The highly classified documents found at Trump's residence Mar-a-Lago

This weblog is not only about signals intelligence, communications security and top level telecommunications equipment, but also about the US Classification System, which is equally fascinating in all its complexities.

Recently, an unprecedented photo from the FBI provided a unique look at highly classified documents which former US president Trump stole from the White House and stored at his private residence Mar-a-Lago in Florida.

Here I'll provide a detailed explanation of these documents, as well as where they apparantly came from.





Moving to Mar-a-Lago

On January 20, 2021, former president Donald J. Trump left the White House and moved his belongings to his residence Mar-a-Lago in Florida. The National Archives and Records Administration (NARA) subsequently learned of approximately two dozen boxes of presidential records that had not been returned to it as required under the Presidential Records Act (PRA).

Late 2021, officials at the archives warned Trump's team that there could be a referral to the Justice Department or an alert to Congress if he continued to refuse to comply with the PRA. Apparently, Trump ultimately went through several boxes at Mar-a-Lago himself and late December, his lawyers informed the NARA that they had found 12 boxes of documents and that they were ready for retrieval.




15 boxes retrieved

On January 18, 2022, the NARA finally retrieved 15 boxes of records from Mar-a-Lago, containing presidential records and other sensitive material, along with various news clippings and other miscellanea. In its initial review of the materials within those boxes, NARA identified classified documents marked up to the level of Top Secret, including Sensitive Compartmented Information (SCI) and Special Access Programs (SAP).

On February 9, NARA told the Department of Justice (DOJ) that the 15 boxes contained highly classified records that were "unfoldered, intermixed with other records and otherwise unproperly identified." President Biden granted the FBI with access to the boxes for examination and by May, the bureau had identified classified documents in 14 of the 15 boxes. In total, there were 184 classified documents, 67 of which were marked Confidential, 92 Secret and 25 Top Secret.


Criminal investigation

Former president Trump then attempted to delay the DOJ's review of the materials by asserting executive privilege over the documents. After the Assistant Attorney General for the Office of Legal Counsel rejected this claim, the FBI launched a criminal investigation to determine:

- How these classified documents were removed from the White House;
- Whether Mar-a-Lago was an authorized storage location for those documents;
- Whether additional classified documents had been removed from the White House;
- Which individuals were involved in the removal and storage of the documents at Mar-a-Lago.

A grand jury was installed and the FBI began interviewing several of Trump's personal aides as well as three former White House lawyers who had been among Trump's representatives to the archives.


Classification markings

On May 11, former president Donald J. Trump was served with a grand jury subpoena which ordered him to hand over any and all documents bearing at least the following classification markings:




This list was likely composed of all the classification markings that the FBI found on the documents in the 15 boxes that had already been retrieved by the NARA and therefore could be expected to be on the documents in the remaining boxes a Mar-a-Lago as well.

These classification markings contain a lot of lesser-known abbreviations, which are explained in my earlier overview of the US Classification System. They are, in order of appearance:

SI = Special Intelligence (intelligence from intercepted communications)
G = GAMMA (sensitive communication intercepts)
NOFORN = No Foreign Nationals
ORCON = Originator Controlled
HCS = Humint Control System (intelligence from human sources)
HCS-O = HCS Operations (HUMINT operations and methods)
HCS-P = HCS Product (HUMINT intelligence reports)
TK = TALENT-KEYHOLE (intelligence from satellite collection)
TS = Top Secret (release would cause exceptionally grave damage)
SAP = Special Access Program (non-intelligence equivalent of SCI)
NF = NOFORN (see above)
OC = ORCON (see above)
FRD = Formerly Restricted Data (about nuclear weapons)
NATO = Releasable to NATO partners
S = Secret (release would cause serious damage)
C = Confidential (release would cause damage to national security)

Nuclear weapons information?

Likely it was the marking FRD on this list that later led to press reports saying that among the things that Trump was still hiding were documents about nuclear weapons. Given that the FRD marking is only listed once, there may have been only very few if not just one single document with nuclear weapons information, with many more about signals intelligence (SI) and human intelligence (HCS).

In an affidavit from August 5, the FBI listed the statutory authorities upon which it based its application for a search warrant:

- 18 USC 793(e), the Espionage Act
- 18 USC 1519, obstruction
- 18 USC 2071, willfully removing information
- 44 USC 2201, the Presidential Records Act
- 44 USC 3301(a), the Federal Records Act
- EO 13526, the Executive Order governing classified information

Not listed was the Atomic Energy Act (AEA), so apparently the FBI didn't expect to find classified documents about American nuclear weapons. However, on September 6, it was reported that among the thousands of documents which the FBI eventually seized at Mar-a-Lago, there was one document that described a "foreign government's military defenses, including its nuclear capabilities".


A misleading statement

On June 3, the DoJ's Chief of Counterintelligence Jay Bratt and some FBI agents visited Mar-a-Lago where they received 38 additional classified documents, including 17 labeled Top Secret, in "a single Redweld envelope, double-wrapped in tape". One of Trump's lawyers signed a statement asserting that they had conducted a diligent search of the boxes from the White House and handed over the remaining classified material.

The FBI was informed that all of the records from the White House had been kept in one particular storage room and that "there were no other records stored in any private office space or other location at the Premises and that all available boxes were searched." However, government personnel was"explicitly prohibited from opening or looking inside any of the boxes that remained in the storage room."





The search at Mar-a-Lago

On August 5, 2022, a federal judge signed a search warrant for Mar-a-Lago on the grounds that "National Defense Information" (NDI) had been found in the boxes NARA retrieved from Mar-a-Lago and that there was probable cause to believe that additional documents containing such information remained at Trump's estate.

Three days later, FBI agents searched the Mar-a-Lago estate and seized what initially appeared to be 12 boxes of documents. Classified material was recovered from the basement storage room and from a container on the floor of a closet in a former dressing room of the bridal suite above the ballroom, which now serves as Trump's office, also known as the "45 office".


Items seized by the FBI

The result of this search is described in a form called "Receipt for Property" which lists 33 items, mostly boxes, which were (discontinuously) labeled from A-1 to A-73. Besides the boxes there were also some separate documents, notes and binders of photos. A detailed discussion of these seized materials can be found at the emptywheel weblog.




According to a DoJ filing from August 31, these boxes contained over a hundred classified records spread over 11 boxes. In the receipt they are seperately listed and marked with an additional A, for example: "13 - Box labeled A-18" which contained "13A - Miscellaneous Top Secret Documents", etc.


Highly classified documents

The most sensitive kind of documents, classified as Sensitive Compartmented Information (SCI), were only found in item #2, a "Leatherbound box of documents". Apparently they appeared so sensitive that "even the FBI counterintelligence personnel and DOJ attorneys conducting the review required additional clearances before they were permitted to review them."

On August 30, a filing by the Justice Department included an unprecedented photograph which shows the classified documents from the leatherbound box from Trump's office:




This photo was taken by the FBI in order to document the evidence they found, which explains the ruler and a marker that says that this is item #2A. To counter the impression that Trump had them lying on the floor like this, he said that it had been FBI agents who "took [these documents] out of cartons and spread them around on the carpet".

The documents were spread on a carpet with a classic flower motive, with on the right side a cardboard box with five picture frames, one of which shows a Time magazine cover from March 4, 2019, showing all the Democratic candidates who hoped to challenge Trump in the 2020 election.

On the left there's a small part of fringed dark-blue fabric, probably a curtain, and a white scalloped cabinet, which was identified as a $3679.- Birkdale File Chest - most likely from the time that this room was part of Mar-a-Lago's bridal suite.



Cover sheets

Most eye-catching are the colorful cover sheets for classified information. In the photo we can recognize four types, three of which were never seen before. Already known and publicly available are the standard cover sheets (SF704) with the broad borders in red, which are used to protect documents classified as Secret.


Secret/SCI

In the front of the photo there's a cover sheet which looks brownish but may also be red with the text "SECRET//SCI - Contains Sensitive Compartmented Information up to HCS-P/SI/TK". Unlike the common cover sheets for Secret documents, this one was never seen before. It's also more rare, because usually information from an SCI compartment is classified Top Secret.



SCI is sometimes called "above Top Secret" but officially that's not correct: SCI encompasses compartments of information that provide additional protection within the level Top Secret. In the same way these compartments can exist within the level Secret (and it's even possible that a particular SCI compartment contains both Secret and Top Secret information):



Top Secret/SCI

In the FBI photo we also see five cover sheets for documents classified as Top Secret/SCI. While the standard cover sheet for Top Secret information (SF703) is also publicly available, this one was never seen before. It has a broad border in yellow, which is the color code for Sensitive Compartmented Information (SCI), and text in orange, which may refer to the color code for Top Secret:



A White House cover sheet

Finally, there's a fourth cover sheet, which is only partially visible because it's folded back, probably to show the classification marking on the document. On the cover sheet we can read "PLEASE STORE IN" (a GSA Approved Security Container which is depicted right above these words) and "UNAU[THORIZED]".

In the upper right corner it has a seal which can be identified as that of the Executive Office of the President of the United States (EOP), which includes the National Security Council (NSC) and the staff of the West Wing.



This document is classified Top Secret, but interestingly, the rest of the classification line has been redacted by the FBI. Usually that happens when a particular program or compartment has not been declassified. Given that it has a custom White House cover sheet, the document may be about a sensitive White House program.


Classification markings

The various cover sheets not only hide the content of the particular documents, but also their mandatory classification line at the top and the bottom of the document. Therefore we don't know which kind of intelligence they contain and how sensitive they actually are.

The cover sheets for Secret/SCI and Top Secret/SCI both have the warning "Contains Sensitive Compartmented Information up to HCS-P/SI/TK", which means the documents may contain information from one, two or even all three of the following SCI control systems:

- HCS-P = Humint Control System - Product (intelligence from human sources)
- SI = Special Intelligence (intelligence from intercepted communications)
- TK = TALENT KEYHOLE (intelligence from satellite collection platforms)

It's not clear whether these cover sheets are also used for documents with information from compartments or sub-compartments of these control systems, i.e. even more sensitive and closely guarded secrets.


Dissemination markings

Besides the documents with a cover sheet, the FBI photo shows 12 classified documents without such a colorful protection and therefore they redacted all the content. One document (between the yellow Top Secret/SCI cover sheets) is fully redacted, on the other ones we see the following classification markings:

- SECRET//ORCON-USGOV/NOFORN and LIMITED ACCESS (2 documents)
- SECRET//ORCON-USGOV/NOFORN (6 documents)
- SECRET with additional markings redacted (1 document)
- SECRET NOFORN (1 document)
- SECRET and something ineligible (1 document)
- CONFIDENTIAL and LIMITED ACCESS (1 document)

Distinctive here are the so-called dissemination markings, which are added to the classification level to restrict the dissemination of information within only those people who have the appropriate clearance level and the need to know the information. The dissemination markings seen here are:

- ORCON, which means the originator of the information controls to whom it is released. It allows originators to maintain knowledge, supervision, and control of the distribution of the information beyond its original dissemination. Further dissemination of this information requires advance permission from the originator.

- ORCON-USGOV, which means the information "has been pre-approved for further dissemination without originator approval to the US Government's Executive Branch Departments and Agencies." It's not allowed to use this marking with information classified as SI-G or HCS-O.

- NOFORN, which means the information may not be disclosed or released to foreign nationals, foreign governments, or international organizations of governments without permission by the originator.

- LIMITED ACCESS seems not an official dissemination marking as it's not part of the classification line and is also not listed in the 2016 manual for the Intelligence Community Markings System nor in the list of CUI dissemination markings from 2021, which suggests that it's an internal White House marking.

This reminds of US Director of National Intelligence Dan Coats who in February 2018 warned that presidential aides with interim security clearances should only have limited access to classified information. Not much later a bill to the same effect was introduced.

Shortly before it had come out that Trump's former staff secretary Rob Porter and his son-in-law Jared Kushner were working under an interim security clearance and more than 30 of Trump's aides had their clearance downgraded from Top Secret to Secret.


In total, the FBI photo of item #2A shows 22 classified documents: 1 Confidential, 14 Secret and 7 Top Secret.



The detailed property inventory

As if the photo of the classified documents wasn't enough, the court also unsealed the Detailed Property Inventory, which happened on September 2, 2022. This inventory lists in more detail all the things the FBI seized at Mar-a-Lago:




Here we see the other documents which the FBI found in the leatherbound box that was marked as item #2. We also learn that there were actually 24 classified documents: 2 Confidential, 15 Secret and 7 Top Secret, which is 1 Confidential and 1 Secret document more than could be seen in the photo, maybe because some were stacked together.

Overall the FBI found 103 classified documents: 31 Confidential, 54 Secret and 18 Top Secret, dispersed in 13 boxes from the storage room as well as in the leatherbound box from Trump's office, where one separate classified document (item #1) was found as well.


Empty folders

According to the detailed inventory, item #2 also included 43 "Empty Folders with "CLASSIFIED" Bannners" as well as 28 empty folders labeled "Return to Staff Secretary/Military Aide". These kind of folders are used in the White House to bundle (and cover) the actual classified documents for the president. From Obama's presidency there are several photos of such folders:




On Twitter there even appeared a photo of such an empty folder which is on display among other memorabilia from Trump's presidency in the 45 Wine & Whiskey bar on the lobby floor of Trump Tower in Manhattan:



In total, the detailed inventory lists 48 of these empty folders, so it's possible that they originally contained the 103 classified documents which the FBI found "unfoldered" and scattered among the various boxes. Interesting though, is that 43 of those empty folders were in the box with the (much smaller number of) classified documents in Trump's office.

At the White House such folders and their content had to be returned to the staff secretary, just like how the empty folders for unclassified documents were labeled. This didn't bother Trump, who had the habit of simply ripping up any papers he was no longer interested in or had finished reviewing.

He did so with papers ranging"from routine documents to classified material, and leaving the pieces strewn around the floor or in a trash can. Officials would have to rummage through the shreds and tape them back together to recreate the documents in order to store them as required under the Presidential Records Act."



Trump's boxes

According to the Detailed Property Inventory, the FBI also found a huge number of "US Government Documents/Photographs without Classification Markings" - over 1400 in Trump's office and over 9700(!) in the various boxes from the storage room.

Interesting is that most of the 26 boxes from the storage room contain a mix of:
- Magazines, newspapers, press articles, other printed media (1,673 in total)
- Classified US government documents (103 in total)
- Unclassified US government documents/photographs (11,179 in total)
- Miscellanea (clothing, books, gifts and empty folders)


Trump's way of working

This more or less similar composition can be explained by Trump's routine at the White House, where he used to work in the small dining room near the Oval Office. On the dining table he made piles of paper, which included everything from news articles to highly classified government documents. These were stacked into cardboard boxes, while "staffers kept swapping out the boxes as they filled up."

Trump also had material sent"up to the White House Residence, and it was not always clear what happened to it. He sometimes asked to keep material after his intelligence briefings, but aides said he was so uninterested in the paperwork during the briefings themselves that they never understood what he wanted it for."

The boxes followed him wherever he went as they contained"all the save-for-later items that Trump would spend long flights going through: articles that he wanted to scribble Sharpie messages on before mailing them off to close friends; gossipy stories about West Wing drama that he would hate-read as he sought to identify leakers; and, occasionally, important memos on any number of policy topics or budding crises."




The last batch of boxes

The papers that Trump had accumulated in his last several months in office had been dropped into roughly two dozen boxes, which had apparently been in the White House Residence and thus were packed up with Trump's personal belongings.

As such, they not only contained some highly classified documents, but also several personal mementos, including the "love letters" from the North Korean dictator Kim Jong-un and the letter which former president Obama left on his last day in office.

Although the White House Counsel's Office had told Trump's chief of staff Mark Meadows that these boxes in the Residence needed to be turned over to the National Archives, they were actually shipped to Mar-a-Lago.

However, as emptywheel noticed, the press clippings date back to 1995, but there are no ones that postdate November 2020, which may indicate that the FBI still has not all the documents that Trump took with him.



Links and sources

- Emptywheel: Trump Document Theft Resources
- LegalEagle: Videos about the Mar-a-Lago search case
- Wikipedia: FBI search of Mar-a-Lago

- The Washington Post: Material on foreign nation’s nuclear capabilities seized at Trump’s Mar-a-Lago (Sept. 6, 2022)
- The New York Times: F.B.I. Found 48 Empty Folders That Had Contained Classified Documents at Trump’s Home (Sept. 2, 2022)
- Lawfare: A Justice Department Show of Force in the Mar-a-Lago Case (Aug. 31, 2022)
- The Washington Post: The photo of classified documents at Trump’s Mar-a-Lago resort, annotated (Aug. 31, 2022)
- Politico: Trump team likely sought to conceal classified docs at Mar-a-Lago, DOJ tells judge (Aug. 30, 2022)
- Indian Express: Inside the 20-month fight to get Trump to return Presidential material (Aug. 28, 2022)
- The New York Times: Another Trump Mystery: Why Did He Resist Returning the Government’s Documents? (Aug. 18, 2022)
- The Guardian: FBI searched Trump’s Mar-a-Lago home for classified nuclear weapons documents (Aug. 12, 2022)
- CNN: Former White House officials describe Trump’s habit of ripping up documents and haphazard record-keeping (Febr. 8, 2022)
- US State Department: Storing and Safeguarding Classified Material (Febr. 24, 2022)