| Field | Value |
|---|---|
| Date | Mon, 07 Jun 2021 16:51:03 +0000 |
| From | "‭[redacted]‬" (USANYS) <[redacted]> |
| To | "‭[redacted]‬" (USANYS) <[redacted]> |
| Subject | RE: Maxwell |

Date: Mon, 07 Jun 2021 16:51:03 +0000

Inline-Images: image003.jpg; image002.jpg

The image contains an email thread.

Key Participants:

*   (USANYS)
*   (USAEO)

Subject: RE: Maxwell

The issue of conduct is closed.
An employee is leaving CACI's employ this Friday.

As to he is leaving CACI's employ this Friday, but it has nothing to do with the transfer of documents. I think we can let it die on Friday.

Thanks,

EFTA00029337

Key details of the email:

*   **From:** (USAEO)
*   **Sent:** Monday, June 7, 2021, 10:56 AM
*   **To:** (USANYS)
*   **Cc:** (USAEO)
*   **Subject:** RE: Maxwell

Good morning

GCO's records show that this matter, as it applies to S was already addressed by GCO back on April 19. Those records show that the USAO took necessary steps to mitigate the action and did not wish to proceed with any disciplinary actions given the circumstances. Would you like to discuss the circumstances regarding the new incident with employee who I understand is also a contractor?

Thank you,

Key information from the image:

*   **Email Sender:** (USAEO)
*   **Sent Date:** Friday, June 4, 2021 12:45 PM
*   **Email Recipient:** SOC-EOUSA
*   **Subject:** RE: Maxwell
*   **Importance:** High
*   **CC:** (USAEO), (USANYS), (USAEO)
*   **Other Entities:** Assistant United States Attorney, General Counsel's Office (On Detail), Executive Office for U.S. Attorneys

SOC,

Please complete the following actions with the district:

• I've spoken with M, this is not a classified spill. The data label is based on a protective order issued by the court.

• The Information Disclosure will need to be completed as there was a substantial amount of Pll included in the upload.

• Validate the information was received by the intended recipient.

• Insure the data has been removed from and

I believe the district did speak to the individual on this, not sure if you have any further questions. A summary of the incident is below for your reference.

• On April 13th, [REDACTED] uploaded 5.5 GB of data to [REDACTED]

• Analysts determined the content of these files were discovery for the Jeffrey Epstein case against Ghislaine Maxwell. It contained the under-age victim names among other PII.

• The CISO notification was sent May 26th and the SOC notification with the Information Disclosure form sent on May 28th.

EFTA00029338

• Contractor stated they chose to use the Sharefile.com instead of USAfx.

• In the last 24 hours, another user from the same district, uploaded less than a GB of data to another law firm that uses sharefile.com. This user is: in NYS.

R/G

| Field | Extracted content |
|---|---|
| Certifications | CISSP, C|EH |
| Job Title | Assistant Director & Chief Information Security Officer |
| Organization / Unit | Department of Justice — Executive Office for the United States Attorneys’ — Office of the Chief Information Officer, Cybersecurity Services Group |
| Signature lines | Multiple additional lines present and blacked out (redacted) |
| Embedded image filename | <image003.jpg> |
| Email header — Forward (top) | From: [redacted] (USANYS) <[redacted]>; Sent: Thursday, June 3, 2021 1:59 PM; To: [redacted] (USAEO) <[redacted]>; Subject: FW: Maxwell |
| Email header — Original (below) | From: [redacted] (USANYS) <[redacted]>; Sent: Thursday, June 3, 2021 1:49 PM; To: [redacted] (USANYS) <[redacted]>; Cc: [redacted] (USANYS) <[redacted]>; [redacted] <[redacted]>; Subject: Maxwell |

- Key visible subject: "Maxwell"
- Several personal names/addresses are blacked out (redacted).



Attached is the Court ordered protective order, which requires us to mark things as confidential (paragraph 7).

The production uploaded was non-testifying witness 3500. An example page is attached, and includes our "confidential" marking that we applied pursuant to the protective order. Given that this information clearly contains Pll for victims, the designation is necessary. We'd also ask that this page not be widely disseminated outside of those at EOUSA who already have access.

Thank you,

Chief, Public Corruption Unit
U.S. Attorney's Office
Southern District of New York

EFTA00029339

- Two identical header graphics (stacked one above the other), each with a circular U.S. Department of Justice-style seal at left and text to the right:
  - THE EXECUTIVE OFFICE
  - for
  - UNITED STATES ATTORNEYS
  - Cybersecurity Staff

EFTA00029340