How do leak investigations work?

On Friday, Attorney General Jeff Sessions announced efforts to a crack down on unauthorized disclosures to the news media, citing an uptick in “leaks” investigations and a plan to revisit policies on obtaining journalists’ records.  President Trump, who has routinely castigated disclosures to the news media, praised the threatened crackdown in a tweet:

After many years of LEAKS going on in Washington, it is great to see the A.G. taking action! For National Security, the tougher the better!

— Donald J. Trump (@realDonaldTrump) August 5, 2017

This isn’t the first time Trump has fixated on leaks. Twenty-four days into his tenure, national security adviser Lt. Gen. Michael T. Flynn was forced to resign after the Washington Post reported that he and the Russian ambassador discussed U.S. sanctions against Russia for its alleged interference in the 2016 presidential election. The Post story relied on anonymous current and former officials at senior levels of multiple agencies—truth-seekers or traitors, depending on the narrative. The following day, President Donald Trump tweeted that the leaks were the “real story here.” Most headlines disagreed, but the next day, Trump tweeted again:

Information is being illegally given to the failing @nytimes & @washingtonpost by the intelligence community (NSA and FBI?).Just like Russia

— Donald J. Trump (@realDonaldTrump) February 15, 2017

Trump isn’t the only one focused on leaks. In February, the same day the president posted his tweets about the Flynn leak, two House Republicans asked the Justice Department’s Inspector General to investigate the leak, signaling that they believed the leak could have come from within Justice. Since then, there have been letters, questions, and even a directive from the White House and Congress asking intelligence agencies to investigate leaks.

These demands will doubtless include the leaks underlying the most recent revelations about Trump’s disclosure to Russian officials. It is more important now than ever to understand what these demands mean—in other words, how leak investigations work.

Using the Flynn case as an example, below is a brief overview of two kinds of leak investigations. These investigations are usually undertaken by the Justice Department, but the Department’s Inspector General may lead the charge where the leak potentially comes from within the Department itself. The first months of Trump’s administration have raised several questions: Is anyone investigating leaks, like the Flynn leak? If so, who? What can the inner workings of a leak investigation reveal about disseminating important information to the public in the era of presidential threats of leak crackdowns? And what does it mean for inspectors general—who are independent voices within agencies—to take on a larger role in leak investigations?

The Typical Leak Investigation: The Justice Department

Trump said he directed the Justice Department to look into the Flynn leaks, but that’s not how it usually works. The typical leak investigation starts in an executive branch agency outside the Justice Department, most commonly the Central Intelligence Agency or National Security Agency.

Not all disclosures to the news media are unlawful, so the general counsel of the agency begins with a “preliminary inquiry” into whether there is reasonable basis to suspect a federal crime. Disclosures are generally only unlawful if they disclose “national defense” or “classified” information, although some laws criminalize more specific actions that might be taken in connection to such disclosures, like stealing government records, lying to an investigator, or disclosing a spy’s identity. An agency’s preliminary inquiry, which focuses on whether the information is classified or related to national defense, is typically limited to reviewing agency records and publicly available information and interviewing people other than the accused.

If the inquiry reveals a potential illegal disclosure, the agency reports it to the head of the Justice Department—the Attorney General—usually via a written “crimes report,” but sometimes orally. Three authorities—a law (28 U.S.C. § 535), an executive order (Executive Order 12333, § 1.6(b)), and a 1995 interagency Memorandum Of Understanding—require that senior officials report potential violations by employees to the Attorney General.

The Justice Department receives, on average, nearly 40 crime reports each year from executive branch agencies regarding unlawful disclosures of classified information.

After receiving the crimes report, the Justice Department’s National Security Division collaborates with the referring agency to assess whether to open an investigation. Only a small number of referrals are investigated. For example, from 2005-09 (the most recent available data), there were 23-55 referrals per year, but only 2­ to 9 per year were investigated, and only about half of those identified a suspect.

Because the Justice Department cannot pursue an investigation in response to every referral, it asks agencies to provide in the crimes report specific information that can help the Department prioritize the leaks. To guide the agencies, the Justice Department has issued a questionnaire for the agencies to answer and attach to the crimes reports when referring a disclosure made to the news media. These have come to be known as “the 11 questions.” Although the questions can vary slightly on a case-by-case basis, the goal of the questions is to get the referring agency to identify the leaked information, explain whether the leaked information is accurate, assess the harm of the leak, and evaluate how far the leaked information spread and whether the information could have been disclosed by lawful means. Even though these questions focus on disclosures to the news media, none of the questions ask whether an investigation would require surveilling or otherwise targeting a journalist. The questions instead are geared toward allowing the Department to estimate the difficulty of finding and prosecuting the leaker.

As suggested by the so-called 11 questions, an open Justice Department investigation indicates that there is some truth to the leaked information. An open investigation also indicates that the leaked information probably wasn’t known to many people within the government—if it were, the leaker would be harder to track down.

Once opened, the investigation is typically conducted by FBI agents under the supervision of lawyers in the National Security Division and local prosecutors. Because the FBI derives its existence and mandates from the Attorney General’s authority to create investigative agents for the enforcement of federal laws, the Attorney General may oversee and stop the leak investigation, as with any other FBI investigation.

When it comes to disclosures to the news media, the Justice Department has a “longstanding practice” of focusing the investigation on leakers rather than on the recipient journalists, and Justice Department guidelines place special safeguards, such as the Attorney General’s required sign-off, on legal demands to the press related to “newsgathering activities.” But these guidelines aren’t legally enforceable. They also don’t cover all investigative tools: for example, the FBI needs Attorney General sign-off to issue subpoenas but, according to a press account, does not require sign-off to issue controversial National Security Letters, which can be used to obtain journalists’ records from internet service providers and telephone companies during national security investigations.

A leak investigation might never lead to a prosecution. A successful criminal prosecution requires the government to identify the leaker and prove the case beyond a reasonable doubt, and there is a risk that during the prosecution, sensitive information could be confirmed or the defense could use the risk of disclosure at trial to force a plea or dismissal, a practice known as graymail. If there simply isn’t enough evidence, the FBI and the National Security Division can agree to close the investigation and will inform the General Counsel of the referring agency. The referring agency may then take noncriminal administrative action against the suspect, such as reprimands, revocation of security clearance, or termination of employment.

The Inspector General

The Office of the Inspector General is the watchdog of the Justice Department: it has independent oversight of the department’s programs and personnel, and it can review activities by divisions such as the FBI.

The Inspector General sometimes gets involved in investigating leaks that come from within the Justice Department. For example, in January the Inspector General announced that it will review how the Justice Department and FBI handled the Clinton email investigation, and part of that review includes looking into leaks. In 2016, the Inspector General investigated a self-reported leak by an FBI agent, and in 2013, the Inspector General investigated a U.S. Attorney’s leak to Fox News. But Inspector General-led leak investigations are relatively rare.

That could change. In December 2016, Congress enacted a new law, the Inspector General Empowerment Act of 2016 (amending the Inspector General Act of 1978, 5 U.S.C. App. § 6), which granted greater power to the Inspector General by ensuring the office full and prompt access to agency records. This law was enacted in response to years of conflict between agencies and their Inspectors General. It empowered the Inspector General to ramp up investigations by evaluating Justice Department and FBI documents, including those that might trace the Flynn leak.

But the Inspector General still has limitations. For example, the new law includes an exception that permits the Attorney General and the Secretaries of Defense, the Treasury, Homeland Security, or Energy to prohibit Inspectors General from accessing “certain sensitive or national security information.” The Inspector General also cannot prosecute suspects. If the Inspector General finds evidence of illegality, the Inspector General must “report expeditiously” to the Attorney General, who then decides whether to prosecute. If the Inspector General doesn’t find evidence of a crime, the investigation may instead be made public in a report.

Comparing the Two

The typical Justice Department leak investigation is more aggressive and robust than an Inspector General investigation. The Inspector General cannot subpoena testimony and cannot prosecute, and the Attorney General always has the final say on whether to prosecute. The Justice Department process also loops in the referring agency, which can provide valuable expertise on how to trace the leak. The Inspector General does, however, appear to have one tool the FBI doesn’t: it can open an investigation without consulting the Justice Department’s 11 questions.

Among other things, this means the Inspector General may investigate leaks of information widely disseminated within the government. The Justice Department prefers investigations where it will be easy to pinpoint the leaker.

Of course, if the leak came from within the Justice Department or FBI, there could be a conflict of interest in the typical Justice Department-led model. Historically, the appearance of a conflict of interest in the Justice Department is solved by recusal. For example, in 2013 then-Attorney General Eric Holder announced that he recused himself from a Justice Department leak investigation that involved journalists at the Associated Press; the deputy attorney general supervised the investigation instead.

The 11 Questions and the Mike Flynn Leaks

Despite badgering from the White House and Congress, the Flynn leak doesn’t pass the high threshold for opening an investigation under the Justice Department’s 11 questions.

First, there is the issue of uncertain unlawfulness. The legality of the Flynn leak is a tricky question, complicated by the fact that the “leak” was actually a stream of leaks building on each other, beginning in a January 12 op-ed and culminating in the February 13 revelation that Acting Attorney General Sally Yates had warned the White House that Flynn had misled the Vice President. The Flynn leak might violate certain provisions of the Espionage Act, the authority under which leakers are most commonly prosecuted and which prohibits disclosing specific categories of classified and national defense information. But the leak could alternatively be characterized as disclosure of the simple but important fact that a government official lied to the Vice President. That might make headlines, frustrate Trump, and arguably implicate other laws, but because it wouldn’t involve national security, it probably wouldn’t be an Espionage Act violation.

Even if the Flynn leak were unlawful, the Justice Department saves its resources for the most damaging leaks, concerning sensitive information known to relatively few people, and by these standards the Flynn leak is impractical to pursue. According to the New York Times, White House staffers widely disseminated related information—including intercepted communications of Russian officials discussing contacts with Trump associates—in the last days of the Obama administration.

This widespread dissemination came up during the House Intelligence Committee hearing on Russian interference with the presidential election. Without naming Flynn, a representative asked how many people in government would have the ability to “unmask” Flynn’s name. FBI Director James Comey identified five intelligence agencies whose leaders have that power, and the National Security Agency’s Admiral Michael Rogers testified that there are 20 such people in his agency alone.

That said, the Attorney General could make an exception, other agencies could investigate on their own, or—the most likely course—the Inspector General could get involved. It isn’t clear what triggers an Inspector General investigation, but its most recent leak investigation was opened in response to requests from Congressional committees and the public. And because it does not rely on the Justice Department’s 11 questions, the Inspector General may presumably assess a leak even if the leak did not violate the Espionage Act or was not particularly damaging.

The Inspector General has continued to be politically popular during this time of partisan divide because it is considered “our eyes and ears within the executive branch,” as Sen. Charles Grassley (R-IA) has suggested. Its mission is to increase government accountability by allowing the public to peer into the inner workings of the government and identify official misconduct. It would be ironic if that office now spearheads efforts to root out the Flynn leakers—whose leaks did exactly that.

Selina MacLaren (@SelinaMacLaren) is the Stanton Foundation Free Press/National Security Legal Fellow at The Reporters Committee for Freedom of the Press, where she works on issues related to national security, privacy, and free expression. MacLaren was previously a litigation associate at a D.C. law firm. MacLaren is a graduate of the University of Chicago Law School and the University of California at Berkeley.