Dangerous Meltdown at Treasury

BuzzFeed News reveals the Kremlin was trying to obtain financial information on its enemies in 2016, and Russian government agents were using unsecured Gmail and Hotmail accounts to communicate with U.S. Treasury officials, who responded to them.

The extraordinary unofficial line of communication arose in the final year of the Obama administration — in the midst of what multiple US intelligence agencies have said was a secret campaign by the Kremlin to interfere in the US election. Russian agents ostensibly trying to track ISIS instead pressed their American counterparts for private financial documents on at least two dozen dissidents, academics, private investigators, and American citizens.

Most startlingly, Russia requested sensitive documents on Dirk, Edward, and Daniel Ziff, billionaire investors who had run afoul of the Kremlin. That request was made weeks before a Russian lawyer showed up at Trump Tower offering top campaign aides “dirt” on Hillary Clinton — including her supposed connection to the Ziff brothers.

Russia’s financial crimes agency, whose second-in-command is a former KGB officer and schoolmate of President Vladimir Putin, also asked the Americans for documents on executives from two prominent Jewish groups, the Anti-Defamation League and the National Council of Jewish Women, as well as Kremlin opponents living abroad in London and Kiev.

In an astonishing departure from protocol, documents show that at the same time the requests were being made, Treasury officials were using their government email accounts to send messages back and forth with a network of private Hotmail and Gmail accounts set up by the Russians, rather than communicating through the secure network usually used to exchange information with other countries.

Analysts at an elite agency within Treasury first warned supervisors in 2016 that the Russians were “manipulating the system” to conduct “fishing expeditions.” And they raised fears that the Treasury’s internal systems could be compromised by viruses contained in emails from the unofficial Russian accounts. But staff continued using the Gmail back channel into 2017, despite repeated internal warnings that Russia could be trawling for sensitive financial records — including Social Security and bank account numbers — to spy on, endanger, or recruit targets in the West.

BuzzFeed News, which obtained the information from documents it reviewed, could not get Treasury to explain what exactly happened or why.

In a statement, a spokesperson said: “Treasury does not discuss or comment on confidential communications with foreign governments, including to confirm whether or not they have occurred. We have notified our Office of the Inspector General of these allegations.”

(...)

Officials at FinCEN said they reported the use of the back channel to Treasury’s counterterrorism unit and security office, and requested an investigation. They said it was a breach of protocol and that it exposed the Treasury to potential hackers because the Russian messages contained attachments — a common way for intruders to worm inside an organization’s servers.

“If the attachment had a virus it could infiltrate the server,” a senior FinCEN official told BuzzFeed News. This source said insiders have been concerned that their internal records could have been corrupted.

The FinCEN officials reported the incidents in July and August 2016, and claim that there was no substantive investigation of the matter. These sources said that other senior officials continued to use the back channel even after they were told to stop by the Treasury’s office for security.

They suspected that the Russian agency making the requests, called Rosfinmonitoring, set up by Putin in 2001 to combat money laundering and terrorist financing, was closely tied to Russia’s espionage apparatus.

“They are passing information that may have interest to the Russians for other reasons,” a FinCEN official wrote to colleagues in March 2017. “One has to wonder what the heck is going on here.” This official filed for whistleblower protection and quit last year.

In emails reviewed by BuzzFeed News, FinCEN insiders expressed shock that staff in another Treasury office had agreed to communicate with the Russians outside of normal, secure channels. FinCEN uses an encrypted portal called the Egmont Secure Web to exchange information with more than 160 other countries, including Russia, and to keep sensitive financial data out of the wrong hands.

(...)

The first chapter in this extraordinary chain of communications began in late 2015, when a unit of the Treasury Department called the Office of Terrorist Financing and Financial Crimes entered into an agreement, named the ISIL Project, that called for Russia and the US to share information on financial institutions in the Middle East suspected of supporting ISIS.

According to a senior FinCEN intelligence analyst, Russia’s subsequent actions suggest that was just a cover. “What we were seeing with Russia was the fruition of a long-term strategy to try and compromise Treasury by cultivating civil servants. That’s why we sounded the alarm and reported it.”

(...)

FinCEN is a critical US law enforcement agency that each day collects and analyzes thousands of bank reports about suspicious financial behavior. Analysts have played a key role in current investigations by the FBI and special counsel Robert Mueller, assisting FBI agents with inquiries into the murky finances of President Donald Trump and his associates.

Yet hundreds of internal records and interviews with more than a dozen insiders — from frontline workers to senior leaders — show an agency in turmoil, torn apart by turf battles, sinking morale, and internal chaos. Officials there say that, as a result, the unit struggles to hold the line against global money launderers, terrorist organizations, and drug cartels, and lies vulnerable to foreign threats.

Critical financial records on some Trump associates and Russian figures, collected by FinCEN analysts, have not been turned over to Congress, despite numerous requests ...

(...)

At least 10 FinCEN employees have filed formal whistleblower complaints about the department. The whistleblowers say they tried multiple times to raise concerns about issues they believed threatened national security, but that they faced retaliation instead of being heeded. Some of FinCEN’s top officials quit in anger. One senior adviser has been arrested and accused of releasing financial records to a journalist.

That adviser, a whistleblower named Natalie Mayflower Edwards, first sounded the alarm in the summer of 2016. She went on to speak with six different congressional committee staffers to air her concerns. In July and August 2018, she met again with staffers of one of the Senate committees investigating Russian interference during the presidential campaign. In those meetings, she told the staffers that FinCEN withheld documents revealing suspicious financial transactions of Trump associates that the committee had requested.

Along with a colleague, Edwards wrote a letter last year to six congressional oversight committees. In it, the analysts included documentary evidence and Edwards wrote, “I have brought forward lawful documented evidential disclosures of violations of law, rule, and regulations, gross mismanagement, gross waste of funds, abuse of authority, and substantial and specific danger to public safety and I have NOT been protected against reprisal.”

Edwards added that she reported the “wrongdoing” to her supervisor, the inspector general, Treasury’s general counsel, Treasury security personnel, and the counterterrorism unit, requesting an internal investigation, as well as alerting the Office of Special Counsel, the federal government agency that deals with whistleblower complaints. Despite her disclosures, she wrote, “I continue to be retaliated against.”

“May Edwards took it on herself to try and protect everyone here as well as national security,” a senior FinCEN official told BuzzFeed News. “Nobody listened to her or some of the other brave whistleblowers who came forward. They’re all now paying a high price.”