Russia’s Hybrid Warfare, Here to Stay

Seems like everyday, Russia is in our house, in fact it is true. The hybrid warfare crafted by the Kremlin is here to stay so exactly when does the Trump White House deal with this constant threat? What threat you ask?

Adam Meyers is from the cyber-security firm CrowdStrike. As the Vice President of Intelligence, Adam heads a team that identifies the perpetrators of cyber-crimes, both in the private and public sectors. CrowdStrike helped to identify the hackers behind the Democratic National Committee’s email leaks last year, and more recently the mastermind behind the Kelihos Botnet.

*** Notice, there was no intrusion into Marie Le Pen’s campaign operations. Why? Putin endorses LePen and has provided campaign funds to her.

According to Trend Micro researchers, the campaign of French presidential candidate Emmanuel Macron has been hit by the same Russian hackers who targeted Democratic campaign officials in the U.S. before last year’s presidential election, the New York Times reports.

On March 15, the researchers say, they saw the Pawn Storm group (a.k.a. Fancy Bear, APT28 or the Sofacy Group) begin targeting Macron’s campaign with phishing attacks seeking campaign officials’ login information.

“The phishing pages we are talking about are very personalized Web pages to look like the real address,” Mounir Mahjoubi, Macron’s digital director, told the Times. “They were pixel perfect. It’s exactly the same page. That means there was talent behind it and time went into it — talent, money, experience, time and will.”

Still, Mahjoubi said none of the attacks was successful.

He described the phishing attacks as the invisible side of a Russian campaign against Macron, with the visible side being fake news published on Russian news sites like Sputnik and RT. More here.

***

Panel to Senate: Cyber Operations Influence Political Processes Worldwide

Russia used “useful idiots” to meddle in the U.S. presidential election and “fellow travelers” opposed to European Union and NATO to influence elections in France and Germany, while Islamic terrorists used “agent provocateurs” to topple Spain’s government in 2004 and cast another pall over French voting, a cyber security expert told a congressional subcommittee Thursday.

That, in capsule form, is how cyber is changing how the public views elections, Clint Watts, of the Foreign Policy Research Institute, said at the Senate Armed Services cybersecurity subcommittee hearing.

So far in the case of the United States warding off this kind of activity, “far more is said than done.” He added it is a “human challenge, not technical ones” that needs to be addressed.

In the American and European elections, he said at the panel’s first public hearing since being formed the Russians created content, sent it out as if were “nuclear-powered and “pushed [it] in unison from many locations,” including “gray outlets” that appear to be legitimate sources of news. They also did all of this over long periods of time.

The goal in the American election was to plant doubt in the integrity of the voting, he said. He added there was no indication that actual votes were tampered with.

Later in answer to a question, Watts said the Russians “are picking parties and supporting them” in the United States and financially in Europe.

In cyber, not all is as it appears and its speed is instantaneous.

Rand Waltzman, senior information scientist at the RAND Corporation, described how an American special forces raid that successfully rescued a hostage and killed a number of terrorists in Iraq was turned into a terrorist propaganda victory. “Those guys film everything,” he said describing how they recorded the incident by placing the bodies on prayer rugs so it appeared that soldiers killed innocent civilians. The video was posted before the special forces soldiers returned to their base. “How did they manage to this so fast?” Their mobile phones.

This changed the story of what happened 180 degrees and put the United States in the position of having to refute the video rather than telling a story of rescue.

He said this kind of quick reaction by adversaries — misinformation, fake news — requires new thinking on cyber security. Instead of the traditional “denial of service” by causing a crash, they are applying “cognitive denial of service” — misinformation and propaganda — to achieve their ends.

“We’re hamstrung” by bureaucracy and directives in addressing the new “hyperkinetic world,” Michael Lumpkin, former acting under secretary of defense for policy, said. The United States’ government efforts in public diplomacy, public affairs and information operations have not been synchronized so that it becomes a credible source of information. It also needs to take the necessary steps “to make sure our information is accurate” before releasing it. “That has not always been the case.”

John Inglis, former deputy director of the National Security Agency, used his organization’s handling of metadata collection as an example. “You need to go first” to establish credibility and explain the value of what it is you are doing. “We went second. That made it more difficult to put it back in the bottle.”

Watts said one approach would be to have a rating non-profit, private agency, similar to Consumer Reports, vet every story on Twitter, Facebook and Google. He added Facebook and Google “are moving in that direction” to eliminate false news, but so far Twitter has not acted.

When asked how he rated RT, the Russian-sponsored media outlet, as a source of news, he said 70 percent was true, 20 percent was misleading and 10 percent false. Watts said he rated some American media outlets as falling in the same percentages of true, misleading and false.

A continuing difficulty in improving cyber security in and out of government is “how do you get people to share problems,” Waltzman said when they would prefer not to admit being hacked or even attacked. Lumpkin said more also needs to be done in training people how not to “provide access to adversaries unwittingly” and holding them accountable for security.

As for recruiting skilled cyber workers, “they’re motivated people out there” interested in the challenges they can find in government, rather than private sector, careers, Watts said. “Give them the space to be the tech savants they are.”

*** Need more? Do you ever watch C-Span and listen to testimony before Congressional committees? No? Too bad, but here is some help:

Russian cyber enabled influence operations demonstrate never-before-seen synchronization of Active Measures.  Content created by white outlets (RT and Sputnik News) promoting the release of compromising material will magically generate manipulated truths and falsehoods from conspiratorial websites promoting Russian foreign policy positions, Kremlin preferred candidates or attacking Russian opponents.  Hackers, hecklers and honeypots rapidly extend these information campaigns amongst foreign audiences. As a comparison, the full spectrum synchronization, scale, repetition and speed of Russia’s cyber-enabled information operations far outperform the Islamic State’s recently successful terrorism propaganda campaigns or any other electoral campaign seen to date.

Cyber-enabled Influence Thrives When Paired with Physical Actors and Their Actions – 

American obsession with social media has overlooked the real world actors assisting Russian influence operations in cyber space, specifically “Useful Idiots,” “Fellow Travelers,” and “Agent Provocateurs.”

“Useful Idiots” – Meddling in the U.S. and now European elections has been accentuated by Russian cultivation and exploitation of “Useful Idiots” – a Soviet era term referring to unwitting American politicians, political groups and government representatives who further amplify Russian influence amongst Western populaces by utilizing Russian kompromat and resulting themes.

“Fellow Travelers” – In some cases, Russia has curried the favor of “Fellow Travelers” – a Soviet term referring to individuals ideologically sympathetic to Russia’s anti-EU, anti-NATO and anti-immigration ideology. A cast of alternative right characters across Europe and America now openly push Russia’s agenda both on-the-ground and online accelerating the spread of Russia’s cyber-enabled influence operations.

“Agent Provocateurs” – Ever more dangerous may be Russia’s renewed placement and use of “Agent Provocateurs” – Russian agents or manipulated political supporters who commit or entice others to commit illegal, surreptitious acts to discredit opponent political groups and power falsehoods in cyber space. Shots fired in a Washington, D.C. pizza parlor by an American who fell victim to a fake news campaign called #PizzaGate demonstrate the potential for cyber-enabled influence to result in real world consequences. While this campaign cannot be directly linked to Russia, the Kremlin currently has the capability to foment, amplify, and through covert social media accounts, encourage Americans to undertake actions either knowingly or unknowingly as Agent Provocateurs.

Each of these actors assists Russia’s online efforts to divide Western electorates across political, social, and ethnic lines while maintaining a degree of “plausible deniability” with regards to Kremlin interventions. In general, Russian influence operations targeting closer to Moscow and further from Washington, D.C. will utilize greater quantities and more advanced levels of human operatives to power cyber-influence operations. Russia’s Crimean campaign and their links to an attempted coup in Montenegro demonstrate the blend of real world and cyber influence they can utilize to win over target audiences. The physical station or promotion of gray media outlets and overt Russian supporters in Eastern Europe were essential to their influence of the U.S. Presidential election and sustaining “plausible deniability.”

It’s important to note that America is not immune to infiltration either, physically or virtually.  In addition to the Cold War history of Soviet agents recruiting Americans for Active Measures purposes, the recently released dossier gathered by ex MI6 agent Chris Steele alleges on page 8 that Russia used “Russian émigré & associated offensive cyber operatives in U.S.” during their recent campaign to influence the U.S. election. While still unverified, if true, the employment of such agents of influence in the U.S. would provide further plausible deniability and provocation capability for Russian cyber-enabled influence operations.

2) How can the U.S. government counter cyber-enabled influence operations?

When it comes to America countering cyber-enabled influence operations, when all is said and done, far more is said than done. When the U.S. has done something to date, at best, it has been ineffective. At worst, it has been counterproductive. Despite spending hundreds of millions of dollars since 9/11, U.S. influence operations have made little or no progress in countering al Qaeda, its spawn the Islamic State or any connected jihadist threat group radicalizing and recruiting via social media.

Policymakers and strategists should take note of this failure before rapidly plunging into an information battle with state sponsored cyber-enabled influence operations coupled with widespread hacking operations – a far more complex threat than any previous terrorist actor we’ve encountered.  Thus far, U.S. cyber influence has been excessively focused on bureaucracy and expensive technology tools – social media monitoring systems that have failed to detect the Arab Spring, the rise of ISIS, the Islamic State’s taking of Mosul, and most recently Russia’s influence of the U.S. election.  America will only succeed in countering Russian influence by turning its current approaches upside down, clearly determining what it seeks to achieve with its counter influence strategy and then harnessing top talent empowered rather than shackled by technology – a methodology prioritizing Task, Talent, Teamwork and Technology in that order.

Task – Witnessing the frightening possibility of Russian interference in the recent U.S. Presidential election, American policy makers have immediately called to counter Russian cyber influence.  But the U.S. should take pause in rushing into such efforts. The U.S. and Europe lack a firm understanding of what is currently taking place.  The U.S. should begin by clearly mapping out the purpose and scope of Russian cyber influence methods.  Second, American politicians, political organizations and government officials must reaffirm their commitment to fact over fiction by regaining the trust of their constituents through accurate communications. They must also end their use of Russian kompromat stolen from American citizens’ private communications as ammunition in political contests. Third, the U.S. must clearly articulate its policies with regards to the European Union, NATO, and immigration, which, at present, sometimes seems to mirror rather than counters that of the Kremlin. Only after these three actions have been completed, can the U.S. government undertake efforts to meet the challenge of Russian information warfare through its agencies as I detailed during my previous testimony.

Talent –Russia’s dominance in cyber-enabled influence operations arises not from their employment of sophisticated technology, but through the employment of top talent. Actual humans, not artificial intelligence, achieved Russia’s recent success in information warfare. Rather than developing cyber operatives internally, Russia leverages an asymmetric advantage by which they coopt, compromise or coerce components of Russia’s cyber criminal underground.  Russia deliberately brings select individuals into their ranks, such as those GRU [Russia’s foreign intelligence agency] leaders and proxies designated in the 29 December 2016 U.S. sanctions. Others in Russia with access to sophisticated malware, hacking techniques or botnets are compelled to act on behalf of the Kremlin.

The U.S. has top talent for cyber influence but will be unlikely and unable to leverage it against its adversaries.  The U.S. focuses on technologists failing to blend them with needed information campaign tacticians and threat analysts.  Even further, U.S. agency attempts to recruit cyber and influence operation personnel excessively focus on security clearances and rudimentary training thus screening out many top picks.  Those few that can pass these screening criteria are placed in restrictive information environments deep inside government buildings and limited to a narrow set of tools.  The end result is a lesser-qualified cyber-influence cadre with limited capability relying on outside contractors to read, collate and parse open source information from the Internet on their behalf.  The majority of the top talent needed for cyber-enabled influence resides in the private sector, has no need for a security clearance, has likely used a controlled substance during their lifetime and can probably work from home easier and more successfully than they could from a government building.

Teamwork – Russia’s cyber-enabled influence operations excel because they seamlessly integrate cyber operations, influence efforts, intelligence operatives and diplomats into a cohesive strategy.  Russia doesn’t obsess over their bureaucracy and employs competing and even overlapping efforts at times to win their objectives.

Meanwhile, U.S. government counter influence efforts have fallen into the repeated trap of pursuing bureaucratic whole-of-government approaches. Whether it is terror groups or nation states, these approaches assign tangential tasks to competing bureaucratic entities focused on their primary mission more than countering cyber influence.  Whole-of-government approaches to countering cyber influence will assign no responsible entity with the authority and needed resources to tackle our country’s cyber adversaries.  Moving forward, a task force led by a single entity must be created to counter the rise of Russian cyber-enabled operations.

Technology – Over more than a decade, I’ve repeatedly observed the U.S. buying technology tools in the cyber- influence space for problems they don’t fully understand. These tech tool purchases have excessively focused on social media analytical packages producing an incomprehensible array of charts depicting connected dots with different colored lines. Many of these technology products represent nothing more than modern snake oil for the digital age.  They may work well for Internet marketing but routinely muddy the waters for understanding cyber influence and the bad actors hiding amongst social media storm.

Detecting cyber influence operations requires the identification of specific needles, amongst stacks of needles hidden in massive haystacks. These needles are cyber hackers and influencers seeking to hide their hand in the social media universe. Based on my experience, the most successful technology for identifying cyber and influence actors comes from talented analysts that first comprehensively identify threat actor intentions and techniques and then build automated applications specifically tailored to detect these actors.  The U.S. government should not buy technical tools nor seek to build expensive, enterprise-wide solutions for cyber-influence analytics that rapidly become outdated and obsolete.  Instead, top talent should be allowed to nimbly purchase or rent the latest and best tools on the market for whatever current or emerging social media platforms or hacker malware kits arise.

3. What can the public and private sector do to counter influence operations?

I’ve already outlined my recommendations for U.S. government actions to thwart Russia’s Active Measures online in my previous testimony on 30 March 2017. Social media companies and mainstream media outlets must restore the integrity of information by reaffirming the purity of their systems. In the roughly one month since I last testified however, the private sector has made significant advances in this regard. Facebook has led the way, continuing their efforts to reduce fake news distribution and removing up to 30,000 false accounts from its system just this past week. Google has added a fact checking function to their search engine for news stories and further refined its search algorithm to sideline false and misleading information. Wikipedia launched a crowd-funded effort to fight fake news this week.  The key remaining private sector participant is Twitter, as their platform remains an critical networking and dissemination vector for cyber-enabled influence operations.  Their participation in fighting fake news and nefarious cyber influence will be essential. I hope they will follow the efforts of other social media platforms as their identification and elimination of fake news spreading bots and false accounts may provide a critical block to Russian manipulation and influence of the upcoming French and German elections.

In conclusion, my colleagues and I identified, tracked and traced the rise of Russian influence operations on social media with home computers and some credit cards. While cyber-influence operations may appear highly technical in execution, they are very human in design and implementation.  Technology and money will not be the challenge for America in countering Russia’s online Active Measures; it will be humans and the bureaucracies America has created that prevent our country from employing its most talented cyber savants against the greatest enemies to our democracy. Full article here.

DHS’s Office for Community Partnerships, Stonewalling

Release Date:
September 28, 2015  <– Note Jeh Johnson created this department

DHS: Violent extremism – that which is inspired by foreign terrorist groups and that which is rooted in a range of domestic-based radical ideologies – pose a persistent and unpredictable threat to our homeland. Countering violent extremism has become a key focus of DHS’s work to secure the homeland. Last year I appointed a Department-wide coordinator for our efforts to counter violent extremism. As Secretary of Homeland Security, I am also personally committed to this mission, having traveled to Boston, Chicago, Columbus, Houston, Los Angeles, Minneapolis, New York City, northern Virginia and suburban Maryland to meet with community leaders as part of this effort. We heard many strongly-held views, generated conversations, and built some bridges.

It is now time to take our efforts to the next level.

Today I announce the creation of the DHS Office for Community Partnerships. This Office will be dedicated to the mission of countering violent extremism, but its ultimate mission is as its name suggests – community partnerships. My charge to this Office, to be set forth in a more detailed plan, is to continue to build relationships and promote trust, and, in addition, find innovative ways to support communities that seek to discourage violent extremism and undercut terrorist narratives. More here.

Problem? Either DHS was told to hide documents, not cooperate, there is collusion or the Obama White House applied executive privilege to the documents.

Just before Jeh Johnson left as Secretary of DHS:

For Immediate Release
Office of the Press Secretary
Contact: 202-282-8010

In 2016, Congress answered our call for federal grants, awarded and administered by the Department of Homeland Security, to support local efforts to counter violent extremism. Today, I am pleased to announce the first round of awards of these grants.

A total of 31 proposals, from various organizations in multiple communities, have been accepted to receive some part of the $10 million appropriated by Congress last year. The funding will go for activities that include intervention, developing resilience, challenging the narrative, and building capacity. The organizations approved for grants include local governments, universities, and non-profit organizations, in locations across the country such as Boston, Minneapolis, Los Angeles, Detroit, Nebraska, Houston, Illinois, New Jersey, Texas and New York City. Among the awardees are organizations devoted specifically to countering ISIL’s recruitment efforts in our homeland, and Life After Hate, an organization devoted to the rehabilitation of former neo-Nazis and other domestic extremists in this country. More here.

The lawsuit is found here.

Background:

Philadelphia – May 1, 2017 – The Middle East Forum has filed a lawsuit against the Department of Homeland Security (DHS) to secure the release of documents related to the Obama administration’s Countering Violent Extremism (CVE) grant program.

The grant program, which began last year, is intended to assist “efforts at the community level to counter violent extremist recruitment and radicalization to violence,” but MEF was concerned about U.S. Islamist groups – themselves radicals – receiving CVE funds. Indeed, grant recipients have included the Muslim Public Affairs Council (MPAC), an organization with ties to the Muslim Brotherhood and a long history of sanitizing Islamist terrorism.

On January 10, MEF filed a detailed Freedom of Information Act (FOIA) request with DHS seeking documents about the selection criteria and specific decisions in awarding CVE grants. The request indicated that the documents are mostly located at the DHS Office for Community Partnerships (OCP), headed by George Selim.

Having failed to receive even a response to its request within the 20-day period mandated by law, MEF contacted DHS. Finally, on March 23, DHS FOIA officer Ebony Livingston informed us that the request had been routed to the Federal Emergency Management System (FEMA), which found no pertinent records.

On April 26, MEF filed a lawsuit alleging that DHS violated the law by not only failing to produce the documents, but failing even to conduct a search for the documents.

The complaint, prepared by attorney Matt Hardin, a specialist in FOIA litigation, seeks injunctive relief compelling DHS “to search for and produce all records in its possession responsive to plaintiff’s FOIA request.”

“We filed a detailed FOIA request, specifying the documents we were looking for and where they likely were,” said MEF Director Gregg Roman. “DHS not only failed to produce the documents, it failed even to conduct a search and closed our case without bothering to tell us. This is not just unacceptable but illegal.”

The case has been assigned to Judge Royce C. Lamberth of the United States District Court for the District of Columbia. It bears noting that Judge Lamberth previously handled FOIA litigation concerning former Secretary of State Hillary Clinton’s emails.

“The CVE program should be canceled altogether,” said Sam Westrop, director of MEF’s Islamist Watch project. “And guidelines should be put in place to make sure that extremist groups like MPAC never receive taxpayer money to counter extremism.”

Military Prepping for Major Power Grid Hack

Image result for u.s. power grid

Military Is Ramping Up Preparation For Major U.S. Power Grid Hack

By 2020, the Pentagon hopes to be able to repair our power grid within a week of a massive attack

The U.S. Department of Defense is growing increasingly concerned about hackers taking down our power grid and crippling the nation, which is why the Pentagon has created a $77-million security plan that it hopes will be up and running by 2020.

The U.S. power grid is threatened every few days. While these physical and cyber attacks have never led to wide-scale outages, attacks are getting more sophisticated. According to a 494-page report released by the Department of Energy in January, the nation’s grid “faces imminent danger from cyber attacks.” Such a major, sweeping attack could threaten “U.S. lifeline networks, critical defense infrastructure, and much of the economy; it could also endanger the health and safety of millions of citizens.” If it were to happen today, America could be powered-down and vulnerable for weeks.

The DoD is working on an automated system to speed up recovery time to a week or less — what it calls the Rapid Attack Detection, Isolation, and Characterization (RADICS) program. DARPA, the Pentagon’s research arm, originally solicited proposals in late 2015, asking for technology that did three things. Primarily, it had to detect early warning signs and distinguish between attacks and normal outages, but it also had to pinpoint the access point of the attack and determine what malicious software was used. Finally, it must include an emergency system that can rapidly connect various power-supply centers, without any human coordination. This would allow emergency and military responders to have an ad hoc communication system in place moments after an attack.

“If a well-coordinated cyberattack on the nation’s power grid were to occur today, the time it would take to restore power would pose daunting national security challenges,” said DARPA program manager John Everett, in a statement, at the time. “Beyond the severe domestic impacts, including economic and human costs, prolonged disruption of the grid would hamper military mobilization and logistics, impairing the government’s ability to project force or pursue solutions to international crises.”

DARPA plans to spend $77 million on RADICS. Last November, SRI International announced it had received $7.3 million from the program. In December, Raython was granted $9 million. The latest addition is BAE Systems, which received $8.6 million last month to develop technology that detects and contains power-grid threats, and creates a secure emergency provisional system that restores some power and communication in the wake of an attack — what is being called a secure emergency network.

According to the military news site Defense Systems, BAE’s SEN would rely on radio, satellite, or wireless internet — whatever is available that allows the grid to continue working. The SEN would serve as a wireless connection between separate power grid stations.

While the ultimate goal of the RADICS program will be the restoration of civilian power and communications, the SEN will prioritize communication networks that would be used for defense or combat, so the U.S. government can still wage war while the rest of us are in the dark.

Image result for u.s. power grid Called the “largest interconnected machine,” the U.S. electricity grid is a complex digital and physical system crucial to life and commerce in this country. Today, it is made up of more than 7,000 power plants, 55,000 substations, 160,000 miles of high-voltage transmission lines and millions of miles of low-voltage distribution lines. This web of generators, substations and power lines is organized into three major interconnections, operated by 66 balancing authorities and 3,000 different utilities. That’s a lot of power, and many possible vulnerabilities. More here from USNews.

*** Last year from the Department of Energy:

Today’s electric grid increasingly uses “smart” devices that can be controlled remotely — letting operators manage the grid better and more efficiently. But as the electric grid becomes smarter, it also becomes more vulnerable to hackers. That’s why a new initiative underway at the National Renewable Energy Laboratory (NREL) aims to prevent hackers from gaining control of parts of the nation’s power grid, which could damage electrical equipment and cause localized power outages.

Tackling the challenge is Erfan Ibrahim and his team at NREL’s Cyber Physical Systems Security and Resilience Center. Ibrahim’s team launched an effort to build the Test Bed for Secure Distributed Grid Management. It’s a hardware system that mimics the communications, power systems, and cybersecurity layers for a utility’s power distribution system, the part of the power grid that carries power from substations to homes and businesses.

The test bed incorporates a lot of brand-new cybersecurity technologies that need to be tested in order to make the system as secure as possible. So, naturally, they tried to break it. Specifically, they tried to hack the system.

Approaching the system from three different angles, they found a single vulnerability, which was due to a misconfigured cybersecurity device. Through that one cyber vulnerability, a designated white hat hacker was able to get into the system, gain administrator rights, and launch a denial of service attack that disabled the entire testbed. That’s the type of insight the test bed is designed to provide. One of the cybersecurity firms actually refined its product after seeing how it performed on the test bed.

Janet Napolitano Took DC Fraud Tactics With Her

Hello FBI, when you get a chance…how about dispatching a few agents to visit Nappy….got any agents available?

Primer: Using a visa loophole to fire well-paid U.S. information technology workers and replace them with low-paid immigrants from India is despicable enough when it’s done by profit-making companies such as Southern California Edison and Walt Disney Co.

But the latest employer to try this stunt sets a new mark in what might be termed “job laundering.” It’s the University of California. Experts in the abuse of so-called H-1B visas say UC is the first public university to send the jobs of American IT staff offshore. That’s not a distinction UC should wear proudly. More here.

Image result for janet napolitano university of california NBC

The corruption continues –>

Napolitano’s UC hid $175 million while demanding money, audit says

FNC: The University of California hid a stash of $175 million in secret funds while its leaders requested more money from the state, an audit released on Tuesday said.

The San Francisco Chronicle reported that the audit found that the secret fund ballooned due to UC Office of the President overestimating how much is needed to run the school system that includes 10 campuses in the state. Janet Napolitano, the former Department of Homeland Security chief, is in charge of the school system.

Napolitano denied the audit’s claim. She reportedly said the money was held for any unexpected expenses. Her office also denied the amount in the fund.

“The true amount is $38 million, which is roughly 10 percent of (the office’s) operating and administrative budget, a prudent and reasonable amount for unexpected expenses such as cybersecurity threat response and emerging issues like increased support for undocumented students and efforts to prevent sexual violence and sexual harassment,” her office said in a statement.

Elaine Howle, the state auditor who came up with the report, found that from 2012 to 2016 the office looked to raise more funding by inflating estimates. Howle also said that a top staff member in Napolitano’s office improperly screened confidential surveys that were sent to each campus. Howle said answers that were critical of Napolitano’s office were deleted or changed before being sent to auditors.

“I’ve never had a situation like that in my 17 years as state auditor,” Howle said. “My attorneys are looking at whether any improper government activities occurred.”

The UC Board of Regents is now hearing calls to overturn its decision to increase tuition this fall by 2.5 percent.

Howle said Napolitano also overcharged the system’s 10 campuses to fund its operations, paid its employees significantly more than state employees and interfered in the auditing process.

“Taken as a whole, these problems indicate that significant change is necessary to strengthen the public’s trust in the University of California,” Howle wrote in the report.

The audit found that over the course of four years, the UC’s central bureaucracy amassed more than $175 million in reserve funds by spending significantly less than it budgeted for and asking for increases in future funding based on its previous years’ over-estimated budgets rather than its actual expenditures.

“In effect, the Office of the President received more funds than it needed each year, and it amassed millions of dollars in reserves that it spent with little or no oversight,” the report said.

Napolitano argues the amount accounts for 10 percent of the operating and administrative budget. She called it “a modest amount for an organization our size.”

The office argued it did not need to disclose its reserves because the regents had approved the spending in previous years’ budgets. Howle said the undisclosed funds included $32 million collected from campuses that could have been spent for other purposes.

University employees and lawmakers, who requested the audit, expressed outrage over the audit’s findings.

“Today we learned that after squandering millions of public dollars on bloated management and unaccountable ‘initiatives,’ (the Office of the President) has effectively been operating a slush fund that shields hundreds of millions of public dollars from public scrutiny,” Kathryn Lybarger, president of UC’s largest employee union, said in a statement.

She criticized the office’s “skyrocketing executive pay,” a reference to the audit’s finding that the 10 executives in the office were paid a total of $3.7 million in the 2014-15 fiscal year — over $700,000 more than the combined salaries of their highest paid state employee counterparts.

Lt. Gov. Gavin Newsom, a Democrat and member of the UC Board of Regents, said the audit calls into question the university’s decision to raise this fall’s tuition for the first time in six years when it has money available. The decision in January increases the cost of tuition and fees for California residents, who currently pay $12,294 a year, to $12,630.

“It is outrageous and unjust to force tuition hikes on students while the UC hides secret funds, and I call for the tuition decision to come back before the Board of Regents for reconsideration and reversal,” he said.

Among her recommendations for reforms, Howle suggested that state lawmakers should increase oversight of the office.

However, she said the office’s attempt to interfere with the audit process by reviewing surveys auditors sent to the campuses “cast doubt on whether it will make a genuine effort to change.”

In 2012, the director of the California Parks Department resigned after it came to light that the department hid $54 million in parks funding for more than a decade, at the same time the state threatened to close dozens of parks to save money amid a state budget crisis. The state auditor recommended new accounting methods, which were later adopted.

 

Comey’s FBI and Operation ‘Midyear’ on Hillary

 Loretta_Lynch_and_Bill_Clinton_meet_in_P_0_41315067_ver1.0_640_480

Primer: This summary places events in a timeline and context. There are some additional details and the text appears to be fair. Further, when Loretta Lynch refers to the investigation as a ‘matter’, it for the most parts tells us all we need to know.

Comey Tried to
Shield the F.B.I. From
Politics. Then He
Shaped an Election.

As the F.B.I. investigated Hillary Clinton and the Trump
campaign, James B. Comey tried to keep the bureau out
of politics but plunged it into the center of a bitter election.

New York Times/WASHINGTON — The day before he upended the 2016 election, James B. Comey, the director of the Federal Bureau of Investigation, summoned agents and lawyers to his conference room. They had been debating all day, and it was time for a decision.

Mr. Comey’s plan was to tell Congress that the F.B.I. had received new evidence and was reopening its investigation into Hillary Clinton, the presidential front-runner. The move would violate the policies of an agency that does not reveal its investigations or do anything that may influence an election. But Mr. Comey had declared the case closed, and he believed he was obligated to tell Congress that had changed.

“Should you consider what you’re about to do may help elect Donald Trump president?” an adviser asked him, Mr. Comey recalled recently at a closed meeting with F.B.I. agents.

He could not let politics affect his decision, he replied. “If we ever start considering who might be affected, and in what way, by what we do, we’re done,” he told the agents.

But with polls showing Mrs. Clinton holding a comfortable lead, Mr. Comey ended up plunging the F.B.I. into the molten center of a bitter election. Fearing the backlash that would come if it were revealed after the election that the F.B.I. had been investigating the next president and had kept it a secret, Mr. Comey sent a letter informing Congress that the case was reopened.

For Mr. Comey, keeping the F.B.I. out of politics is such a preoccupation that he once said he would never play basketball with President Barack Obama because of the appearance of being chummy with the man who appointed him. But in the final months of the presidential campaign, the leader of the nation’s pre-eminent law enforcement agency shaped the contours, if not the outcome, of the presidential race by his handling of the Clinton and Trump-related investigations.

An examination by The New York Times, based on interviews with more than 30 current and former law enforcement, congressional and other government officials, found that while partisanship was not a factor in Mr. Comey’s approach to the two investigations, he handled them in starkly different ways. In the case of Mrs. Clinton, he rewrote the script, partly based on the F.B.I.’s expectation that she would win and fearing the bureau would be accused of helping her. In the case of Mr. Trump, he conducted the investigation by the book, with the F.B.I.’s traditional secrecy. Many of the officials discussed the investigations on the condition of anonymity because they were not authorized to speak to reporters.

Mr. Comey made those decisions with the supreme self-confidence of a former prosecutor who, in a distinguished career, has cultivated a reputation for what supporters see as fierce independence, and detractors view as media-savvy arrogance.

The Times found that this go-it-alone strategy was shaped by his distrust of senior officials at the Justice Department, who he and other F.B.I. officials felt had provided Mrs. Clinton with political cover. The distrust extended to his boss, Loretta E. Lynch, the attorney general, who Mr. Comey believed had subtly helped play down the Clinton investigation.

His misgivings were only fueled by the discovery last year of a document written by a Democratic operative that seemed — at least in the eyes of Mr. Comey and his aides — to raise questions about her independence. In a bizarre example of how tangled the F.B.I. investigations had become, the document had been stolen by Russian hackers.

The examination also showed that at one point, President Obama himself was reluctant to disclose the suspected Russian influence in the election last summer, for fear his administration would be accused of meddling.

Mr. Comey, the highest-profile F.B.I. director since J. Edgar Hoover, has not squarely addressed his decisions last year. He has touched on them only obliquely, asserting that the F.B.I. is blind to partisan considerations. “We’re not considering whose ox will be gored by this action or that action, whose fortune will be helped,” he said at a public event recently. “We just don’t care. We can’t care. We only ask: ‘What are the facts? What is the law?’”

But circumstances and choices landed him in uncharted and perhaps unwanted territory, as he made what he thought were the least damaging choices from even less desirable alternatives.

“This was unique in the history of the F.B.I.,” said Michael B. Steinbach, the former senior national security official at the F.B.I., who worked closely with Mr. Comey, describing the circumstances the agency faced last year while investigating both the Republican and Democratic candidates for president. “People say, ‘This has never been done before.’ Well, there never was a before. Or ‘That’s not normally how you do it.’ There wasn’t anything normal about this.”

‘Federal Bureau of Matters’

Attorney General Loretta E. Lynch and Mr. Comey during a news conference in Brooklyn in May 2015. Both had been federal prosecutors in New York, Mr. Comey in Manhattan and Ms. Lynch in Brooklyn. Credit Sam Hodgson for The New York Times 

The F.B.I.’s involvement with Mrs. Clinton’s emails began in July 2015 when it received a letter from the inspector general for the intelligence community.

The letter said that classified information had been found on Mrs. Clinton’s home email server, which she had used as secretary of state. The secret email setup was already proving to be a damaging issue in her presidential campaign.

Mr. Comey’s deputies quickly concluded that there was reasonable evidence that a crime may have occurred in the way classified materials were handled, and that the F.B.I. had to investigate. “We knew as an organization that we didn’t have a choice,” said John Giacalone, a former mob investigator who had risen to become the F.B.I.’s top national security official.

On July 10, 2015, the F.B.I. opened a criminal investigation, code-named “Midyear,” into Mrs. Clinton’s handling of classified information. The Midyear team included two dozen investigators led by a senior analyst and by an experienced F.B.I. supervisor, Peter Strzok, a former Army officer who had worked on some of the most secretive investigations in recent years involving Russian and Chinese espionage.

There was controversy almost immediately.

Responding to questions from The Times, the Justice Department confirmed that it had received a criminal referral — the first step toward a criminal investigation — over Mrs. Clinton’s handling of classified information.

But the next morning, the department revised its statement.

“The department has received a referral related to the potential compromise of classified information,” the new statement read. “It is not a criminal referral.”

The Justice Department knew a criminal investigation was underway, but officials said they were being technically accurate about the nature of the referral. Some at the F.B.I. suspected that Democratic appointees were playing semantic games to help Mrs. Clinton, who immediately seized on the statement to play down the issue. “It is not a criminal investigation,” she said, incorrectly. “It is a security review.”

In September of that year, as Mr. Comey prepared for his first public questions about the case at congressional hearings and press briefings, he went across the street to the Justice Department to meet with Ms. Lynch and her staff.

Both had been federal prosecutors in New York — Mr. Comey in the Manhattan limelight, Ms. Lynch in the lower-wattage Brooklyn office. The 6-foot-8 Mr. Comey commanded a room and the spotlight. Ms. Lynch, 5 feet tall, was known for being cautious and relentlessly on message. In her five months as attorney general, she had shown no sign of changing her style.

At the meeting, everyone agreed that Mr. Comey should not reveal details about the Clinton investigation. But Ms. Lynch told him to be even more circumspect: Do not even call it an investigation, she said, according to three people who attended the meeting. Call it a “matter.”

Ms. Lynch reasoned that the word “investigation” would raise other questions: What charges were being investigated? Who was the target? But most important, she believed that the department should stick by its policy of not confirming investigations.

It was a by-the-book decision. But Mr. Comey and other F.B.I. officials regarded it as disingenuous in an investigation that was so widely known. And Mr. Comey was concerned that a Democratic attorney general was asking him to be misleading and line up his talking points with Mrs. Clinton’s campaign, according to people who spoke with him afterward.

As the meeting broke up, George Z. Toscas, a national security prosecutor, ribbed Mr. Comey. “I guess you’re the Federal Bureau of Matters now,” Mr. Toscas said, according to two people who were there.

Despite his concerns, Mr. Comey avoided calling it an investigation. “I am confident we have the resources and the personnel assigned to the matter,” Mr. Comey told reporters days after the meeting.

The F.B.I. investigation into Mrs. Clinton’s email server was the biggest political story in the country in the fall of 2015. But something much bigger was happening in Washington. And nobody recognized it.

While agents were investigating Mrs. Clinton, the Democratic National Committee’s computer system was compromised. It appeared to have been the work of Russian hackers.

The significance of this moment is obvious now, but it did not immediately cause alarm at the F.B.I. or the Justice Department.

Months passed before the D.N.C. and the F.B.I. met to address the hacks. And it would take more than a year for the government to conclude that the Russian president, Vladimir V. Putin, had an audacious plan to steer the outcome of an American election.

 Missing Emails

Despite moments of tension between leaders of the F.B.I. and the Justice Department, agents and prosecutors working on the case made progress. “The investigative team did a thorough job,” Mr. Giacalone said. “They left no stone unturned.”

They knew it would not be enough to prove that Mrs. Clinton was sloppy or careless. To bring charges, they needed evidence that she knowingly received classified information or set up her server for that purpose.

A Hot Tarmac

A chance encounter set those plans in motion.

In late June, Ms. Lynch’s plane touched down at Phoenix Sky Harbor International Airport as part of her nationwide tour of police departments. Former President Bill Clinton was also in Phoenix that day, leaving from the same tarmac.

Ms. Lynch’s staff loaded into vans, leaving the attorney general and her husband on board. Mr. Clinton’s Secret Service agents mingled with her security team. When the former president learned who was on the plane, his aides say, he asked to say hello.

Mr. Clinton’s aides say he intended only to greet Ms. Lynch as she disembarked. But Ms. Lynch later told colleagues that the message she received — relayed from one security team to another — was that Mr. Clinton wanted to come aboard, and she agreed.

When Ms. Lynch’s staff members noticed Mr. Clinton boarding the plane, a press aide hurriedly called the Justice Department’s communications director, Melanie Newman, who said to break up the meeting immediately. A staff member rushed to stop it, but by the time the conversation ended, Mr. Clinton had been on the plane for about 20 minutes.

Ms. Lynch said she would not step aside but would accept whatever career prosecutors and the F.B.I. recommended on the Clinton case — something she had planned to do all along.

The script had been edited and revised several times, former officials said. Mr. Strzok, Mr. Steinbach, lawyers and others debated every phrase. Speaking so openly about a closed case is rare, and the decision to do so was not unanimous, officials said. But the team ultimately agreed that there was an obligation to inform American voters.

Mr. Comey’s criticism — his description of her carelessness — was the most controversial part of the speech. Agents and prosecutors have been reprimanded for injecting their legal conclusions with personal opinions. But those close to Mr. Comey say he has no regrets.

By scolding Mrs. Clinton, Mr. Comey was speaking not only to voters but to his own agents. While they agreed that Mrs. Clinton should not face charges, many viewed her conduct as inexcusable. Mr. Comey’s remarks made clear that the F.B.I. did not approve.

At the Justice Department, frustrated prosecutors said Mr. Comey should have consulted with them first. Mrs. Clinton’s supporters said that Mr. Comey’s condemnations seemed to make an oblique case for charging her, undermining the effect of his decision.

In the days after the announcement, Mr. Comey and Ms. Lynch each testified before Congress, with different results. Neither the F.B.I. nor the Justice Department normally gives Congress a fact-by-fact recounting of its investigations, and Ms. Lynch spent five hours avoiding doing so.

“I know that this is a frustrating exercise for you,” she told the House Judiciary Committee.

Mr. Comey discussed his decision to close the investigation and renewed his criticism of Mrs. Clinton.

And with both parties angry at him, he had proved yet again that he was willing to speak his mind, regardless of the blowback. He seemed to have safely piloted the F.B.I. through the storm of a presidential election.

But as Mr. Comey moved past one tumultuous investigation, another was about to heat up.

Russia Rising

Days after Mr. Comey’s news conference, Carter Page, an American businessman, gave a speech in Moscow criticizing American foreign policy. Such a trip would typically be unremarkable, but Mr. Page had previously been under F.B.I. scrutiny years earlier, as he was believed to have been marked for recruitment by Russian spies. And he was now a foreign policy adviser to Mr. Trump.

“Russia, if you’re listening,” he said, “I hope you’ll be able to find the 30,000 emails that are missing.”

In late July, the F.B.I. opened an investigation into possible collusion between members of Mr. Trump’s campaign and Russian operatives. Besides Mr. Comey and a small team of agents, officials said, only a dozen or so people at the F.B.I. knew about the investigation. Mr. Strzok, just days removed from the Clinton case, was selected to supervise it.

In late August, Mr. Comey and his deputies were briefed on a provocative set of documents about purported dealings between shadowy Russian figures and Mr. Trump’s campaign. One report, filled with references to secret meetings, spoke ominously of Mr. Trump’s “compromising relationship with the Kremlin” and threats of “blackmail.”

Mr. Steele had been a covert agent for MI6 in Moscow, maintained deep ties with Russians and worked with the F.B.I., but his claims were largely unverified. It was increasingly clear at the F.B.I. that Russia was trying to interfere with the election.

As the F.B.I. plunged deeper into that investigation, Mr. Comey became convinced that the American public needed to understand the scope of the foreign interference and be “inoculated” against it.

The president replied that going public would play right into Russia’s hands by sowing doubts about the election’s legitimacy. Mr. Trump was already saying the system was “rigged,” and if the Obama administration accused Russia of interference, Republicans could accuse the White House of stoking national security fears to help Mrs. Clinton.

Mr. Comey argued that he had unique credibility to call out the Russians and avoid that criticism. After all, he said, he had just chastised Mrs. Clinton at his news conference.

But John O. Brennan, the C.I.A. director, was so concerned about the Russian threat that he gave an unusual private briefing in the late summer to Harry Reid, then the Senate Democratic leader.

Mr. Comey knew the investigation of the Trump campaign was just underway, and keeping with policy, he said nothing about it.

Mr. Reid’s letter sparked frenzied speculation about what the F.B.I. was doing. At a congressional hearing in September, Representative Jerrold Nadler, Democrat of New York, pressed Mr. Comey for an explanation, citing his willingness to give details about his investigation of Mrs. Clinton.

But Mr. Comey never considered disclosing the case. Doing so, he believed, would have undermined an active investigation and cast public suspicion on people the F.B.I. could not be sure were implicated.

“I’m not confirming that we’re investigating people associated with Mr. Trump,” Mr. Comey said to Mr. Nadler. “In the matter of the email investigation, it was our judgment — my judgment and the rest of the F.B.I.’s judgment — that those were exceptional circumstances.”

Even in classified briefings with House and Senate intelligence committee members, Mr. Comey repeatedly declined to answer questions about whether there was an investigation of the Trump campaign.

To Mr. Comey’s allies, the two investigations were totally different. One was closed when he spoke about it. The other was continuing, highly classified and in its earliest stages. Much of the debate over Mr. Comey’s actions over the last seven months can be distilled into whether people make that same distinction.

The agent said that if Mr. Steele could get solid corroboration of his reports, the F.B.I. would pay him $50,000 for his efforts, according to two people familiar with the offer. Ultimately, he was not paid.

But by fall, the gravity of the Russian effort to affect the presidential election had become clear.

The D.N.C. hack and others like it had once appeared to be standard Russian tactics to tarnish a Western democracy. After the WikiLeaks disclosures and subsequent leaks by a Russian group using the name DCLeaks, agents and analysts began to realize that Moscow was not just meddling. It was trying to tip the election away from Mrs. Clinton and toward Mr. Trump.

At their second meeting, Mr. Comey argued that it would look too political for the F.B.I. to comment so close to the election, according to several people in attendance. Officials in the room felt whiplashed. Two months earlier, Mr. Comey had been willing to put his name on a newspaper article; now he was refusing to sign on to an official assessment of the intelligence community.

That night, WikiLeaks began posting thousands of hacked emails from another source: the private email account of John D. Podesta, chairman of the Clinton campaign.

The emails included embarrassing messages between campaign staff members and excerpts from Mrs. Clinton’s speeches to Wall Street. The disclosure further convinced the F.B.I. that it had initially misread Russia’s intentions.

“You may be aware that your emails have been hacked,” an agent told him.

Mr. Podesta laughed. The same agency that had so thoroughly investigated Mrs. Clinton, he said, seemed painfully slow at responding to Russian hacking.

“Yes,” he answered. “I’m aware.”

Supplementing the Record

The Daily Mail, a British tabloid, was first with the salacious story: Anthony D. Weiner, the former New York congressman, had exchanged sexually charged messages with a 15-year-old girl.

F.B.I. agents in New York seized Mr. Weiner’s laptop in early October. The investigation was just one of many in the New York office and was not treated with great urgency, officials said. Further slowing the investigation, the F.B.I. software used to catalog the computer files kept crashing.

Eventually, investigators realized that they had hundreds of thousands of emails, many of which belonged to Ms. Abedin and had been backed up to her husband’s computer.

Neither Mr. Comey nor Ms. Lynch was concerned. Agents had discovered devices before in the Clinton investigation (old cellphones, for example) that turned up no new evidence.

Then, agents in New York who were searching image files on Mr. Weiner’s computer discovered a State Department document containing the initials H.R.C. — Hillary Rodham Clinton. They found messages linked to Mrs. Clinton’s home server.

And they made another surprising discovery: evidence that some of the emails had moved through Mrs. Clinton’s old BlackBerry server, the one she used before moving to her home server. If Mrs. Clinton had intended to conceal something, agents had always believed, the evidence might be in those emails. But reading them would require another search warrant, essentially reopening the Clinton investigation.

The election was two weeks away.

Mr. Comey learned of the Clinton emails on the evening of Oct. 26 and gathered his team the next morning to discuss the development.

Seeking a new warrant was an easy decision. He had a thornier issue on his mind.

Back in July, he told Congress that the Clinton investigation was closed. What was his obligation, he asked, to acknowledge that this was no longer true?

It was a perilous idea. It would push the F.B.I. back into the political arena, weeks after refusing to confirm the active investigation of the Trump campaign and declining to accuse Russia of hacking.

The question consumed hours of conference calls and meetings. Agents felt they had two options: Tell Congress about the search, which everyone acknowledged would create a political furor, or keep it quiet, which followed policy and tradition but carried its own risk, especially if the F.B.I. found new evidence in the emails.

“In my mind at the time, Clinton is likely to win,” Mr. Steinbach said. “It’s pretty apparent. So what happens after the election, in November or December? How do we say to the American public: ‘Hey, we found some things that might be problematic. But we didn’t tell you about it before you voted’? The damage to our organization would have been irreparable.”

Conservative news outlets had already branded Mr. Comey a Clinton toady. That same week, the cover of National Review featured a story on “James Comey’s Dereliction,” and a cartoon of a hapless Mr. Comey shrugging as Mrs. Clinton smashed her laptop with a sledgehammer.

Congressional Republicans were preparing for years of hearings during a Clinton presidency. If Mr. Comey became the subject of those hearings, F.B.I. officials feared, it would hobble the agency and harm its reputation. “I don’t think the organization would have survived that,” Mr. Steinbach said.

The assumption was that the email review would take many weeks or months. “If we thought we could be done in a week,” Mr. Steinbach said, “we wouldn’t say anything.”

The spirited debate continued when Mr. Comey reassembled his team later that day. F.B.I. lawyers raised concerns, former officials said. But in the end, Mr. Comey said he felt obligated to tell Congress.

“I went back and forth, changing my mind several times,” Mr. Steinbach recalled. “Ultimately, it was the right call.”

That afternoon, Mr. Comey’s chief of staff called the office of Ms. Yates, the deputy attorney general, and revealed the plan.

When Ms. Lynch was told, she was both stunned and confused. While the Justice Department’s rules on “election year sensitivities” do not expressly forbid making comments close to an election, administrations of both parties have interpreted them as a broad prohibition against anything that may influence a political outcome.

Ms. Lynch understood Mr. Comey’s predicament, but not his hurry. In a series of phone calls, her aides told Mr. Comey’s deputies that there was no need to tell Congress anything until agents knew what the emails contained.

Either Ms. Lynch or Ms. Yates could have ordered Mr. Comey not to send the letter, but their aides argued against it. If Ms. Lynch issued the order and Mr. Comey obeyed, she risked the same fate that Mr. Comey feared: accusations of political interference and favoritism by a Democratic attorney general.

If Mr. Comey disregarded her order and sent the letter — a real possibility, her aides thought — it would be an act of insubordination that would force her to consider firing him, aggravating the situation.

Document

Letter to Congress From F.B.I. Director on Clinton Email Case

In the letter, the F.B.I. director, James B. Comey, said that new emails had surfaced in a case unrelated to the closed investigation into whether Hillary Clinton or her aides had mishandled classified information, and that the messages “appear to be pertinent to the investigation.”

So the debate ended at the staff level, with the Justice Department imploring the F.B.I. to follow protocol and stay out of the campaign’s final days. Ms. Lynch never called Mr. Comey herself.

The next morning, Friday, Oct. 28, Mr. Comey wrote to Congress, “In connection with an unrelated case, the F.B.I. has learned of the existence of emails that appear to be pertinent to the investigation.”

His letter became public within minutes. Representative Jason Chaffetz of Utah, a Republican and a leading antagonist of Mrs. Clinton’s, jubilantly announced on Twitter, “Case reopened.”

‘This Changes Everything’

The Clinton team was outraged. Even at the F.B.I., agents who supported their high-profile director were stunned. They knew the letter would call into question the F.B.I.’s political independence.

Mr. Trump immediately mentioned it on the campaign trail. “As you might have heard,” Mr. Trump told supporters in Maine, “earlier today, the F.B.I. … ” The crowd interrupted with a roar. Everyone had heard.

Polls almost immediately showed Mrs. Clinton’s support declining. Presidential races nearly always tighten in the final days, but some political scientists reported a measurable “Comey effect.”

“This changes everything,” Mr. Trump said.

Mr. Comey explained in an email to his agents that Congress needed to be notified. “It would be misleading to the American people were we not to supplement the record,” he wrote.

But many agents were not satisfied.

At the Justice Department, career prosecutors and political appointees privately criticized not only Mr. Comey for sending the letter but also Ms. Lynch and Ms. Yates for not stopping him. Many saw the letter as the logical result of years of not reining him in.

Mr. Comey told Congress that he had no idea how long the email review would take, but Ms. Lynch promised every resource needed to complete it before Election Day.

At the F.B.I., the Clinton investigative team was reassembled, and the Justice Department obtained a warrant to read emails to or from Mrs. Clinton during her time at the State Department. As it turned out, only about 50,000 emails met those criteria, far fewer than anticipated, officials said, and the F.B.I. had already seen many of them.

Mr. Comey was again under fire. Former Justice Department officials from both parties wrote a Washington Post op-ed piece titled “James Comey Is Damaging Our Democracy.”

At a Justice Department memorial for Mr. Margolis, organizers removed all the chairs from the stage, avoiding the awkward scene of Mr. Comey sitting beside some of his sharpest critics.

Jamie S. Gorelick, a deputy attorney general during the Clinton administration, eulogized Mr. Margolis for unfailingly following the rules, even when facing unpopular options. Audience members heard it as a veiled critique of both Mr. Comey and Ms. Lynch.

On Nov. 5, three days before Election Day, Mr. Strzok and his team had 3,000 emails left to review. That night, they ordered pizza and dug in. At about 2 a.m., Mr. Strzok wrote an email to Mr. Comey and scheduled it to send at 6 a.m. They were finished.

A few hours later, Mr. Strzok and his team were back in Mr. Comey’s conference room for a final briefing: Only about 3,000 emails had been potentially work-related. A dozen or so email chains contained classified information, but the F.B.I. had already seen it.

And agents had found no emails from the BlackBerry server during the crucial period when Mrs. Clinton was at the State Department.

Nothing had changed what Mr. Comey had said in July.

That conclusion was met with a mixture of relief and angst. Everyone at the meeting knew that the question would quickly turn to whether Mr. Comey’s letter had been necessary.

That afternoon, Mr. Comey sent a second letter to Congress. “Based on our review,” he wrote, “we have not changed our conclusions.”

Political Consequences

Mr. Comey did not vote on Election Day, records show, the first time he skipped a national election, according to friends. But the director of the F.B.I. was a central story line on every television station as Mr. Trump swept to an upset victory.

Many factors explained Mr. Trump’s success, but Mrs. Clinton blamed just one. “Our analysis is that Comey’s letter — raising doubts that were groundless, baseless, proven to be — stopped our momentum,” she told donors a few days after the election. She pointed to polling data showing that late-deciding voters chose Mr. Trump in unusually large numbers.

Even many Democrats believe that this analysis ignores other factors, but at the F.B.I., the accusation stung. Agents are used to criticism and second-guessing. Rarely has the agency been accused of political favoritism or, worse, tipping an election.

For all the attention on Mrs. Clinton’s emails, history is likely to see Russian influence as the more significant story of the 2016 election. Questions about Russian meddling and possible collusion have marred Mr. Trump’s first 100 days in the White House, cost him his national security adviser and triggered two congressional investigations. Despite Mr. Trump’s assertions that “Russia is fake news,” the White House has been unable to escape its shadow.

Mr. Comey has told friends that he has no regrets, about either the July news conference or the October letter or his handling of the Russia investigation. Confidants like Mr. Richman say he was constrained by circumstance while “navigating waters in which every move has political consequences.”

But officials and others close to him also acknowledge that Mr. Comey has been changed by the tumultuous year.

Early on Saturday, March 4, the president accused Mr. Obama on Twitter of illegally wiretapping Trump Tower in Manhattan. Mr. Comey believed the government should forcefully denounce that claim. But this time he took a different approach. He asked the Justice Department to correct the record. When officials there refused, Mr. Comey followed orders and said nothing publicly.

“Comey should say this on the record,” said Tommy Vietor, a National Security Council spokesman in the Obama administration. “He’s already shattered all norms about commenting on ongoing investigations.”

Mr. Richman sees no conflict, but rather “a consistent pattern of someone trying to act with independence and integrity, but within established channels.”

“His approach to the Russia investigation fits this pattern,” he added.

But perhaps the most telling sign that Mr. Comey may have had enough of being Washington’s Lone Ranger occurred last month before the House Intelligence Committee.

Early in the hearing, Mr. Comey acknowledged for the first time what had been widely reported: The F.B.I. was investigating members of the Trump campaign for possible collusion with Russia.

Yet the independent-minded F.B.I. director struck a collaborative tone. “I have been authorized by the Department of Justice to confirm,” he began, ushering in the next phase of his extraordinary moment in national politics.

Mr. Comey was still in the spotlight, but no longer alone.