b)(7)(C) accessed
(b)(6), (b)(7)(C)
the "Joseph Biden" record for 20 seconds . Exhibit (23) pertains.

25 . On 28Feb24 - 17Apr24 , (b)(6), (b)(7)(C) electronic devices were forens cally

reviewed . Due to administrative e r ror , (b)(6), (b)(7)(C) was incorrectl y r ferre-- - - - - - - - - - - -
to as (b)(6), (b)(7)(C) in this report . Exhibit (24) pertains .

26. On 16Apr24 , the findings media pertaining to the forensic revie (b)(6),
of (b)(7)(C)
's
electronic devices was received. Exhibit (25) pertains.
(b)(6), (b)(7)(C)

27 . On 24Apr24 , (b)(6), (b)(7)(C) USN, T ial

Counsel (TC) , Region Legal Services Office (RLSO) , Washington Navy ard
(WNY), Washington, DC, were apprised of the status of the
investigation .

28. Active investigation complete. This case is pending

judicial/administrative action . Any additional investigative steps equired
throuohout judicial/administrative review will be documented as app opriate;
however, routine reporting is hereby suspended.

PARTICIPANTS
INVESTIGATOR, WASHINGTON FIELD OFFICE
(b)(6), (b)(7)(C) ECIAL AGENT, WASHINGTON FIELD OFFICE
PECIAL AGENT, NCIS CYBER WASHINGTON DC

DISTRIBUTION
NCISHQ : 0023
INFO (b)(6), (b)(7)(C)

PAGE 4
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAV/>L CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL OUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAl.-eRIMIN:Al:1NVESTIGATM!'SERVtCE-. - - -

CUI

000008
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 24APR24

(b)(6), (b)(7)(C)

PAGE 5 LAST V2 LNN

(b)(6), (b)(7)(C)
WARNI G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSEO TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AI.JTHORlZATION FROM E NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000009
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 27FEB24

CONTROL: 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS B

USN MEMBER

RESULTS OF CONTACT WITH NIWC LANT CSSP PERSONNEL

1 . On 26FEB24 , the Multi- Threat Alert Center (MTAC) received

event/incident report (OPREP- 3) Navy Blue (NB) message which provi
information describing any significant event or incident not of
national - level interest. The OPREP- 3 NB report indicated a U. S . Na
active- duty service member had gained unauthorized access to the P
of the United States ' (POTUS) medical records . (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
integrates inpatient and outpatient electronic sol
(b)(6), (b)(7)(C)
connecting medical and denta l r ecords for DoD, USCG, and veterans .
of c yber security for (b)(6), (b)(7)(C) were the responsibility oft Naval
Information Warfare Center (NIWC) Atlantic (LANT). NIWC LANT wast
identified Cyber Security Ser vice Provider (CSSP) for the computer atabase
which included protecting against, defending against , and respondi to
suspicious or malicious cyber activity .

2 . On 27FEB24 , at approximately 0725 , (b)(6), (b)(7)(C) to NIW

related via telephone he was in communication with (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
Charleston,
(b)(6), (b)(7)(C) SC , responsive to OPREP- 3 NB . (b)(6), (b)(7)(C) indic
LANT personnel were initiating an audit of the U. S . Navy service me
profile to begin collecting network artifacts to provide in support
captioned investigation .

3 . On 27FEB24 , from approximately 1208 to 1750, Reporting Agent ( and

were in telephonic and email communication .(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) related
profile (b)(6), (b)(7)(C) had been used to access an account with the
text identifier JOSEPH BIDEN . The profile used had accessed the JOS
medical recorcrvra th~ (b)(6), (b)(7)(C) .(b)(6), (b)(7)(C)
indicate trre--
POTUS medical records should not have been accessible to unauthoriz
(b)(6), (b)(7)(C) Additionally ,(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)identified (b)(6), (b)(7)(C) of WHMU , Washinton, DC ,
as a point of contact having knowledge of POTUS ' medical records .
Additionally (b)(6), , related (b)(6), (b)(7)(C) staff included a nurse(b)(6),
(b)(7)(C) , (b)(7)(C)
(b)(6), (b)(7)(C) CIV, Walter Reed National Military Medical Center (WRNMMC,
Bethesda , MD, who was (b)(6), (b)(7)(C)
provided (b)(6), (b)(7)(C) a list of access logs for acco nt
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) at or near the time of the reported unauthorized ace ss .
Subsequent to review of the access logs , (b)(6), (b)(7)(C) indicated ther were no

PAGE 1
WARN NG:
THIS DOCUMENT IS THE PROPERTY OF NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI
EXHIBIT ( \)
000010
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL:27FEB24-DCWA-00032-6XNA

concerns that POTUS ' legitimate medical records had been accessed b sed upon
his review(b)(6),
. had NIWC LANT personnel conduct a da ta pull for
(b)(7)(C) rowser
search history . Results of the data pull returned Google search que ies
which included the search parameter " joe biden ' s doctor" on 22FEB24 at 1322
GMT -05 : 00 fr om pro file (b)(6), (b)(7)(C)

4 . Contact in f ormat i on for(b)(6), (b)(7)(C)

was identified as follows :

a . Email: (b)(6), (b)(7)(C)

b. Mobile: (b)(6), (b)(7)(C)

c . Desk : (b)(6), (b)(7)(C)

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE: NCIS CYBER WASHINGTON DC

PAGE 2 LAST(b)(6), (b)(7)(C)

V2 LNN
WARN G:
TI11S DOCUMENT IS TI1E PROPERTY OF TI1 NAV/IJ.. CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TD TI1E PARTY(S) CONCERNED
WITHOUT SPECIFleAUTHORIZATION FR TI1E Ni'l:YAL C"IMINJO<L INvl!S'l'IC!ATl'II! .!ll!"vlCI!.

CUI

000011
 CUI

U. S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 27FEB24

CONTROL : 27FEB24- DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY

USN MEMBER

RESULTS OF CONTACT ' WITH UNITED STATES SECRET SERVICE

1. On 26FEB24, the Multi - Threat Alert Center (MTAC) received an ope ations
event/incident report (OPREP- 3) Navy Blue (NB) message which provid d
informat ion descri b i ng any significant event or incident not of
national- level interest . The OPREP- 3 NB report indicated a U.S . Nav
active- duty service member had gained unauthorized access to the Pr sident
of the United States ' (POTUS) medical records . Due to the reported exus to
POTUS ' medical records the United States Secret Service (USSS) beca e
involved to identify if there was an immediate threat to POTUS .

2 . On 27 FEB2 4, at approximatel y 0930 , ASAIC USSS (b)(6), (b)(7)(C)USSS , Los geles ,

CA , contacted Reporting Agent (RA) to relate USSS interest in suppo ting the
captioned investigati on . ASAIC related RA ' s contacted infor m
USSS (b)(6), (b)(7)(C) tion
would be provided to the Protective Intelligence and Assessment Ope ations
Center (PIOC) for further coordination. ASAIC provided the f
USSS (b)(6), (b)(7)(C) !lowing
contact information :

a . Phone : USSS (b)(6), (b)(7)(C)

b . Email : USSS (b)(6), (b)(7)(C)

3 . On 27FEB24 , at approximately 1130 , ASAIC USSS (b)(6), (b)(7)(C) USSS , Was ington ,
DC , contact ed RA on the behal f of t he PIOC . ASAIC i dentified himself
USSS (b)(6), (b)(7)(C)
as the day shift supervi sor fo r the PIOC . ASAIC i ndicated th t NCISRA
USSS (b)(6), (b)(7)(C)
Washington, DC (DCWA) had investigative primacy regarding the repor ed
unauthorized access to POTUS ' electronic health records (EHR) . ASAI USSS (b)(6), (b)(7)(C)
indicated USSS special agents f r om the USSS Washington Field Office (WFO)
would li ke to be present for the interrogation of SA (b)(6), (b)(7)(C) USN ,
Naval Medici ne and Readi ness Tr aining Center (NMRTC, For t Belvoi r , A. The
responding USSS agents were e xpected to ascertain why access made ; f any
other persons were involved; if organizations of interests were inv lved;
and if the information was printed; emailed or released to anyone. 's
contact information was passed to USSS WFO for coordination . ASAIC USSS (b)(6), (b)(7)(C)
provided the following contact information :

a . Phone : USSS (b)(6), (b)(7)(C)

b . Email: USSS (b)(6), (b)(7)(C)

4 . On 27FEB24 , at approximately 1332 , SA USSS (b)(6), (b)(7)(C) USSS , Washi

and OFC USSS (b)(6), (b)(7)(C) USSS , Washington , DC, contacted RA to in

PAGE 1
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI
EXHIBIT (a-_ )
- 000012
_._ ....;_
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032 - 6XNA 27FEB24

(b)(6), (b)(7)(C) was expected to be interrogated and to relate their expe ted time
of arrival to be present for the interrogation . At or near 1700 hou s , SA
USSS (b)(6), (b)(7)(C) arrived on scene . RA related the known fac t and
circumstances to include RA had been in touch with (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)RA
informed SA and OFC (b)(6), (b)(7)(C) the searched accoun was not
(b)(6), (b)(7)(C)
POTUS ' accoun t . SA and OFC (b)(6), (b)(7)(C) provided the f ollowing c ntact
(b)(6), (b)(7)(C)
information :

a. Work : USSS (b)(6), (b)(7)(C)

b. Mobile : USSS (b)(6), (b)(7)(C)

c . (b)(6), (b)(7)(C)
USSS Email : USSS (b)(6), (b)(7)(C)

d. Mobile: USSS (b)(6), (b)(7)(C)

e. Email : USSS (b)(6), (b)(7)(C)

REPORTED BY : (b)(6), (b)(7)(C) , Special Agent

OFFICE : NCIS CYBER WASHINGTON DC

PAGE 2 LAST V2 LNN

(b)(6), (b)(7)(C)
WAAN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE DISCLOSED TO THE PAATY(S) CONCERNED
WITHOUT SPECIFIC ALITMORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000013
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGAT I VE ACTI ON 28FEB24

CONTRO: : 27FEB24 - DCWA- 00032 - 6XNA

:/FORT BELVOIR, VA/U~AUTHORIZED BREACH OF POTUS ' MEDI CAL RECORDS B

USN MEMBER

RESULTS OF CONTACT WI TH (b)(6), (b)(7)(C) USN

1 . On 27 Feb24 , Repo r t i ng Agent (RA) contacted (b)(6), (b)(7)(C)

Medical Readiness ar.d Training Center (NMRTC) , Fort Belvoir , VA,
her knowledge of the captioned i nve stiga t i on .

2 . (b)(6), (b)(7)(C) advised she co~piled the Navy O?REP- 3 r egar d i ng the
unauthorized access to the President ' s medical records . (b)(6), (b)(7)(C)
the person who conducted the unauthorized access was (b)(6), (b)(7)(C)
NMRTC , For t Belvoir, VA .

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARNI G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TOP RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM HE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI
EXHIBIT ( 3 )

000014
 CUI

U. S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTivN 28FEB2~

CONTROL : 27FEB24 - DCWA- 00032- 6XNA

: / FORT 3:::LVO:R, VA/'J:lAi.JTHO:C ZE[; BREACH OF POT US ' MEDICAL RECORDS B

USN MEM3ER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) , uSN

1 . On 27 Feb24 , Repor t i ng Agent (RA) and ?ar ticipating Agent (PA)

(b)(6), (b)(7)(C)
interviewed
(b)(6), (b)(7)(C) (b)(6), (b)(7)(C) Na al
Medical Readiness Tra i ning Cenrer (NMRTC) , Fort Belvoir , VA, regar ing her
knowledge of the cap:ioned investigaticn .

2 . (b)(6), (b)(7)(C) advised on the afternoon of 26Feb2 4 she was contacte by (b)(7)(C)
(b)(6),
(b)(6), (b)(7)(C) , USN , NMRTC , Fort Belvoi r , VA . (b)(6), (b)(7)(C) rel ted
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) USN , NMRTC , For- Belvoir , VA, went into -he health ecord o:
the President of :he Jnited States , which was reported by d friend (NFI)
that (b)(6), (b)(7)(C) told . (b)(6), (b)(7)(C) advi sed the Health Insurance
PL rtabili :y and Accour.tability Art (HI PAA) o::icer (NFI) was brie: d about
the incident .

3 . (b)(6), (b)(7)(C) rela::ed (b)(6), (b)(7)(C) was removed :rom patient -.:are and rought
to the command sui - e o: NMRTC , out of the hospital . (b)(6), (b)(7)(C) USN ,
NMRTC , Fort Be~voir , VA , discussed the incident with (b)(6), (b)(7)(C) wh he
arrived at the command suite . According to (b)(6), (b)(7)(C) - (b)(6),
ld (b)(7)(C)
(b)(6), (b)(7)(C)he did access ~he records . (b)(6), (b)(7)(C) advised they wipea (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) access so r.e is unable to get ontc a computer at the
hospital .

4 . According - o (b)(6), (b)(7)(C) s~e was tola (b)(6), (b)(7)(C) accessed the re ords for
one to two minutes or three different occurrences . (b)(6), (b)(7)(C) did n t know
if (b)(6), (b)(7)(C) printed any records or did anything else beside s acce s the
re~ords . (b)(6), (b)(7)(C) related (b)(6), (b)(7)(C) used a work station in the c inic at
Fort Belvoir Communi:y Hospital to access these re~ords . These comp ters are
not specifically assigned to each person . (b)(6), (b)(7)(C) explained ever one
working in the hospi:al has access to (b)(6), (b)(7)(C) which contains t .e
electronic heal-h records of - ne patients . (b)(6), (b)(7)(C) ra~P QnlinP - rhP
hcsp1tal last March . The H:PAA g~ides and trainings train people try are
not supposed to access or resear~h other health records that do not pertai n
tc their jobs . Everyone who has ac~ess receives this training .

5 . (b)(6), (b)(7)(C) related (b)(6), (b)(7)(C) is a hospi tal corpsman and his reg lar
tasks include checking in patients and assisting doctors , which can include
taking their blood pressure/vitals and/or looking up their nedical
records .

o . (b)(6), (b)(7)(C) provided no furtner informa~ior. relevant to the cap~i ned

investigation .

PAGE 1
WARNI G
THIS DOCUMENT IS THE PROPERTY OF THNAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAV BE DISCLOSEO ONLV TO RSONS WHOSE OFFICIAL DUTIES REOU IRE
ACCESS HERETO CONTENTS MAY NOT BE ISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM HE NAVA!. CRIM,NAL INVESTIGATIVE SERVICE

CUI
E HIBIT ( £i )
000015
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL:27FEB24-DCWA-00032-6XNA 28FEB24

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OF FICE : RESIDENT AGENCY WASHINGTON DC

PAGE 2 LAST V2 LNN

(b)(6), (b)(7)(C)
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY($ ) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI

000016
 CUI

U. S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTION l.!MAR24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

:/r0RT 32L.v'O: R, VA/'J:--JA:.JTHORIZED BREACH OF POTUS ' MEDICAL RECORDS B

USN MEMSER

RESULTS OF :NTERVIEW OF (b)(6), (b)(7)(C) JSN

1 . On 27 Feb24 , Reporting Agenr (RA) and Pa r ticipating Agent (PA)(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)i ntervi ewed
(b)(6), (b)(7)(C) USN , Naval Medicine Readine s
Training Center (NMRTC) , Fort Belvoi r, VA , r egarding her knowledge of the
captioned investiga:ion .

2 . (b)(6), (b)(7)(C) advisPd (b)(6), (b)(7)(C) 0SN , NMRT,, Fort Belvoir , VA, was
escorted to the COITL~ar.d suite by (b)(6), (b)(7)(C) USA, For t Belvoir,
VA, afte r command learned about - he unauthor ized access . (b)(6), (b)(7)(C) spoke
to (b)(6), (b)(7)(C) :-egardir.g the incident . (b)(6), (b)(7)(C) stated he knew wh he was
at the command suite and relayed he did not know why he access the records .
(b)(6), (b)(7)(C) told him he was not supposed ::o try to access them an (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)related he understood . (b)(6), (b)(7)(C) also spoke to (b)(6), (b)(7)(C)
Health Ins~rance ?or:ao1l1ty and Accountability Act (HIPAA) Office , Fort
Belvo1r , VA , and to l d her the details about what he d i d . (b)(6), (b)(7)(C)
expressed he d ~d not do anything with the i r.: ormation and did not .are any
cf i t .

3 . (b)(6), (b)(7)(C) advised (b)(6), (b)(7)(C) has no access to computers curr_ -ly and
he was told to remai n at the command suite , which is located separa e fr om
Fort Belvoir Co:nmunity H~sp_tal, Fort Belvoir , VA . (b)(6), (b)(7)(C) el ted the
unauthorized ac~ess happened late last week and occurred en three ::eren::
incidents somewjere oe-ween 0730 ::o 1400 based on the ir.rormation s e was
pr0vided . (b)(6), (b)(7)(C) detdiled they use shared computers at the ho pital
iind use ::heir Co:nmon .l,ccess Cards (CACs) to access ::he cor.-puters as well as
the record system . (b)(6), (b)(7)(C) related (b)(6), (b)(7)(C) daily duties w uld
involve looking at records , but it would only be of current patient at the
hospital .

4 . (b)(6), (b)(7)(C) pr ovided no further detail s pertinent to thP cnpcio Pd

investigation .

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFF:CE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARNI G
THIS DOCUMENT IS THE PROPERTY OF TH NAVP>J. CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO P RSONS WHOSE OFFICIP>J. DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSE0 TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM HE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI
EXHIBIT ( 5 )
000017
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE A~TION llMAR24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

:/FORT SELVOIR, VA/UNAJTHORIZED BREACH OF POTUS ' MEDICAL RECORDS B

USN MEMBER

PESU:..TS OF !NTERVIE\1 CF (b)(6), (b)(7)(C) i.JSN

1 . On 27Feb24 , Reporting Agent (RA) and Participating Ag~nt (PA)(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)interviewed (b)(6), (b)(7)(C) USN , Naval Medical Read ness
Training Cen ter (~MRTC) , Fort Belvoir , VA , regarding hi s knowledge of the
unauthorized access conducted by (b)(6), (b)(7)(C) USN , NMRTC , For Belvoir ,
VA .

2. (b)(6), (b)(7)(C) stated he received the report of the unauthorize access

:rom (b)(6), (b)(7)(C) Family Medicine , Fort Belvoir Cormnuni :.y
Hospital (FBCH) , For: Belvoir , VA . Arcvrding to (b)(6), (b)(7)(C)
reported :he incident :c (b)(6), (b)(7)(C) CIV , Health Insurance Port bili ty
and Accountability Ac: (HIPAA) O::icer , FBCh , Fort Belvoir , VA, wh
conpleted an inves:iga : ion .

REPORT'::[ BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARN G
THIS DOCUMENT IS THE PROPERTY OF TH NAVAi. CRIMINAL INVESTIGATlVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAi. CRIMINAL INVESTIGATIVE SERVICE

CUI

000018
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTION 12MAR24

CONTROL : 27FEB24- DCWA- 00032 - 6XNA

:/FORT 32LVO:R, VA/U~AJTHOR:ZED BREACH OF POTUS ' ~EDICAL RECORDS B

USN MSM3ER

RESULTS OF :N:ERVIEW CF (b)(6), (b)(7)(C) CIV

1 . On 27Feb24 , Reporting Agen t (RA) and Participating Agent (PA)(b)(6), (b)(7)(C)

interviewed
(b)(6), (b)(7)(C) (b)(6), (b)(7)(C) c:v, Nu r sing Supe r v i sor , Family Medicine ,
Fort Belvoir Community Hospi tal (FBCH) , Fort Belvoi r, VA, regardin her
kn0wledge of tre cap:iored investigation .

2 .(b)(6), (b)(7)(C)statPd aro~nd 0830 or 23Feb24 after their morning huddl , she was
approached by (b)(6), (b)(7)(C) CIV, Licensed Nurse , Family M dicine ,
FBCH , Fo r t Belvoir , VA . (b)(6), (b)(7)(C) advised an act i ve duty member o n the
team shared with a group that he searched for the President ' s medial
records in(b)(6), (b)(7)(C)(b)(6), (b)(7)(C) advised the active duty member was (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)'.JSN , Naval Medicine Readiness Trair.ing Center (Nr.RTC) , Fo t
Belvoi r, VA. Accordir.g cc (b)(6), (b)(7)(C) and :wo others •..:er t:1e
nurse ' s station wi-r. (b)(6), (b)(7)(C) when this occurred .(b)(6), (b)(7)(C)identi (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) (NFI) , as people present this
occurred .

3 .(b)(6), (b)(7)(C)t ook this i nformati on to (b)(6), (b)(7)(C) active duty super (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) , USA, Fort Belvoir , VA .(b)(6), (b)(7)(C)
said she a l so genera
e~ail ciocumer.ting - he infor~a-i~r. J (b)(6), (b)(7)(C) Enclosure (A)
pPrtains .

4 .(b)(6), (b)(7)(C)related(b)(6), (b)(7)(C)be·~ame active last :-1arc-h ar.d you use yo r Common
Access Card (CAC) with your pin to log into :he system . (b)(6), (b)(7)(C)re ted your
access l evel to t he records depends on your ti t le within the hospi 1
structure . (b)(6), (b)(7)(C)was not sur e how reco r ds of high ranking members were
identified in(b)(6), (b)(7)(C) but related in the old system, Ul ta , if som ne tried
tc access a high rar.<1ng me~ber ' s ~ediral records , a pop up woula a pear
ask i ng if you were sure you wanted to view : he records . (b)(6), (b)(7)(C)r e l ted you
hit ' yes ' or ' n1 ' and if you ni - ' ye~ • . you could viPw -ha recora.

5 .(b)(6), (b)(7)(C)provided no furthe r information relevant to the

investigation .

ENCLOSr.:,s (S)
(A) SMAI:. PROV:JED BY(b)(6), (b)(7)(C)
/2•FEB24

PAGE 1
WARN G
THIS DOCUMENT IS THE PRO PERTY OF TH NAVI.J.. CRIMINI.J.. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICl.t.L DUTIES REQUIRE
.t.CCESS HERETO. CONTENTS M.t.Y NOT BE DISCLOSEJ TO THE P.t.RTY(S) CONCERNED
WITHOUT SPECIFIC .t.UTHORIZATION FRO THE N.t.V.t.L CRIMINI.J.. INVESTIGATIVE SERVICE

CUI
EXHIBIT ( 1 )

_J_ 000019
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 12MAR24

REPORTED BY : (b)(6), (b)(7)(C) Speci a l Agent

OFFICE: RESIDENT AGENCY WASHINGTON DC

PAGE 2 LAST(b)(6), (b)(7)(C)

V2 LNN
WARNI G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000020
Page 21 redacted for the following reason:
- - - - - - - - - - - - - - - - - - - - -Page (21), Enclosure (a) - Email: Referred to the Defense Health Agency, 7700
Arlington Boulevard, Falls Church, VA 22042
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 12MAR24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

!/FORT 3ELVOIR, VA/UNAJTHORIZED BREACH OF POTUS ' ~EDICAL RECORDS B

USN MEM3ER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) USA

1 . On 27Feb24 , Repor ting Agent (RA) and Par ticipating Agent (PA) (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)i ntervi ewed(b)(6), (b)(7)(C) USA, Fami ly Medicine , Fort Belvoir
Cor:ununity Hospital (FBCH) , For t Belvoir , VA, regard i ng t i s knowled
captioned investigation .

2 . (b)(6), (b)(7)(C) rela:ed he is the (b)(6), (b)(7)(C) for his tea~ and adv sect he
frequent l y tells everyone not to leave the i r Comi~on Access Cards ( ACs) in
the i r work station when t hey walk away . At some point , people int e office
asked w~y and someone (NFI) stated because you can use the CAC to heck for
the President ' s records . According to (b)(6), (b)(7)(C) USN ,
Naval Medicine Readiness Training Center (NMRTC) , Fort Belvoir , VA , heard
this and did not believe it , so he tried looking up the President ' name . (b)(7)(C)
(b)(6),
(b)(6), (b)(7)(C)told (b)(6), (b)(7)(C) that he did it . (b)(6), (b)(7)(C) said this occurre either
on 21Feb24 or 22Feb24 . (b)(6), (b)(7)(C) related he was not d irectly preset when (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)searched fo r the reco r ds ; he was told by (b)(6), (b)(7)(C) about ·t . (b)(7)(C)
(b)(6),
said (b)(6), (b)(7)(C) did not mention printing or tak i ng photograp s of the
(b)(6), (b)(7)(C)
records . (b)(6), (b)(7)(C) r e l ated (b)(6), (b)(7)(C) tol d him that he did it to s
coula . (b)(6), (b)(7)(C) did r.ot recall anyone else being present when (b)(6), (b)(7)(C)
told h i m. (b)(6), (b)(7)(C) advised he told his supervisor , (b)(6), (b)(7)(C) USA,
FBC~ , Fort Belvoir , VA .

3 . (b)(6), (b)(7)(C) stated within (b)(6), (b)(7)(C)when s e a r ching a r ecord, you t ea name
to go to the medical record of the individual . The cha r t will then op up
with the documents . (b)(6), (b)(7)(C) never tried to access a patient ' s re rds when
they were hidden , so he did not know how it worked . (b)(6), (b)(7)(C) advi d to
print the full medical record of an individ~al , you have to go to e
~edical records office . However , they can print certain things fro (b)(6), (b)(7)(C)
such as doctor ' s notes .

4 . (b)(6), (b)(7)(C) provided no further information relevant to the capti ed

invest i gation .

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAi.. INVESTIGATIVE SERVICE
CONTENT S MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAi.. iNVESTiGATiVE SERVICE

CUI
EXHIBIT ( S )

000022
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTION 12MAR2,;

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

:/FORT 3ELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS B

US N MEMBER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) CIV

1 . On 27Feb24 , Reporting Agen t (RA) and Participating Agent (PA) i terviewe d

(b)(6), (b)(7)(C) CIV, Licensed Nurse , Family Medicine , Fort elvoir
Cor.ununity Hospital (FBCH) , Fo r t Be lvoi r, VA . Also preser.t f or the nce rview
was (b)(6), (b)(7)(C) CIV, Nursing Supervisor , Family Medicine , FBCH , Fort
Belvoir , VA.

2 . (b)(6), (b)(7)(C) stated on Thursday (22Feb24) afte rn oon , she was at the
nursing statior. wi:h (b)(6), (b)(7)(C) USN, Naval Medicine Readine s
Training Center (NMRTC) , Fort Be l voir , VA ; (b)(6), (b)(7)(C) CSA Family
Medicine , FBCH, Fort Belvoir , VA; and (b)(6), (b)(7)(C) CIV , Ce rti ied
Nursing Assistant , Family Medic ine , FBCH , Fort Belvoir , VA . (b)(6), (b)(7)(C)
related she did not remember che exact conversac i on , b~c (b)(6), (b)(7)(C) said
something chat caused her to walk over and look at his work stat i o
.:ompu t e r . (b)(6), (b)(7)(C) then saw (b)(6), (b)(7)(C) type "Joe [or Joseph) B den " i nto
the sea r ch bar o f che records system . (b)(6), (b)(7)(C) explained when person
is searched in the records system , it wil l populate all pati ents w'th that
name . I n this instance, only one :ile popped up . (b)(6), (b)(7)(C) opened the file .
(b)(6), (b)(7)(C) described at this point they all " freaked out " . (b)(6), (b)(7)(C)
related she walked away from the sta tion when he opened the record . As she
walked away , she yelled for someone to pull (b)(6), (b)(7)(C) Common Ac ess Card
(CAC) . (b)(6), (b)(7)(C) sa i d when she walked back , (b)(6), (b)(7)(C) was l ogg·r.g back
into t he computer . (b)(6), (b)(7)(C) advised (b)(6), (b)(7)(C) sa id he did i t
was curious .

3 . (b)(6), (b)(7)(C) said (b)(6), (b)(7)(C) can print from that work station ,
does not think he prir.:ed anythi ng at the time . (b)(6), (b)(7)(C) was n
what (b)(6), (b)(7)(C)or (b)(6), (b)(7)(C) saw on (b)(6), (b)(7)(C) work scacion . (b)(6), (b)(7)(C)
reported the incident the next morning .

4 . (b)(6), (b)(7)(C) provided no further information relevant to the ca tioned

investigation .

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST(b)(6), (b)(7)(C)

V2 LNN
WARN NG·
THIS DOCUMENT IS THE PROPERTY OF T NAVl>J. CRIMINl>J. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICll>J. DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINl>J. INVESTIGATIVE SERVICE

CUI

000023
 CUI

U. S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTI ON 12MAR24
CONTROL : 27FEB24 - DCWA- 00032- 6XNA

I/FORT BELVOIR, VA/JNAJTHORIZED BREACH OF POTUS ' MEDICAL RECORDS B

USN MEM3ER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) CIV

1 . On 27 Feb24 , Repor ~ing Agent (RA) and Par t i cipating Agent (PA)(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)i nterviewed (b)(6), (b)(7)(C) CIV , Cert i fied Nu r sing Assis
Fami ly Medi c i ne , For t Belvoi r Community Hospi tal (FBCH) , For t Be l v ir, VA ,
regarding her knowledge of the captioned investigation .

2 . (b)(6), (b)(7)(C) said on Thursday , 22Feb24 , she was standing at the nu se "s
station . (b)(6), (b)(7)(C)described she was in fron t of the desk facing (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) USN , Naval Medicine Readi ness Tr a i ni ng Cente r (NMRTC) , Fo t
Belvoi r , VA . (b)(6), (b)(7)(C) was having a conve r sation with (b)(6), (b)(7)(C)
USA , Fami ly Medi c i ne , FBCH , Fo r t Belvoir, VA, while she was having a
conversation with (b)(6), (b)(7)(C) CIV, Licensed Nurse , Fami y
Medic i ne , FBCH , For t Belvoir , VA . (b)(6), (b)(7)(C)r elated (b)(6), (b)(7)(C) sea ched for
":osepn Biden " in the medical records system and verified the date o: birth
listed for " Joseph Ei den ". (b)(6), (b)(7)(C) to l d (b)(6), (b)(7)(C) not to click he chart .
(b)(6), (b)(7)(C) advise d she wa l ked away whe n (b)(6), (b)(7)(C) sai d he did it . (b)(6), (b)(7)(C)
did not see anything on the screen , but bel i eved (b)(6), (b)(7)(C)
saw the screen . (b)(6), (b)(7)(C) sa i d no one encour aged him to search fo r "Joseph
Biden " and no one said anything to make h i m do it . (b)(6), (b)(7)(C) did n t knew if
he printed anything :rom the record and d i d not bel i eve (b)(6), (b)(7)(C) went any
further into the record .

3 . (b)(6), (b)(7)(C) stated (b)(6), (b)(7)(C) was nonchala nt about doing this ; ho ve r, she
believed his body language displayed (b)(6), (b)(7)(C) was " freaked out " . (b)(6), (b)(7)(C)
has not heard (b)(6), (b)(7)(C) say anything about his poli t i ca l beliefs
background .

4 . (b)(6), (b)(7)(C) prJvided no furthe r information relevant to the captio ed

investigat i on .

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST(b)(6), (b)(7)(C)

V2 LNN
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAi. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZ.ATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI
XHIBIT ( 10 )
000024
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTI GATIVE ACTION 27FEB24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY

USN MEMBER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) CIV

1 . As background, (b)(6), (b)(7)(C) USN , Naval Medical Readiness an

Training Center (NMRTC) , Fort Belvoir , VA, was suspected of initiat ng an
unauthorized da tabase que r y within the (b)(6), (b)(7)(C)
for the medical records of President of the United States, Jo
(b)(6), (b)(7)(C) eph
Biden . (b)(6), (b)(7)(C) unauthorized database query was reported as a H alth
Insurance Portabi l ity and Accountability Act (HIPM) violation . As uch , an
internal investigation was initiated. The internal investigation wa led by
(b)(6), (b)(7)(C) , CIV, HIPM Privacy Officer , Alexander T. Augusta Mil tary
Medical Center (ATAMMC ), Fort Belvoir , VA .

2 . On 27FEB24, Reporting Agent (RA) interviewed (b)(6), (b)(7)(C)pursuant t her

investigation of the suspected HIPM violation. The following infor ation
was related : On 23FEB24 , (b)(6), (b)(7)(C)interviewed (b)(6), (b)(7)(C) subse quent to
notification of a suspected HIPM breach related via email. The ema 1
notification was made by (b)(6), (b)(7)(C) , CIV, Head Nurse Family Medic ne ,
ATAMMC, Fort Belvoir , VA. Subsequent to receipt of the email notifi ation ,
(b)(6), (b)(7)(C)conducted an audit of the P2 Sentinel Modul e within the (b)(6), (b)(7)(C)
The audit returned seven (7) entries indicating (b)(6), (b)(7)(C) had accessed
(b)(6), (b)(7)(C)
a patient medical reco r d identified as JOSEPH BIDEN . Accesses were ogged
beginning at 13 : 22:42 (EST) and concluded at 13:23:06 (EST). (b)(6), (b)(7)(C)
interviewed (b)(6), (b)(7)(C) followi ng audit findings . (b)(6), (b)(7)(C) was adv sed of
his rights prior to questioning by (b)(6), (b)(7)(C) additionally, (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) USN, ATAMMC , For t Belvoir, VA and (b)(6), (b)(7)(C) USN, TAMMC,
Fort Belvoir, VA, were present as (b)(6), (b)(7)(C) leadership. Respons veto
questioning (b)(6), (b)(7)(C) admitted he believed the account was that of the
President of the United States Joseph Biden . (b)(6), (b)(7)(C) did not pro ide
(b)(6), (b)(7)(C)with an explanation of his actions.

3. (b)(6), (b)(7)(C)provided RA with documents and logs collected pursuant

HIPAA violation investigation. The documents provided included an e
notification of a suspected HIPM violation; a signed Military Righ
Advisory Warning; a six (6) question interview questionnaire; a P2
Module Access Audit logs captured in an Excel Spreadsheet; a Breach
Personally Identifiable Information (PII) REPORT , DD Form 2959; a B
Risk Analysis Template ; a Memorandum for Record to Director for
Administration ; and a printout of the electronic record for the HIP
violation investigation; Enclosures (A) through (H) pertain . RA rev ewed the
documents provided by (b)(6), (b)(7)(C) Results of the review are as follo s :

PAGE 1
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAf_ CRIMINAf_ INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAf_ DUTIES REQUIRE
ACCESS HERET<r.CONTENTS MAY NOT DISCLOSED TO THePARTY(S► GONCERNEO
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAf_ CRIMINAf_ INVESTIGATIVE SERVICE.

CUI

EXHIBIT ( \\ ) 000025
 CUI

U. S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 27FEB24

A. EMAIL NOTIFICATION OF SUSPECTED HIPAA VIOLATION

On 23FEB24 , at approximately 1045 (EST) , (b)(6), (b)(7)(C)

emailed (b)(6), (b)(7)(C) directly
and courtesy copied (b)(6), (b)(7)(C)for awareness of a reported HIPAA viol tion
resulting from the actions of (b)(6), (b)(7)(C). Reportedly, (b)(6), (b)(7)(C) sh red with
his teammates in family medicine (FM) that he had accessed the medial
records for POTUS .

B. SIGNE D MILITARY RIGHTS ADVISORY WARNING

On 23FEB24, (b)(6), (b)(7)(C) s i gned t he Military Rights Advisory Warning s

administered by(b)(6), (b)(7)(C)at approximately 1402 (EST). (b)(6), (b)(7)(C) igned
the Military Rights Advisory Warning as a witness at approximatel y 403
(EST).

C. SIX (6) QUESTION INTERVIEW QUESTIONNAIRE

On 23FEB24 , (b)(6), (b)(7)(C) asked (b)(6), (b)(7)(C) six (6) prepared questions. Te
questions asked to (b)(6), (b)(7)(C) are provided below in verbatim with
misspell ings a nd grammatical errors included.

- Where do you work and what do your role there?

- When did you start working there?

- Have you attended Newcomer ' s Brief and completed your annual HIP
training requirement on JKO?

- Have you accessed any information pertaining to a beneficiary by the name

of Joseph Biden?

- I so , how did this a ccess rela te to your official duties?

- Is t here anything you would like t o add t o this interview?

D. P2 SENTINEL MODULE ACCESS AUDIT LOGS

On 23FEB24, (b)(6), (b)(7)(C)conducted an audit of the P2 Sentinel Module rsuant

to report o f a HIPAA violation resu lting (b)(6), (b)(7)(C) searching the
(b)(6), (b)(7)(C)
EHR of the medical records of POTUS. The audited returned s ven (7)
(b)(6), (b)(7)(C)
entries . The entries captured a ccess logs beginning at 13 : 22 :42 {ES ) and
concluded at 13 : 23 : 06 (EST) on 22FEB24 . Logging appears to be on an interval
basis of f our (4) to five (5) seconds between entries . There was li ely only
one (1) access made by (b)(6), (b)(7)(C) over the seven (7 ) returned entri s f or a
calculated length of 24 seconds .

E . BREACH OF PII DD FORM 2959 REPORT

PAGE 2
WARN G;
THIS DOCUMENT IS THE PROPERTY OF TH NAV/lJ.. CRIMIN/lJ.. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC Al1THORIZATION FR THE NAV/lJ.. CRIMIN/lJ.. INVESTIGATIVE SERVICE.

CUI

000026
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032 - 6XNA 27FEB24

On 24FEB24 , (b)(6), (b)(7)(C)prepared an initial report pursuant to a HIPAA

violation committed (b)(6), (b)(7)(C) The report was captured in a DD For 2959
and described as a breach wherein a (b)(6), (b)(7)(C) accessed a VIP ' s inf rmation
on (b)(6), (b)(7)(C) The date of the breach was reported as 22FEB24 and he date
of the discovery of the breach was reported as 23FEB24 . Additionall , the
report captures that a P2 Sentinel audit was performed and confirme the
suspected access. (b)(6), (b)(7)(C) was interviewed by(b)(6), (b)(7)(C)and confes ed to
the access . Details of the incident were related to leadership for
administrative sanctions .

F. BREACH RISK ANALYSIS TEMPLATE

(b)(6), (b)(7)(C)completed
a Breach Risk Analysis Template (BRAT) documente as
US- CERT 2024 -BR-399. The reported related the date of discovery of he
breach incident as 23FEB24 with one (1) total number of potentially affected
individuals . Information was confirmed to have been viewed and acce sed by
an unauthorized or unintended party .

G. MFR DIRECTOR FOR ADMINISTRATION

On 24FEB24 , (b)(6), (b)(7)(C)prepared an MFR for the Director of Administra ion . The
MFR related (b)(6), (b)(7)(C) confessed to unauthorized access ; moreover, he
matter of impermissible access was substantiated. (b)(6), (b)(7)(C) had co pleted
Joint Knowledge Online (JKO) training for HIPAA and Privacy Act Tra ning
Course (DHA- US0Ol) on 12MAY23.

H. PRINTOUT OF ELECTRONIC FOR HIPAA VIOLATION INVESTIGATION

The electronic record indicated the date of the breach was 22FEB24 hile the
date of discovery was 23FEB24 . The breach was described as a compro ise
caused by a failure to f ollow policy. Personnel from the ATAMMC Fam ly
Clinic notified(b)(6), (b)(7)(C)of the breach . Reportedly, (b)(6), (b)(7)(C) verb lly
shared that he was able to access the electronic health record of a VIP. An
audit of the P2 Sentinel module confirmed (b)(6), (b)(7)(C) accessed the h alth
record . (b)(6), (b)(7)(C) was interviewed and admitted to the violation (A ENT
NOTE: (b)(6), (b)(7)(C)wrote the date of the interview occurred on 22FEB24 ithin
the document; however, investigative efforts would indicate this is a
typographical error on the part of (b)(6), (b)(7)(C) .

4. Contact information for (b)(6), (b)(7)(C)was identified as fol l ows :

a . Email: (b)(6), (b)(7)(C)

b . Phone : (b)(6), (b)(7)(C)

PAGE 3
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPEClFIC AUTHORIZATION FRO THENAVAI. CRIMINAL INVESTIGATIVE SERVICE.

CUI

000027
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24 - DCWA-00032-6XNA 27FEB24

ENCL OSURE(S )
(A) (U) EMAIL NOTIFICATION OF HI PAA VIOLATION (U) /23FEB24
(B ) (U) RIGHTS ADVISEMENT ARTICLE 31B WAIVER (U) /23FEB24
(C) (U) INTERVIEW QUEST IONS (U) /23FEB24
(D) (U) P2 SENTINEL MODULE ACCESS AUDIT LOGS (U)/23FEB24
(E) (U) DD FORM 2959 BREACH OF PII REPORT (U ) /24FEB24
(F) (U) BREACH RISK ANALYSIS TEMPLATE (U) /23FEB24
(G) (U) MFR TO DIRECTOR OF ADMINISTRATION (U) / 24FEB24
(H) (U) DPIM BREACH INFORMATION (U) /23 FEB24

REPORTED BY: (b)(6), (b)(7)(C) Special Agent

OFFICE : NCIS CYBER WASHINGTON DC

PAGE 4 LAST V2 LNN

(b)(6), (b)(7)(C)
WAAN G:
TMIS DOCUMENT IS TME PROPERTY OF TM NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE OlSCLOSEO ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT OlSCLOSED TO TME PARTY(S) CONCERNED
wm10IJT SPECIFIC AUTHORIZATION TME NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000028
Pages 29 through 31 redacted for the following reasons:
- - - - - - - - - - - - - - - - - - - - - - - - - - - -Pages (29) - (31), Enclosures (a) - (c), Email/Waiver/Questions: Referred to the
Defense Health Agency
 NAVAL CRIMINAL INVESTIGATIVE SERVICE
CROSS REFERENCE SHEET
(Insert this behind the cover sheet)

CASE CONTROL NUMBER (CCN)

27FEB24-DCWA-00032-6XNA
SUBJECT (Subject NamefTitle)
I / FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS' MEDICAL RECORDS BY USN MEMBER
EXHIBIT/ENCLOSURE($} 11 / D
contains the following additional material on (subject of the additional material)
ONE VERBATIM DVD-R CONTAINING P2 SENTINEL ACCESS AUDIT LOC,S

that has been retained in its original format and stored separately as specified below:

TYPE

D Grand Jury

D Disk (Roxie Password

D Photograph(s) (images of photographs are contained in the electronic media, original pt"otograph(s) are also
contained in the file.

D Source Envelope

D Other

(Description)

NCIS 5000/4 (Rev. 3-2020)

000032
Pages 33 through 42 redacted for the following reasons:
- - - - - - - - - - - - - - - - - - - - - - - - - - - -Pages (33) - (42), Enclosures (e) - (h), Report/Analysis/MFR/Information:
Referred to the Defense Health Agency
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 27FEB24

CONTROL: 27FEB24-DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) , USA

1 . As background, (b)(6), (b)(7)(C)

(b)(6), (b)(7)(C) Fort Belvoir, VA, was i dentified as the Alexander T. Augusta
Military Medical Center (ATAMMC) . The responsibility (b)(6), (b)(7)(C) is to
(b)(6), (b)(7)(C)
aid in the design , implementati on and use of healthcare informati n
technology (IT ) in a healthcare organization .

2 . On 27FEB24 , Reporting Agent (RA) conducted an in- person interv· ew (b)(6), of (b)(7)(C)
(b)(6), (b)(7)(C)pursuant to the captioned investigation . (b)(6), (b)(7)(C) pr ided an
overvi ew of the functions of the (b)(6), (b)(7)(C)
database while examining the access logs for (b)(6), (b)(7)(C) US , Medical
Readiness and Training Center (NMRTC) , Fort Belvoir , VA . Results the
interview were as follows: Use r s of the (b)(6), (b)(7)(C) da tabase are quired to
complete training prior to being granted access to the database.
training defines what is permissible and what is a violation of da abase
usage. Access is role based; meani ng , users may only access module within
the (b)(6), (b)(7)(C) database consistent wi th their job. (b)(6), (b)(7)(C) likely
accessed the database by authenticating with his common access c ar (CAC).
(b)(6), (b)(7)(C)' s last l ogin was 22FEB24 at approxi mately 1300 hou r s ;
additionally, (b)(6), (b)(7)(C) sess i on ended 23FEB2 4 at approximately 741 hours
as a result of a timeout . A review of the a ccess logs indicated (b)(6), (b)(7)(C)
only attempted to access the Lifetime Pharmacy Encounter (LFE) fil within
the profile JOSEPH BIDEN written in plain text. No i nformation was present
(b)(6), (b)(7)(C) as a ma nner of document ng within
(b)(6), (b)(7)(C) de scribe d(b)(6), (b)(7)(C)
the database that patients were permitted to receive medication . T ere was
no record o f a print job present while (b)(6), (b)(7)(C) accessed (b)(6), (b)(7)(C) in the
JOSEPH BIDEN profile . (b)(6), (b)(7)(C) access to the heal th .mil comput r network
was revoked on 23FEB24 while his access to (b)(6), (b)(7)(C) was rev ked on
26FEB24 .
3. Tho following contact information tor (b)(6), (b)(7)(C) was identifi d as
follows :

a . Emai l : (b)(6), (b)(7)(C)

b. Phone : (b)(6), (b)(7)(C)

PAGE 1
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSEO TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AU'THORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI
XHIBIT (\1')
000043
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 27FEB24

REPORTED BY : (b)(6), (b)(7)(C) , Special Agent

OFFICE : NCIS CYBER WASHINGTON DC

PAGE 2 LAST(b)(6), (b)(7)(C)

V2 LNN
WARNI 0 :
THIS DOCUMENT IS THE PROPERTY OF TH NAVl>J.. CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSEO TO THE PARTY(S) CONCERNED
W1TliOUT SPECIFIC AUTHORIZATION FROM E NAVl>J.. CRIMINAL INVESTIGATIVE SERVICE.

CUI

000044
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 27FEB24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF ?OTUS ' MEDICAL RECORDS Y

USN MEMBER

RESULTS OF CONTACT WITH (b)(6), (b)(7)(C) USN

1 . On 27FEB24 , (b)(6), (b)(7)(C) Staff Judge Advocate (SJA), For Belv_2.rr.,-

VA , contacted Reporting Agent (RA) as the identified NCIS point o contact
(POC) . (b)(6), (b)(7)(C) intimated that the office of the SJA at the Ale nder-'f-:--- -- - - - - - - - - -
Augusta Military Medical Center (ATAMMC) would provide support as equested
by NCIS personnel pursuant to the captioned investigation . At the ime
the call , RA apprised (b)(6), (b)(7)(C) of the known facts and circumsta es of the
investigation and NCIS efforts to delineate between a policy viola ion and
criminal act.
2. The following contact information for(b)(6), (b)(7)(C)was identified as
follows :

a . Email : (b)(6), (b)(7)(C)

b . Phone : (b)(6), (b)(7)(C)

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE: NCIS CYBER WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARNI G:
THIS DOCUMENT IS THE PROPERTY OF TH NAV& CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETOcCOlffENTS MAY NOT SCL8BEB 1'8 1'1 IE l'Nl'f¥f6) 68116ERII EB
WITHOUT SPECIFIC AUTHORIZATION FROM E NAVIJ. CRIMINAi. lNIVESTIGATIVE SERVICE.

CUI

EXHIBIT ( \, )
000045
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 27FEB24

CONTROL : 27FEB24-DCWA-00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

RESULTS OF CONTACT WITH (b)(6), (b)(7)(C) USA

1 . For context, (b)(6), (b)(7)(C) of the Whi House

Medical Unit (WHMU) , Washington , DC , was identified as a person h ing
knowledge of (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)

2 . On 27FEB24 , Reporting Agent (RA) spoke telephonically with (b)(6), (b)(7)(C)

pursuant to the captioned investigation . RA provided (b)(6), (b)(7)(C) a financial
encounter number (FIN) to verify if the records searched via compu er
network profile (b)(6), (b)(7)(C) were related to POTUS. The FIN prov'ded to
(b)(6), (b)(7)(C) for review was (b)(6), (b)(7)(C) related the follo ing : The
FIN provided did not return to the legitimate electronic health re ord (EHR)
of POTUS . A review of the returned EHR was identified in plain tex as
JOSEPH BIDEN; (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) The records pres nt did
not correlate to POTUS ' health records . (b)(6), (b)(7)(C)
(b)(7)(E) (b)(6), (b)(7)(C)

3 . Contact information for(b)(6), (b)(7)(C)was provided as follows :

a . Phone : (b)(6), (b)(7)(C)

b . Email : (b)(6), (b)(7)(C)

REPORTED BY: (b)(6), (b)(7)(C) Special Agent

OFFICE: NCIS CYBER WASHINGTON DC

PAGE 1 LAST(b)(6), (b)(7)(C)

V2 LNN
WARNI G:
THIS DOCUMENT IS THE PROPERTY Of TH NAVAi.. CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OfFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE $CLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM E NAVAi.. CRIMINAL INVESTIGATIVE SERVICE.

CUI

HIBIT (I*)
000046
- - -- ---
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 12MAR24
CONTROL : 27FEB24 - DCWA- 00032- 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

RESULTS OF DATABASE CHECKS

1 . On 27Feb24, database checks of (b)(6), (b)(7)(C) USN , Naval Me i cine

Readiness Training Cer.cer , Fore Belvoir , VA , were conducted using DDEX ,
NCIC, KKST, CLEOC , DI SS , and DCII . D:SS revealed (b)(6), (b)(7)(C) has a Secret
security clearance . Nothing else pertaining co the captioned inve tigation
was located .

REPORTSD BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARNI G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CR MINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TOP RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM HE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI
EXHIBIT ( l 5 )
000047
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 06MAR24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

RESULTS OF SOCIAL MEDIA CHECKS ON (b)(6), (b)(7)(C)

1 . On 27Feb24 , Investigative Analyst (IA) (b)(6), (b)(7)(C) comple

social media checks pertaining to the captioned investigation. I was
tasked with obtaining information and social media for (b)(6), (b)(7)(C)
USN , Naval Medical Readiness and Training Center (NMRTC) , Fort Be oir, VA,
as it pertains to the captioned investigation . IA obtained inform tion using
open- source searches of publicly available databases and commerci lly
available law enforcement databases .

2 . The following biographical information was identified for

(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)

3 . Subsequently, the following social media accounts possibly asso iated

with (b)(6), (b)(7)(C) were identified and reviewed.

Signal
Phone Number : (b)(6), (b)(7)(C)

WhatsApp
Phone Number : (b)(6), (b)(7)(C)

CashApp

(b)(6), (b)(7)(C)

Google

(b)(6), (b)(7)(C)

Instagram

PAGE 1
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT 8 DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAV1'1.. CRIMINAL INVESTIGATIVE SERVICE.

CUI

EXHIBIT (I~)
000048
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 06MAR24

(b)(6), (b)(7)(C)

Kik

(b)(6), (b)(7)(C)

Minecraft
(b)(6), (b)(7)(C)

Pinterest

(b)(6), (b)(7)(C)

PSNProfiles

(b)(6), (b)(7)(C)

Roblox

(b)(6), (b)(7)(C)

Snapchat

(b)(6), (b)(7)(C)

Twitch

(b)(6), (b)(7)(C)

4. IA extracted the profile picture URLs from the Instagram accoun and
Google account listed above and ran the image URLs through a rever image
search tool . Of note, the reverse image search on the profile pict e for
Instagram profile (b)(6), (b)(7)(C) revealed imagery potentially associ ed with
the online "hactivist " group Anonymous; Enclosure (A) pertains . The reverse
image search on the aforementioned Google a ccount revealed imagery ikely
associated with a video game and did not appear relevant to the
investigation .

PAGE 2
WARN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE DISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAV/>J.. CRIMINAL INVESTIGATIVE SERVICE.

CUI

000049
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 06MAR24

5 . Al l additional rev i ews of the aforement ioned s oci a l me di a acco nts

poss i b ly associated wi t h (b)(6), (b)(7)(C) resulted in ne gative findings of a ny
additional content associated with the captioned investigation .

ENCLOSURE (S)
(A) NCIS PHOTO TEMPLATE /27 FEB24

RE PORTED BY : (b)(6), (b)(7)(C) I nvestigator

OFFICE : WASHINGTON FIELD OFFI CE

PAGE 3 LAST(b)(6), (b)(7)(C)

V2 LNN
WAAN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT 8 DISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000050
Pages 51 through 52 redacted for the following reasons:
----------------------------
(b)(6), (b)(7)(C): Pages (51) - (52), Enclosure (a) - Social media photographs
 CUI

U . S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 04MAR24

CONTROL : 27FEB24- DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

RESULTS OF REVIEW OF (b)(6), (b)(7)(C) OFFICIAL MILITARY PERSONNEL FIL

(OMPF)

1 . On 27Feb24 , Investigati ve Analys t (IA) (b)(6), (b)(7)(C) revi ew d the

Official Military Per sonnel Fi le (OMPF) of (b)(6), (b)(7)(C) USN , Naval
Medical Readiness and Training Center (NMRTC) , Fort Belvoir, VA .

2 . The following was obtained from the OMPF review :

(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C) completed and signed the United States Navy Aberrant Be avior
Screening Certificate (NAVCRUIT 1130/120 ) on 07Apr22 .

3 . No other deroga tory or relevant information was obtained .

REPORTED BY : (b)(6), (b)(7)(C) Investigator

PAGE 1
WAAN G:
THIS DOCUMENT IS THE PROPERTY OF TH NAVM. CRIMINM. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSEEH&n!E PAATY<S)-€()NGERN
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAL CRIMINM. INVESTIGATIVE SERVICE.

CUI

EXHIBIT (\-\,)
000053
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 04MAR24

OFFICE : WASHINGTON FIELD OFFICE

PAGE 2 LAST(b)(6), (b)(7)(C)

V2 LNN
W ING:
THIS DOCUMENT IS THE PROPERTY OF E NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT DISCLOSED TO THE PARTY(S) CONCERNED
WmtO\JT SPECIFIC AlmtORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI

000054
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTION 28FEB24
CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

:/FORT BELVOIR , VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY

USN MEMBER

RESULTS OF INTERVIEW OF (b)(6), (b)(7)(C) USN

1 . On 27 Feb24 , Reporting Agent (RA) and Participating Agent (PA) (b)(6), (b)(7)(C)
interrogated
(b)(6), (b)(7)(C) (b)(6), (b)(7)(C) USN , Naval Medical Readin ss and
Training Center (NMRTC) , Fort Belvoir , VA, at the Army Cr iminal
:nvestigation Division Resident Agency Fort Belvoir , VA , regardi the
unauthorized access o: the President of t~e Unite d States ' (POTU med:cal
records . RA and PA(b)(6), (b)(7)(C)identi:ied therrselves as agents of NCI to SA
ve r bally and by presenting their NCIS issued credentials .
(b)(6), (b)(7)(C)

2 . Prior to discussir.g details related to the captioned investiga ion , RA

advised (b)(6), (b)(7)(C) o: his Article 31b rights using the Mi litary R ghts
Cleansing Waiver form . (b)(6), (b)(7)(C) verbally acknowledged his under tanding of
the rights and subsequent l y signed the fo r m at 1648 , waiving his ights .
Enclosure (Al pertains .

3 . (b)(6), (b)(7)(C) advised he is a corpsman at Fort Belvoir Corr~unity ospital

(FBCH) , Fort Belvoir , VA . (b)(6), (b)(7)(C) has been assigned to FBCH si ce May
2023 . As part of his daily job , he assists the doctors when they ee
patients , which includes looking at the patient records . The pati nt re2ords
system is called (b)(6), (b)(7)(C)which he logs into at the work station omputers
at the ~Ospital . (b)(6), (b)(7)(C) stated he logs into the work station omputer
with his Command Access Card (CAC) a nd i s then able to get int o t e (b)(6), (b)(7)(C)
system . (b)(6), (b)(7)(C) related sometimes he has to re - ente r his CAC p· to enter
the(b)(6), (b)(7)(C)system, b~: not always after logging into the system .

4 . (b)(6), (b)(7)(C) said on 22Feb24 in the afternoon , he was at a work

station computer wi tr. other coworkers around , (b)(6), (b)(7)(C) SA, FBCH ,
Fort Belvoir , VA , and (b)(6), (b)(7)(C) , CIV, Licensed Nurse , BCH , Fort
Belvoir , VA . (b)(6), (b)(7)(C) did not recall if anyone else was around . (b)(6), (b)(7)(C)
related (b)(6), (b)(7)(C) l e:t her CAC plugged into the wor k 5tation co puter
when she walked away from the station . The group then discussed wh you
should not leave your CAC in a computer when you wal k away f rom it
A~cording to (b)(6), (b)(7)(C) (b)(6), (b)(7)(C) related :hat someone could mali iously
use you r CAC to searer. databases , such as ~sing it to search for P TUS '
records . (b)(6), (b)(7)(C) advised he had disbelie: he could look up POTU '
records , so he pulled up the(b)(6), (b)(7)(C)system and searched the patie t records
for "Joseph Bicen ".

5 . (b)(6), (b)(7)(C) recal l ed when you search a person ' s name i n the syst m, it
lists all of the records with that name and the birthdate associat d with
the name . (b)(6), (b)(7)(C) s:ated there was one record with the name "Jo ph

PAGE 1
WARN NG:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATN E SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(SJ CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI
EXHIBIT ( t8 )

000055
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA- 0 0032-6XNA 28FEB24

Biden " and it provi ded a birthdate . (b)(6), (b)(7)(C) then used the sam computer
to search on Google fo r POTUS ' birthdate , which subseque ntly mat hed the or.e
on the record . Out of curiosity , (b)(6), (b)(7)(C) then clicked into th record to
see what informa t ion was ins i de . (b)(6), (b)(7)(C) recalled there was n t a l::>t of
information in the record , except two instances . (b)(6), (b)(7)(C) did ot remember
the speci f i cs of the instances , but remembe r ed a doctor ' s name w s listed .
(b)(6), (b)(7)(C) then agai n used the same work station computer to sea
Google the name of POTJS ' doctor , which d i d not match the name o the
record . At this point , (b)(6), (b)(7)(C) realized he should stop lookin at t he
record and closed it out . (b)(6), (b)(7)(C) only looked at the record o the one
instance . (b)(6), (b)(7)(C) said he d i d no t print , save , ema i l , downloa ,
photograph, or otherwise documert the record .

6 . (b)(6), (b)(7)(C) was aware (b)(6), (b)(7)(C) saw he searched the system f r POTUS .
She told h i m :o repo r t himsel f to his supervisor . (b)(6), (b)(7)(C) knew
(b)(6), (b)(7)(C) was going to report him for violating Health :nsuran e
Portability and Accountability Act (HIPAA) . (b)(6), (b)(7)(C) relayed he did not
i mmediate l y r ep or t hi mself , but he f elt gui lty so he r eported hi m elf the
next morning ; however , it had already been r eported .

7 . (b)(6), (b)(7)(C) related he did not access the record or attempt to ccess the
record on his personal devices , which include his iPhone 13 and l ptop
computer . (b)(6), (b)(7)(C) was not sure he could access the(b)(6), (b)(7)(C)sys em on his
personal devices ; however , he d i d previousiy use his personal l ap op with
his CAC to corrplete training . (b)(6), (b)(7)(C) did not shar e the i nform tion in
the record with anyor.e . (b)(6), (b)(7)(C) reiterated he did not print an thing . (b)(7)(C)
(b)(6),
(b)(6), (b)(7)(C)sa i d he li ke l y printed something wo r k related after acces i ng the
record . He did not remember what the print job contained , but he new he did
not print anything pertaining to the record he accessed under the ame
" .7osepn o i den ". (b)(6), (b)(7)(C) a l so adv i sed he d i d not take anything ga r d:ng
the record to his residence .

8 . RA obtained verbal authorization and a signed Permiss i ve Author·zation

: or Search and Seizure (PASS) f r om (b)(6), (b)(7)(C) to sear ch his reside c e for
his laptop corrputer and any other potential evidence of the unauth rizec
access of POTUS ' medical records . Additionally , RA obtained verbal
authorization and a signed PASS =or (b)(6), (b)(7)(C) e lectr o nic device to
search for any potential evidence related to the unautho r ized acce s of
POTUS ' me d i cal records ; Enclosu r e (C) perta i ns . Results of both se rches
will be documented under separate covers .

9 . After RA anc PA(b)(6), (b)(7)(C)concluded the interview of (b)(6), (b)(7)(C) pecial

Agent (SA) (b)(6), (b)(7)(C) , CIV, Washington Field Office (WFO) , Unit d States
Secret Ser vice (USSS) , Washington , DC , and SA (b)(6), (b)(7)(C) CI , WFO,
USSS , Washington , DC , asked (b)(6), (b)(7)(C) questions , wh i ch is documen ed in the
recording o : the i nterview .

PAGE 2
WARN NG.
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO~ THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI

000056
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24 - DCWA- 0 0032-6XNA 28FEB24

10 . At t~e conclus i or. o: the inter view , (b)(6), (b)(7)(C) was released o tis
Cor'll'.lano ?epresentative , (b)(6), (b)(7)(C) USN , NMRTC, Fort Belv ir ,
VA .

11 . This interview was audio/video recorded . Enclosure (B) perta ns .

ENCLOSURE (S)
(A) M:LITARY RIGHTS CLEANSING WAIVER FORMi2 7 FEB24
(B) DVD CONTAINING AUDIO/VIDEO RECORDING OF (b)(6), (b)(7)(C)
: XERVIEW/27FEB24
(Cl S: GKED ELEC'TRl")KICS PER..'1ISSE'E AUTHORIZATION FOR SEARCH ANJ
SEIZURE/27FEB24

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFF:CE : RESIDENT AGENCY WASHINGTON DC

PAGE 3 LAST V2 LNN

(b)(6), (b)(7)(C)
WARN G
THIS DOCUMENT IS THE PROPERTY OF TH NAVAi. CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO RSONS WHOSE OFFIC IAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAi. iNVESTiGATiVE SERVICE

CUI

000057
 MILITARY RIGHTS CLEANSING WAIVER

Place:
(b)(6), (b)(7)(C)
Date:

(b)(6), (b)(7)(C) (b)(6), (b)(7)(C) (b)(6), (b)(7)(C)

that I have been suspected of:

I have also been advised that (b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)
(1) Any prior illegal admissions or other improperly obtained evidence which inc minated me cannot be
used against me in a trial by court-martial;
(2) I have the right to remain silent and make no statement at all;
(b)(6), (b)(7)(C)
(3) Any statement I do make can be used against me in a trial by court-martial o other judicial or
administrative proceeding;
(4) I have the right to consult with a lawyer prior to any questioning. This lawyer
(b)(6), (b)(7)(C) ay be a civilian lawyer
retained by me at no cost to the United States, a military lawyer appointed to act as my co nsel at no cost to me,
or both;
(5) I have the right to have my retained civilian lawyer and/or appointed military I wyer present
(b)(6), (b)(7)(C)
during this interview; and
(6) I may terminate this interview at any time, for any reason.
(b)(6), (b)(7)(C)
I understand my rights as related to me and as set forth above. With that understanding, I h ve decided that I do not desire
to remain silent, consult with a retained or appointed lawyer, or have a lawyer present at this ti e. I make this decision freely
and voluntarily. No threats or promises have been made to me.

(b)(6), (b)(7)(C)
Signature:

Date: l, 7 FEB g

Witnessed:
(b)(6), (b)(7)(C)

NCIS 5580/ 19 (REV. 6-2021 )

EXHIBIT (\'6) NCLOSURE ( A )
000058
 (b)(6), (b)(7)(C): Page (59), Enclosure (b) - DVD containing recorded interview - Withheld

NAVAL CRIMINAL INVESTIGATIVE SERV CE

CROSS REFERENCE SHEET
(Insert this behind the cover sheet)

CASE CONTROL NUMBER (CCN)

27FEB24-DCWA-00032-6XNA
SUBJECT (Subject Nameffitle)
I / FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS' MEDICAL RE CORDS BY USN MEMBER
EXHIBIT/ENCLOSURE(S) 18 / B

contains the following additional material on (subject of the additional material)

DVD-R CONTAINING AUDINIDEO RECORDING OF (b)(6), (b)(7)(C) IN~ ERVIEW

that has been retained in its original format and stored separately as specified below:

TYPE

0 Grand Jury

0 Disk (Roxio Password

0 Photograph(s) (images of photographs are contained in the electronic media, original I hotograph(s) are also
contained in the file.

0 Source Envelope

0 Other

(Description)

NCIS 5000/4 (Rev. 3-2020)

000059

- - - -- - - -- - - - L -- - - --
 PERMISSIVE AUTHORIZATION FOR SEARCH

(b)(6), (b)(7)(C) ' after being advised by Special Agent(s) (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) that the Naval Criminal Investi ative Service
1
is
conducting an investi ation concerning the V '
' "{\ • ~ffi haH been requ ted to
permit a search of Ol ~ nd any computers
and/or electronic storage media locat d within my apartment. I h ve been informed of
my constitutional right to refuse to permit this search in the absen e of a search
warrant. In full understanding of this right, I have nevertheless d cided to permit this
search to be made.
(b)(6), (b)(7)(C)

This
search and seizure may be conducted on --~~~iu...='-------1....-----and
(b)(6), (b)(7)(C)
subsequent days as necessary to complete the computer forensic e min~fion .of al~L \_ .
electronic storage media found during the search_by Special Agent s) (b)(6), (b)(7)(C)
_________. and all other NCIS Special Agents as may be nece sary, and I hereby
give the Special Agent(s) my permission to remove and retain any roperty or papers
found during the search which are desired for investigative purpos(b)(6),
s. (b)(7)(C)

I also
(b)(6), (b)(7)(C)give permission to NCIS Special Agent(s) to conduct forensic reviews, by persons
qualified to conduct said examinations, of all electronic storage me ia and data files, to
include text and graphical image files, contained on the electronic s orage media
attached to and/or accompanying the described seized equipment ( uch as but not
limited to computers or other devices) for investigative purposes p rsuant to the
investigation listed above.
(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)
I make
this decision freely and voluntarily, and it is made with not reats having been
made or promises extended to me.
(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)
TIMES OFSE

Sta rt: ~05

Special Agent, NCIS
End: ----4---

Command Representative

~°'~~coc)J. (b)(6), (b)(7)(C)

\,~~ , (b)(6), (b)(7)(C)

EXHIBIT (\<& ) ENCLOSURE ( G)

000060
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 27FEB24

CONTROL: 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY

USN MEMBER

RESULTS OF SCENE DOCUMENTATION

1 . On 27FEB24 , Reporting Agent (RA) and Participating Agent (PA)(b)(6), (b)(7)(C)

responded
(b)(6), (b)(7)(C) to Room Vaccaro Hall , Fort Belvoir, VA t conduct a
(b)(6), (b)(7)(C)
scene examination pertaining to the captioned investigation . As ackground,
(b)(6), (b)(7)(C) , USN, Naval Medical Readiness and Training Cent r (NMRTC) ,
Fort Belvoir, VA, allegedly accessed the President of the United States'
(POTUS) medical records without authorization.

2. On 27FEB24 , a signed Permissive Authorization for Search and eizure

(PASS) was obtained from (b)(6), (b)(7)(C) for his residence , Room Vaccaro
(b)(6), (b)(7)(C)
Hall , Fort Belvoir , VA; Enclosure (Al pertains .

3. RA photographically documented the scene . A total of (40l pho ographs

were taken and placed onto a disc and appended as Enclosure (Bl . (4l
photographs were placed onto NCIS Photograph Templates; Enclosur (C)
pertains .

4 . A MSI Laptop (SN: K2205N0068793) and associated charger were n the desk
in (b)(6), (b)(7)(C) room . RA placed the laptop and charger into one rown paper
bag , which was l abeled as Item A. (b)(6), (b)(7)(C) personal iPhone w s brought
from the interview at U. S Army Criminal Investigation Division t Room
(b)(6), (b)(7)(C)
Vaccaro Hall and placed in a clear plastic bag , which was labele as Item B.
All items were entered into NCISRA Washington , DC Consolidated E idence
Facility under log# 0025- 24 .

5. At conclusion of the search , the barracks room was turned ove to

(b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)

ENCLOSURE ( S)
(A) PERMISSIVE AUTHORIZATION FOR SEARCH AND SEIZURE/27FEB24
(B) DISC CONTAINING SCENE PHOTOGRAPHS/05MAR24
(C ) NCIS PHOTO TEMPLATE/05MAR24

REPORTED BY: (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASH I NGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
W NING:
THIS DOCUMENT IS THE PROPERTY O THE NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY O PERSONS WHOSE OFFICIAL DUTIES REQUIRE
A CCESS HERETO. CONTENTS MAY NO BE DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION F OM THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI EXHIBIT ( \q )
000061
 PERMISSIVE AUTHORIZATION FOR SEARCH AND EIZURE

(b)(6), (b)(7)(C) (b)(6), (b)(7)(C)

I, . = . - - - - - - - - - - - ' after being dvised by
(b)(6), (b)(7)(C) aval
..Criminal In estigative Service is
conducting an investigation into ~ ...-~~~....-":-~~l':'."'-~ ~~lrf:t:.--' have een requested to permit a
search of my ~ ~ \'O0lft \Y\ OOY\l)tf-ti C-OM
I e,\~~ 1
~~f{\(b)(6), (b)(7)(C) '51~0 q~ S\- I B et\'JO\l, ~~ (b)(6), (b)(7)(C)
I have
(b)(6), (b)(7)(C) been informed of my constitutional nght to refuse to permit this searc in the absence of a
search warrant. In full understanding of this right, I have neve1theless decide to permit this search to
be made.
(b)(6), (b)(7)(C)

his
search may be conducted on
(b)(6), (b)(7)(C) ~ftuJ d)4 b
Nv\ S ~ \:S , and I h;;;by give my permission to remove nd retain any property or
papers founduring the search which are desired for investigative purposes.
(b)(6), (b)(7)(C)

I make
(b)(6), (b)(7)(C) this decision freely and voluntarily. and it is made with no threats hav ng been made or
promises extended to me.
(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)

Representative. Na, al Criminal lnvcst1gative Service

Command Representative

TIMES OF SEARCH
Start: \ ~0~
End : \; C\ is

EXHIBIT (\~)
NCLOSURE ( )
000062
CIS 5580/21 (Rev. 12-2008)
 (b)(6), (b)(7)(C): Page (63), Enclosure (b) - DVD containing photographs - Withheld

NAVAL CRIMINAL INVESTIGATIVE SERV CE

CROSS REFERENCE SHEET
(Insert this behind the cover sheet)

CASE CONTROL NUMBER (CCN)

27FE B24-DCWA-00032-6XNA
SUBJECT (Subject Name/Title)
I / FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS' MEDICAL RI CORDS BY USN MEMBER
EXHIBIT/ENCLOSURE(S) 19 / B

contains the following additional material on (subject of the additional material)

SCENE PHOTOGRAPHS OF ROOM VACCARO HALL, FORT BELVOI R, VA
(b)(6), (b)(7)(C)

that has been retained in its original format and stored separately as specified below:

TYPE

D Grand Jury

D Disk (Roxio Password

D Photograph(s) (images of photographs are contained in the electronic media, original I hotograph(s) are also
contained in the file.

D Source Envelope

D Other

(Description)

NCIS 5000/4 (Rev. 3-2020)

000063

- - - - - ~- --
Pages 64 through 67 redacted for the following reasons:
----------------------------
(b)(6), (b)(7)(C): Pages (64) - (67), Enclosure (c) - Photographs
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTI ON 04MAR24

CONTROL : 27FEB24 - DCWA- 00032- 6XNA

I/FORT BELVOIR , VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

SUBMISSION OF MEMORANDUM REQUESTING USER ACCOUNT INFORMATION AND

1 . As background , (b)(6), (b)(7)(C) USN , Naval Medical Readiness

Training Center (NMRTC) , For t Belvoir , VA, was suspected of initi an
unauthorized query of the (b)(6), (b)(7)(C)
database for the medical records of President of the United State , Joseph
Biden . The unauthorized query was initiated from user account pro ile
(b)(6), (b)(7)(C) in association wi th the Health . mil computer networ . The
Cyber Security Service Provider (CSSP) was identified as Naval In rmat:i.on
Warfare Center (NIWC) Atlantic (LANT) .

2 . On 04MAR2 4, Reporting Agent (RA) submitted a signed, serialize

letterhead memorandum to CIV (b)(6), (b)(7)(C) Division Head and Seni r Cyber
Advisor to DHA, NI WC LANT, Charleston , SC , requesting the receipt f user
account information and logs fo r profile (b)(6), (b)(7)(C) The reque ted
information and logs included event logs , access logs , personal st rage
table (PST) files , and user roaming profile. Enclosure (A) pertain

ENCLOSURE(S)
(A) LETTERHEAD MEMORANDUM TO NIWC LANT/03MAR24

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFFICE : NCIS CYBER WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARN NG:
THIS DOCUMENT IS me PROPERTY OF TH NAVl>J.. CRIMINl>J.. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICII\I. DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT DISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIF IC AUTHORIZATION FR me
NAVAL CRIMINl>J.. INVESTIGATIVE SERVICE.

CUI

EXHIBIT (~u )
000068
 DEPARTMENT OF THE NAVY
NAVAL CRIMINAL INVESTIGATIVE SERVICE
NCIS CYBER OPERATIONS FIELD OFFICE - WASHINGTON, DC
2713 MITSCHER ROAD SW BLDG. 168 SUITE 200
ANACOSTIAANNEX, DISTRICT OF COLUMBIA 20373

5000
Ser CBFO/24U0007
03MAR24

From: Assistant Special Agent in Charge (ASAC), NCIS Cyber Operations ield Office
Washington, DC

To: Division Head and Senior Cyber Advisor to DHA

(b)(6), (b)(7)(C)
Naval Infonnation Warfare Center Atlantic (NIWC LANT)
Defense Health IT Division
1 Innovation Drive, Hanahan, SC 29410

Subject: Request for Receipt of Profile (b)(6), (b)(7)(C) User Account Infor ation and Logs

Sir,

Pursuant to suspected violation of Title 18 U.S. Code § - Fraud and Related ctivity in
Connection with Computers, relative to reported misuse of account (b)(6), (b)(7)(C) the Naval
Criminal Investigative Service (NCIS) maintains an active investigation. T •s letter serves as a
fonnal request for the preservation of all stored communications, records, a other evidence in
your possession regarding the user account (b)(6), (b)(7)(C)

This request applies to the following items, whether electronic or other form including
infonnation stored on backup media, if available:

1. The contents of any communication or file stored by or for the ac ount and any
associated accounts, and any infonnation associated with those c mmunications or
files, such as the source and destination email addresses or IP add esses.

2. All records and other infonnation relating to the account and any ssociated accounts
including the following:

a. Name(s) to include subscriber name, usemame and screen name;

b. Records of session times and durations;
c. Length of services to include start date and types of servic s utilized;
d. User browser logs, event logs, and electronic health recor (EHR) access logs
e. User personal storage table (PST) files, print jobs, and ne ork defense logs;
f. User roaming profile to include Active Directory (AD);

E CLOSURE ( A)
(CUI)
HIBIT (io) 000069
 DEPARTMENT OF THE NAVY
NAVAL CRIMINAL INVESTIGATIVE SERVICE
NCIS CYBER OPERATIONS FIELD OFFICE - WASHINGTON, DC
2713 MITSCHER ROAD SW BLDG. 168 SUITE 200
ANACOSTIAANNEX, DISTRICT OF COLUMBIA 20373

If you have any questions regarding this request, please contact (b)(6), (b)(7)(C) via
telephone at (b)(6), (b)(7)(C) or at email address (b)(6), (b)(7)(C)

Respectfully,

(b)(6), (b)(7)(C)

NCIS Cyber ations Field Office

(CCI)
000070
 CUI

U . S. NAVAL CRIMINAL INVESTIGAT I VE SERVICE

:NVESTIGATIVE ACTION 24APR24
CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAJTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY

USN MEMBER

RETURN OF EVIDENCE

1 . On 06Mar24 , Repo r t i ng Agent (RA) and Par ticipating Agent (PA) (b)(6), (b)(7)(C)
re t ur ned
(b)(6), (b)(7)(C) an MSI l aptop and iPhone to (b)(6), (b)(7)(C) USN , val
Medical Readi ness and Training Center , For t Belvoir , VA . These i t ms of
evidence we r e previously seized from (b)(6), (b)(7)(C) under a Permissiv
Author i zation for Sea r ch and Sei zure , whi ch is documented under a separate
cover .

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFF I CE: RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARN NG:
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FRO THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI

000071
 CUI

U. S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 12MAR24

CONTROL : 27FEB24 - DCWA- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORI ZED BREACH OF POTUS ' MEDICAL RECORDS Y

USN MEMBER

RECEIPT OF HEALTH . MIL ACCOUNT PROFILE (b)(6), (b)(7)(C)

1 . For context, (b)(6), (b)(7)(C) USN, Naval Medicine Readiness a d Training

Center (NMRTC) , Fort Belvoi r, VA, was suspected of initiating an
unauthorized query of (b)(6), (b)(7)(C)
database for the medical records of President of the United State , Joseph
Biden. The unauthorized query was initiated from user account pro ile
(b)(6), (b)(7)(C) in association wi th the Health.mil computer networ . The
Cyber Security Service Provider (CSSP) was identified as Naval In ormation
Warfare Center (NIWC) Atlantic (LANT) . On 28FEB24, Reporting Agen (RA) made
an informal request to (b)(6), (b)(7)(C) CIV, Division Head and Seni
Advisor to DHA, NIWC LANT, Char leston , SC , for receipt of (b)(6), (b)(7)(C)
Health . mil profile for a date range of 15FEB24 to 22FEB24; moreov ,(b)(6), (b)(7)(C)
coordinated with (b)(6), (b)(7)(C) CIV, CSSP Director , NIWC LANT, arleston ,
SC , to comp lete the request . On 04MAR24 , RA provided(b)(6), (b)(7)(C)a fo alized
request in the form of a letterhead memorandum (LHM) for (b)(6), (b)(7)(C)
Health . mil account profile.

2 . On 08MAR24 ,(b)(6), (b)(7)(C)provided RA a DoD SAFE link via email for r trieval
of the requested data . RA downloaded the requested logs the same d y . There
were 26 files retrieved that included log files , timeline and log
exports .
3 . On 12MAR24 , RA down l oaded the files to two (2) Verbatim DVD- Rd sks . The
two (2) disks were provided to the case agent assigned at the time of this
report for the captioned investigation.

4 . The following contact information for(b)(6), (b)(7)(C)

was provided :

a . Desk : (b)(6), (b)(7)(C)

b. Mobile: (b)(6), (b)(7)(C)

c . Email : (b)(6), (b)(7)(C)

REPORTED BY: (b)(6), (b)(7)(C) Special Agent

PAGE 1
WAR NG:
THIS DOCUMENT IS THE PROPERTY OFT E NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO ERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI
EXHIBIT (id\)
000072
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 12MAR24

OFFICE : NCIS CYBER WASHINGTON DC

PAGE 2 LAST(b)(6), (b)(7)(C)

V2 LNN
W NG:
THIS DOCUMENT IS THE PROPERTY OF NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO SONS WHOSE OFFICIAL OlJTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT B DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FR THE WM<L Cl'tlMINlllt lN~s-T101<1'N!! S!!l'tv!C!!.

CUI

000073
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTION 22MAR24

CONTRO: : 27FEB24 - DCWA- 00032 - 6XNA

:/FORT SELVOIR , VA/]NAJTHORIZED BREACH OF POTUS ' ~EDICAL RECORDS BY

USN MEMBER

REV:Evl OF THE CONTENTS OF THE HEALTH . MIL ACCOUNT PROFILE (b)(6), (b)(7)(C)

1 . On 22Mar24 , Repor :ing Agent (RA) revie~ed the ccr.ter.:s of tt.e ata
related to (b)(6), (b)(7)(C) USN , Naval Medicine Readi ness Trai ,ing Center
(NMRTC) , Fort Belvoi r , VA, health . mil user account pro: i le with u ername ,
(b)(6), (b)(7)(C) As bar-kgrouno , thPse records were previously re eived from
(b)(6), (b)(7)(C) CIV, Cyber Sec~rity Service Provider (CSSP) Jire tor , Naval
Information warfare Center (KIWC) Atlantic (LANT) , Charleston , SC which is
documented under a separate cover.

2 . RA reviewed all :te records provided by(b)(6), (b)(7)(C)The re~ords n tated on

22Feb24 (b)(6), (b)(7)(C) account logged into (b)(6), (b)(7)(C) to access th chart
belonging to "Joseph Biden " at approximately 1322 . The network al o log;ed
that (b)(6), (b)(7)(C) conducted a Google search fo r :oseph Biden ' s doct r during
this time . The record access for " Joseph Biden " (b)(6), (b)(7)(C)
record . (b)(6), (b)(7)(C) accessed the "Joseph Biden " record for 20 seco
Enrlosure (Al pertair.s .

3 . All of the reco r ds provided for (b)(6), (b)(7)(C) account were plac onto a
DVD and appended as Erclosure (Bl .

ENCLOSURE($ )
(A) SEKTINEL AUDIT/08MAR24
(Bl JVD CONTAINING (b)(6), (b)(7)(C) PROFILE/08MAR24

AFPORTED BY: (b)(6), (b)(7)(C) Special Agent

OFFICE : RESIDENT AGENCY WASHINGTON DC

PAGE 1 LAST V2 LNN

(b)(6), (b)(7)(C)
WARNI G
THIS DOCUMENT IS THE PROPERTY OF TH NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY TO P RSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO CONTENTS MAY NOT BE ISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AlfTHORIZATION FROM HE NAVAi. CRIMINAL INVESTIGATIVE SERVICE

CUI
EXHIBIT ( 23)

000074
Page 75 redacted for the following reason:
---------------------
Page (75), Enclosure (a) - Audit: Referred to the Defense Health Agency
 NAVAL CRIMINAL INVESTIGATIVE SER\J CE
CROSS REFERENCE SHEET
(Insert this behind the cover sheet)

CASE CONTROL NUMBER (CCN)

27FEB24-DCWA-00032-6XNA
SUBJECT (Subject Name/Title)
I / FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS' MEDICAL RI CORDS BY USN MEMBER
EXHIBIT/ENCLOSURE($) 23 / 8

contains the following additional material on (subject of the additional material)

DVD-R CONTAINING SA (b)(6), (b)(7)(C) HEALTH.MIL PROFILE

that has been retained in its original format and stored separately as specified below:

TYPE

0 Grand Jury

0 Disk (Roxie Password (b)(6), (b)(7)(C) )

0 Photograph(s) (images of photographs are contained in the electronic media, original hotograph(s) are also
contained in the file.

0 Source Envelope

0 Other

(Description)

NCIS 5000/4 (Rev. 3-2020)

000076
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

INVESTIGATIVE ACTION 18APR24

CONTROL : 27FEB24 - DCWA- 00032-6XNA

I/FORT BELVOIR , VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORD BY

USN MEMBER

RESULTS OF DIGITAL FORENSIC EXAMINATION OF (b)(6), (b)(7)(C) DEVICES

SUMMARY
1. Between 28FEB24 and 17APR24 , Digital Forensic Examiner (DFE), (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) NCIS Cyber Operations Field Office , Washington, DC, conducted a
forensic examination of the cell phone and laptop belonging to (b)(6), (b)(7)(C) for
information regarding the medical records believed to belong to
Joseph BIDEN . The examination revealed one text conversation o interest.
In this conversation (b)(6), (b)(7)(C) claims to have " looked up Joe Bi n. " The
text conversation, in its entirety , was ex t racted and provided the case
agent for review.

REQUEST
1 . On 28FEB24 Special Agent (SA) (b)(6), (b)(7)(C) NCISRA Washington DC ,
verbally requested assistance to conduct a forensic examination f
(b)(6), (b)(7)(C) electronic devices for information regarding the med'cal records
believed to belong to President Joseph BIDEN .

2 . On 17APR24 Special Agent (SA) submitted a written reques for

(b)(6), (b)(7)(C)
digital forensic support for the examination of (b)(6), (b)(7)(C) seiz d
electronic dev i ces.

SEARCH AUTHORIZATION
1 . DFE (b)(6), (b)(7)(C) conducted the digital forensic examination of (b)(6), (b)(7)(C)
digital devices pursuant to a Permissive Authorization for Searc and
Seizure (PASS) executed by (b)(6), (b)(7)(C) dated 27FEB24.

EVIDENCE
1. On 28FEB24 DFE (b)(6), (b)(7)(C) obtained the following items for an lysis from
SA
(b)(6), (b)(7)(C)
Evidence Custody Document (ECO)

Log Item Description

DCWA 0025-24 ITEM A One (1) MSI laptop S/N: (b)(6), (b)(7)(C)
DCWA 0025- 24 ITEM B One (1) Apple iPhone in Eugene Delacoix case

2. On 05MAR24 DFE (b)(6), (b)(7)(C) submitted a hard drive containing t forensic

image of the MSI laptop listed under DCWA Log Number 0025 - 24 ITE A. This
hard drive was entered into the consolidated evidence facility Wa hington DC
under DCWA Log Number 0028-24 ITEM A " One (1) Constellation ES Ha d Drive
with serial number (b)(6), (b)(7)(C)

PAGE 1
W RNING:
THIS DOCUMENT IS THE PROPERlY O THE NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY O PERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NO BE DISCLOSED TO THE PARlY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION F OM THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI EXHIBIT (~i) 000077

 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 18APR24

3 . On 05MAR24 DFE (b)(6), (b)(7)(C) submitted a hard drive containing he
extraction of the iPhone listed under DCWA Log Number 0025- 24 I EM B . This
hard drive was entered into the consolidated evidence facility ashington DC
under DCWA Log Number 0028 - 24 ITEM B " One (1) Seagate Constella ion Hard
Drive with serial number (b)(6), (b)(7)(C)

4. On 05MAR24 DFE (b)(6), (b)(7)(C) submitted a hard drive containing copy of the
image of the MSI laptop listed under DCWA Log Number 0025-24 IT MA and also
a copy of the extraction o f the iPhone listed under DCWA Log Nu er 0025- 2 4
Item B . This hard drive was entered into the consolidated evide
Washington DC under DCWA Log Number 0029-24 ITEM A "One (1) Sea
Barracuda Hard Drive SN : (b)(6), (b)(7)(C) "

5 . On 16APR24 DFE (b)(6), (b)(7)(C) submitted one DVD containing the F DINGS MEDI A
to the consolidated evidence facility , WASHINGTON, DC under DCW Log Number
0046- 2 4 ITEM A " One (1) DVD containing the FINDINGS MEDIA.

FORENSIC ACQUISITION AND VERIFICATION

1 . On 28FEB24 Digital Forensic Examiner (DFE) , (b)(6), (b)(7)(C) NC S Cyber
Operations Fiel d Office , Washington, DC obtained a digital foren ic
extraction of the Apple iPh one item listed u nder DCWA Log Number 0025 - 24
ITEM Busing Greykey , version 1 . 20 . 0 . 27291815 . The mobile device was not
wri te - protected because it must be powered on during the acquisi ion - - - - - - - - - - - - - -
process . DFE (b)(6), (b)(7)(C)used the Personal Identification Number (PI) (b)(6), (b)(7)(C)
written on the PASS to unlock the device. The digital forensic e traction of
the Apple iPhone was verified through industry standard accepted
practices .

2 . On 28FEB24 DFE (b)(6), (b)(7)(C) obtained a forensic image of the MS laptop

listed under DCWA Log Number 0025-24 ITEM A using the Logicube F lcon- Neo ,
version 3 . 3u4 . The Falcon-Neo provides write-protection during t e
acquisition of the seized digital media . The digital forensic ac uisition of
all items was verified through industry standard accepted practi es .

EXAMINATION DETAILS
1. DFE (b)(6), (b)(7)(C) reviewed the forensic extraction of the Apple "Phone
listed under DCWA Log Number 0025 - 24 I TEM Busing Magnet Ax iom E amine
v7 . 2 . 0 . 36145 . DFE (b)(6), (b)(7)(C) reviewed the photographs , videos , t t message
communications , and browser history on the cell phone . Keywords rches for
"Biden ," " Doctor , " " Flights , " " Anonymous ," " President ," " POTUS " re
conducted . In the results for the keyword " Biden " DFE (b)(6), (b)(7)(C) 'dentified
one text messaging conversation of interest between (b)(6), (b)(7)(C) an phone
number (b)(6), (b)(7)(C) associated with contact name " (b)(6), (b)(7)(C) sent the
following three texts at 13:33 PM Eastern Standard Time on 22FEB2 : (b)(6), (b)(7)(C)

(b)(6), (b)(7)(C)

PAGE 2
W NING:
THIS DOCUMENT IS THE PROPERTY O THE NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY PERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NO BE DISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION F OM THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI 000078
 CUI

U.S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

CONTROL : 27FEB24-DCWA-00032-6XNA 18APR24

2 . DFE (b)(6), (b)(7)(C) exported the entire chat history between (b)(6), (b)(7)(C) and
phone number (b)(6), (b)(7)(C) to the directo ry named " (a) Chat Mess ges " on the
FINDINGS MEDIA

3. DFE (b)(6), (b)(7)(C) completed the review of the data on the Appl iPhone and
did not identify any additional data pertinent to the investiga

4. DFE (b)(6), (b)(7)(C) reviewed the forensic image of MSI laptop lis ed under
DCWA Log Number 0025-24 ITEM A using Magnet Axiom Examine v7 . 2 . . 36145 . A
review was conducted on the Internet search history of Google C rome ,
Microsoft Edge Browsers. DFE (b)(6), (b)(7)(C) reviewed the photograph and videos .
Keyword searches for " Biden , " " Doctor, " " Flights , " " Anonymous, " " President, "
" POTUS " were conducted. DFE (b)(6), (b)(7)(C) review of the MSI Lapt did not
locate data pertaining to this investigation .

FINDINGS MEDIA
1. On 16APR24 DFE (b)(6), (b)(7)(C) provided the FINDINGS MEDIA contain'ng FINDING
(a) to SA (b)(6), (b)(7)(C) , NCISRA Washington, DC , for subsequ nt
review .

DISPOSITION OF EVIDENCE
1 . On 05MAR24 , DFE (b)(6), (b)(7)(C) returned all seized digital media ubmi t ted
for examinat i on to the Consolidated Evidence Facility, Washingto, DC.

REPORTED BY : (b)(6), (b)(7)(C) Represent ative

OFFICE : NCIS CYBER WASHINGTON DC

PAGE V2 LNN
3 LAST(b)(6), (b)(7)(C)
W NING:
THIS DOCUMENT IS THE PROPERTY O THE NAVAL CRIMINAL INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY PERSONS WHOSE OFFICIAL DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NO BE DISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION F OM THE NAVAL CRIMINAL INVESTIGATIVE SERVICE

CUI 000079
 CUI

U . S. NAVAL CRIMINAL INVESTIGATIVE SERVICE

:NVESTIGATIVE ACTION 24APR24

CONTROL : 27FEB24 - DCWA- 00032- 6XNA

:'.JFORT SELVOIR, VA/"JNA'J':'HOR!ZED BREACH OF POTUS ' ~'1EDICAL RECORDS BY

USN MEMBER

RECE:PT OF FINJINGS MED:A

1 . On 16Ap r 24 , (b)(6), (b)(7)(C) Digi tal Forensic Examiner (DFE , NCIS

Cyber Oper ations Field O:fice , Washington , DC , provided Reporting Agent with
a copy of the findi ngs media f r om his analys i s . Encl osure (A) per ains .

ENCLOSURE(S)
(A) DVD CONTAcNING FIND:NGS MEDIA/16APR24

REPORTED BY : (b)(6), (b)(7)(C) Special Agent

OFF:CE : RESIDENT AGENrY WASH : NGTON DC

PAGE 1 LAST(b)(6), (b)(7)(C)

V2 LNN
WARN! G
THIS DOCUMENT IS THE PROPERTY OF TH NAVl>J.. CRIMINl>J.. INVESTIGATIVE SERVICE
CONTENT S MAY BE DISCLOSED ONLY TO P RSONS WHOSE OFFICll>J.. DUTIES REOUIRE
ACCESS HERETO. CONTENTS MAY NOT BE ISCLOSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION FROM HE NAVAL CRIMINl>J.. INVESTIGATIVE SERVICE

CUI
EXHIBIT ( 'l. 5 )
000080
 (b)(6), (b)(7)(C): Page (81), Enclosure (a) - DVD containing media findings - Withheld

NAVAL CRIMINAL INVESTIGATIVE SERV CE

CROSS REFERENCE SHEET
(Insert this behind the cover sheet)

CASE CONTROL NUMBER (CCN)

27FEB24-DCWA-00032-6XNA
SUBJECT (Subject Name/Title)
I/ FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS' MEDICAL RI CORDS BY USN MEMBER
EXHIBIT/ENCLOSURE(S) 25 / A
contains the following additional material on (subject of the additional material)
DVD CONTAINING FINDINGS MEDIA

that has been retained in its original format and stored separately as specified below:

TYPE

D Grand Jury

D Disk (Roxio Password

D Photograph(s) (images of photographs are contained in the electronic media, original I hotograph(s) are also
contained in the file.

D Source Envelope

D Other

(Description)

NCIS 5000/4 (Rev. 3-2020)

000081
 CUI

U.S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

RE PORT OF INVEST I GATION (ACTION) 18APR24

SPECIAL INQUIRY (II) CONTROL : 27FEB24 - A- 00032- 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORD BY USN

MEMBER

COMMAND/NAVY MEDICINE READINESS AND TRAINING COMMAND/68920

MADE AT/CBDC/NCIS CYBER WASHINGTON DC/ (b)(6), (b)(7)(C)

REPRESENTATIVE

REFERENCE (S)
(A) NCISRA WASHINGTON , DC ROI (ACTION ) /17APR24

NARRATIVE
Reference (A) requested digital forensics examination of seized igital
devices . The examination details can be viewed in Exhibit (1) . Lad tasking
for CBFO concerni ng digital media is complete .

DISTRIBUTION
NCISHQ : CBDC/23B2/CBF0/023B
INFO : 002A/DCFO/DCWA

PAGE V2 LNN
1 LAST(b)(6), (b)(7)(C)
w ING:
THIS DOCUMENT IS THE PROPERTY OF NAVN.. CRJMINAl INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY PERSONS WHOSE OFF1CIAl ~ES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT DISCI.OSED TO THE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION THE NAVN.. CRJMINAl. INVESTIGATIVE SERVICE.

CUI
000082
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

REPORT OF INVESTIGATION (ACTION) 17APR24

SPECIAL INQUIRY (II) CONTROL : 27FEB24 - DC A- 00032 - 6XNA

I/FORT BELVOIR, VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY USN

MEMBER

COMMAND/NAVY MEDICINE READINESS AND TRAINING COMMAND/68920

MADE AT/DCWA/RESIDENT AGENCY WASHINGTON DC/ (b)(6), (b)(7)(C) SUPERVI ORY

SPECIAL AGENT

REFERENCE(S)
(A) NCISRA WASHINGTON, DC ROI (OPEN) /28 FEB24

NARRATIVE
1. On 27FEB2 4, (b)(6), (b)(7)(C) USN , Naval Medical Readiness an Training
Ce nter (NMRTC) , Fort Belvoir, VA , signed a Permissive Authorizat on for
Search and Seizure (PASS) for (b)(6), (b)(7)(C) ' s electronic devices t o search for
any potential evidence related to the unauthorized access of the President
of the United States ' medical records , which is documented under a separate
cover . On 27FEB24 , NCIS seized (b)(6), (b)(7)(C) electronic devices w'th his
permission and entered it into the NCISRA Washington , DC Evidenc Custody
System under log t 0025- 24 .

ACTION
R. CBFO: Attn: (b)(6), (b)(7)(C) Please conduct a digital
forensic examination of the seized electronic devices f m
(b)(6), (b)(7)(C) which is in the NCI SRA Washington , DC Evide e
Custody System under l og t 0025-24.

DISTRIBUTION
NCISHQ:CBF0/023B
ACTION : CBFO
INFO : DCWA/DCF0/002A

PAGE 1 LAST(b)(6), (b)(7)(C)

V2 LNN
w
THIS DOCUMENT IS THE PROPERlY OF NAVM. CRIMINM. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY T PERSONS WHOSE OFFICW. DVTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NOT DISCLOSED TO llE PARTY(S) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION ntE NAVAL CRIMINAL INVESTIGATIVE SERVICE.

CUI
000083
 CUI

U . S . NAVAL CRIMINAL INVESTIGATIVE SERVICE

REPORT OF INVESTIGATION (OPEN ) 28FEB24

SPECIAL INQUIRY (II ) CONTROL : 27 FEB24 - DC A- 00032- GXNA

I /FORT BELVOIR , VA/UNAUTHORIZED BREACH OF POTUS ' MEDICAL RECORDS BY USN

MEMBER

COMMAND/NAVY MEDICINE READINESS AND TRAINING COMMAND/68920

MADE AT/DCWA/RESIDENT AGENCY WASHINGTON DC/ (b)(6), (b)(7)(C)

SPECIAL AGENT

NARRATIVE
1 . This reactive i nvestiga tion pertains to suspected violations f 18 United
States Code 1030 (Fraud and related activity in connection with
computers) .

2 . On 27Feb24 , NCISRA Washington , DC was contacted by (b)(6), (b)(7)(C)

Watch Officer , NCIS , in reference to a notification via Navy OP
regarding an incident at Fort Belvoir, VA . The incident involved a suspected
unauthorized access to the President of the United States ' (POTU) medical
records by a USN member . It was reported that a database (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) was accessed mul t iple t imes on 22Feb24 . The al eged
offender wa s identified as (b)(6), (b)(7)(C) USN , Naval Medical eadiness
and Training Center (NMRTC) , Fort Belvoir , VA .

3 . On 27 Feb24 , (b)(6), (b)(7)(C) USN , NMRTC, Fort Belvoir, VA, (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C) , USN , Region Legal Services Office (RLSO) , Washing
were apprised of the status of t his investigation .

4 . On 28Feb24 , (b)(6), (b)(7)(C) USN , Staff Judge Advocate , NMR

Bethesda , MD , was apprised of the status of this investigation .

5 . This investigation is pending witness interviews , interview (b)(6), o (b)(7)(C)

,
review of (b)(6), (b)(7)(C) ' s electronic devices, review o f (b)(6), (b)(7)(C)
(b)(6), (b)(7)(C)
network activity , and any other investigative endeavors deemed n essary .

DISTRIBUTION
NCISHQ:23B2
INFO : DCWA/DCFO/002A

PAGE 1 LAST(b)(6), (b)(7)(C)

V2 LNN
W HING:
THIS DOCUMENT IS THE PROPERTY O THE NAVAL CRIMINAi. INVESTIGATIVE SERVICE
CONTENTS MAY BE DISCLOSED ONLY O PERSONS WHOSE OFACW. DUTIES REQUIRE
ACCESS HERETO. CONTENTS MAY NO BE DISCLOSED TO THE PARTY($) CONCERNED
WITHOUT SPECIFIC AUTHORIZATION F OM THE NAVAL CRIMINAi. iNVESTiGATiVE SERVICE.

CUI
000084