O gAj T j3 O z OFFICE OF INSPECTOR GENERAL Oy AND SE 'J Department of Homeland Security Washington DC 20528 www oig dhs gov JAN 1 7 Dlj The Honorable Brian P Kemp Secretary of State State of Georgia 214 State Capitol Atlanta GA 30334 Dear Secretary Kemp The Department of Homeland Security DHS Office of Inspector General OIG is investigating a series of ten alleged scanning events of the Georgia Secretary of State's network that may have originated from DHSaffiliated IP addresses The U S House of Representatives Committee on Oversight and Government Reform has forwarded us your prior correspondence with Secretary Johnson and President-Elect Trump on this issue and has asked us to investigate the allegations raised in your letters Pursuant to the Inspector General Act 5 U S C App DHS OIG has the duty and responsibility to conduct and supervise audits and investigations to promote economy efficiency and effectiveness in the administration of and to prevent and detect fraud and abuse in and relating to the programs and operations of DHS DHS OIG is an independent and objective agency within DHS and thus our investigation is also separate and independent of any other inquiries conducted by other DHS offices In order to thoroughly investigate these allegations we request that you provide us with the following documentation and information 1 Any web HTTPD logs and network netflow logs from one hour before and after the following dates times on the activity from IP Address 216 81 81 80 or any other IP address that you believe may be associated with DHS a February 2 2016 at 13 03 CST b February 28 2016 at 13 19 CST c May 23 2016 at 08 42 CDT d September 12 2016 at 11 52 CDT y OF 4P F T s OFFICE OF INSPECTOR GENERAL Department of Homeland Security o gND SE J e f g h i j September 28 2016 at 07 54 CDT October 3 2016 at 10 41 CDT October 6 2016 at 10 14 CDT November 7 2016 at 12 15 CST November 8 2016 at 07 35 CST November 15 2016 at 07 43 CST 2 Any intrusion detection alerts that resulted from the above activity including the alert details 3 Any other information that you believe evidences or indicates DHS attempts to breach your network or any other information that you believe will be helpful to our investigation Your cooperation with this investigation is necessary for us to be able to fully and properly investigate the allegations you have raised and we thank you in advance for your assistance Please call me with any questions or your staff may contact Chad Steel Special Agent in Charge Digital Forensics and Analysis Unit at 202 254-4093 Sincerely U v John Roth Inspector General E                     National Security Archive    Suite 701  Gelman Library  The George Washington University    2130 H Street  NW  Washington  D C  20037    Phone  202 994‐7000  Fax  202 994‐7005  nsarchiv@gwu edu