You are on page 1of 2

\O~gAj"\~~T

j3
O

OFFICE OF INSPECTOR GENERAL

Oy~~AND SE~'J~

Department of Homeland Security


Washington, DC 20528 / www.oig.dhs.gov

JAN 1 7 ~Dlj

The Honorable Brian P. Kemp


Secretary of State
State of Georgia
214 State Capitol
Atlanta, GA 30334
Dear Secretary Kemp:
The Department of Homeland Security (DHS) Office of Inspector General
(OIG) is investigating a series of ten alleged scanning events of the
Georgia Secretary of State's network that may have originated from DHSaffiliated IP addresses. The U.S. House of Representatives, Committee on
Oversight and Government Reform has forwarded us your prior
correspondence with Secretary Johnson and President-Elect Trump on
this issue and has asked us to investigate the allegations raised in your
letters.
Pursuant to the Inspector General Act, 5 U.S.C. App., DHS OIG has the
duty and responsibility to conduct and supervise audits and
investigations, to promote economy, efficiency and effectiveness in the
administration of, and to prevent and detect fraud and abuse in and
relating to, the programs and operations of DHS. DHS OIG is an
independent and objective agency within DHS and thus our investigation
is also separate and independent of any other inquiries conducted by
other DHS offices.
In order to thoroughly investigate these allegations, we request that you
provide us with the following documentation and information:
1. Any web (HTTPD) logs and network (netflow) logs from one hour
before and after the following dates/times on the activity from IP
Address 216.81.81.80 or any other IP address that you believe may
be associated with DHS:
a. February 2, 2016, at 13:03 CST
b. February 28, 2016, at 13:19 CST
c. May 23, 2016, at 08:42 CDT
d. September 12, 2016, at 11:52 CDT

y.

OF,4P~~F~.
T

~
s
~~~

OFFICE OF INSPECTOR GENERAL


Department of Homeland Security

o~~~gND SE~"J~

e.
f.
g.
h.
i.
j.

September 28, 2016, at 07:54 CDT


October 3, 2016, at 10:41 CDT
October 6, 2016, at 10:14 CDT
November 7, 2016, at 12:15 CST
November 8, 2016, at 07:35 CST
November 15, 2016, at 07:43 CST

2. Any intrusion detection alerts that resulted from the above activity,
including the alert details.
3. Any other information that you believe evidences or indicates DHS
attempts to breach your network or any other information that you
believe will be helpful to our investigation.
Your cooperation with this investigation is necessary for us to be able to
fully and properly investigate the allegations you have raised, and we
thank you in advance for your assistance.
Please call me with any questions, or your staff may contact Chad Steel,
Special Agent in Charge, Digital Forensics and Analysis Unit,
at (202) 254-4093.
Sincerely,
(~U~

John Roth
Inspector General

You might also like