Some documents exist publicly for years before anyone sees them whole. A line here, a footnote there, buried inside other FBI files that researcher John Greenewald had already obtained through the Freedom of Information Act (FOIA). The document itself, an FBI intelligence assessment on cyber threats to the United States, only appeared in complete form on April 5, 2024, after a Mandatory Declassification Review (MDR), the process by which an agency is asked to re-examine a previously classified record for release. What arrived was thirty pages, much of it blacked out.
Nine Years for a Threat Assessment
The document is dated June 22, 2009, titled “FBI Cyber National Threat Assessment, 2008,” and covers the period from June 30, 2007, to July 1, 2008, with some earlier material folded in for context. Before its release, it existed in public view only as scattered citations inside other FBI files already given to The Black Vault, the FOIA research site Greenewald runs. He filed Mandatory Declassification Review case 1363960-000 on December 16, 2016, asking the FBI to review the assessment itself. The full document, thirty pages at 10.3 megabytes, was published April 5, 2024, roughly seven and a half years later. The source gives no running account of what happened in between: no interim correspondence, no stated cause for the pace.
Who Signed Off, and Under What
The release letter that accompanied the document lists four agencies beyond the FBI that had a hand in the redactions: the Air Force Office of Special Investigations (AFOSI), the National Security Agency (NSA), the Office of the Director of National Intelligence (ODNI), and U.S. Cyber Command (USCYBERCOM). The exemptions cited are (b)(1), (b)(3), (b)(6), (b)(7)(C), and (b)(7)(E), the FOIA and Privacy Act categories covering, respectively, classified national security information, material protected under other federal statutes, personal privacy, privacy specific to law enforcement records, and law enforcement techniques or procedures. That is the formal chain of custody for what was cut: which offices reviewed the text and which legal basis each invoked. It does not say what any one of them specifically wanted withheld.
What the Assessment Describes
What survived covers a wide field. The assessment addresses tactics used against industrial control systems, financial institutions, government networks, and supply chains. It flags the potential misuse of IPv6, the newer internet addressing standard, and of virtual worlds, both relatively new terrain for intrusion in 2007 and 2008. Botnets, networks of compromised computers, get particular weight: the document states they “continue to pose a threat to US critical infrastructures” and can “wage denial of service attacks against targeted online entities, conduct phishing and spamming campaigns, and steal passwords and other login credentials.” It adds that attackers “typically collect passwords, login credentials, keystrokes, credit card numbers, and personally identifying information from botnet victims.” These are the named subjects. In what remains visible, the document does not tie most of them to a specific incident or a named victim.
A Forecast, Not a Case File
This was written as a threat assessment, a forward-looking survey of risk, not an investigation into a single breach. What survived redaction points to a judgment about trend rather than about any one attacker: that botnets and evolving intrusion methods represented a persistent, significant risk to U.S. infrastructure across the period surveyed. That is a statement about capability and pattern. It is not a verdict on a named actor, a closed case, or even a fully identified incident. Nothing in the public text confirms that any particular intrusion described here was traced, stopped, or resolved.
What the Redactions Are Hiding
The specific material withheld under each of the five exemptions is not disclosed in the released copy. The document shows that something was removed and the legal basis cited for removing it, but not what the removed text said. That is a fact about the paperwork, not a hint about its contents. A blacked-out passage filed under (b)(7)(E) could describe a named investigative method, or it could be standard boilerplate the FBI withholds as a matter of routine practice across many releases. The public record offers no way to tell which.
Three Unanswered Questions
The source does not say when the document was actually handed to Greenewald, only that the process from filing to publication took roughly seven years. No explanation appears anywhere for why the review took that long. And the relationship between this full release and the earlier partial citations already found in other FBI files is never spelled out: whether those citations quoted this assessment directly, summarized it, or drew on a related but separate record is not established. These are three distinct gaps, not one.
The Requester’s Reading
Greenewald has argued that redaction this extensive, maintained roughly a decade and a half after the assessment was drafted, suggests the material remains sensitive in some ongoing way. That is his reading of the document’s shape, not a statement from the FBI, which has offered no public explanation for why these particular passages stayed sealed. It is a claim, not a finding, and it stands out mainly because it is the only voice in this record drawing a conclusion from the silence. The release letter itself lists the exemption codes and stops there.
—
**Notes on corrections made:**, Changed “US critical infrastructures” to “U.S. critical infrastructures” for consistency with other U.S. references in the text (style consistency). No relative-to-today date references were found requiring correction, all time references (“roughly seven and a half years later,” “roughly a decade and a half after”) are year-based and anchored to specific calendar dates already in the text, so they remain valid per the exception rule. No subject-verb agreement, article, tense, pronoun/homophone, spelling, punctuation, or capitalization errors were found beyond the one consistency fix above.