“If this effort results in information identifying a party responsible for an unauthorized disclosure,” then such information “will be referred to the appropriate criminal entity for criminal prosecution,” the memo stated.