FBI Intelligence Investigations of Jeffrey Epstein

A Forensic Reconstruction from the EFTA Corpus

The FBI had at least five intelligence case numbers connected to Jeffrey Epstein, running from 2017 through at least 2022, across field offices in New York, Los Angeles, Dallas, Birmingham, Buffalo, Albuquerque, and San Juan. The criminal investigations are well known. The parallel intelligence track is not.

Table of Contents

1. The Case Files
2. The Sources
3. The Intelligence Products
4. The External Partners
5. The Timeline
6. The "No Investigative Value" Paradox
7. Credibility Assessment
8. What We Can Reconstruct

Part 1: The Case Files

How FBI Case Numbers Work

Before mapping the cases, a brief primer on the FBI's case numbering system — the Universal Case File Number (UCFN). Every FBI case file is assigned a number in the format [Classification][Suffix]-[FieldOffice]-[SequentialNumber]. For example, 813B-NY-2928278 decodes as:

• 813 = The classification number — this identifies what kind of case it is. The FBI maintains hundreds of classifications; the most complete public mapping is a researcher reconstruction derived from FBI records in National Archives Record Group 65 (the FBI has never officially published the full modern list). The 800-series covers intelligence programs: 800 = Intelligence Program, 801 = International/Domestic Terrorism, 802 = Counterintelligence, 803 = Cyber, 804 = Criminal. Classifications 808 through 814 are all labeled "Foreign Intelligence Program" in the NARA-derived records — likely each corresponding to a specific country or region (the specific mapping is classified).
• B = A sub-type suffix within the classification. These vary by classification — for example, in the 266 threat classification, "N" designates White Racially Motivated Violent Extremism and "K" designates Black RMVE. The specific meaning of "B" within 813 is not publicly documented.
• NY = Field Office of Origin (New York)
• 2928278 = Sequential case file number

Case files can also have sub-files (e.g., -INTELPRODS for intelligence products, -GJ for grand jury material) and individual documents within a case receive serial numbers (Serial 1, Serial 2, etc.).

Importantly, under the FBI's Domestic Investigations and Operations Guide, all three levels of investigative activity — assessments, preliminary investigations, and full investigations — generate case file numbers in the Sentinel case management system. A 2024 DOJ Inspector General audit confirmed that even assessments opened in the FBI's Guardian intake system create "parallel case[s] opened in Sentinel." This means a case number alone does not tell us the investigation's level — only its subject matter, location, and type.

The Four Criminal Investigations

The FBI's Epstein investigations are generally discussed as one story: the child sex trafficking case that led to his 2019 arrest. In reality, the EFTA corpus reveals at least nine distinct case numbers across four criminal investigations, multiple intelligence sub-files, and at least one standalone foreign intelligence case.

The Four Criminal Investigations

These are well-documented. The briefing deck at EFTA00164939 lays out all four on its title page. But the corpus also reveals case numbers that fall outside this framework entirely.

The Intelligence Cases

Plus sub-files:

What the Prefixes Mean

FBI case numbers encode their purpose. While the FBI's full classification guide is not public, the documents themselves reveal the system:

• 31E: Child Exploitation investigations — the original Miami case used this prefix (EFTA00164941)
• 50D: Human Trafficking / Sex Trafficking investigations — the SDNY case (EFTA00164943)
• 72: Obstruction of Justice (EFTA00164942)
• 90A: Death Investigation (EFTA00164950)
• 813B: Foreign Intelligence Program — classification 813 covers the FBI's Foreign Intelligence Program. The "B" suffix designates a sub-file type. This case was derived from the FBI's National Security Information Classification Guide (EFTA01683874)
• 804I: Intelligence products and assessments — appears across four field offices in cases ranging from election influence to transnational organized crime
• 266N: Domestic terrorism / threat assessment — the Birmingham case tracking the Black Book's appearance on extremist Telegram channels (EFTA00174673)

The INTELPRODS suffix designates a sub-file within a case specifically for intelligence products — Tactical Intelligence Reports (TIRs), Intelligence Notes (INs), and other analytical work product. These are distinct from evidentiary serials: they're produced by the Intelligence Division, not the criminal squads.

The Significance of 813B-NY-2928278

Classification 813 — "Foreign Intelligence Program" per the NARA-derived classification list — sits within the FBI's 800-series intelligence classifications (800 = Intelligence Program, 801 = International/Domestic Terrorism, 802 = Counterintelligence, 803 = Cyber, 804 = Criminal intelligence). While the FBI has not officially published the modern classification list, the 813 designation is independently corroborated by the document's treatment: SECRET//NOFORN classification derived from the FBI's National Security Information Classification Guide, an intelligence division squad (ID 25) as the handling unit, and a 25-year declassification timeline standard for national security material. An 813 case, based on the available evidence, is a foreign intelligence matter, not a criminal investigation.

The 2017 FD-1023 filed under case 813B-NY-2928278 is the only document in the corpus that shows Epstein as the subject of a foreign intelligence case. It was filed by New York Field Office Squad ID 25 — an intelligence division squad, not a criminal squad like C-20 (which handled the trafficking case). The classification is derived from the FBI NSIC (National Security Information Classification Guide), and the declassification date is 2042-12-31 — 25 years out, the standard for national security material.

Whether the FBI formally opened 813B-NY-2928278 as a full investigation, a preliminary inquiry, or merely an assessment cannot be determined from the FD-1023 alone. Under the FBI's Domestic Investigations and Operations Guide, all three levels generate case file numbers in Sentinel. An assessment — the lowest threshold, requiring only an "authorized purpose and clearly defined objective(s)" rather than the "articulable factual basis" needed for predicated investigations — can still generate a dedicated case number, receive serialized CHS reports, and carry classification markings. The existence of a case number, a serialized FD-1023, an assigned intelligence squad, and SECRET//NOFORN classification is consistent with any of the three levels. What is clear is that the FBI's intelligence division was running Epstein-related material through a foreign intelligence case file 18 months before the SDNY criminal investigation opened in December 2018.

Part 2: The Sources

The Sentinel File Review (EFTA01649074) maps every Confidential Human Source who reported on Epstein matters. Combined with a second, nearly identical file review at EFTA01657282, we can reconstruct the full CHS landscape.

50D-NY-3027571 (SDNY Trafficking Case) — CHS Reports

31E-MM-108062 (Miami Case) — CHS Reports

813B-NY-2928278 (Foreign Intelligence Case) — CHS Reports

Source Profiles

Source S-00099701 — Los Angeles, Squad I-01

The most prolific intelligence source in the Epstein corpus. This CHS filed at least five reports between July and November 2020, spanning both criminal and intelligence case files.

Contact method: Encrypted messaging application — an unusual detail that appears on multiple FD-1023s for this source (EFTA01245118, EFTA00090314).

Handling agent: SA Kevin Adam (named in EFTA01245118).

Reports filed:

1. Serial 473 (7/1/2020): Initial contact. CHS claimed to have information about Maxwell and Epstein's money laundering through Harvard. Stated "Dershowitz was controlled by the Israelis," identified Mitch Webber as a contact who "spoke with Maxwell all the time" during the first plea deal, and claimed Maxwell and Epstein were "investors" in technology for Reid Hoffman, Brock Pierce, and Thor Halvorssen. CHS stated: "Mind raping is what foreign spies do to steal technology know-how." Also claimed both Epstein and Maxwell were "Israeli spies" (EFTA01245118).

2. Serial 532 (10/16/2020): Filed under both 804I-LA-3315657-INTELPRODS and 50D-NY-3027571. The handling agent asked the CHS specifically about "improper domestic or foreign influence over the electoral process in the U.S." The CHS reported:
   - Dershowitz told Alex Acosta that Epstein "belonged to both U.S. and allied intelligence services"
   - After phone calls between Dershowitz and Epstein, "Mossad would then call Dershowitz to debrief"
   - Epstein "trained as a spy under" Ehud Barak
   - Masha Drokova (Day One Ventures) was in Silicon Valley to "steal technology"
   - Leon Black "owns the mercenary firm formerly known as Blackwater, now Constellis"
   - Synopsis: "Foreign influence on U.S. officials by Israel, Russia, and UAE"
   (EFTA00090314)

3. Serial 538 (11/3/2020): SECRET//NOFORN (per the briefing deck; the Sentinel export's overall classification field is redacted, but the visible synopsis portion marking is (S)). The primary case is fully redacted — initiated 9/8/2020, a case opened over a year after Epstein's death. Two additional cases listed, one being the trafficking case. Squad: I 03 (intelligence). Content: "(S) More information o..." — rest classified and redacted. This is one of the three S//NF serials the briefing deck identifies (EFTA01683595).

4. Serial 558: Referenced in the Sentinel File Review but the FD-1023 has not been identified separately in the corpus.

The import form for Serial 532 (EFTA00090310) reveals the 804I-LA case's full title: "2020 Election Influence Threat Assessment; FBI Los Angeles Area of Responsibility; Type 3 Assessment; Intelligence Products." The FBI was routing this CHS's Epstein-related intelligence reporting through an election influence threat assessment.

Credibility indicators: Mixed. The CHS had apparent access to Dershowitz and knowledge of the Epstein-Maxwell orbit. However, the claim that Leon Black "owns the mercenary firm formerly known as Blackwater, now Constellis" is factually incorrect — Constellis was owned by private equity firms including Cerberus Capital Management and later ACADEMI Holdings, not Leon Black. This error, noted by the FBI's own closure codes on the related FD-1023 from the same source, suggests the CHS was mixing genuine access with secondhand or open-source claims. The FBI assessed Serial 684 (from the related S-00104760 source) as "Contains Open Source Information" and "Does not meet DETAILED threshold."

Source S-00104760 — Los Angeles

Filed Serial 684, the SECRET//NOFORN FD-1023 dated 12/22/2021. This is a different source from S-00099701, though both operated from the LA field office. The report covers:

• Sue Desmond-Hellmann's departure from the Bill & Melinda Gates Foundation and Facebook board after the October 2019 New York Times article about Gates-Epstein meetings. The CHS reported that a "known U.S. person" (USPER) encountered Desmond-Hellmann at the "Alpha Club" in January 2020, where she appeared to have had a "miraculous recovery" from the illness she cited when resigning.
• Epstein was "running an Israeli state-sponsored technology collection and extortion operation"
• Maxwell's father Robert Maxwell "was a very wealthy Israeli Intelligence (Mossad) Agent"
• Epstein's operation "lured some of the most powerful and influential people in the world to his home, where they had the opportunity to have sex with young girls in lavish situations. This would have been recorded in some way, which could be used to control and extort non-cooperators"

(EFTA01683612)

FBI disposition: Three separate closure code assessments were conducted between January 20-27, 2022:
1. "Reports - Contains Operation Information" (completed 1/27/2022)
2. "Collection - Does not address an FBI requirement" (completed 1/24/2022)
3. "Reports - Contains Operation Information, Reports - Does not meet DETAILED threshold, Reports - Contains Open Source Information" (completed 1/20/2022)

The fastest closure (same day, 1/20/2022) applied the harshest assessment: the reporting contained open-source information and didn't meet the threshold for a Detailed Intelligence Information Report. The FBI was saying, in bureaucratic language, that this CHS was partly telling them things from newspapers.

Timeline verification: The CHS's account of Desmond-Hellmann's movements is broadly accurate but conflates two departures. The New York Times published its Gates-Epstein article on October 12, 2019. On October 30, 2019, Desmond-Hellmann departed Facebook's board, citing "increasing demands from my CEO role, my extended family, and my own health." On December 5, 2019, the Gates Foundation announced she was stepping down as CEO, effective February 1, 2020. She subsequently joined Pfizer's board and became a senior advisor to Google Ventures. The CHS reported she informed the Facebook board "just after publication" of the NYT article "during the same week" — the Facebook departure was announced 18 days later, not within the same week. The CHS's characterization of Desmond-Hellmann "panicking" and then pursuing high-level positions is interpretation, not verifiable fact. No public reporting directly links Desmond-Hellmann to Epstein, though in February 2026, Gates told foundation staff he "brought foundation executives to meetings with Jeffrey Epstein."

The 2017 New York CHS — Squad ID 25

Filed the SECRET//NOFORN FD-1023 under case 813B-NY-2928278 on 12/13/2017, based on a contact dated 11/27/2017 in New York City. The FBI described this as a source with whom they had "recently established a relationship."

The CHS reported:
- Epstein "had a compound in New Mexico where he lured and video recorded underage women"
- Epstein "was President Vladimir Putin's wealth manager and provided the same service for Zimbabwean President Robert Mugabe"
- Epstein "made his money from charging his clients fees to hide their money offshore"
- "In the spring of 2015, President Trump had just been to Epstein's property for lunch"
- Epstein had a "personal hacker" — an Italian citizen born in Calabria who developed zero-day exploits, sold them to GCHQ and Hezbollah, and "established the Saudi government's cyber surveillance program." This hacker's former company "was acquired by CrowdStrike in fall 2017"
- The hacker had a "Vatican City passport" and possibly Iranian and Israeli passports

(EFTA01683874)

The hacker: Following the EFTA release in January 2026, multiple outlets identified the individual as Vincenzo Iozzo, a former CrowdStrike senior director. Iozzo denied the characterization: "I was never Jeffrey Epstein's 'hacker,' nor did I do any hacking for him." However, emails in the EFTA corpus between Iozzo and Epstein independently confirm a relationship, lending some credibility to the CHS's claim of a connection while leaving the nature of that relationship disputed.

Chuck Johnson — Washington, D.C. (Phone Interview)

The only named source in the intelligence-related documents. The FD-302 at EFTA01683889 records a phone interview on 4/28/2020 with an individual whose alias is given as "Chuck Johnson." The document is classified SECRET//NOFORN with classification reason 1.4(b) — "foreign government information" and a declassification date of 2045-12-31.

The interview is almost entirely redacted across 9 pages. The one visible substantive passage states:

(U//FOUO) [REDACTED] expressed concern that JEFFREY EPSTEIN was an Israeli spy. He and BANNON may have had a business relationship and EPSTEIN paid BANNON with money from the Israelis. [REDACTED] referenced a news story about Israel and Stingray equipment found around the WH. BANNON may have utilized the technology to get information out of the WH.

Charles C. Johnson is a right-wing blogger and political operative who ran GotNews.com. He was permanently banned from Twitter in 2015 and was found liable for $40 million in a civil racketeering case in 2025. He operated in the orbit of Steve Bannon and Mike Cernovich. The FBI interviewed him not because they considered him a credible intelligence source, but because he had access to the Bannon-Epstein nexus.

The 1.4(b) classification — "foreign government information" — is the most legally significant detail in this document. Under Executive Order 13526 §1.4(b), this classification reason applies specifically to information "provided by a foreign government or governments, an international organization of governments, or any element thereof, with the expectation that the information, the source of the information, or both are to be held in confidence." This is not a classification for discussing foreign governments — it is a classification for protecting information that originated from a foreign government. The classification protects either the information itself, the fact that the foreign government provided it, or both.

In the context of a phone interview with a right-wing blogger, this raises a question with three possible answers. First, Johnson may have relayed — knowingly or unknowingly — material that originated from a foreign government. Second, his statements may have been evaluated against classified foreign government information the FBI already possessed, requiring the 1.4(b) marking to protect that comparison. Third, the redacted portions of the nine-page interview may have involved the FBI sharing or referencing FGI during questioning. All three scenarios would warrant the 1.4(b) classification; what's clear is that the interview intersected with foreign government-origin material — something beyond simply discussing foreign affairs.

The visible passage referencing "Israel and Stingray equipment found around the WH" may relate to confirmed reporting from September 2019 that Israel had placed cell-site simulators near the White House, based on U.S. intelligence assessments. If the FBI's Stingray findings originated from or were shared with a foreign government partner, that would independently explain the 1.4(b) marking.

Source S-00002345 — Birmingham, Squad 6

Filed Serial 117 on 8/23/2019 under case 266N-BH-2232077. This CHS is described with the strongest credibility language in the entire corpus: "An established source who is considered highly reliable and is responsive to tasking with both direct and indirect access, much of whose reporting has been corroborated and validated over the past eighteen years."

The report is mundane — the CHS flagged that an alt-right Telegram channel ("Alt-Right Shitlords," t.me/WhiteIsRight) had posted what purported to be "the Unredacted little black book" of Jeffrey Epstein. The CHS noted it included personal phone numbers for members of the Trump family and expressed concern about potential misuse by "spammers / blackmailers / journalists."

(EFTA00174673)

This was routed to New York's ID-13/C-20 (Intelligence/Criminal squads handling Epstein) via an email at EFTA00174672.

Source S-00019639 — Buffalo

Filed Serial 459 on 7/16/2020 via telephone. A minimal single tip: "CHS, who is not in a position to testify," reported that a woman had gone to Epstein's island years ago, received money, and "had sex on the island." No intelligence content — pure criminal lead forwarding (EFTA01245107).

Source S-00017284 — Dallas (Closed)

Filed Serial 222 on 8/13/2019. A walk-in at the FBI Dallas-Tyler Resident Agency whose sub-source, a journalist named Pat Matrisciana, claimed to have been in direct contact with Ghislaine Maxwell. The CHS offered to provide Maxwell's location in the "Washington, D.C. area." This was filed under both a Dallas 804I intelligence assessment and the trafficking case (EFTA01245082).

Sources from the Miami Case (31E-MM-108062)

• S-00000640: Serial 229. No FD-1023 identified in the corpus.
• S-00023871: Serials 228 and 232. No FD-1023 identified in the corpus.

These CHS reports from the original 2006-era investigation remain unidentified in the EFTA production.

Part 3: The Intelligence Products

The INTELPRODS sub-file under the SDNY case (50D-NY-3027571-INTELPRODS) contains 12 serialized intelligence products, all Tactical Intelligence Reports (TIRs), produced between August 2019 and March 2022.

A TIR is a finished intelligence product — an analytical assessment produced by the FBI's Intelligence Division that synthesizes raw information into actionable intelligence. TIRs are distinct from raw intelligence (FD-1023 CHS reports) and investigative documents (FD-302 interview reports). They represent the FBI's Intelligence Division working in support of criminal investigations.

The 12 INTELPRODS Serials

Note that Serials 10-12 are cross-filed to 804I-NY-304798-INTELPRODS — a standalone intelligence case for "Human Trafficking" intelligence products. This means the Intelligence Division was maintaining its own separate case file for Epstein-related analytical work beginning no later than March 2022.

The Two Production Phases

Phase 1 (October 2019): Five TIRs produced in rapid succession after Epstein's death (8/10/2019) and before Maxwell's arrest. The Intelligence Division was analyzing financial records (Bank Secrecy Act data), travel patterns, and toll records. These supported the pivot from Epstein to Maxwell.

Phase 2 (January-March 2022): Seven TIRs produced after Maxwell's conviction (12/29/2021). The travel records TIR (EFTA01731246) retroactively documented how intelligence analysis of TECS (Customs) records enabled Epstein's arrest. The remaining TIRs identified persons of interest and researched Maxwell defense witnesses — the Intelligence Division conducting background checks to support trial preparation.

The Intelligence Note

Beyond the TIR sub-file, the Intelligence Division produced a standalone Intelligence Note (IN) on April 6, 2022, filed under 804I-NY-304798-INTELPRODS:

(U//FOUO) Wealthy, Influential Individuals Involved in Sex Trafficking Likely Rely Primarily on Referrals and Career Enhancement Promises to Entice Victims, Representing an Expansion of Traditional Sex Trafficking Techniques

This 8-page analytical product assessed — with "medium confidence" — that wealthy traffickers like Epstein, Peter Nygard, R. Kelly, Harvey Weinstein, and Allison Mack used their social and financial capital to recruit victims in ways that "represent an expansion of traditional sex trafficking techniques." It was produced by ID-13 (Intelligence Division, Section 13) at FBI New York (EFTA00172536).

The Intelligence Note uses formal IC (Intelligence Community) analytical tradecraft: expressions of likelihood, confidence levels, source summary statements, and analysis of alternatives. It's formatted for FBI internal consumption only ("DO NOT DISSEMINATE EXTERNALLY") but uses the same analytical framework as products shared with the broader Intelligence Community.

The NY Intelligence Division Weekly Reports

Two weekly reports from the NY Intelligence Division confirm the operational integration between intelligence and criminal squads:

• December 17, 2021 (EFTA01683834): During the Maxwell trial, notes that an SOS (Special Operations Specialist) from the Intelligence Division testified on December 6-7, 2021 "at end of day and on 12/7 at beginning of day on the Maxwell trial regarding case 50D-NY-3027571." The SOS was working alongside the case agent and AUSAs during the trial.

• March 11, 2022 (EFTA01683846): Notes that "ID-13 SOS serialized a TIR on a person of interest in a child exploitation investigation to 50D-NY-3027571-INTELPRODS, serial 8." This confirms INTELPRODS Serial 8 was authored by an Intelligence Division SOS in ID-13.

Both reports are classified with declassification exemption 50X1-HUM — the permanent exemption for information that could reveal human intelligence sources (up to 75 years).

The Albuquerque Intelligence Note

A separate, unrelated 804I case — 804I-AQ-2482314 — produced a curious intelligence product. On August 12, 2020, FBI Albuquerque's INT-1 squad assessed that a historical artifact — a "Death Bell" missing from a New Mexico church since the 1930s — may have been housed at Epstein's Zorro Ranch, based on photos and videos showing what "appears to be a collection of New Mexico Colonial style artwork and artifacts in the residence" (EFTA00129048).

This is not intelligence-investigation related, but it demonstrates how widely the 804I intelligence product framework was being used across field offices for Epstein-adjacent matters.

Part 4: The External Partners

Two documents establish that the FBI was communicating with at least one external intelligence agency about Epstein:

The Memorandum (EFTA01683698)

A memorandum addressed to the FBI — specifically to the "Unit Chief, Crimes against Children and Human Trafficking Unit" — with the subject line "Response to Questions on Ongoing Criminal Investigation." The originating agency is redacted. The substantive content is almost entirely redacted across three pages. The final page identifies three persons:

• IDEN A: U.S. Person [REDACTED]
• IDEN B: U.S. Person Jeffrey Epstein
• IDEN C: Presumed U.S. Person Ghislaine Maxwell

(EFTA01683698)

The "IDENS" block and "U.S. Person" / "Presumed U.S. Person" designations are hallmarks of Intelligence Community products governed by Executive Order 12333 and USSID 18 minimization procedures. External agencies (CIA, NSA, DIA, etc.) use these designations when sharing information about U.S. persons with domestic agencies. The phrase "Presumed U.S. Person" for Maxwell — who held both U.S. and UK citizenship — is precisely correct IC terminology.

The memo establishes that an external agency responded to FBI questions about its ongoing criminal investigation of Epstein and Maxwell. The FBI asked; they answered.

The ORCON/NOFORN Email (EFTA01683701)

An internal FBI email forwarding material from an "external partner":

Classification: SECRET//ORCON/NOFORN
Classified By: J54J32T82
Derived From: FBI NSICG
Declassify On: 50X1-HUM

Per UNET e-mail, attached is a copy of the information received from our external partner.

(EFTA01683701)

The classification markings decode as follows:
- SECRET: Unauthorized release would cause "serious" damage to national security
- ORCON (Originator Controlled): The originating agency controls all dissemination
- NOFORN: Cannot be shared with foreign nationals
- 50X1-HUM: Exempt from automatic declassification for up to 75 years because release "could be expected to reveal the identity of a confidential human source or a human intelligence source"

The ORCON caveat means the external agency retained control over who could see this material even after sharing it with the FBI. UNET refers to the FBI Unclassified Network (CJIS UNet) — a nationwide wide area network providing FBI personnel access to sensitive but unclassified intelligence information with two-factor authentication. That SECRET//ORCON/NOFORN material was referenced in a UNET email suggests the classified attachment was handled separately from the unclassified cover email.

These two documents — the memorandum and the ORCON/NOFORN forwarded material — are the clearest evidence in the EFTA corpus that the FBI's Epstein investigation involved active, bidirectional intelligence sharing with at least one other U.S. intelligence agency.

We do not speculate about which agency. The IDENS format, the ORCON marking, and the "external partner" designation are used across the Intelligence Community. Any of the 18 IC member agencies could be the originator.

Part 5: The Timeline

Pre-2017: The Foundation

• 7/24/2006: FBI West Palm Beach opens child exploitation investigation 31E-MM-108062
• 2006-2008: CHS reports filed under the Miami case (S-00000640, S-00023871)
• 6/2008: Epstein accepts plea deal
• 10/28/2009: Obstruction case 72-MM-113327 opened
• 12/8/2009: Black book seized
• 1996: An FD-71 (lead document) referencing Epstein exists from this date — predating the FBI's current electronic records system. Referenced in EFTA02730468 as "not included in the case file because they were NOT of evidentiary value."

2017: The CI Case Opens

• 11/27/2017: Two FBI agents meet with a newly established CHS in New York City. The CHS reports on Epstein's alleged role as Putin's wealth manager, the Italian hacker, and the Trump lunch. Filed under 813B-NY-2928278 by Squad ID 25 (Intelligence Division). Classification: SECRET//NOFORN (EFTA01683874).

2018-2019: Criminal Investigation Reopens

• 12/6/2018: FBI New York opens 50D-NY-3027571 at SDNY's request
• 7/2/2019: Epstein indicted
• 7/5/2019: TECS "Silent Hit" alert triggers — Epstein returning to Teterboro on 7/6/2019 at 5:20 PM on aircraft N212JE (EFTA01731246)
• 7/6/2019: Epstein arrested at Teterboro
• 8/10/2019: Epstein found dead at MCC
• 8/13/2019: Two CHS reports filed the same week:
• S-00002345 (Birmingham): Black book on Telegram (EFTA00174673)
• S-00017284 (Dallas): Maxwell location tip (EFTA01245082)
• 8/29/2019: INTELPRODS sub-file opened — Serial 1 is the opening document (EFTA00261337)
• 10/1-10/24/2019: Five TIRs produced in rapid succession (Serials 2-6) — financial analysis, travel records, Maxwell tracking, toll records

2020: The Intelligence Surge

• 4/28/2020: Chuck Johnson phone interview — classified SECRET//NOFORN under 1.4(b) "foreign government information" (EFTA01683889)
• 7/1/2020: S-00099701 initial contact via encrypted messaging (EFTA01245118)
• 7/2/2020: Maxwell arrested in New Hampshire
• 7/13/2021: SAR (Suspicious Activity Report) review meeting in USVI discusses "Estate of Jeffery E. Epstein, Southern Country International, Richard D. Kahn, Darren K. Indyke, Southern Trust Co." — filed under 804I-SJ-3371215 (EFTA00128664)
• 7/16/2020: S-00019639 (Buffalo) single tip (EFTA01245107)
• 9/8/2020: A new case is initiated — case number fully redacted. This is the primary case for Serial 538 (EFTA01683595)
• 9/30/2020: External partner communication received via UNET — SECRET//ORCON/NOFORN, 50X1-HUM (EFTA01683701)
• 10/16/2020: S-00099701 reports on election influence, Israeli intelligence, Drokova — cross-filed to 804I-LA-3315657-INTELPRODS (EFTA00090314)
• 11/3/2020: S-00099701 files SECRET//NOFORN report — Serial 538, the first of the three classified serials (EFTA01683595)
• 11/9/2020: Serial 539 filed — second S//NF serial (referenced in briefing deck, EFTA00164943)

2021-2022: Trial and Final Intelligence Production

• 11/29/2021: Maxwell trial begins
• 12/6-12/7/2021: Intelligence Division SOS testifies at Maxwell trial (EFTA01683834)
• 12/17/2021: NY Intelligence Division Weekly Report documents SOS involvement in trial
• 12/22/2021: S-00104760 reports on Desmond-Hellmann, Israeli intelligence claims — Serial 684, SECRET//NOFORN (EFTA01683612)
• 12/29/2021: Maxwell convicted on 5 of 6 counts
• 1/20/2022: Serial 684 serialized — third and final S//NF serial
• 1/31/2022: INTELPRODS Serial 7 — travel records TIR (EFTA01731246)
• 3/2-3/31/2022: Five TIRs (Serials 8-12) — person of interest identification, defense witness research
• 3/11/2022: NY Intelligence Division Weekly Report notes ID-13 SOS serialized INTELPRODS Serial 8 (EFTA01683846)
• 4/6/2022: Intelligence Note on wealthy trafficker recruitment techniques (EFTA00172536)
• 6/28/2022: Maxwell sentenced to 20 years

Part 6: The "No Investigative Value" Paradox

The briefing deck states plainly:

"3 Serials in 50D are classified at S//NF which have no investigative value"
Serial 538 - 11/4/2020; 539 - 11/9/2020; 684 - 1/20/2022

(EFTA00164943)

This has been widely cited as evidence that the FBI dismissed or buried its own classified intelligence on Epstein. The reality is more nuanced.

What "No Investigative Value" Means

In FBI usage, "investigative value" refers to value for the criminal prosecution — evidence that could be used at trial or lead to additional charges. CHS reports about Epstein being an Israeli spy, regardless of their truth, have no investigative value for a child sex trafficking prosecution. The jury doesn't care about geopolitics; it cares about whether the defendant trafficked minors.

The classification itself tells you the FBI took the intelligence content seriously. You don't stamp SECRET//NOFORN on material you genuinely consider worthless. The "no investigative value" assessment is case-specific: no value to 50D-NY-3027571, the criminal case. It says nothing about value to 813B-NY-2928278, the CI case, or to the intelligence assessments routed through the 804I cases.

The Closure Codes Tell a Different Story

Serial 538 (the SECRET//NOFORN FD-1023 from S-00099701) received the following closure codes:

• "Reports - Contains Open Source Information" — the CHS was partly regurgitating public information
• "Collection - Addresses a validated field office collection gap" — the reporting filled an identified intelligence gap
• "Collection - Addresses NHCD or USIC requirement" — the reporting satisfied a National HUMINT Collection Directive or U.S. Intelligence Community requirement

(EFTA01683595)

These codes are contradictory only if you assume "investigative value" and "intelligence value" are the same thing. They aren't. The FBI was simultaneously saying: this has no value for the criminal case, but it addresses a validated intelligence collection requirement. The intelligence side of the house was collecting against specific gaps; the criminal side was prosecuting trafficking. Both assessments can be true.

The "NHCD or USIC requirement" closure code is particularly significant. National HUMINT Collection Directives are issued by the Director of National Intelligence and specify intelligence gaps that the Intelligence Community needs filled. If Serial 538 addressed an NHCD, it means the content of that classified CHS report was responsive to a formally tasked intelligence collection priority — the opposite of "no value."

The Bridge: INTELPRODS

The INTELPRODS sub-file is the mechanism that bridges this divide. Intelligence from the criminal case was packaged into analytical products (TIRs, Intelligence Notes) that could be used by the intelligence side. The cross-filing of Serials 10-12 to 804I-NY-304798-INTELPRODS shows this bridge in action: the same material served both criminal and intelligence purposes under different case numbers.

Part 7: Credibility Assessment

What Is Verified from the Corpus

The following claims from CHS reporting can be independently corroborated using other EFTA documents or public records:

1. Iozzo-Epstein connection: The CHS's claim of a relationship between the Italian hacker and Epstein is supported by emails in the corpus between the two. The nature of that relationship is disputed by Iozzo.

2. Masha Drokova's Epstein ties: An FBI ARMS (Asset/Risk Management System) investigation at EFTA00129096 independently describes Drokova as "nicknamed 'Putin's kiss,' former publicist for JEFFREY EPSTEIN" and documents regular 2017 meetings with Epstein. This corroborates the LA CHS's claim about Drokova's connection.

3. Desmond-Hellmann timeline: The CHS's account of her departures from BMGF and Facebook aligns with public reporting: the New York Times Gates-Epstein article published October 12, 2019; Desmond-Hellmann's departure announced December 2019; subsequent Pfizer and Google Ventures roles publicly confirmed.

4. Acosta "belonged to intelligence" claim: The CHS report at EFTA00090314 states Dershowitz told Acosta that Epstein "belonged to both U.S. and allied intelligence services." A Daily Beast article by Vicky Ward from July 2019, copies of which circulated within the SDNY office (found in the EFTA corpus), reports that Acosta told Trump transition officials he "was told Epstein 'belonged to intelligence' and to leave it alone." Acosta, in a deposition under oath, gave a qualified denial: "Not to my recollection."

5. FBI operational awareness since 1996: An FD-71 (lead document) from 1996 references Epstein (EFTA02730468). This predates the commonly cited 2005 Palm Beach investigation as the FBI's first known contact with Epstein matters.

6. Mitch Webber: The CHS states "Mitch Webber, who now works for the US DOJ or the White House, spoke with Maxwell all the time when the first plea deal was being negotiated." This is substantially verified. Mitchell D. Webber served as a research assistant to Alan Dershowitz while at Harvard Law School during Dershowitz's defense of Epstein (2006-2008). Billing documents from DOJ releases show $21,728 paid to Webber for work on Epstein's case. Court documents indicate Webber attended meetings with Florida prosecutors and communicated with Maxwell during plea negotiations. He later served as Associate Counsel and Special Assistant to the President in the White House Counsel's office (2019-2021) and is now a partner at Paul, Weiss. Webber claims he was merely relaying Dershowitz's legal interpretations.

What Remains Unverifiable

1. Putin wealth management: The 2017 CHS claim that Epstein was "Putin's wealth manager" and provided the same service for Mugabe is extraordinary and unsupported. Putin's wealth is believed to be managed through oligarch intermediaries (Rotenberg brothers, Timchenko) and state structures. The claim that an American sex offender known to U.S. law enforcement since 2005 would serve this function defies operational logic.

2. Mossad debriefing Dershowitz: The claim that "Mossad would then call Dershowitz to debrief" after Dershowitz-Epstein phone calls is single-source from S-00099701 and cannot be verified from the corpus.

3. Epstein "trained as a spy" under Barak: Single-source from the same CHS. While Epstein's relationship with Ehud Barak is extensively documented in the corpus (including a December 2018 email where Epstein writes "you should make clear that i dont work for mossad :)" and "unfortunately, not" — Barak responds "You or I?" and Epstein clarifies "that I dont :)"), this does not constitute evidence of a training relationship.

4. Israeli state-sponsored operation: The S-00104760 CHS's characterization of Epstein as "running an Israeli state-sponsored technology collection and extortion operation" is analytical conclusion, not first-hand observation. The FBI's closure codes assessed this reporting as containing open-source information that did not meet the DETAILED threshold.

5. Leon Black / Blackwater: The claim that Leon Black "owns the mercenary firm formerly known as Blackwater, now Constellis" is factually incorrect. This error in the CHS's reporting undermines the source's reliability on matters requiring specific factual knowledge.

The Structural Finding

The most significant finding is not what any individual CHS said. It is that the FBI maintained parallel intelligence and criminal tracks on Epstein from at least 2017 through at least 2022:

• A foreign intelligence case (813B) opened by the Intelligence Division in 2017
• A criminal case (50D) opened by the Criminal Division in 2018
• An intelligence products sub-file (INTELPRODS) producing finished analytical work
• An election influence threat assessment (804I-LA) in 2020
• External partner communication (ORCON/NF) in 2020
• At least one fully redacted case initiated September 2020
• Intelligence Division personnel testifying at the Maxwell trial in 2021

The FBI was not ignoring the intelligence dimension of Epstein. It was processing it through institutional channels designed to keep intelligence work separate from criminal proceedings — a separation that is standard practice, not evidence of cover-up.

Part 8: What We Can Reconstruct

The Known Architecture

FBI EPSTEIN INVESTIGATIONS — CASE ARCHITECTURE
═══════════════════════════════════════════════════

CRIMINAL TRACK
├── 31E-MM-108062 (Miami, 2006) — Child Exploitation
│   ├── CHS: S-00000640, S-00023871
│   ├── Grand Jury sub-file (31E-MM-108062-GJ)
│   └── INTELPRODS sub-file (31E-NY-3027571-INTELPRODS, opened 8/29/2019)
│
├── 72-MM-113327 (Miami, 2009) — Obstruction
│
├── 50D-NY-3027571 (New York, 2018) — Sex Trafficking
│   ├── CHS: S-00017284, S-00019639, S-00099701, S-00104760
│   ├── 706+ serials (through 3/12/2025)
│   ├── INTELPRODS sub-file: 12 TIRs (8/2019 - 3/2022)
│   └── 3 classified serials (538, 539, 684) — S//NF
│
└── 90A-NY-3151227 (New York, 2019) — Death Investigation
    └── 211 serials, closed 12/5/2022

INTELLIGENCE TRACK
├── 813B-NY-2928278 (New York, 2017) — Foreign Intelligence Program
│   └── FD-1023 from Squad ID 25
│
├── 804I-LA-3315657-INTELPRODS (Los Angeles, 2020) — Election Influence
│   └── S-00099701 reporting, cross-filed to 50D
│
├── 804I-NY-304798-INTELPRODS (New York, 2019-2022) — Human Trafficking Intel
│   ├── Intelligence Note (4/6/2022)
│   └── Cross-filed TIRs (Serials 10-12)
│
├── 804I-DL-5089795 (Dallas, 2019) — VCAC Assessment
│   └── S-00017284 Maxwell location tip
│
├── 804I-SJ-3371215 (San Juan, 2021) — TOC Assessment
│   └── SAR review of Epstein estate entities
│
├── [FULLY REDACTED] (Unknown, initiated 9/8/2020)
│   └── Primary case for S//NF Serial 538
│
└── 266N-BH-2232077 (Birmingham, 2019) — Domestic Threat Assessment
    └── S-00002345 Black Book Telegram

EXTERNAL COORDINATION
├── Intel agency memorandum to FBI CACHT Unit (EFTA01683698)
└── SECRET//ORCON/NOFORN material from "external partner" (EFTA01683701)

What This Means

The FBI's intelligence apparatus was engaged with the Epstein matter at a scale and duration that far exceeds what has been publicly discussed. This is not a story of one rogue CHS making spy claims. It is a story of institutional intelligence collection: validated collection gaps, NHCD requirements, finished intelligence products, external agency coordination, and classified case files maintained across multiple field offices for five years.

At the same time, the corpus provides no evidence that the intelligence track altered the criminal track — or that it should have. The CHS reports are raw, unverified claims from sources of varying reliability. The FBI's closure codes indicate awareness of their limitations. The INTELPRODS sub-file produced tactical analysis (travel records, financial data, person identification) that supported the criminal investigation, not strategic intelligence assessments about Epstein's alleged intelligence connections.

The unanswered question is what happened in the spaces we cannot see: the fully redacted case initiated September 8, 2020; the substantive content of the external agency memorandum; the 6 fully redacted pages of the Sydney Australia interview (EFTA01683669); and the content of Serial 539, the one classified serial whose source document has not been identified in the EFTA production.

What Is Not in the Corpus

Several expected documents are absent:

1. No formal foreign intelligence investigation report: If 813B-NY-2928278 progressed beyond an assessment to a preliminary or full investigation, there should be analytical products — assessments, case summaries, closing memos. None appear in the corpus.

2. No response to the intelligence claims: Despite multiple CHS reports alleging Israeli intelligence connections, the corpus contains no FD-302s or analytical products documenting the FBI's investigation of those specific claims.

3. Serial 539: The middle of the three classified serials. Serials 538 and 684 have been identified (EFTA01683595 and EFTA01683612). Serial 539 (dated 11/9/2020) has not been matched to a specific FD-1023 in the corpus.

4. The FD-71 from 1996: Referenced in EFTA02730468 as an attachment, but the text of the 1996 lead document itself — predating the FBI's digital records system — does not appear in the production. It was among documents described as "associated with Epstein but not included in 50D case file" because they "were NOT of evidentiary value."

5. Operational orders: Two "Ops Order" documents from 2019 are referenced in EFTA02730468 — "Ops Order from 2019" and "Ops Order Form Section 2 from 2019." These are operational planning documents for FBI field operations (likely the Teterboro arrest or the search warrants). They were described as "NOT of evidentiary value" and not included in the case file.

Methodology

This report is based entirely on the DOJ's EFTA production (2.91 million pages across 12 datasets) plus FBI Vault and House Oversight materials. All EFTA citations were verified against the full_text_corpus.db database. All quoted text was read directly from the database, not from summaries.

For areas overlapping with Israeli intelligence connections, this report cross-references the Israel Deep Dive V2 and focuses on the structural FBI architecture rather than re-documenting claims already covered in that report.

Analytical standard: CHS reports (FD-1023s) are raw, unverified intelligence. As the FBI's own disclaimer states: "Recording this information does not validate it, establish its credibility, or weigh it against other information." This report presents the structure of the FBI's intelligence investigations and the content of the source reporting without endorsing the claims made by individual sources. Where claims can be independently verified or contradicted, this is noted.

External Sources

This analysis relies on Claude Code running Opus 4.6, which can make mistakes. All claims are cited to specific EFTA numbers that readers can verify independently.