The image is an email header.

*   From: \[redacted] (USANYS) \[redacted]
*   To: \[redacted] (USANYS) \[redacted]
*   Subject: RE: Maxwell

Date: Mon, 07 Jun 2021 16:51:03 +0000

Inline-Images: image003.jpg; image002.jpg

Key Information from Image:

*   Email correspondence regarding "Maxwell"
*   Sender (USANYS) sent to (USAEO).
*   Response from (USAEO) to (USANYS) at 12:11 PM on June 7, 2021.
*   USANYS sent the original email on Monday, June 7, 2021 at 11:49 AM
*   Subject: RE: Maxwell
*   The issue related to conduct is closed.
*   Person leaving CACI's employ.
*   Includes title Assistant Director & Chief Information Security Officer, Department of Justice, etc.

As to he is leaving CACI's employ this Friday, but it has nothing to do with the transfer of documents. I think we can let it die on Friday.

Thanks,

EFTA00029020

| Field | Value |
|---|---|
| From | [redacted] (USAEO) <[redacted]> |
| Sent | Monday, June 7, 2021 10:56 AM |
| To | [redacted] (USANYS) <[redacted]> |
| Cc | [redacted] (USAEO) <[redacted]> |
| Subject | RE: Maxwell |

Good morning

GCO's records show that this matter, as it applies to S was already addressed by GCO back on April 19. Those records show that the USAO took necessary steps to mitigate the action and did not wish to proceed with any disciplinary actions given the circumstances. Would you like to discuss the circumstances regarding the new incident with employee who I understand is also a contractor?

Thank you,

Key information from the email:

*   **Sender:** (USAEO)
*   **Recipient:** SOC-EOUSA
*   **Date:** Friday, June 4, 2021, 12:45 PM
*   **Subject:** RE: Maxwell
*   **Importance:** High
*   **Also Involved:** Assistant United States Attorney, General Counsel's Office (On Detail), Executive Office for U.S. Attorneys, (USANYS), (USAEO)

SOC,

Please complete the following actions with the district:

• I've spoken with M, this is not a classified spill. The data label is based on a protective order issued by the court.

• The Information Disclosure will need to be completed as there was a substantial amount of Pll included in the upload.

• Validate the information was received by the intended recipient.

• Insure the data has been removed from and

I believe the district did speak to the individual on this, not sure if you have any further questions. A summary of the incident is below for your reference.

• On April 13th, [REDACTED] uploaded 5.5 GB of data to [REDACTED]

• Analysts determined the content of these files were discovery for the Jeffrey Epstein case against Ghislaine Maxwell. It contained the under-age victim names among other PII.

• The CISO notification was sent May 26th and the SOC notification with the Information Disclosure form sent on May 28th.

EFTA00029021

• Contractor stated they chose to use the Sharefile.com instead of USAfx.

• In the last 24 hours, another user from the same district, uploaded less than a GB of data to another law firm that uses sharefile.com. This user is: in NYS.

R/G

Key information:

*   **Sender (top email):** USANYS, Sent: Thursday, June 3, 2021 1:59 PM
*   **Recipient (top email):** USAEO
*   **Subject (top email):** FW: Maxwell
*   **Sender (bottom email):** USANYS, Sent: Thursday, June 3, 2021 1:49 PM
*   **Recipient (bottom email):** USANYS
*   **CC (bottom email):** USANYS
*   **Subject (bottom email):** Maxwell
*   The emails appear to be related to "Maxwell" and involve recipients/senders within USANYS and USAEO.





Attached is the Court ordered protective order, which requires us to mark things as confidential (paragraph 7).

The production uploaded was non-testifying witness 3500. An example page is attached, and includes our "confidential" marking that we applied pursuant to the protective order. Given that this information clearly contains Pll for victims, the designation is necessary. We'd also ask that this page not be widely disseminated outside of those at EOUSA who already have access.

Thank you,

Chief, Public Corruption Unit
U.S. Attorney's Office
Southern District of New York

EFTA00029022

*   **Entities:** United States Attorneys Cybersecurity Staff, The Executive Office.
*   **Duplication:** The same logo and text are repeated twice in the image.

EFTA00029023