Core finding. The archive supports three separate facts that should not be collapsed: Cycurity produced the HFA proposal; Barak's archive preserved it; and Barak was simultaneously exploring possible participation in Cycurity. None of those facts, alone or together, proves that a U.S. campaign hired the company or that Barak became an investor.
The seven-page HFA proposal
The controlling attachment is HFA Campaign Proposal_F.pdf, preserved under Barak's Sent!3/1 (272) attachment lane. Its SHA-256 hash is a82f9bc79eb8af6c16cedf44dd07c41bbd1bd87b2956703079fc49ef8f598308. The title page reads “HFA,” “Elections Campaign,” “In USA,” and “Large Scale Relationship Influencing Project,” dated July 2015.
The proposal describes a system for identifying and cultivating relationships with thought leaders, activists and decision makers. Its workflow includes a VIP Mapper, VIP Monitor, Content Engine, Channel Engine, Relationship Engine, Influence Engine and a Strategy Console. It proposes localized social channels, geospatial and traffic analysis, micro-targeting and human-reviewed engagement with named individuals.
Its measurement ladder runs from people who might have seen a campaign through directly targeted VIPs, responses, public endorsements and finally people it classifies as “Mobilized.” The operational section names Cycurity as the supplier of training, back-office help, management technical support and technical support.
What “HFA” establishes—and what it does not
Federal Election Commission records identify Hillary for America, committee C00575795, as Hillary Clinton's principal presidential campaign committee, registered April 13, 2015. That public record supplies context for the acronym and date.
GAH does not use the acronym, archive custody, or proposal text as proof that Hillary for America commissioned the document, received it, paid Cycurity, approved it or deployed the described system. No such closing receipt has been recovered in the source set used for this article.
The proposal was part of a defined 2015 product stack
The HFA language is not isolated. A June 2015 document titled Large Scale Relationship Influencing uses the same VIP Mapper, VIP Monitor, Content Engine, Channel Engine, Relationship Engine and Influence Engine vocabulary. A separate 2015 Cycurity company profile describes compliance/KYC, competitive intelligence, tender-support intelligence, online reputation management, grassroots lobbying and large-scale one-to-one marketing.
That continuity supports treating the HFA document as a tailored application of a broader 2015 Cycurity offering. It does not justify backdating the full software stack to 2013. The earliest 2013 records recovered in this archive describe Halevi reputation work, KYC, branding/influence and “CyberSec services”; they do not contain the later engine names.
July 2015: investment diligence runs beside the influence material
A previously hashed July 29 email preserved in the forensic workpapers records Barak asking Aviram Halevi to have Halevi or Mark contact Udi Knaani regarding Barak's “possible participation” in the company. Barak wrote that he had briefed Udi and trusted him. Halevi replied that he would do so.
The same July 29 source chain records Barak forwarding Halevi's “Proposal” to Udi and telling him to expect contact from Aviram or Mark. The HFA PDF survives in that message's attachment directory. The raw parent HTML is no longer mounted in the current archive copy, so GAH classifies the message wording as a hashed-email workpaper reconstruction, while the attached proposal itself remains a directly inspectable primary artifact.
August 6: a diligence meeting—and then a missing report
On August 6, Udi told Barak in Hebrew that he was meeting “them” that day and would update him. Earlier correspondence identifies the anticipated contacts as Aviram and/or Mark. The forensic search then tracked Udi/Cycurity/Halevi/Goldblatt terms through the end of September and did not recover the promised report-back.
Silence is not a verdict. The missing report does not prove that Barak abandoned the investment, and it does not prove that he completed it. The correct finding is narrower: the recovered archive leaves the outcome unresolved.
August 25: the investment package becomes explicit
The surviving CyFlow Business Plan — Aug 2015 proposes a $2 million investment for 10% of a new company under formation. The post-investment cap table shown in the deck is 45% Starter, 45% Cycurity and 10% investor. Half of the proposed investment was allocated to marketing and sales; half to technology research and development.
The same deck divides the business into large influence projects called “Pearls” and scalable marketing products called “Sapphires.” It claims seven contracted Pearl projects at $750,000 or more and lists “Elections X 2” and “Anti BDS” on a customer/pipeline slide. Those are company claims inside an investment presentation, not independently verified customer identities or proof of campaign deployment.
A second proposal shows the same model outside the HFA document
An August 2015 proposal labeled The Phoenix Project describes improving an unnamed client's standing among Israeli public opinion leaders. It proposes more than 100 localized channels, relationships with up to 1,000 opinion leaders and influencers, and 6,000 monthly interactions after the first quarter. Commercial terms were $45,000 per quarter with a 12-month minimum commitment.
The Phoenix document matters because it independently shows the same relationship-influence model being packaged for another use case. Its client is unnamed, so GAH does not identify Barak—or anyone else—as that client.
The 2013 origin claim stays retrospective
The CyFlow deck says Cycurity and Starter had operated a profitable joint venture since July 2013 and reports $4.365 million of 2013–2014 JV revenue. Those statements are important, but they are statements made in a 2015 fundraising document about earlier years.
The archive search did not recover a contemporaneous 2013 Starter/Reshef parent email, JV agreement, technology-license document, revenue-share contract or software-assignment record. The first parent-message naming Eran Reshef is from July 2015, when Halevi called him “our technologist” and described moving influence projects into a new 50/50 subsidiary to make investment easier.
Claim / source / limit / silence
| Claim | Source | Limit | Open slot |
|---|---|---|---|
| A July 2015 HFA U.S.-elections influence proposal exists in Barak's archive. | HFA Campaign Proposal_F.pdf; hash-verified attachment. | Archive custody is not campaign adoption. | Who commissioned it? |
| Cycurity offered a defined relationship-influence stack. | HFA PDF + June 2015 influence PDF + company profile. | Offered capability is not proof of performance. | Which customers deployed which modules? |
| Barak was exploring possible participation in Cycurity. | Hashed July 29 email reconstruction. | Proposed participation is not funded equity. | Did Barak invest? |
| Udi entered diligence and met the company side. | July 29/Aug. 6 hashed-email workpapers. | The promised report is missing. | What did Udi recommend? |
| CyFlow later offered $2M for 10%. | Aug. 2015 CyFlow business plan. | Fundraising terms are not a closing. | Who, if anyone, subscribed? |
| Cycurity/Starter said their JV dated to July 2013. | 2015 CyFlow business plan. | Retrospective company claim. | No contemporaneous 2013 JV record recovered. |
What this record does not establish
- It does not establish that Ehud Barak directed an HFA influence operation.
- It does not establish that Hillary for America hired, paid or used Cycurity.
- It does not establish that the HFA proposal was operationalized.
- It does not establish that Barak completed an investment in Cycurity or CyFlow.
- It does not establish that the 2015 technical stack existed in identical form in 2013.
Why the sequence matters
The significance is documentary rather than inferential. A sophisticated election-campaign influence proposal, a contemporaneous Barak investment-diligence trail, and a formal CyFlow fundraising package all sit within the same narrow 2015 window. The archive lets those records be placed beside one another. It does not supply the final receipts needed to turn proximity into deployment, ownership or campaign conduct.
Source chain
The machine-readable source list, hashes, classifications and unresolved questions are published at source-manifest.json. The direct-document receipts are now searchable as HFA Campaign Proposal and CyFlow Business Plan. Readers can also inspect the broader Barak archive, source map, timeline and reader guide.
GAH separates primary surviving attachments from forensic workpaper reconstructions when a raw parent-message wrapper is no longer mounted. That distinction is part of the evidence, not a formatting detail.