u.s.

Department of Justice

SEP - 1 ·2010 Ubshington. D,C 20530

MEMORANDUM

TO: Gary Grindler

Acting Deputy Attorney General

FROM: Lee Lofthus

Assistant Attorney Gene
for Administration

SUBJECT: Emails of John Yoo and Patrick Philbin

In July 2009 the Office of Professional Responsibility (OPR) submitted its final report regarding
the drafting of Office of Legal Counsel (OLC) memos relating to enhanced interrogation
techniques. The OLC memos were issued on August 1,2002 and March 14,2003, and the OPR
investigation began in October 2004. The final OPR report included the following footnote on
page 5:

OLC initially provided us with a relatively small number of emails, files, and draft
documents. After it became apparent, during the course of our review, that relevant
documents were missing, we requested and were given direct access to the email and
computer records of [redacted] Yoo, Philbin, Bybee, and Goldsmith. However, we were
told that most ofYoo's email records had been deleted and were not recoverable.
Philbin's email records from July 2002 through August 5, 2002 - the time period in
which the Bybee Memo was completed and the Classified Bybee Memo (discussed
below) was created had also been deleted and were reportedly not recoverable.
Although we were initially advised that Goldsmith's records had been deleted, we were
later told that they had been recovered and we were given access to them.

In light of the concerns raised by Congress and others subsequent to the Department's release of
this report to the Judiciary Committees, you asked the Justice Management Division (JMD) to (a)
search for and recover Y00 and Philbin emails from the 2002-03 period and (b) describe the
applicable policies and procedures in place at the time.

In response, we conducted a far-ranging search of potential sources ofYoo and Philbin emails,
including physical searches at multiple locations. Our search effort included locating and
restoring 287 backup tapes, which took about 2 to 4 hours per tape. We will describe our search
and the relevant policies and procedures more fully below, .but will begin here with a synopsis of
what we found.

We reviewed the Yoo and Philbin emails to which we understand OPR had access. We found
approximately 500 emails in Yoo's account for the 2001-2003 time period and found a gap in
Philbin's Inbox e-mails from July 2,2002 through August 5, 2002, and a gap in his Sent Items
folder from July 16,2002 through August 15,2002. The gaps in Philbin's emails comport with
the gap we understand he self-identified to OPR.

We then located backup tapes that included OLC emails from the periods that Yoo and Philbin
worked at the Department. We were able to retrieve approximately 20,000 Yoo emails from all
available sources, although we did not de-duplicate these emails and this number includes
multiple copies of the same emails. We also found approximately 600 emails (including
duplicates) that Philbin sent during the "gap" period in his Sent Items folder, but we did not
locate any emails that he received during the gap period in his Inbox. The retrieved emails (and
any attachments) were provided to the review team headed by John Cruden.

Policies and Procedures

All Department employees are subject to the Federal Records Act (44 U.S.C. §§ 3101 et seq.)
and are therefore responsible for creating and retaining accurate and complete records of their
activities. At the time Yoo and Philbin worked for OLC (2001-2003), the Assistant Attorney
General for Administration (AAG/A) had issued memoranda relevant to retention of record
emails. A memorandum issued by AAG/A Stephen Colgate on November 8, 2000 (attached at
Tab A) reminded all DOJ components of their obligation to preserve records. It noted that
employees should preserve their record emails either electronically or by printing and storing
them in paper files. Later, Janis Sposato, then Acting AAG/A, sent a memorandum regarding
recordkeeping dated July 30,2001 to all leadership office employees (attached at Tab B); this
memorandum was sent to OLC as one of the leadership offices (also referred to as "Senior
Management Offices" or "SMOs"). The memo reminded SMO employees of their recordkeeping
responsibilities, discussed the need to retain emails that qualified as federal records, and
paraphrased the statutory definition of records as follows: "federal records include all materials,
regardless of their physical form, which are made or received by an agency and are worthy of
preservation because they evidence the organization, functions, policies, decisions, procedures,
operations, or other activities of the Government or because of the informational value of data in
them." Neither these memoranda nor the Federal Records Act required DOJ employees to retain
emails that did not have record content.

We further understand that OLC had a policy of giving its new Attorney-Advisors a "Manual for
Attorney-Advisors" ("OLC Manual"), dated June 2000, that informed them that they "should
retain all notes, documents, and e-mails that are important to understanding a decision of the
Office." The policy with respect to retaining record emails at that time was for JMD's Systems

-2­
Technology Staff (STS, now known as the Operations Services Staff (OSS)) to set up
"auto archiving" on the computers of SMO employees, including those in OLC. This policy is
des~ribed in the July 30, 2001 Sposato memo (Tab B), as well as a memo from Stephen Colgate
dated August 18,2000 (attached at Tab C). As described in these memos, the autoarchiving
system was set up on leadership office employees' computers and would periodically save any e­
mail messages that remained in an employee's Inbox or Sent Items folder for 30 days. Therefore,
the memos advised employees to leave record emails in their Inbox and Sent Items folder for at
least 30 days so they could be autoarchived. Autoarchived emails were saved in .pst files on the
employee's H drive. If an employee's H drive (including Outlook folders and archive folders)
got too large, STS would move the archived emails to an archive server on the JMD Storage
Area Network (SAN). Employees could access and/or delete any auto archived emails on the H
drive and/or their folder on the archive server.

When an OLe employee left the Department, OLC submitted to JMD a "JMD/SMO JeON
Delete or Suspend Account Request Form" ("Departure Request Form") requesting that the
employee's JeON account be suspended (so it could no longer be accessed) and then closed, and
indicating what was to be done with the employee's files. Typically OLC requested that the
emails of any departing employee (including those emails in the Outlook mailbox, and any .pst
files on the employee's H drive and/or archive server) be copied to a folder on OLC's Gdrive to
be available for use by OLC. OLC had the ability to control who within its office could access
the emails on the G drive, and anyone with such access could amend or delete these emails. In
addition to the copy of the emails on OLC's G drive, it was JMD policy to make its own copies
of the departing employee's emails (again including those emails in the Outlook mailbox, and
any .pst files on the employee's H drive and/or archive server) into a "Departed Users" folder on
JMD's SAN. This folder was locked down and only accessible by the JMD JCON Account
Manager administrators and JMD Domain system administrators. Periodically, when storage
limits were reached, these folders were copied onto CDs and/or DVDs. JMD is retaining the
CDs/DVDs containing SMO emails indefinitely.l

JMD also creates backup tapes of the Department's electronic files, for which the policies and
procedures have not changed since the 2002-03 time frame. Backup tapes provide a "snapshot"
of the data on a server at the time of the backup. Backup tapes are created for disaster recovery;
they are not created, preserved or used for recordkeeping purposes. Email messages in the
leadership offices are backed up daily with a "full" backup, meaning that everything in the email
database is copied to the backup tape when the backup is run. The only difference between
Daily, WeeJdy and Monthly email backups is the length of time the backup tapes are kept before
they are overwritten. Daily email backups run every night Monday through Friday, and are kept

1 Since the 2002-03 time frame at issue here the Department has been engaged in

significant efforts to evaluate and modernize its recordkeeping programs, beginning with the
establishment of the Office of Records Management Policy (ORMP) and the development and
issuance of a Departmental Order that sets out policy, roles and responsibilities, and authorities
for recordkeeping within the Department.

-3­
for 2 weeks before being overwritten. Weekly email backups run every Saturday/Sunday, except
the last Saturday/Sunday of the month, and a,re kept for 5 weeks before being overwritten.
Monthly backups are made the last Saturday/Sunday of the month and are kept for approximately
1 year before being overwritten. That being said, as you will see below, at times we find that
backup tapes from more than a year ago are still available and have not been overwritten,
although these older tapes are difficult to restore and some may be corrupted.

Another tool that can provide information regarding Department emails is what we call the
"Gateway logs." Email messages going into and out of the Department of Justice 2 go through a
"gateway" which filters the emails for spam and viruses. This gateway also captures and logs the
senders, recipients, dates, times and occasionally the subject matter lines of email messages that
pass through it. The primary purpose of the gateway is to filter emails and guard against viruses.
The Gateway does not retain a copy of the email content itself, nor do these logs capture internal
DOJ emails. As a general matter the Gateway logs are only saved for two years, although we
found some log infonnation dating back to July 2002. Therefore, we do not have comprehensive
Gateway logs that cover the entire period Yoo and Philbin worked for OLC. We also cannot be
certain that there are no gaps in those Gateway logs that are available.

Finally, we detennined that during the 2002-03 time period employees in OLC did not have
classified email accounts, nor did they have access to such email accounts.

Searches for Y 00 Emails

We began by searching for Yoo emails that were retained on JMD's DVDs and OLC's G Drive.
An STS work log dated July 1,2001 indicates that Yoo had email auto archiving set up on his
computer. Therefore, to the extent Yoo was retaining his record emails electronically (as
opposed to printing them to paper), we would have expected to find those emails in his Outlook
Inbox or Sent Items folder, or in folders on the H drive or an archive server, at the time of his
departure. We located the Departure Request Fonn for Yoo sent from OLC to lMD on May 30,
2003, and the related STS work log. The STS work log indicates that on June 4, 2003, Yoo's
"FileslEmails saved to \\jmdO1 61\archives\smoarchives\0Ic\jyoo(OLC)." This was the archive
folder for departed users on the JMD SAN. Since that time, as was lMD's practice described
above, the files were moved from this folder to DVDs, which are still in the possession of JMD.
Further, a set ofYoo's emails was also placed on OLC's G drive at the time of his departure, and
remains there today. We reviewed the OLC G drive and the JMD DVDs containing Yoo's email
account. 3 We found approximately 500 emails, dated between July 19, 200 I, and June 4, 2003;

2 At times the bureaus, including the Federal Bureau ofInvestigation and the Bureau of
Prisons, have handled their emails separately and have not used the Gateway described here.

3 The set ofYoo's emails on the OLC G drive and the set on lMD's DVDs are
essentially the same; the only significant difference we found was approximately 50 emails that
appeared on the OLC G drive and not on the JMD DVDs. In reviewing these approximately 50

-4­
 one of these was in Yoo's Sent Items folder and the rest were in his Inbox.

In addition to searching the JMD DVDs and the OLe G drive, we also looked to see if we had
backup tapes from the relevant time period that might have OLe emails on them. While in the
normal course any such backup tapes would have since been overwritten and/or discarded, as
described above, we were able to locate 287 backup tapes that either: (1) indicated they were
from JMD and/or SMO servers from 2002 and 2003 or (2) were from a discontinued tape library.
We could not readily determine the dates or source servers of the tapes in the discontinued library
because the automated index is no longer available; nevertheless we mounted and searched these
tapes as part of our review. Of the 287 outdated backup tapes, we found that 39 were unreadable.
Of the 248 that were readable, we found that II contained Yoo emails. When we combine all
sources of emails from Yoo's account (OLe G drive, DVDs, backup tapes) there are a total of
approximately 20,000 emails, but these are not de-duplicated and this number includes multiple
copies of many emails. These emails (and any attachments) were provided to the review team
headed by John emden.

We tried to determine what happened in 2005 when OPR requested Yoo's emails. We found
emails from OLe to JMD in early 2005 discussing the need for OPR to review OLe emails and
indicating that OPR was given access to a copy ofYoo's emails that had been stored on the JMD
SAN. We also understand that, in response to a subsequent request from OLC's then-Executive
Officer, JMD technical staff attempted to recover one or more backup tapes for OPR's search but
was unable to restore the data. We were unable to determine the scope ofthat 2005 restoration
effort or why it did not locate the backup information that we have now located. We cannot say
whether a more exhaustive effort at that time to restore backup tapes would have found
additional Yoo (or Philbin) emails, because we cannot determine what tapes were available then
as compared to what are available now. Other tapes may have existed, and it is possible that
some of the backup tapes that are now unreadable could have been read in 2004-05. As for
sources other than backup tapes, the Yoo emails we found on JMD's DVDs and OLC's G drive
were comprised of the material archived at the time he left the Department in May 2003. As
such, we believe a search of those sources in 2004 or 2005 would have found the same material,
i. e. that search would have found no more than what we found in our current search.

We also reviewed the Gateway logs of the traffic between Yoo and non-DOJ email users. These
logs indicate that between July 2002 and June 2003 4 Yoo sent 3,553 emails from his Justice
email address to outside email addresses, and received 4,810 emails on his Justice account from
outside email addresses. Whether these emails qualified as records cannot be determined by

emails we determined that they were not to or from Y00 (they were all from another OLe staff
member) and therefore should not have been associated with Yoo's email folder. This indicates
that they were copied to Yoo's folder on OLe's G drive at some point after Yoo left, and should
not be considered part of his emails.

4 As discussed above, we only have Gateway logs going back to July 2002.

-5­
reviewing the logs since the logs do not reveal the content of the emails. To the extent the
Department still has electronic copies of any of these emails, they are included in the
approximately 20,000 emails founc.l on the OLC G drive, DVDs, or backup tapes. We provided
the Gateway log information to John Cmden's review team.

In addition, we looked for evidence of whether Y00 used any personal (non-DOJ) email
accounts. Upon review of the JMD DVDs and the Gateway logs, we found email addresses for
Yoo from his university account and from a private internet service provider. We also looked at
the Gateway logs for the period July 2002 through June 2003 to determine the extent ofYoo's
use of his personal email addresses to send things to and from the Department and found that he
was typically forwarding messages to himself at his DOJ account or, at least, he cc'ed himself.
We cannot tell the content of these emails from the Gateway logs. The Gateway log information
and any electronic copies of emails we found that Y00 sent between his personal accounts and
his DOJ account were provided to the review team. We note that if Y00 used his personal email
addresses for work activities and did not send or copy them to a DOJ email address we would not
have found them in these searches.

We note, as stated above, that only record emails need to be retained, and any emails printed to
paper did not need to be retained electronically. Therefore, we reviewed Yoo's paper files, which
are now located at OLC and at OPR. OLC has six boxes ofYoo's hard copy files. Those boxes
contain 10 emails that have "John Yoo" on the top line, suggesting that they were printed by Yoo
from his email account. OPR has one box of documents labeled "Yoo" in its custody; the box
appears to include documents it received from OLC as well as documents it printed from its
search of electronic files. The box contains no emails that indicate they were printed by Yoo and
five emails that could possibly have been printed by Yoo (i.e., there was no name at the top
indicating who printed them).

Searches for Philbin Emails

While we looked for emails from throughout Yoo's tenure, for Philbin we focused on the July­
August 2002 period in which OPR found a gap in his emails. We found Philbin emails on JMD
DVDs, OLC's G drive,S 14 backup tapes, and a JMD server. 6 We found no emails for Philbin's

5 It appears from the STS work log that when Philbin moved from OLC to the Deputy
Attorney General's office on May 30,2003, his OLC emails moved with him to ODAG, so we
do not have records of them being stored by JMD and/or OLC at that time. Philbin, unlike Yoo,
was still working at the Department (in ODAG) at the time of the OPR investigation in 2004-05,
and he discovered, and we understand that he reported, the gap in his emails from July-August
2002 when searching for his old emails in response to the investigation. We located the SIS
work log for Philbin's departure from DOJ dated January 18,2006. According to the work log
ODAG requested that STS copy Philbin's ..email pst and H Drive files to a disk and send to [an
ODAG employee], Room 4110 ... 2 copies requested." The work log also states that on March
16,2006, Philbin's account was closed and his files and emails saved to JMD's Storage Area

-6­
Inbox from July 2,2002 through August 5, 2002 (except for one from the evening of August 5,
2002). As for his sent emails, the DVDs and G drive contained no emails from July 16, 2002
through August 15,2002, but the backup tapes contained approximately 600 total emails that he
sent during that period, located in his Sent Items and Deleted Items folders. These sent emails
have not been de-duplicated. Especially given the passage of time, we were not able to
determine the reasons for the gaps. As discussed above, the policy at that time was for JMD/STS
to set up email autoarchiving on the computers of OLe employees, but we did not find any work
log or ticket specifically indicating that autoarchiving was set up on Philbin's computer when he
worked at OLe. All the Philbin emails (and any attachements) we found, regardless oftime
period, were provided to the review team.

The gateway logs show that Philbin sent 54 emails from his DOJ email account to non-DOJ
email addresses in July and August 2002 (including 12 emails during the "sent gap" of July 16­
August 15), and he received 2 I 6 emails from outside the Department in July and August 2002
(including 12 emails during the "Inbox gap" of July 2-August 5). We provided this gateway
information to the review team.

Please let us know if you require further information or have any questions regarding this matter.

Network. Later these emails were moved to JMD DVDs. We understand that at some point
Philbin's emails from his tenure at OLe were also copied to OLe's G drive. The universe of
Philbin emails on the OLe G drive and the JMD DVDs were essentially the same; there were
two additional<emails in Philbin's Inbox on the G drive and one additional email on the JMD
DVDs that was in Philbin's "Drafts" folder.

6 While emails stored on JMD's archive servers were typically deleted after they were
copied to DVDs, we were able to find two .pst files containing Philbin's em ails on a JMD server.

-7­
 u. S. Department of Justice

NOV - 8 2000 Washington. D.C. ]0530

MEMORANDUM FOR HEADS OF DEPARTMENT COMPONENTS

FROM: Stephen R. Colgate

Assistant Attorney General

for Administration

SUBJECT: Recordkeeping Obligations

In a series of memoranda over the last several years, I have

reminded you of your obligation to ensure that records created or
received by you and your employees are preserved. Records that
must be retained include all materials, regardless of their
physical form, which are made or received by an agency and are
. worthy of preservation because they evidence the organization,
functions, policies, decisions, procedures, operations, or other
activities of the government or because of the informational
value of data in them. I have also advised that records could be
kept in .various mediums, such as paper, film, disk or in an
electronic recordkeeping system. Regardless of the medium in
which the records are retained t the recordkeeping system should
allow for the easy and timely retrieval of related records.

In ensuring that your component appropriately maintains its

records, it .is especially important to verify that records
created electronically, such as electronic mail, are retained in
a recordkeeping system. Most components currently print such
documents and include them with paper files. JMD has recently
set up an electronic recordkeeping system for the email records
in the leadership offices. Through the use of the Microsoft
Outlook e-mail archiving system t these e-mail records are being

retained electronically, and the system allows for their search

and retrieval. You may want to consider whether this or a

similar e-mail archiving system will meet your needs and satisfy

your recordkeeping obligations.

It is imperative that you and your employees retain all records

in an organized, searchable manner. Your Records Management
Officer/Records Management Liaison is familiar with the
maintenance and retention requirements for your records and can
assist in determining the appropriate ways to maintain your
records including those created electronically.
t

If you have any questions, please contact Linda Burek, the Deputy
Assistant Attorney General for Information Resources Management,
on 4-0507.
..

~
.
"'" . U.S. Department of Justice
. ,...... . .
. ­
"

W:l1hlngton. D.C. 2(5)0

JUl 30 2001
MEMORANDUM OFFICES

FROM:

SUBJECT: Electronic Mail Archiving

In the continuing effort to provide e-mail archiving to the

. Senior Management Offices,. the Systems Technology Staff (STS)
will be checking the settings on your computer's· electronic mail
archiving system. We are utilizing chis archiving system in
order to meet our obligations to ~aintain electronic records.
We have instructed the STS employees that the archiving system
can only beconfigu~ed in a specific manner, and they are not
p~rmitted to accommodate irid.ividual requests with respect to
these settings. It is also important that you do not modify the
settings of the archiving system in any way. You may, however.
create folders within your Inbox and Sene Items, but you muse
contact the JeON Help Desk to have the Archive flag set for the
folder. If this q.ag is not set, the mail you have moved to the
new folder will no't be archived.

The electronic mail archiving system will periodically save any

e-mail messages that have remained in either your Inbox or Sent
Items for 30 days. It will also automatically save calendar
entries that are 6 months old. Employees in the Offices of the
Attorney General, Deputy Attorney General, and Associate Attorney
General should not delete any e-mails that are business-related
so they can be properly archived after 30 days. For these senior
leadership offices, we counsel employees to consider all
business-related records- to be Federal Records worthy of
retention. Employees in other offices should make determinations
as to whether an e-mail qualifies as a federal record 1 or needs

~.Federal records include all materials, regardless of their

physical form, which are made or received by an agency and are
worchy of preservation because they evidence the organization,
functions, policies, d~cisiong, procedures, operations, or other
activities of the Government ol;:" because of the informat:ional
value of data in them. .
All Employees in the Leadership Offices Page 2
Subject: Electronic Mail Archiving
to be retained Eor more than )0 days for business reasons, and
shouid'delete all o~her messages. All employees should delete
messages such as JeON broadcasts and personal e-mails that do not
involve the business of the office.

STS will monitor the file size of the auto-archive file. When
the auto-archive file reaches a predefined limit, STS will create
a new auto-archive file and modify your desktop to reflect this
change. .

If you have any questions regarding this system, please contact

Linda Burek, Deputy Assistant Attorney General for Information
Resources Management, on (202) 514-0507:

please ensure that this memorandum is distributed to all members

of your staff.
 u.s. Department of Justice

._-- - - ­ -----'------------.~--

lIiJshinglOtI, D.c ]0530

AUG 18 2000

MEMORANDUM FOR ALL EMPLOYEES IN THE LEADERSHIP OFFICES

FROM: Stephen R. Colgate ~

Assistant Attorney General

for Administration .

SUBJECT: Electronic Mail Archiving

In conjunction with the rollout of the Windows NT system in the

leadership offices, the Systems Technology Staff will be checking

and modifying the settings on your computer's electronic mail

archiving system. We are utilizing this archiving system in

order to meet our obligations to maintain electronic records. We

have instructed the STS employees to set up the archiving system

in a particular way, and they will not be permitted to

accommodate individual requests with respect to these settings.

It is also important that you do not modify the settings of the

archiving system in any way.

Once the electronic mail archiving system is set up on your

computer, it will begin periodically saving any e-mail messages

that have remained in your Inbox or Sent Box for 30 days.

Therefore, do not delete any e-mails that are business-related so

they can be properly archived after 30 days. You should,

however, delete messages such as JCON broadcasts and personal

e-mails that do not ,involve the business of the office.

Your computer will also be set up so that if you do not use it

for a certain number of minutes, it will log you out and you will
need to log in again. This is being done for security reasons.
We are looking into simpler solutions that will satisfy our
security concern~, but we appreciate your patience in the
interim.

If you have any questions regarding this system please contact

Linda Burek, Deputy Assistant Attorney General for Information
Resources Management, on 5140507.