Nuts and Bolts of the IG Report on Comey: Correcting Misconceptions

On the morning of Aug. 29, I finished up my lecture notes for my first day teaching a class called “Law of Secrecy.” I would touch on classification, leaking, prepublication review, clearances, and all the other amusing and not-so-amusing things that happen in this realm. Some of the material was dry but peppered throughout would be stories “ripped from the headlines” to show how these arcane issues played out in the real world. I was proud of the lecture. Then I went on Twitter.

So I winged my first lecture at The George Washington University Law School. Here’s why.

The Department of Justice (DOJ) Inspector General’s report is as close to a definitive history as one could hope for in the saga of former FBI Director James Comey’s handling of memos he prepared documenting his private conversations with President Donald Trump. The IG report describes the meetings he had with President Trump, the memos he wrote, what he did with them, and everything that came after.

The purpose of this article is to explain the practical ramifications of the actions Comey took and offer an educated guess as to the likely reason for DOJ’s decision not to attempt a prosecution. As for the rest of the report, at 61 pages (plus 18 pages of exhibits), it is an admittedly long read, but I highly advise anyone interested in this field to read it. It is written in plain English and reads faster than expected.

And yet, the report appears almost designed to be misunderstood and mischaracterized.

For our purposes, the primary point of the report is basically this: Comey violated his non-disclosure agreement (NDA) when he gave copies of four memos to his attorneys, but when one personal attorney, Daniel Richman, provided portions of one memo — called “Memo 4” — to New York Times reporter Michael Schmidt, none of the information provided was classified. The secondary and related point is that six words in another memo Comey gave his attorneys — called “Memo 2” — were classified at the Confidential level, but Comey did not label them as such and the classification happened at the FBI only after the fact. Taking these statements together, I will attempt to explain what exactly happened in the IG and DOJ’s resolution of the case, why it happened, and why this story presents a perfect case study for a class called Law of Secrecy.

Comey Violated His NDA

To discuss these issues, it is first important to explain the purpose of NDAs and prepublication review in the national security realm. Put simply, someone who writes a piece of information — with the intent of disseminating it outside the agency — that he does not believe to be classified may not always be in a position to know for a fact whether or not it is classified. He may have a good-faith belief that he is simply relating an unclassified fact, but he may not realize that by writing the information, he is inadvertently revealing classified information about another government project he knows nothing about.

This is obviously not always — or even often — the case, but there is no practical way for any particular author to know whether it is or is not the case in his particular situation. Because of this broader context, the Supreme Court has held that the government can impose an NDA that requires anyone with a security clearance to first obtain the agency’s permission before publishing anything related to that individual’s work. This process is called prepublication review, and it is the reason that someone can be successfully sued in a civil action by the government for publishing completely unclassified information, simply because they did not use the process first to ensure that it was unclassified.

What is not often understood about prepublication review, however, is that the definition of “publish” is significantly broader than it appears at first blush. In this context, “publish” means “provide information to someone who has not been approved by the government to receive the information.” This includes your personal attorneys. Private attorneys who represent intelligence personnel often run into this problem — their client is not allowed to tell them the information they need to know to represent him until both the client and the attorney jump through various hoops and obtain official government approval, which agencies are extremely reluctant to provide.

So is it clear then that Comey violated his NDA when he gave four memos to his attorneys? There’s an additional wrinkle. Richman had been a “Special Government Employee” until February 2017, and as such possessed a Top Secret clearance with access to Sensitive Compartmented Information, colloquially known as “TS/SCI.” Without getting into arcane details about how SCI is not technically a “clearance,” it is safe to overgeneralize the facts in this discussion: TS/SCI is one of the highest clearances one can have, and it is much higher than the level of any allegedly classified information contained in the memos Richman received. Similarly, both of Comey’s other attorneys — Patrick Fitzgerald and David Kelley — had been senior DOJ attorneys with equally high clearances before they left government service.

However, as best as I can determine, neither Fitzgerald nor Kelley possessed a security clearance in May 2017, when Comey gave them the memos, so it does not matter that they used to have clearances. Richman’s clearance, however, was not deactivated until July 2017, even though he resigned in February. This too makes no difference, though, because in order to be approved to see any specific piece of classified information, a person must both have the appropriate level of security clearance and the “need to know” that particular piece of information. “Need to know” is roughly described as the need to know that information to perform the duties for which you were given the clearance. It is why people on the CIA Indonesia Desk cannot go read classified briefings on Poland; they do not have the requisite “need to know.”

According to the IG’s report, Richman’s job “involved assisting in matters related to ‘challenges to law enforcement and intelligence collection from increasing end-to-end encryption and automatization practices across various tech spaces.’” It did not involve assisting in matters related to the investigation of government officials or the obstruction thereof. He simply lacked the requisite “need to know” what was in the memos.

All that said, Comey was not an ordinary intelligence employee. He was the FBI Director. He had the authority to bestow appropriate clearances and “need to know” on his attorneys if he so chose — until, that is, he was no longer FBI director. Unfortunately, Comey hired all three attorneys after he was fired, so he no longer had that authority. Had he hired them while he was still director, this story would have a much different end.

So, in the final analysis, Comey transmitted four memos he wrote as FBI Director to three attorneys who were not authorized to receive them. That was a violation of his NDA, and it does not even matter whether they actually included classified information or not. That was not his call to make.

Why DOJ Declined to Prosecute

The chief question swirling around this matter, then, is, if Comey violated his NDA, and if one of the memos he gave to his attorneys contained classified information, why then did DOJ decline to attempt to prosecute him? DOJ has been extraordinarily aggressive about prosecuting alleged leakers of classified information in the last several years, so why not here?

There are two main parts to the answer. The first part is the easiest: violating an NDA is not by itself a criminal act. The most that the government can do to someone who violates an NDA but does not publish classified information is sue him for breach of contract. Even then, the government can only recover any compensation (such as royalties) the person received for publishing the information in question. In Comey’s case, he freely gave the information away, so that is not even a viable option. And in any case, it would not be a criminal matter.

The second part of the reason Comey wasn’t prosecuted, however, is significantly more difficult to unpack. It is true that Memo 2 contained six words which are classified Confidential, and that Comey gave that memo to three attorneys unauthorized to have it. In a vacuum, that would suggest that he could be held criminally liable. Upon closer inspection, though, a different picture emerges.

At this point, it is important to explain why the three most apparent reasons DOJ might have had for opting not to prosecute are completely irrelevant. It does not matter that the information was classified at the lowest Confidential level. It does not matter that only six words were classified. And it does not matter that there was “no evidence that Comey or his attorneys released any of the classified information contained in any of the memos to members of the media.”

All classified information is created equal for the purposes of criminal prosecution. While it is true that prosecution under the Espionage Act requires that the information be “national defense information,” which this information probably was not, that is not the only avenue available to DOJ here. More likely, DOJ would have prosecuted Comey under 18 U.S.C. § 1924, the misdemeanor charge about mishandling classified information (the same criminal offense to which  former CIA Director David Petraeus pleaded guilty). For the purposes of that statute, the least damaging Confidential information and the most damaging TS/SCI information are identical under the law. By the same token, it does not matter if one word is classified or an entire report.

Similarly, it does not matter to whom the person gives the classified information. A Times reporter and a private lawyer are equally unauthorized to receive the information. What’s more, the statute itself does not even require that the information be given to anyone. As one CIA contractor learned the hard way, merely taking classified information home and not sharing it is still a violation of the statute.

The problem that DOJ prosecutors faced was more fundamental: was the information in Memo 2 classified when Comey gave it to his attorneys? It was undeniably not marked as classified, nor does Comey agree that it was classified. It was designated as classified information only after the fact. In most cases, however, that would be sufficient reason to initiate a prosecution, because the FBI officially designated the information as classified, meaning that, absent some intervening reason, it was actually classified even at the time the alleged leaker failed to treat it as such.

As noted above, though, Comey was not an ordinary intelligence employee, and that is where the greatest complication arises. In order to be properly classified under the law, a piece of information has to be designated as such by an “original classification authority” for one of various reasons which are not relevant here. Comey was an original classification authority, meaning that he had the authority to designate something as classified or unclassified on his own initiative. In other words, when he wrote Memo 2 and decided that it contained no classified information, that was an official decision that he had the specific authority to make.

Moreover, Comey was no ordinary original classification authority; he was the FBI Director. As such, his authority flowed from the President through the Attorney General, and more importantly, the authority of the officials who retroactively classified the information flowed through him (or, more accurately, through the FBI Director). This means that, even if one of those officials had wanted to designate this information as classified at the time Comey wrote it, Comey could have overridden the decision, meaning that any decision made by such a subordinate would essentially be futile.

In other words, when Comey wrote Memo 2 and did not classify it, it was not classified. When he gave it to his attorneys, it was not classified. When it was later classified by other FBI officials, that designation did not apply retroactively because it went against the official decision of an original classification authority who was also their senior in the hierarchy. Therefore, Comey could not be charged with mishandling classified information because at the time he allegedly “mishandled” it, it was not classified information. He could not be charged with mishandling unclassified information, because that is not a crime. (I am admittedly discounting the occasionally mentioned argument that 18 U.S.C. § 641, which makes it illegal to sell or convey any record or “thing of value of the United States,” applies to the unauthorized release of agency information, since I do not share that interpretation of the statute and believe it suffers from severe constitutional infirmities, but that is a topic for another day.)

In short, the Comey IG report is a perfect case study for a class like Law of Secrecy, because it touches on almost every issue the class covers, and exemplifies the exquisitely intricate ways that all of these topics intertwine with each other. And so, I improvised my first lecture because Inspector General Michael Horowitz could not wait until after the Labor Day holiday to release his findings. Since I did so, it seems only fair that I share the analysis with the readers of Just Security, in hopes that it will help minimize misunderstandings about what the Inspector General actually meant and why DOJ will not prosecute Comey for any of these actions.

IMAGE: Former FBI Director James Comey speaks to members of the media at the Rayburn House Office Building after testifying to the House Judiciary and Oversight and Government Reform committees on Capitol Hill Dec. 07, 2018 in Washington, DC.  (Photo by Alex Wong/Getty Images)


About the Author(s)

Kel McClanahan

Executive Director of National Security Counselors, a Washington-area non-profit public interest law firm which specializes in national security law and information and privacy law, through which he often represents Intelligence Community employees and contractors. Follow him on Twitter (@NatlSecCnslrs).