Commerce Department security unit evolved into counter-intelligence-like operation, Washington Post examination found

An obscure security unit tasked with protecting the Commerce Department’s officials and facilities has evolved into something more akin to a counterintelligence operation that collected information on hundreds of people inside and outside the department, a Washington Post examination found.

The Investigations and Threat Management Service (ITMS) covertly searched employees’ offices at night, ran broad keyword searches of their emails trying to surface signs of foreign influence and scoured Americans’ social media for critical comments about the census, according to documents and interviews with five former investigators.

In one instance, the unit opened a case on a 68-year retiree in Florida who tweeted that the census, which is run by the Commerce Department, would be manipulated “to benefit the Trump Party!” records show.

In another example, the unit searched Commerce servers for particular Chinese words, documents show. The search resulted in the monitoring of many Asian American employees over benign correspondence, according to two former investigators.

The office “has been allowed to operate far outside the bounds of federal law enforcement norms and has created an environment of paranoia and retaliation at the Department,” John Costello, a former deputy assistant secretary of intelligence and security at Commerce in the Trump administration, said in a statement for this story.

ITMS “rests on questionable legal authority and has suffered from poor management and lack of sufficient legal and managerial oversight for much of its existence,” Costello said.

Concerns have long simmered internally about the Commerce unit, which was led for more than a decade by career supervisor George D. Lee.

The unit’s tactics appear as if “someone watched too many ‘Mission Impossible’ movies,” said Bruce Ridlen, a former supervisor.

Investigators lodged complaints with supervisors, and the department’s internal watchdog launched multiple inquiries, documents show. In an internal memo laying out his concerns about the unit, Costello described an inspector general’s investigation that he said had found it had no legal authority to conduct criminal investigations.

But the unit has managed to keep a low public profile until now, while pursuing investigations into “counterintelligence, transnational crime and counterterrorism,” as it described its activities in a 2018 budget document submitted to Congress.

Incoming Commerce leaders from the Biden administration ordered ITMS to pause all criminal investigations on March 10, and on May 13 ordered the suspension of all activities after preliminary results of an ongoing review, according to a statement issued by department spokeswoman Brittany Caplin.

The suspension came two days after The Post presented its findings about the unit to the department and sought interviews.

“The current Commerce Department leadership team takes this issue seriously,” the statement said. “The Department expects that at the end of the review it can and will implement a comprehensive solution to the issues raised.”

The minority party staff of the Senate Commerce Committee, under Sen. Roger Wicker, R-Miss., has been investigating ITMS’s activities since early this year, records show. More than a dozen whistleblowers have given closed-door statements, among them former investigators who allege that the office routinely overstepped its legal limits and has operated without meaningful oversight from within Commerce since the mid-2000s.

Costello privately proposed dissolving ITMS in October after he conducted an internal review, according to a report he wrote. Costello resigned after the Jan. 6 riot at the U.S. Capitol, before the department could act on his recommendation.

Former investigators, supervisors and government contractors who have worked with the unit in recent years said it operates largely on the whims of Lee, 48, who oversaw an expansion of the unit’s reach.

As of last September, ITMS had 17 employees and a $5.38 million budget, Caplin, the department spokeswoman, said. The entire Commerce Department had 54,000 employees and a budget of $15.2 billion at the same time.

Lee did not respond to multiple requests for comment conveyed through numbers listed for his home and cellphones, an email to his Commerce account and a letter sent to a home address. He also did not reply to an interview request submitted to the department.

Caplin said on May 15 that Lee is “not currently supervising the work or the employees of ITMS, and is not performing any investigatory duties.”

Before joining Commerce in 2004, Lee worked as an officer with the federal police force that protects the U.S. Supreme Court and before that as an investigator at a medical center in North Carolina, internal records show.

A year after his arrival, Lee appeared to acknowledge that special agents within the department had limited law enforcement powers. In a memo obtained by The Post, Lee wrote to his supervisors in the Office of Security that the office’s agents “may lack legal authority to conduct an appreciable portion of its investigative efforts, particularly criminal investigations.”

He cited agreements with the U.S. Marshals Service, which grants law enforcement powers to Commerce agents for specific purposes and under certain limitations.

The so-called special deputations for the Commerce agents are “for protection of the Secretary of Commerce,” James Stossel, a spokesman for the Marshals Service, wrote in a statement to The Post. He declined to elaborate on the limitations of that authority but added that it is “the responsibility of the requesting agency to supervise these special Deputy U.S. Marshals.”

In his internal assessment last fall, Costello cited the Commerce Department’s Office of the Inspector General:

“A recent OIG inquiry has found that the deputation of ITMS under this program does not authorize ITMS to conduct criminal investigations and is intended only for the protection of the Secretary and Department critical assets - meaning facility and people. This raises significant questions as to whether ITMS has been exceeding its delegated authority or acting beyond its legal remit in its investigations. Furthermore, it raises significant legal questions as to what authority ITMS is acting under in its investigative actions.”

The inspector general’s office declined to comment. The Post was not able to obtain a copy of the inspector general’s report.

It is not clear precisely when Lee expanded the unit’s portfolio. But a February 2014 investigative guide for the office, then called the Investigations and Threat Division, contains a section entitled “counterintelligence inquiries” that instructs agents on “baseline steps,” including determining whether there are “indicators of tradecraft.”

Former investigators said that in recent years the unit operated under a broad interpretation of its powers and its investigative purview.

It looked for suspicious foreign connections among employees and surreptitiously monitored employees’ communications on work computers and phones, they said.

It also opened cases on people who wrote nonthreatening letters to the commerce secretary, documents show. One was a former federal lawmaker.

Jim Bates, a Democratic California congressman from 1983 to 1991, wrote to Commerce Secretary Wilbur Ross on Nov. 22, 2019, alerting him to the work of a nonprofit organization that Bates had founded.

In the handwritten letter, a copy of which was obtained by The Post, Bates wrote that his group was working to promote the idea that the electoral college was unconstitutional because it was based on a census count that included “noncitizens.”

ITMS initiated a case on Bates and it remained open as of May 21, according to a current Commerce employee familiar with the office who spoke on the condition of anonymity to discuss sensitive investigative matters.

“I think it’s absurd,” Bates said after learning about the probe. “They’re bureaucrats who create these things because they don’t really deal with substantive issues.”

Bates said he never received a response to his letter.

ITMS also launched probes starting in April 2020 into the authors of dozens of social media posts that questioned the integrity or fairness of the census, according to internal records. The cases were billed as an effort to detect any “organized disinformation campaign,” according to a memo the unit sent to the FBI.

Dozens of postings were compiled in a spreadsheet called the Social Media Tracker, internal records show. The spreadsheet shows that investigators completed “high-side” checks - a nickname for searches on secure intelligence databases - on dozens of accounts holders.

The former supervisor, who also spoke on the condition of anonymity to discuss sensitive investigations, said investigators identified the posts through keyword searches on social media platforms, with no other indication of an organized attempt to sow false or misleading information.

The posts flagged for investigation cross the political spectrum, documents show.

Lee conveyed the information to the Foreign Influence Task Force at the FBI and the Office of Intelligence and Analysis at the Department of Homeland Security, according to a letter sent by him to the FBI and obtained by The Post.

The FBI declined to look into the posts, saying they were protected free speech, according to the former supervisor. An FBI spokesperson declined to comment.

Ridlen, a supervisor in the unit hired in March 2020, was alarmed by the inquiries into free-speech activities, he said. He quit the job in late October.

“I chose to resign from my position with ITMS after it became clear there was no authority to perform law enforcement functions,” said Ridlen, who briefly took over as acting director in August. “There were no policies in place to outline standards of conduct or to establish parameters for investigative activities, which led to investigative inquiries of U.S. persons over protected free speech found on several social media platforms.”

Multiple former investigators said Lee would rarely close cases, even if evidence of wrongdoing did not materialize.

As of Oct. 23, the office had 1,183 open cases, nearly half dating to 2018 or earlier and the large majority still in preliminary stages, an internal document shows.

David Harris, chief executive of ADV, a government contractor that supplied about a dozen intelligence analysts and support personnel to the office from 2018 to 2020, called the unit “basically a collector of information.”

“No one could articulate its mission,” he said. “It was whatever direction the wind was blowing that day.”

Harris also told The Post that the unit’s leadership was “disorganized and abusive.”

Over the years, investigators had warned Commerce leaders about the unit and Lee’s management. On his last day on the job after 2½ years working with Lee, former investigator Christopher Cheung emailed then-secretary Ross with allegations about the unit.

“Mr. Lee has discriminately targeted ethnic Chinese foreign guests/visitors and employees as well as other ethnic personnel,” Cheung wrote on June 21, 2019. “When investigations on these ethnic personnel are inconclusive, Mr. Lee refuses to allow agents to close the cases.”

Cheung also alleged that Lee had ordered illegal searches on employee work spaces in addition to a range of other improprieties.

A spokesperson for Ross said he did not recall the email from Cheung or any investigations opened into people who wrote letters to him.

By July 2020, Commerce leaders realized they had to rein in the unit, documents show.

In a meeting that month, Costello told the agency’s assistant secretary and chief financial officer that he had “received numerous credible complaints against George Lee, his investigators, and the ITMS investigation writ-large,” according to a slide presentation prepared for the meeting.

“Most significantly, George Lee’s management has made it difficult or impossible for a supervisor to conduct meaningful oversight and decision-making over ITMS investigations,” he wrote. “These problems have persisted despite numerous attempts at correction by supervisors.”

In subsequent months, Costello invited former investigators to lay out their concerns in memos to him that further revealed details of the office’s past operations, some of which were obtained by The Post.

Martin C. Kehoe, one of the former investigators, wrote:

“I rarely saw cases being closed out. SAC Lee seemed to like always having matters open that he could point to when he was in a jam. During my tenure, I cannot point to a single case that I believe was worked well and resulted in a great outcome. Cases linger, stagnate, and eventually fizzle out. I had no sense of pride in the cases I worked, nor did I feel empowered to take action due to SAC Lee’s persistent micro-management leadership. I firmly believe that SAC Lee hides behind classified information (whether it is actually a classified/need-to-know matter or not) and keeps subordinates and superiors in the dark as to his activities.”

Cheung also wrote a memo to Costello, alleging that during investigations into suspicious foreign visitors to Commerce facilities, Lee “fosters a mind-set that all DOC employees that come into contact with that foreign visitor and are of the same ethnicity are now suspects as well.”

Kehoe and Cheung confirmed the authenticity of the memos obtained by The Post. They are among three agents who formally filed complaints about Lee and the office climate to the Equal Employment Opportunity Commission, according to copies of their complaints.

Lee also ordered two agents to conduct broad searches on department servers, scanning Commerce employees’ emails for certain Chinese-language keywords, Cheung’s memo to Costello alleged. The keywords are listed in a document that characterizes them as words that appear in the names of talent recruitment programs sponsored by the Chinese government, a copy of the list shows.

The search brought back the names of predominantly Asian American employees, and investigators began monitoring the employees’ emails, said two former agents directly involved in some of the searches who spoke on the condition of anonymity to discuss details of the operation.

Cheung also alleged in the memo to Costello that the unit improperly searched employees’ storage areas, including in 2018 when the lock was picked on a cabinet used by a worker at Commerce headquarters.

The unit’s equipment for covert searches, kept in duffel bags, included latex gloves, shoe coverings, hairnets, balaclava-style face masks and a lock-picking set, according to two former investigators and a current Commerce employee, who spoke on the condition of anonymity to discuss unit operations.

During some covert searches, investigators wore the face masks and avoided or blocked the view of security cameras, former investigators said on the condition of anonymity to discuss the office’s operations.

“It was so we didn’t leave a trace,” said one of the former investigators.

Ridlen, the former supervisor, said Lee “favored cloak-and-dagger methods of obtaining evidence over proven investigative techniques practiced by all other federal, state and local law enforcement agencies I have worked with in the last two decades.”

Investigators also complained that Lee compelled new hires to attend a training program he personally designed in the Shenandoah Mountains in Virginia, according to documents and interviews with investigators who attended. For surveillance training, Lee made investigators trail him as he drove erratically at high speeds on mountain roads, investigators said.

It was “the most reckless and unsafe training I have ever attended,” Cheung wrote to Costello in a memo.

“It was clear that SAC [special agent in charge] Lee had limited real world surveillance experience and it felt as if he learned it all by reading a book on it the day prior to class,” Kehoe wrote in a memo.

Despite opening more than 1,000 cases, few resulted in arrests or criminal charges, investigators said. And a case that prominently cited work by the unit and drew national attention was quickly dropped.

Sherry Chen, a Chinese American hydrologist for a National Weather Service office in Wilmington, Ohio, was arrested by the FBI in 2014 on suspicion that she was providing information about the nation’s dams to a high-ranking Chinese official who was also a former classmate. Lee and the Investigations and Threat Management Division were credited in a Justice Department news release.

The case was dropped within months by federal prosecutors in Ohio who provided no explanation in court filings. Chen has since filed a civil lawsuit against former investigators who interrogated her, as well as others, alleging their conduct amounted to false arrest and malicious prosecution. In court filings, the defendants have denied Chen’s claims, maintaining that she accessed a restricted government database using a colleague’s password and lied to federal agents.

She filed suit in 2019 in Cincinnati at the U.S. District Court for the Southern District of Ohio. The lawsuit is still in its preliminary stages.

Chen said in the lawsuit that the two agents who interrogated her “ignored exculpatory evidence throughout the interview, reached false conclusions without even a cursory investigation of underlying facts, and reported false results reflecting their racial and ethnic bias.”

ITMS in its more recent monitoring of social media has provoked similar outrage.

The Florida retiree was alarmed to learn from a Post reporter that his tweet had drawn the Commerce Department’s scrutiny:

“July 2, 2020, Twitter user @barto935 posted: Like Everything Trump has touched, I expect the Census to be corrupted and falsified to benefit the Trump Party!”

He has just over 100 followers.

“I’m not part of any disinformation campaign. I’m just an American,” the retiree said, speaking on the condition of anonymity for fear he would be harassed for his political views. “I just expressed my opinion online.”

The Washington Post’s Alice Crites contributed to this report.