The Cable

Prosecutors Detail What May Be NSA’s Worst-Ever Security Breach

Contractor Harold Martin is accused of lifting as many as 500 million pages of classified and top-secret material from Ft. Meade, and will be charged under the Espionage Act.

The National Security Agency (NSA) headquarters at Fort Meade, Maryland, as seen from the air, January 29, 2010.      AFP PHOTO/Saul LOEB (Photo credit should read SAUL LOEB/AFP/Getty Images)
The National Security Agency (NSA) headquarters at Fort Meade, Maryland, as seen from the air, January 29, 2010. AFP PHOTO/Saul LOEB (Photo credit should read SAUL LOEB/AFP/Getty Images)

When the FBI announced earlier this month it had arrested NSA contractor Harold Martin, it was clear the American signals intelligence agency had suffered a huge breach of internal security. But no one imagined the staggering amount of information Martin allegedly amassed in his suburban Maryland home: a digital archive that may reach 500 million pages, much of it secret.

In a 12-page filing on Thursday, federal prosecutors presented their most detailed accounting so far of the classified material Martin allegedly accumulated over a two-decade career in government. It includes “specific operational plans against a known enemy of the United States” distributed on a “need to know basis” and “notes describing the NSA’s classified computer infrastructure” and operations.

If convicted for his actions, Martin’s home archive may constitute the largest archive of mishandled classified information in U.S. history. Prosecutors revealed on Thursday that they plan to charge him under the Espionage Act. Prosecutors are likely to seek a stiff prison sentence, but it remains unclear which specific charges Martin will face.

“The sheer volume of the programs he could compromise is staggering,” said Dave Aitel, a former NSA research scientist and the CEO of Immunity, Inc., a computer security company.

Prosecutors are still wondering why Martin allegedly did it. They have offered no evidence that he had shared, or planned to share, the material with others, such as a foreign intelligence agency. Yet he allegedly had a stash of guns and advanced encryption tools, and communicated online in different languages, including Russian. Investigators found hand-written notes explaining the basics of cyber tradecraft on the back of top-secret printouts just lying around Martin’s car.

“At this point, I’m sure the people at Ft. Meade are hoping he offers his full cooperation so they can do proper damage control. The sooner the better,” said Aitel.

During his time at the NSA, Martin reportedly worked with the agency’s most elite hackers, a unit known as Tailored Access Operations and charged with penetrating the most difficult targets.

Following the disclosure of a huge quantity of classified material by Edward Snowden 2013, the U.S. government has spent billions of dollars to clamp down on what it calls “insider threats.” If true, Martin’s theft of classified information would represent a black eye on the intelligence community’s efforts to prevent such leaks.

According to prosecutors, the classified materials found at Martin’s home date from 1996 to 2016. Several documents marked Top Secret/Sensitive Compartmented Information — which designates some of the government’s most closely held information — were found lying openly in Martin’s home and the backseat and trunk of his car. The raid on his home netted six bankers’ boxes worth of physical material, and a number of computers, thumb drives, and external hard drives.

Investigators are still going over that material, and it remains unclear what portion of Martin’s digital storage devices contain government secrets. Prosecutors say their investigation has so far revealed an “astonishing quantity” of classified material in Martin’s possession and that they expect to discover additional secrets.

Thursday’s filing makes clear that prosecutors are still puzzling over Martin’s motive. The former Booz Allen Hamilton contractor has been described as a loner and a hoarder who brought classified material home for his own edification. Enrolled in a PhD program in computer security, Martin may have been using NSA materials for research purposes.

But Thursday’s filing indicates that prosecutors are looking hard at whether Martin attempted to disseminate any of the information he brought home, though they have so far presented no evidence that he did.

Most intriguingly, the search of Martin’s car turned up a printed email chain marked “top secret” with the former contractor’s notes on the back. “The handwritten notes also include descriptions of the most basic concepts associated with classified operations, as if the notes were intended for an audience outside of the Intelligence Community unfamiliar with the details of its operations,” prosecutors said in their filing.  

The notes, Aitel said, may indicate that Martin “intended to release that information to someone not familiar with cyber operations, such as, perhaps, another country’s intelligence service.”

According to the New York Times, the material found at Martin’s home includes NSA hacking tools that turned up for sale online two months ago. An unidentified hacking group calling itself the Shadow Brokers released the NSA code online this summer to establish the credibility of another file allegedly containing additional NSA cyberweapons. The Shadow Brokers demanded several million dollars in exchange for the file, but have not found a buyer so far.

Investigators have reportedly not found any evidence so far to indicate that Martin served as the source of the Shadow Brokers dump.

The search of Martin’s home also turned up ten firearms, including an AR-15 rifle and a shotgun with a flash suppressor. FBI agents seized the weapons at the request of Martin’s wife, who was unaware of the number of weapons at their shared home. Prosecutors said she feared her husband might kill himself with the one of the weapons.

Investigators also found advanced encryption and anonymization tools, which someone with Martin’s skill could use to shield his internet activities and communication.

Thursday’s filing came in support of a government request to keep Martin in jail ahead of his trial. They argue that Martin constitutes a serious flight risk, and that foreign intelligence agencies could reap huge benefit from Martin’s knowledge. Prosecutors alleged in their filing that Martin has “communicated online with others in languages other than English, including in Russian.”

Defense lawyers for Martin argued in a separate filing Thursday that prosecutors had concocted “fantastical scenarios” to keep their client behind bars. Martin does not posses a valid passport, served in the United States Navy, and has a wife and home in Maryland, his lawyers James Wyda and Deborah Boardman noted.

“There is no evidence he intended to betray his country,” they wrote.

On Friday, Martin will appear in a Baltimore federal court for a detention hearing.

SAUL LOEB/AFP/Getty Images

Elias Groll is a staff writer at Foreign Policy. Twitter: @EliasGroll

Trending Now Sponsored Links by Taboola

By Taboola

More from Foreign Policy

By Taboola