House watchdog weighs ‘behavioral monitoring’ to deter internal security threats

A top congressional watchdog is considering calling for the House to launch a program aimed at identifying and deterring internal threats, including through “behavioral monitoring,” according to a draft document reviewed by POLITICO.

The draft recommendations from the House’s inspector general come as the Capitol undergoes a campuswide push to shore up its security in the wake of the Jan. 6 attack last year. The chamber’s current top security official Sergeant at Arms William Walker said in a statement, however, that he does not plan to roll out any new program involving surveillance and monitoring.

The document shows the extent to which congressional security has become a priority since the riot led by then-President Donald Trump’s supporters and the muscular threat-detection tactics that are now under consideration for the Hill. The monitoring recommendations in particular also will face significant pushback because of privacy concerns.

“Everything you told me about that report, I will stand at the top of my lungs and fight against,” said Rep. Kelly Armstrong (R-N.D.).

POLITICO reviewed a draft report titled “Sergeant at Arms Insider Threat Risks,” dated Dec. 30, 2021, and produced by the House’s Office of the Inspector General. The slim document suggested that the House Sergeant at Arms’ office — which leads security for the chamber — start a comprehensive “insider threat” program, which it currently lacks. 

National security officials use the term “insider threats” to describe people who deliberately harm their workplaces and employers. The best-known example is Edward Snowden, a former National Security Agency contractor who leaked an extensive amount of classified government material to journalists.

Comprehensive insider threat programs are widely used in the executive branch, particularly in national security agencies, to try to prevent Snowden-style leaks and other security compromises. The programs generally assess typical employee behavior — the average number of pages printed per week, for instance — in an effort to gauge if someone’s online activity has become aberrant. The degrees of scrutiny that these programs level can vary substantially from agency to agency.

Some of the most robust programs track every keystroke that employees make on their work computers.

“Without a program, the House may be vulnerable to insider threats,” the draft inspector general’s office report reads. It then recommends that the Sergeant at Arms “work with House leadership to consider establishing a comprehensive insider threat program.”

The report does not explicitly say which groups of people working on the Capitol Campus should be included in the proposed insider threat program.

The draft report included a letter from Walker, in which he said he's already started developing an insider threat awareness program. Walker told POLITICO that he does not plan any new surveillance as part of that work, but instead is rolling out voluntary training for House staff regarding security.

“The House Sergeant at Arms has no plans, intentions, or interests in conducting any surveillance or monitoring of people who work on the Hill as part of its effort to prevent an insider threat from materializing,” he added.

The House inspector general’s office referred questions about the draft report to the House Administration Committee, where a spokesman did not weigh on the details of the draft report.

Monitoring — behavioral and otherwise

Insider threat programs can take a variety of steps to try to prevent destructive behavior by government employees, as the draft report explains.

“These programs identify anomalous behaviors that may indicate an individual poses a risk,” the report reads, adding that people running insider threat programs aim for “early identification” of potential risks by focusing on “motivation factors.”

A graphic in the report listed a number of steps involved in creating these programs, including developing “a baseline of normal activity.” The report also suggested that the House standardize “pre-employment vetting (background checks), periodic re-vetting of staff, and termination procedures” to deter insider threats.

The potential involvement of security officials in congressional hiring decisions will generate controversy.

“To some degree or another, it’s none of their damn business. The structure of who I hire in my office is between me and the citizens of North Dakota,” said Armstrong. He was one of several House Republicans who raised questions last month after POLITICO reported on Capitol Police intelligence officials separately scrutinizing the backgrounds of people who meet with lawmakers.

Monitoring people would also be important, the draft House inspector general’s office report says: “Monitoring activities may include performing risk-based analytics, conducting internal/ external audits, and monitoring user activity on networks.”

“Various individuals at the House may conduct behavioral monitoring once properly trained,” the report adds in a footnote, “however, network monitoring would be performed by the [Chief Administrative Officer’s House Information Resources] division.”

The report also describes steps that the House would follow when implementing an insider threat program. Those steps include setting up “firm rules of engagement for how the insider threat team should monitor activity, launch investigations, and investigate suspected malicious insiders.”

Another step: “Deploy technology to monitor employee behavior that aligns with your specific requirements, policies, and insider threat team.”

It adds that an insider threat program’s mission and actions must be balanced “with the privacy and civil liberties of employees.”

‘Who are they sharing this with?’

The draft report said that House Sergeant at Arms is working on insider threat prevention, using its recommendations “as a baseline for the development of a more robust program.”

POLITICO shared language from the draft report with Bill Evanina, the former director of the National Counterintelligence and Security Center, who said much of it was standard for executive-branch insider threat programs.

In common parlance around insider threats, the phrases “network monitoring” and “user monitoring” refer to activity on a computer, he said. The phrase “behavioral monitoring,” meanwhile, refers to activity that isn’t online. Evanina questioned whether the report’s authors meant to refer to online behavior when they used the phrase “behavioral monitoring.”

“In any insider threat program, the efficacy starts with implementation and the identification of what behavior is and is not acceptable,” added Evanina, who is now CEO of the Evanina Group consulting firm. “And from that space, what is the standardized behavior you’re looking to monitor? In the insider threat community, that has not been perfected, both inside the government and outside the government.”

Daniel Schuman of the progressive group Demand Progress, meanwhile, said in an interview that he worried about oversight and transparency in regards to any congressional insider threat program.

“Are they using this for intelligence gathering, to create criminal prosecutions?” he said. “Who are they sharing this with? None of this has been developed, certainly not within the public and I’ve seen no evidence of competence in these matters inside the legislative branch.”

What’s next

Peter Whippy, a spokesperson for the House Administration Committee, said in a statement that panel Chair Zoe Lofgren (D-Calif.) “believes security decisions affecting the House are best made by security professionals. While the Inspector General has not yet issued a report on insider threat risks, the Chairperson will review his findings when they have been finalized and transmitted to the Committee.”

An appendix to the inspector general's draft report included a letter from the Sergeant at Arms.

“I am delighted to report that the [House Sergeant at Arms] Insider Threat Awareness and Risks Mitigation Program has been in development since July of 2021,” he wrote.

Walker said in a statement that his team is rolling out “a strictly voluntary insider threat awareness and risk mitigation training opportunity” for employees.

The training’s goal, Walker continued, is to “make them aware of the potential costs associated with talking about Member and or staff scheduling, travel, meetings, etcetera” with people who might not need that information.

“The goal is to equip employees with the knowledge to help prevent carelessness so they do not accidentally, mistakenly or unwittingly share seemingly trivial or thought to be insignificant information with anyone not having a need to know,” he added.

The big picture

In the months after the Jan. 6 insurrection, concerns grew that people working on the Hill could pose threats. In September, Capitol Police announced that half a dozen officers were being disciplined for misconduct the day of the attack.

And in October, the Justice Department charged a Capitol Police officer with obstruction of justice because of his communications with a rioter in the days after the attack. That rioter had posted on social media about being in the Capitol on Jan. 6.

Days after the attack, Rep. Mikie Sherrill (D-N.J.) claimed to have seen Republican members of Congress lead people through the Capitol on Jan. 5, 2021, as part of “reconnaissance for the next day.” When POLITICO has asked Sherrill in the past for further detail, she has declined to elaborate, referring questions to the D.C. U.S. attorney’s office and the Jan. 6 select committee.

Posted in Uncategorized

Read the never-issued Trump order that would have seized voting machines

Among the records that Donald Trump’s lawyers tried to shield from Jan. 6 investigators are a draft executive order that would have directed the defense secretary to seize voting machines and a document titled “Remarks on National Healing.”

POLITICO has reviewed both documents. The text of the draft executive order is published here for the first time.

The executive order — which also would have appointed a special counsel to probe the 2020 election — was never issued. The remarks are a draft of a speech Trump gave the next day. Together, the two documents point to the wildly divergent perspectives of White House advisers and allies during Trump’s frenetic final weeks in office.

It’s not clear who wrote either document. But the draft executive order is dated Dec. 16, 2020, and is consistent with proposals that lawyer Sidney Powell made to the then-president. On Dec. 18, 2020, Powell, former Trump national security adviser Michael Flynn, former Trump administration lawyer Emily Newman, and former Overstock.com CEO Patrick Byrne met with Trump in the Oval Office.

In that meeting, Powell urged Trump to seize voting machines and to appoint her as a special counsel to investigate the election, according to Axios.

A spokesperson for the House’s Jan. 6 select committee confirmed earlier Friday that the panel had received the last of the documents that Trump’s lawyers tried to keep under wraps and later declined to comment for this story on these two documents.

The draft executive order

The draft executive order shows that the weeks between Election Day and the Capitol attack could have been even more chaotic than they were. It credulously cites conspiracy theories about election fraud in Georgia and Michigan, as well as debunked notions about Dominion voting machines.

The order empowers the defense secretary to “seize, collect, retain and analyze all machines, equipment, electronically stored information, and material records required for retention under” a U.S. law that relates to preservation of election records. It also cites a lawsuit filed in 2017 against Georgia Secretary of State Brad Raffensperger.

Additionally, the draft order would have given the defense secretary 60 days to write an assessment of the 2020 election. That suggests it could have been a gambit to keep Trump in power until at least mid-February of 2021.

The full text of the never-issued executive order can be read here.

It opens by citing a host of presidential authorities to permit the steps that Trump would take, including the Constitution and Executive Order 12333, a well-known order governing the intelligence community. But the draft executive order also cites two classified documents: National Security Presidential Memoranda 13 and 21.

The existence of the first of those memoranda is publicly known, but the existence of the second has not been previously reported. NSPM 13 governs the Pentagon’s offensive cyber operations. According to a person with knowledge of the memoranda, 21 makes small adjustments to 13, and the two documents are viewed within the executive branch as a pair.

The fact that the draft executive order’s author knew about the existence of Memorandum 21 suggests that they had access to information about sensitive government secrets, the person told POLITICO.

The draft order also greenlit “the appointment of a Special Counsel to oversee this operation and institute all criminal and civil proceedings as appropriate based on the evidence collected and provided all resources necessary to carry out her duties consistent with federal laws and the Constitution.”

To bolster its provisions, the draft order cites “the forensic report of the Antrim County, Michigan voting machines.” That report was produced by Russ Ramsland, who confused precincts in Minnesota for those in Michigan, according to the Washington Post. Michigan’s secretary of state, meanwhile, released an exhaustive report rebutting election conspiracy theories and concluding that none of the “known anomalies” in Antrim County’s November 2020 election were the result of any security breach.

"This draft order represents not only an abuse of emergency powers, but a total misunderstanding of them," said Liza Goitein, co-director of the liberty and national security program at the nonprofit Brennan Center for Justice. "The order doesn’t even make the basic finding of an 'unusual and extraordinary threat' that would be necessary to trigger any action under [federal emergency powers law]. It’s the legal equivalent of a kid scrawling on the wall with crayons."

The draft remarks

The draft document labeled “Remarks on National Healing,” also now in the select panel’s possession, provides a first look at the remarks Trump would deliver the next day, which stand in jarring contrast to other rhetoric Trump employed at the time and continues to use when discussing the insurrection.

“I would like to begin today by addressing the heinous attack that took place yesterday at the United States Capitol,” it opens. “Like all Americans, I was outraged and sickened by the violence, lawlessness and mayhem. I immediately deployed the National Guard and federal law enforcement to secure the building and expel the intruders. America is, and must always be, a nation of law and order.”

That claim that Trump immediately ordered the National Guard to head to the Capitol may be false. The Jan. 6 select committee sent a letter Thursday saying that Trump’s defense secretary at the time of the riot, Chris Miller, “has testified under oath that the President never contacted him at any time on January 6th, and never, at any time, issued him any order to deploy the National Guard.”

The “national healing” document continued with sharp criticism of the attack.

“The Demonstrators who infiltrated the Capitol have defiled the seat of American Democracy,” the remarks state. “I am directing the Department of Justice to ensure all lawbreakers are prosecuted to the fullest extent” of the law.”

The document follows with a direct communication to the rioters: “We must send a message - not with mercy but with justice. To those who engaged in acts of violence and destruction, I want to be very clear: you do not represent me. You do not represent our movement. You do not represent our country. And if you broke the law, you belong in jail.”

The remarks departed significantly from the way he described the rioters in other contexts. In a video released during the attack, Trump struck a tone of empathy with the mob.

“We have to have peace,” Trump said then. “So go home. We love you. You’re very special. You’ve seen what happens, you see the way others are treated that are so bad and so evil. I know how you feel.”

The day after the attack, facing a torrent of criticism and public discussion about invoking the 25th Amendment in order to remove him from office, Trump delivered an Oval Office address similar to the draft remarks. In that address, Trump also condemned the violence at the Capitol and called for perpetrators to be held accountable.

A Trump spokesperson declined to comment for this story.

Draft vs. reality

The draft remarks go on to describe emotions running high after an intense election. “But now, tempers must be cooled and calm restored.”

Trump “vigorously pursued every legal avenue to contest the election results,” the remarks add, and still urges election “reform” so voters could be confident about future contests.

“But as for THIS election, Congress has now certified the results,” the remarks say. “The election fight is over. A new administration will be inaugurated on January 20th. My focus now turns to ensuring a smooth, orderly and seamless transition of power. This moment calls for healing and reconciliation.”

In the year since the riot, Trump’s recent characterization of the attack has veered wildly from that sentiment in the draft remarks. The former president has described the 2020 election as “the insurrection” and Jan. 6, 2021, as “the Protest.” He has also praised Ashli Babbitt, a rioter who entered the Capitol and was shot and killed there by a police officer.

The remarks go on to strike a unifying tone in discussing the coronavirus.

“The pandemic isolated millions in their homes, damaged the economy, and claimed countless victims,” the document continues. “Ending the pandemic and rebuilding the economy,” it adds, “will require all of us working together,” along with renewed emphasis on patriotism, faith and community.

“We must renew the sacred bonds of love and loyalty that bind us together as one national family,” it adds.

While Trump has courted the disapproval of some in his own base by publicly sharing that he’s received a booster shot against Covid, he has chiefly emphasized the success of vaccines against the virus as his own personal victory.

“I came up with a vaccine, with three vaccines,” Trump told conservative pundit Candace Owens last month. “All are very, very good.”

CORRECTION: An earlier version of this report misstated how the draft remarks were used. Former President Donald Trump delivered a speech the day following the Jan. 6 Capitol insurrection that was substantially similar to the document obtained by the select committee.
CLARIFICATION: Our reproduction of the text of the draft executive order introduced four minor typographical errors, none of which had a material effect on the language. These errors have been resolved.
Posted in Uncategorized

Manhattan prosecutor pick ducks questions about Barr’s job offer

President Donald Trump and Attorney General Bill Barr first learned less than two weeks ago that their chosen replacement for the Manhattan U.S. attorney wanted the job, that person told Congress on Thursday.

Jay Clayton––currently the chairman of the Securities and Exchange Commission (SEC)––made the revelation in a hearing before a subcommittee of the House Financial Services Committee, while fielding questions from Rep. Carolyn Maloney (D-NY).

Late in the evening on Friday, June 19, Barr announced that the U.S. Attorney for the Southern District of New York, Geoff Berman, was stepping down, and that Trump would nominate Clayton to replace him. Berman, however, said he had no plans to step down, kicking off a dramatic intra-DOJ stand-off that ended Saturday afternoon.

“When did you first discuss the Southern District job with the president, or the Trump administration, and who did you discuss it with?” Maloney asked. “Attorney General Barr?”

“Look, I’m here as the chairman of the SEC to discuss the work of the SEC,” he replied. “What I can say is that, as I said in my opening statement, I need to go back to New York.”

“I was just asking for a timeline,” Maloney replied. “When did you discuss it? Just give me the approximate date, the timeline.”

“What I want to say is, this is something I’ve been talking about for a while, consulting with people as to whether this would make sense for me to continue in public service,” Clayton continued. “This was first raised to the president and the attorney general last weekend. It was something that I had wanted to do, and they first became aware of it last weekend.”

“Thank you, and did you know that Mr. Berman did not want to leave his job in the Southern District when you agreed to accept the nomination?” she asked. “In other words, did you know he was going to be fired to make room for you, instead, for the job?”

“I’m not going to get into that here,” he replied.

Clayton’s statement appeared to indicate that within hours of his expressing interest in the job, Barr moved to fire the person who held it at the time––a remarkably quick decision-making process. A spokesperson for the SEC did not immediately respond to a request for more clarification of Clayton’s statement. Later in the hearing, after Rep. Madeleine Dean (D-PA) asked him to clarify, he said he actually had “the initial conversation” with Barr and Trump over the weekend of June 12.

“This was entirely my idea,” he said. “This was something that I’d been thinking about for several months as a possible continuation of public service after my time at the SEC is done.”

Clayton golfed with Trump on Saturday, June 13, according to The New York Times, raising the question of whether he discussed the Southern District posting directly with the president on that occasion.

In his exchange with Maloney, Clayton also addressed a question about whether or not he would recuse himself from matters involving Trump and his allies.

“If you are eventually confirmed by the Senate for this job, would you commit to recusing yourself from all of that office’s current investigation into President Trump and his associates?” she asked.

“Here’s what I’m gonna say,” he replied. “That’s a process that’s way down the road. Whatever my current position or any position I take, I commit to doing it independently, without fear or favor, in the pursuit of justice.”

“I’m sorry, that’s not what I was asking,” Maloney shot back, going on to detail why she was pressing him on it.

“I’m asking you a very simple question,” she said. “Will you commit, right here, to recusing yourself from these investigations?”

“That position and that process is something that is separate and doesn’t need my attention. What I will commit to do, what I commit to do in my current job, is to approach the job with independence and to follow all ethical rules.”

Maloney said he still wasn’t answering the question, and said the American people need to know whether or not he will be independent.

“Understood, and I commit to independence,” he replied.

The circumstances of Berman’s ouster generated furor among congressional Democrats and critics of Trump’s DOJ. And it still isn’t clear why Barr fired him so quickly, as he could have stayed in the position until the Senate confirmed Clayton as his replacement.

Some even called for Barr’s impeachment in the wake of the move. But House Speaker Nancy Pelosi batted down that talk in an interview with The Washington Post on Thursday.

“At this point, let’s solve our problems by going to the polls and voting on election day,” she said.

Posted in Uncategorized