Return to the USDOJ/OIG Home Page
Return to the Table of Contents

An Investigation of the Belated Production of Documents
in the Oklahoma City Bombing Case

March 19, 2002
Office of the Inspector General



This chapter sets forth the basic terminology and procedures used in the FBI's document management system. We describe the relevant aspects of the FBI's field structure, the OKBOMB Task Force, the documents at issue, and the procedures used by the FBI to process documents. We also describe the computer systems used by the FBI to assist its document management.

  1. The FBI Field Structure
  2. The FBI is a component of the United States Department of Justice. The FBI is headed by a Director. During the time period under review, the second in command was the Deputy Director.5 Included in the FBI's organizational structure are its Headquarters operations, which are located in Washington, D.C., 56 field offices, and 44 foreign offices, known as Legal Attaché offices or Legats. The field offices are located in major cities throughout the United States. Each is headed by a Special Agent in Charge (SAC).6 The field offices are also known as divisions, and we use the terms interchangeably. We show an FBI organizational chart in effect in 1995 at Exhibit 1 in the Appendix at p. A-1.

    A field office consists of an office in the "Headquarters City," which is the primary office, and Resident Agencies. The Resident Agencies are located in over 700 smaller cities and towns and may be staffed by only a few agents.

    Field offices are divided into squads that have specific subject matter responsibilities, for example the drug squad, the counterterrorism squad, and so forth. A Supervisory Special Agent manages each squad and supervises the agents assigned to the squad.

    The field offices also have personnel who are assigned to handle administrative support functions. The chief administrative employee is the Administrative Officer. The size of the office dictates how many additional administrative supervisors and support employees are needed.

    In addition to a secretary, each squad has an Information Management Assistant (IMA), or "rotor," assigned to maintain a squad's pending case files.7 Although the rotor works for the investigators on the squad, the rotor's direct supervisor is on the administrative side of the office. The rotor handles all tasks associated with documents, such as filing and entering documents into the FBI's computer system. The rotor is assigned to at least one and often two squads and will handle these tasks for all the agents assigned to those squads. We show an organizational chart for the counterterrorism and administrative operations (the operations most relevant to this report) in a typical field office at Exhibit 2 in the Appendix at p. A-3.

  3. Documents and Other Physical Items
  4. The primary documents at issue in this investigation consist of FD-302s and inserts. FD-302s are the forms used by the FBI to record investigative activity, particularly, although not exclusively, the results of interviews. Inserts also record investigative activity, although they are usually used for information that is believed to be "non-testimonial" or "negative," that is information that is not significant to the investigation. For example, an insert might be used to document that a criminal records check was negative.

    The FBI also uses "1As," "1Bs," "1Cs," and "Elsur" material. A "1A" is an envelope in which small physical items are placed, such as photographs, computer printouts of license checks, and agents' handwritten notes of interviews. Items placed in 1A envelopes do not require that the chain of custody be tracked even though some of the items in the 1A envelopes may be used at trial. A "1B" identifies evidence for which there is a chain of custody. For example, this category of evidence includes material to be tested by the laboratory. We note that for the purposes of FBI information management the term "evidence" has a specific meaning to FBI personnel and refers to 1B items. The "1Cs" are used for 1A-type items that are too large to place in a 1A envelope, such as a large map or photograph. Elsur material, also known as 1Ds, consists of items relating to electronic surveillance, such as tapes and transcripts of intercepted or recorded communications. (Examples of FD-302s are shown at Exhibit 3 at p. A-5; inserts are shown at Exhibit 4 at p. A-8; and 1A envelopes are shown at Exhibit 5 at p. A-11. For each document, we show both a sample form and a mock completed form.)

    In 1995 and 1996, the FBI used "teletypes" to send instructions and other information that needed to be immediately disseminated to its field offices, Legats, and Headquarters offices. A teletype machine instantly dispatched the teletype to the receiving office. For communications that did not need to be instantly dispatched, the FBI used an "airtel," which was essentially a memorandum. For example, when one field office sent items through the mail to another field office, the sending field office often would attach an airtel describing the items being sent. Both the teletype and the airtel have been replaced by the "Electronic Communication" or "EC" that is currently in use. The EC is transmitted instantly through the FBI's computer system. (We show sample and completed forms of a teletype at Exhibit 6 at p. A-14; an airtel at Exhibit 7 at p. A-18; and an EC at Exhibit 8 at p. A-21.)

  5. Document Processing in the Field Offices
  6. We set forth in this section a general description of the process used by the FBI to manage documents and evidence. However, as we found during the investigation, despite FBI procedures supposedly governing the process, field offices differed in the methods by which they handled documents and 1A items.8 We found that a clear understanding of the FBI's document-handling process and, in particular, an understanding of the factors distinguishing "originals" from "copies" was necessary to determine where the breakdown in the OKBOMB case occurred. Because the FBI changed computer database systems in October 1995, many of the procedures that were used during some parts of the OKBOMB investigation are not in use currently.

    When different field offices are involved in an investigation, one office, the office with primary responsibility for conducting the investigation, is known as the Office of Origin. Other offices that assist in conducting specific investigative tasks are known as Auxiliary Offices.9 For OKBOMB, the Office of Origin was a separate entity, which we refer to as the OKBOMB Task Force.10

    If the Office of Origin needed investigative assistance from another office, the Office of Origin sent instructions to the Auxiliary Office specifying either generally or specifically what investigation was to be conducted. This is known as sending a "lead." (In Exhibit 8, pp. A-23-24, we show an example of an EC that contains a lead.) In 1995 and 1996, leads and other written communications were sent by teletype. In OKBOMB, leads usually were sent to the field offices from the OKBOMB Task Force. Though the Office of Origin "set" or assigned most leads, an Auxiliary Office also could set leads, both for its own agents and for other Auxiliary Offices. The investigation of a lead might generate a new lead within a field office or within the jurisdiction of another field office. Similarly, unsolicited phone calls from the public directly to the field offices generated leads within that field office or in other field offices.

    An Auxiliary Office agent conducted the necessary investigation and memorialized his actions in an FD-302 or insert. The agent signed or initialed the FD-302 or insert, thereby marking the document as the "original."11 The original and an unsigned copy were then sent to a supervisor for review. The copy was "block stamped" by the supervisor (in some offices the rotor would apply the block stamp prior to the supervisor's review), and the supervisor initialed the copy to indicate that the supervisor had reviewed it. (We show a mock original FD-302 at Exhibit 3, p. A-7, and an insert with a block stamp at Exhibit 4, p. A-10.)

    After the supervisor's review, the document went to the rotor, who entered key information about the FD-302 or insert into the FBI's computer system, and if the agent or supervisor requested, indexed important information.12 To enter the document into the computer, the rotor typed in the case number, the type of document, who the document was to and from, the office of origin, and the date the document was entered into the system.

    The computer system in use at the time of the bombing until October 16, 1995, was known as the Field Office Information Management Support (FOIMS). Each case entered into FOIMS was given an individual case number. The OKBOMB case number is 174A-OC-56120. The first three numbers of the case number signify the case classification; "174" denotes a bombing matter (the letter "A" signifies a high priority matter). The middle initials denote the Office of Origin, in this case, "OC" meaning Oklahoma City.

    The FBI attempts to track every case-related item in its possession through a system of "serialization."13 All case-related information, such as FD-302s, inserts, internal communications, and physical evidence, are assigned "serial numbers." FBI files are organized by serial number. When a document was entered into FOIMS, the computer assigned a serial number to it. For example, the file began with serial 1, serial 2 was put on top, and so forth.

    Under FOIMS, while each case had its own unique case number, each field office had its own set of serial numbers. In other words, in the Atlanta Field Office OKBOMB files, the first item was numbered 174-OC-56120, serial 1. But there also would be an item numbered 174-OC-56120, serial 1 in Buffalo, in Miami, and in every other office that handled OKBOMB documents. The case number and serial number were handwritten or typed on each document.

    In FOIMS, items could be located by serial number or by the limited information that was entered into the computer, but the text of the document was not uploaded into the system. The actual text of any particular document could be retrieved only through a search of the hard copy files.

    Once the item was entered into FOIMS, the Auxiliary Office was supposed to send the original FD-302 or insert to the Office of Origin.14 In OKBOMB, the Auxiliary Offices were required to send the original, multiple copies, and a floppy disk containing electronic versions of FBI-generated documents (usually FD-302s and inserts) to the OKBOMB Task Force. At least one copy of the FD-302 or insert was supposed to be kept in the Auxiliary Office files. An "airtel," which was essentially a cover memorandum, was usually attached and listed the documents that were being sent to the OKBOMB Task Force.

    A flowchart of this process is shown on the following page.

    [ Image of a flowchart describing OKBOMB FD-302 and Insert Processing At Auxillary Offices is not available electronically.]

    If, in responding to the lead, the Auxiliary Office agent collected physical items (other than chain of custody or 1B material), the agent placed the items in a 1A envelope and filled out the required information on the envelope. We received differing views about the procedures for handling 1As. The FBI's Manual of Administrative and Operative Procedures (MAOP) specifies that original 1As should be sent to the Office of Origin unless the contents of the 1A envelope are to be returned to someone in the jurisdiction of the Auxiliary Office. Nonetheless, we were told by FBI personnel in some offices that original 1As usually were not sent to the Office of Origin but rather kept in the Auxiliary Office.

    In the field offices, material pertaining to a particular case may be kept in various locations. Files for pending cases are kept on the squad's rotor. Files for closed cases are kept in a separate closed files area. Evidence (1B material), Elsur, and materials pertaining to confidential informants are also kept in separate locations. In addition, agents occasionally keep "work files" at their desks, which contain items that may be needed by the agents for cases that they are working. We also learned that some offices maintain "workbox" areas where agents keep materials related to cases that they are working on and want to have readily accessible.

  7. The OKBOMB Task Force
  8. Immediately following the bombing, the FBI established a command post in Oklahoma City to organize and lead the investigation. In the early stages of the investigation, eight command posts were established throughout the country to coordinate activity in regions where substantial investigation was being conducted.15

    The Oklahoma City Command Post was located in a different building from the Oklahoma City FBI Field Office, and the command structure for OKBOMB was separated from the Oklahoma City Field Office as well. Inspector in Charge Danny Defenbaugh headed the OKBOMB investigation. Defenbaugh was a 26-year veteran of the FBI with extensive experience in explosives analysis. At the time of the Oklahoma City bombing, he was assigned to FBI Headquarters as one of six FBI Inspectors.

    In April 1996, the Oklahoma City Command Post relocated to Denver, Colorado, after the trial judge moved the venue for the trials of McVeigh and Nichols to Denver. Throughout this report, we refer to the OKBOMB command, investigative, and support structure as the OKBOMB Task Force.

    Although the FBI was the lead agency conducting the investigation, federal prosecutors were involved in the investigation as well. A team of prosecutors, first consisting of senior prosecutors from Main Justice and later headed by Joe Hartzler, an Assistant United States Attorney from the United States Attorney's Office for the Central District of Illinois, joined the investigation shortly after the bombing. The prosecutors worked closely with the FBI, primarily with Defenbaugh and a limited number of senior FBI personnel.

    The field offices and FBI Headquarters contributed personnel to work on the Task Force on temporary duty. Hundreds of FBI employees worked at the Task Force either in investigative or administrative capacities. At its peak, over 250 FBI employees were working at the OKBOMB command post.

    1. Document Processing at the Task Force
    2. Many different individuals were involved in processing OKBOMB documents. The field offices sent the items to the Oklahoma City Field Office, which transported them to the OKBOMB Task Force for processing.

      When the OKBOMB Task Force received items sent from Auxiliary Offices, rotors separated the original item, the disk, and the copies. Because FOIMS assigned duplicate serial numbers (i.e. Atlanta 174-OC-56120-1, Buffalo 174-OC-56120-1, and so forth), the OKBOMB Task Force re-entered the document into FOIMS to produce a unique OKBOMB serial number. An OKBOMB rotor entered a description of the item into FOIMS, received an OKBOMB serial number, and wrote the serial number on the original and the copies.

      The original document was then filed in the OKBOMB files by serial number. Subfiles were established to aid document management. For example, all FD-302s were located in subfile D and had serial numbers that began with D; all inserts went to subfile E and had serial numbers beginning with E. This subfiling system was critical to the discovery process.

      Documents that were not filed in subfiles, such as teletypes and airtels, went to the OKBOMB Main File. Copies of documents were sent to various teams that were responsible for handling specific subject matter tasks, such as a lead team, teams responsible for the investigation of individuals identified as subjects, a team to review rental truck records, and so forth. The floppy disk was sent to a team responsible for uploading information in a database called "ZyIndex." Unlike FOIMS, ZyIndex stored and personnel could retrieve the full text of documents. We discuss ZyIndex and the Task Force's system for processing documents further in Chapter Three, Section IV C 3. We show a flowchart of the Task Force's document management process on the next page.

    3. Automated Case Support
    4. In October 1995 the FBI changed to a new computer system, Automated Case Support (ACS). Although the change was traumatic for the OKBOMB Task Force, and for the FBI as a whole, it did not change the overall document processing system at the Task Force in any significant way. We discuss ACS in more detail in Chapter Three, Section IV C 3 b.

      [ Image of a flowchart describing FD-302 and Insert Processing At OKBOMB Task Force is not available electronically.]


  1. On December 3, 2001, the FBI announced a reorganization of FBI Headquarters that created four new Executive Assistant Director positions to oversee FBI functions. The FBI's Deputy Director, Thomas Pickard, retired in November 2001, and the FBI has not decided whether the Deputy Director position will be filled.

  2. Very large field offices, such as Los Angeles and New York City, are headed by Assistant Directors in Charge (ADIC), rather than SACs.

  3. IMA is the current official title for this support staff position. These employees were originally called "rotors" because the "rotor" is the storage area where the pending case files are kept. The rotor is a large horizontal filing cabinet that can rotate, allowing files to be stored on both sides of the cabinet. The colloquial title is still used frequently throughout the FBI to refer to the IMA, and we use that term in this report.

  4. The FBI has many procedures governing document and evidence processing, including such minutiae as prescribing when pencil or specific colored ink should be used for certain tasks. Despite these detailed procedures, we nonetheless found considerable variation among the field offices.

  5. The FBI currently uses the term "Lead Office" to describe the offices that are assisting the Office of Origin. As a matter of simplification, we use the term Auxiliary Office throughout this report.

  6. We describe the structure of the OKBOMB Task Force at Section IV in this chapter.

  7. According to FBI procedure, the agent is to sign only one version of the document, thereby distinguishing that document as the original. However, we found inconsistencies throughout the field offices, and even within field offices, regarding whether agents signed copies of documents or only originals. For example, one former Boston Division special agent told us that he only signed originals while another Boston Division special agent said that agents often signed multiple copies. This inconsistent adherence to FBI policy hampered the ability of the OIG to distinguish between originals and copies and thereby to determine the cause of the belated documents. (We discuss the significance of originals and copies in Chapter Three, Section III B 1.)

  8. Names and other information can be "indexed" in the FBI's computer system, thereby allowing FBI personnel to determine, for example, whether an individual has been the subject of or involved in other investigations. An agent or a supervisor underlines in red on a copy the names or other information that should be indexed.

  9. We conducted a limited inquiry into the systems used by other large federal law enforcement agencies. The agencies that we contacted did not have any system comparable to the FBI's for tracking every individual item received.

  10. The FBI's administrative manual specifically states that original FD-302s are to be sent to the Office of Origin at the time they are prepared. See FBI Manual of Administrative and Operative Procedures 2-4.3.2. However, FBI employees in a few field offices told the OIG that originals were kept in the Auxiliary Office. FBI employees in other offices stated that they initially filed the originals and the copies in their Auxiliary Office files until a certain number had been generated. At that time, they sent a package of documents to the Office of Origin.

  11. Command posts were located in Oklahoma City; Atlanta, Georgia; Buffalo, New York; Chicago, Illinois; Detroit, Michigan; Kansas City, Missouri; Phoenix, Arizona; and Washington, D.C.
Return to the USDOJ/OIG Home Page
Return to the Table of Contents