Judge Tells Prosecutors They Need To Prove Contractor Knew He Had Classified Docs In His 50-Terabyte Stash

from the go-big-AND-go-home dept

The federal judge presiding over the prosecution of a government contractor who took home 50 terabytes of sensitive national security documents home with him has sent a message. And the message is this: collect it all.

Harold Martin did what surveillance agencies do best. He built himself a haystack of government documents, some of them designated "top secret." The prosecution is counting on this haystack to put Harold Martin in prison on espionage charges. But the judge has just ordered prosecutors to prove the few "top secret" needles justify a conviction for the entire haystack. Josh Gerstein at Politico has the details.

Baltimore-based U.S. District Court Judge Marvin Garbis suggested in his Feb. 16 order that the sheer volume of information may be a problem for prosecutors because their case is based on 20 felony charges that Martin illegally retained individual classified documents without permission.

Garbis asked the prosecution and defense to explain whether the government must prove that Martin knew he had those specific documents in his possession or whether he could be convicted of the claimed Espionage Act violations without such proof.

Espionage prosecutions are a mess. This mess usually works in the government's favor. The rules surrounding these prosecutions severely restrict the defenses the accused can raise and the evidence they can submit. The sensitivity of the underlying documents results in plenty of ex parte submissions seen only by the judge and the government. In this case, though, the judge is asking the government to prove Martin knowingly took top secret documents, rather than just ending up with some in his massive collection of government paperwork. If it can't, Martin might walk away from charges on the premise he had no idea what was in the 50 terabytes in his possession. Here's law prof Steve Vladeck's take on the order:

"There has not been a lot of really sophisticated litigation about the awkwardness of treating piles of information as being subject to the Espionage Act because of one piece of that pile," said University of Texas law professor Stephen Vladeck. "It's a rare situation where the defendant has a plausible argument that he grabbed the wrong pile of documents."

Prosecutors aren't happy with this order. Their response says they have no obligation to prove Martin knew he had sensitive documents in his stash. This is a questionable assertion, considering the accusing party carries the burden of proof in all criminal cases. The government apparently believes it can secure a conviction without this key evidence.

But prosecutors also make a solid point: a requirement like this encourages people exfiltrating government documents to take as many as possible. The more you grab, the harder it is for prosecutors to prove you knowingly possessed classified material.

If this proves to be a sticking point, prosecutors may decide to go after Martin for theft. It probably won't net them the sentence a 20-count indictment normally would, but probably looks more palatable than accepting Martin's unsolicited offer to plead guilty to a single count of the charges brought against him.

Hopefully, the judge won't back down from this demand. The government's track record with espionage prosecutions is terrible. They've severely harmed people who've done nothing more than try to be a good employee. Lots of people take work home with them. Only a very small percentage of those do anything more nefarious with government documents than work off the clock.

Filed Under: data, harold martin, hoarding, nsa, secrets, top secret

Former NSA Contractor Pleads Guilty To Taking His National Defense Work Home With Him

from the unauthorized-document-removal-service-shuts-down-after-20-years dept

Not sure how leaky our nation is, but it would appear those guarding it from outside attacks seldom gaze inward to see how their internal security is holding up. Harold Martin III, a government contractor, spent 20 years exfiltrating top secret documents before the NSA caught on. Given that some of this happened after the NSA's "oh shit" moment -- Snowden walking away from the NSA and towards journalists with an untold number of documents -- one has to wonder how seriously the NSA takes its own security.

Martin has now pled guilty to one charge of "willful retention of national defense documents." He's still facing twenty charges in total, including the belated addition of an espionage count. Fifty terabytes of documents were lifted by Martin -- not just from the NSA, but from the CIA, US Cyber Command, National Reconnaissance Office, and the Defense Department.

That one count could net Martin 10 years in prison. But he could be facing more time than that, thanks to this being only a plea, rather than a plea deal.

Martin pleaded guilty to one count of willful retention of national defense information, which carries a maximum of 10 years in prison, followed by three years of supervised release and fines up to $250,000.

However, since the guilty plea did not include a deal of any kind and there are other extenuating circumstances—such as the abuse of a position of public trust and another 19 counts charged in the original indictment—the judge will have additional leeway during sentencing.

The other 19 charges are still in play, Martin's plea notwithstanding. The DOJ may try to make an example of Martin as a deterrent for future contractors who can't seem to stop taking their work home with them. Unfortunately, the internal controls on contractor access don't appear to be receiving the same amount of attention. As the White House continues to loosen restrictions on federal agency access to NSA collections and tools, the likelihood of sensitive information that can be accessed or taken by contractors increases. The expanded surveillance apparatus is too big to be handled in-house and will likely never be scaled back to the point where controlled access is anything more than a theory.

This is the end of one contractor's twenty-year run on supposedly ultra-secure systems. Martin cannot possibly be the only contractor whose work has made its way out of the office. The Intelligence Community's oversight has pointed out the half-assed job being done to secure things post-Snowden. Martin is just an embodiment of the IC's ideals: more focused on collecting data than making sure the collected info remains secure.

Filed Under: harold martin, nsa

How Could NSA Contractor Harold Martin Have Been Taking Home Classified Info For 20 Years Without NSA Noticing?

from the seems-like-an-important-question dept

A few weeks back, we wrote about the arrest of Harold Martin, an NSA contractor working at Booz Allen, for apparently taking "highly classified information" from the NSA and storing it electronically and physically in his home. There were a lot of questions about whether or not Martin was connected to the Shadow Brokers release of NSA hacking tools, though as more info comes out, it sounds like perhaps Martin was just found because of an investigation into Shadow Brokers, but not because he was connected to them. Soon after the arrest was made public (after being kept sealed for a little over a month), reports came out suggesting that Martin was basically a digital hoarder, but not a leaker (or a whistleblower).

The latest filing by the government in the case gives you a sense of just how much hoarding was done. Basically, it sounds like Martin has been taking a variety of digital and paper files home for two decades or so. There's a lot of stuff.

The Defendant stole from the government and hid at his residence and in his vehicle a vast amount of irreplaceable classified information. His thefts involved classified government materials that were dated from 1996 through 2016, spanning two decades’ worth of extremely sensitive information.

Now, it may be that he did the taking more recently and just took old documents, but that 1996 date coincides with when he first got access to such material:

The Defendant had access to classified information, including Top Secret information, beginning in 1996. His access to classified information began during his service in the U.S. Naval Reserves, and continued as he worked for seven different private government contracting companies. Access to classified information was critical to the Defendant’s employment in his field. He worked on highly classified, specialized projects and was entrusted with access to government computer systems, programs and information.

The government estimates 50 terabytes of data, but admits it's still going through all of it to figure out what is in there.

During execution of the search warrants, investigators seized thousands of pages of documents and dozens of computers and other digital storage devices and media containing, conservatively, fifty terabytes of information....

[....]

A conservative estimate of the volume of the digital information seized from the Defendant is approximately 50,000 gigabytes. This information must be fully reviewed by appropriate authorities to determine its source and classification level, as well as the extent to which it constitutes “national defense information.” The investigation into the Defendant’s unlawful activities is ongoing, including review of the stolen materials by appropriate authorities. The government anticipates that much of this material will be determined to be national defense information that the government goes to great expense to protect.

Of course, some in the press are claiming, incorrectly, that this means Martin took 500 million pages of records and secrets, but we don't know that yet. The DOJ admits it's still going through everything, and has no idea how much of it is secret (or even how much of it is from the government).

Martin, at the very least, does appear to have been... kind of careless with some of this stuff:

For example, the search of the Defendant’s car revealed a printed email chain marked as “Top Secret” and containing highly sensitive information. The document appears to have been printed by the Defendant from an official government account. On the back of the document are handwritten notes describing the NSA’s classified computer infrastructure and detailed descriptions of classified technical operations. The handwritten notes also include descriptions of the most basic concepts associated with classified operations, as if the notes were intended for an audience outside of the Intelligence Community unfamiliar with the details of its operations.

Among the many other classified documents found in the Defendant’s possession was a document marked as “Top Secret/Sensitive Compartmented Information” (“TS/SCI”) regarding specific operational plans against a known enemy of the United States and its allies. In addition to the classification markings, the top of the document reads “THIS CONOP CONTAINS INFORMATION CONCERNING EXTREMELY SENSITIVE U.S. PLANNING AND OPERATIONS THAT WILL BE DISCUSSED AND DISSEMINATED ONLY ON AN ABSOLUTE NEED TO KNOW BASIS. EXTREME OPSEC PRECAUTIONS MUST BE TAKEN.” The Defendant was not directly involved in this operation and had no need to know about its specifics or to possess this document.

Of course, the usual caveat does apply: this is the DOJ's side of the story, and history tells us they have a habit of massively inflating things or misrepresenting things in these kinds of cases. That includes over-classification or other exaggerations about how serious, important, or secret certain information truly is. So, take the DOJ's claims with at least some grain of salt here. It will certainly be interesting to see how Martin responds to all of this.

The other interesting, and potentially troubling part, is that it appears the DOJ is moving to charge Martin under the Espionage Act. When the initial charge sheet came out, some people noticed that it didn't include Espionage Act charges, which even Ed Snowden pointed out was a "noteworthy absence." At the very least, it implied no distribution by Martin.

However, the latest filing makes it clear the lack of Espionage Act charges was a temporary thing that the DOJ is planning to correct soon. But here's the really crazy bit: the government is arguing that merely collecting this info is an Espionage Act violation, even without distributing it.

The improper retention and transmission of national defense information is prohibited under the Espionage Act. See, e.g., 18 U.S.C. § 793 (Gathering, Transmitting or Losing Defense Information). Information about sources and methods of the Intelligence Community, such as the information in the documents described above, and in the criminal complaint, is classic national defense information. See Gorin v. United States, 312 U.S. 19, 28 (1941) (information relating to the national defense is “a generic concept of broad connotations, referring to the military and naval establishments and the related activities of national preparedness.”). In this case, when an indictment or information is filed, the government anticipates that the charges will include violations of the Espionage Act, an offense that carries significantly higher statutory penalties and advisory guideline ranges than the charges listed in the complaint.

You can check out 18 USC 793 yourself. It's noteworthy that most of it requires intent or belief that the information is being used to harm the US, or distribution, but it's likely that the DOJ is leaning hard on section (f):

Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer

Still... this once again seems like a stretch under the Espionage Act. If it's true that Martin was just hoarding the information (even carelessly), it's overkill to bust out the Espionage Act. If true, it would be stupid, but it's clearly not spying for the purpose of helping a foreign nation or anything.

One final thing, though. Fifty terabytes is a shitload of information. How the hell did the NSA not notice this over the past two decades? Even assuming (which is a pretty bad assumption) that the NSA was not as good at protecting its secrets prior to the Snowden leaks, once Snowden's leak was public, how the hell did the NSA still not notice what Martin had done (or, potentially, was continuing to do)? If anything, this raises a hell of a lot more questions about the NSA's own security practices than anything about Martin himself.

Filed Under: espionage act, harold martin, nsa

FBI Arrested NSA Contractor For Walking Off With 'Highly Classified Information'

from the thought-this-kind-of-thing-was-supposed-to-be-impossible? dept

The Justice Department announced this morning that it had arrested Harold Martin, an NSA contractor (working for Booz Allen), for apparently copying "highly classified" material. The arrest actually happened at the end of August, but the details were only unsealed today.

According to the affidavit, on August 27, 2016, search warrants were executed at Martin’s residence in Glen Burnie, including two storage sheds, as well as upon his vehicle and person. During execution of the warrants, investigators located hard copy documents and digital information stored on various devices and removable digital media. A large percentage of the materials recovered from Martin’s residence and vehicle bore markings indicating that they were property of the United States and contained highly classified information of the United States, including Top Secret and Sensitive Compartmented Information (SCI). In addition, investigators located property of the United States with an aggregate value in excess of $1,000, which Martin allegedly stole.

The complaint alleges that among the classified documents found in the search were six classified documents obtained from sensitive intelligence and produced by a government agency in 2014. These documents were produced through sensitive government sources, methods, and capabilities, which are critical to a wide variety of national security issues. The disclosure of the documents would reveal those sensitive sources, methods, and capabilities.

The NY Times story about this claims that the information Martin had was "computer code." There's a lot of speculation on the Twitters that this is related to the infamous Shadow Brokers "leak" of NSA hacking tools. The dates don't fully line up. The Shadow Brokers leak involved code from 2013. The DOJ claims that the code it found Martin had is from 2014 -- though it's certainly possible that the investigation into Shadow Brokers led them to Martin (the arrest came the week after the Shadow Brokers info went public). However, the NY Times report does say that the info was for breaking into foreign computer systems:

The contractor arrested in recent weeks is suspected of taking the highly classified “source code” developed by the agency to break into computer systems of adversaries like Russia, China, Iran and North Korea. Two officials said that some of the information the contractor is suspected of taking was dated.

As always, it will be interesting to hear the other side of this story. We've certainly seen the DOJ come down hard on former NSA employees and contractors, claiming they had made off with classified information, when the later details turned out to show a lot less. But this is clearly a story worth following...

It should also make you wonder just how many "controls" the NSA has really put in place to keep employees and contractors from walking off with highly classified information. We know that Snowden did it back in 2013, but the NSA keeps insisting that it's put in place more controls to stop it from happening again. And, if this truly is exploit code, this is much worse. Snowden made off with information about certain programs -- but not actual code.

Filed Under: contractor, doj, exploits, fbi, harold martin, nsa, shadow brokers, surveilance
Companies: booz allen