US State Department Worker Charged with Espionage for Sharing Classified Intel with African Nation

A U.S. government contractor employed as an IT help desk technician has been charged with espionage for allegedly transferring classified defense intelligence to an intelligence official from an undisclosed African country. The U.S. Department of Justice announced the charges on Thursday.

The accused, Abraham Teklu Lemma, a 50-year-old naturalized U.S. citizen of Ethiopian descent residing in Silver Spring, Maryland, was arrested on August 24. He faces charges of sending and conspiring to send national defense information to aid another country and the willful retention of sensitive documents, as outlined in a federal affidavit.

Although U.S. officials did not specify the recipient country, The New York Times identified it as Ethiopia.

At the time of his arrest, Lemma worked in the IT department of the U.S. Department of State Bureau of Intelligence and Research since at least 2021. He also held a position as a contract management analyst in the U.S. Department of Justice and had top-secret security clearance since at least 2020.

If convicted, Lemma could face the death penalty or a life sentence, with a minimum of ten years in prison. According to the affidavit, Lemma unauthorizedly copied, removed, and retained secret and top-secret information from at least 85 intelligence reports, with most of them related to the African country, between December 19, 2022, and August 7, 2023.

These documents contained intelligence regarding military operations in the African country and were shared with the belief that they would be used to the detriment of the United States and to the advantage of a foreign nation, according to officials.

Suspicious activities within the State Department initially raised concerns in 2022. In February of that year, Lemma traveled to the African country, returning to his U.S. contractor job approximately five months later. In August and September 2022, Lemma allegedly transmitted classified documents through an encrypted messaging application to an official associated with intelligence in the African nation. The material included satellite imagery and information about a third party conducting business in the country.

Lemma traveled to the African country once more in April and resumed work in June. Prosecutors allege that since then, Lemma copied and pasted dozens of classified reports into Microsoft Word documents, removing U.S. classification markings.

The affidavit reveals correspondence between Lemma and an intelligence official in Ethiopia. An FBI agent, whose name is withheld from the public, stated in the affidavit that Lemma had been in contact with this official and shared classified information. In May 2022, the official applied for a U.S. visa, listing their title and using a phone number that matched the profile Lemma had been communicating with on the encrypted messaging application.

The affidavit cites discussions between Lemma and the foreign official regarding reports on military activities of an armed rebel group in the African country.

In the weeks leading up to his August arrest, officials observed Lemma accessing classified information on his work computer and taking notes on paper. He was seen concealing these notes in his pants pocket while sitting in his car with the lights on for over 20 minutes.

On August 7, Lemma was allegedly witnessed reviewing and copying classified materials to a Microsoft Word document, burning it onto a CD, and leaving work early with the information hidden in his jacket.

Approximately a week later, he was observed accessing classified information again, taking notes on paper for 15 minutes before leaving work. The affidavit further claims that Lemma downloaded 10 documents, mostly classified as secret or top secret, on August 18.

A search of Lemma’s non-government online accounts unveiled digital copies, notes, and maps of classified information. Prosecutors revealed that they had determined the electronic account had been accessed from an IP address in the African country on 31 occasions between April and June, including days when Lemma was not present in the country and during days when he was seen burning CDs.