A federal contractor suspected in the leak of powerful National Security Agency hacking tools has been arrested and charged with stealing classified information from the U.S. government, according to court records and U.S. officials familiar with the case.
Harold Thomas Martin III, 51, who did technology work for Booz Allen Hamilton, was charged with theft of government property and unauthorized removal and retention of classified materials, authorities said. According to two U.S. officials familiar with the case, he is suspected of “hoarding” classified materials going back as far as a decade in his house and car, and the recent leak of the hacking tools tipped investigators to what he was doing.
Martin was arrested in August after investigators raided his home in Glen Burnie, Md., and found documents and digital information stored on various devices that contained highly classified information, authorities said.
The breadth of the harm Martin is alleged to have caused – and what might have motivated it, if proven – was not immediately clear, although officials said some of the documents he took home “could be expected to cause exceptionally grave damage to the national security of the United States.”
Investigators are probing whether Martin, who had top secret clearance, was responsible for an apparent leak that led to a cache of NSA hacking tools appearing online in August, according to the officials familiar with the case, who spoke on the condition of anonymity because the investigation is ongoing.
The FBI and NSA are trying to figure out what drove Martin. The FBI’s Behavioral Analysis Unit is working on a psychological assessment, officials said. “This definitely is different” from other leak cases, one U.S. official said. “That’s why it’s taking us awhile to figure it out.”
The leaked NSA tools included “exploits” that take advantage of unknown flaws in firewalls, for instance, allowing the government to control a network. They were posted by a group calling itself the Shadow Brokers. Current and former federal officials said their disclosure could allow targets of NSA spying to determine they were hacked by the United States, and some foreign spy agencies might be able to repurpose the tools.
“This will embolden many to retaliate, likely leading to an escalation of an already costly exchange of cyberattacks between the U.S. and some of its adversaries,” said Leo Taddeo, a former FBI agent and chief security officer at Cryptzone, a cybersecurity firm.
Martin’s arrest, first reported by the New York Times, marks another humiliating lapse for both Booz Allen and the NSA. In 2013, contractor Edward Snowden, who also worked for Booz Allen, passed a massive trove of documents to journalists, shedding light on massive government surveillance programs that have drawn criticism since they were revealed.
Even before that, the federal government had made detecting and deterring leaks a high priority. In 2011, President Obama created the National Insider Threat Task Force to assist in that effort, and the Justice Department under his administration has prosecuted more leakers than all of its predecessors combined. And after the Snowden disclosures, the NSA doubled down, adopting new technical measures to control information.
For example, officials instituted new rules on downloading sensitive data and implemented audit trails and more frequent screenings of network access by system administrators.
Rep. Adam B. Schiff (Calif.), the ranking Democrat on the House Intelligence Committee, said in a statement that Martin’s arrest made it “painfully clear that the Intelligence Community still has much to do to institutionalize reforms designed to protect in advance the nation’s sources and methods from insider threats.”
An NSA spokesman declined to comment on Martin’s arrest. In a statement attached to an SEC filing, Booz Allen said that when it learned one of its employees was arrested, “we immediately reached out to the authorities to offer our total cooperation in their investigation, and we fired the employee. We continue to cooperate fully with the government on its investigation into this serious matter.” The company said there had “been no material changes to our client engagements as a result of this matter.”
White House press secretary Josh Earnest said Wednesday: “This is certainly a situation that the Department of Justice takes seriously, as evidenced by their complaint. This is also a situation that President Obama takes quite seriously. And it is a good reminder for all of us with security clearances about how important it is for us to protect sensitive national security information.”
Military records and an online profile show that Martin was a former Naval officer and reservist with a broad interest in cyber issues. His attorney said he was a Navy lieutenant, and records show he served for more than a decade, spending some years on the USS Seattle before ending his military career in the inactive reserves.
According to his LinkedIn profile and school officials, Martin was in an information systems graduate program at the University of Maryland Baltimore County, and he had studied software and security engineering at George Mason University and economics at the University of Wisconsin. He wrote that his goal was “to advance state of the art in several areas of computing practices in the public/private sector.”
Federal public defender Jim Wyda and first assistant federal public defender Deborah Boardman, who are representing Martin, said in a statement that the charges against Martin were “mere allegations” and that they had not yet seen prosecutors’ evidence.
“There is no evidence that Hal Martin intended to betray his country. What we do know is that Hal Martin loves his family and his country,” the attorneys said. “He served honorably in the United States Navy as a lieutenant and he has devoted his entire career to protecting his country. We look forward to defending Hal Martin in court.”
When Martin was taken into custody on Aug. 27, a Saturday, neighbors could hear a boom from blocks away.
It was around 2:30 p.m., and Steve Cunningham, behind a house two doors down, was so startled that he dropped to the ground. Around the corner, Glen Bond had just cracked a Miller Lite and sat down to watch TV in his living room. He walked outside, suspicious that a neighbor had just set off a giant firework.
Federal agents dressed in tactical gear and toting drawn rifles were swarming around the small brick and vinyl-sided house. At least two federal vans and more than 20 vehicles shut down access to the area.
Murray Bennett walked out on his stoop just in time to see a dozen agents smash through Bennett’s backyard fence.
“Get back in the house!” a man in an FBI jacket yelled at him.
Not long after, he saw Martin escorted outside in handcuffs.
“Next thing you know, he was gone,” Bennett said.
Until well past midnight, neighbors watched as the investigators ransacked Bennett’s aging purple Chevrolet Caprice – still parked in the driveway – and carried out black trash bags from his home. Bennett said he knew Martin as a “computer guy” who was well educated and decent.
“Unreal,” said Bennett, who has known Martin for about a decade. “We passed out Halloween candy together.”
Neighbors described Martin as friendly but quiet. They said they hadn’t noticed any change in him leading up to the raid.
Around 3 p.m. on Tuesday, a woman who identified herself as Martin’s wife pulled up in a black Nissan Rogue and unloaded her groceries.
“The only thing I can say is that it’s a matter under investigation. I have no comment,” she told reporters before stepping inside.
Prosecutors did not reveal in the criminal complaint how they were tipped to Martin or what precisely they recovered. The complaint alleged that Martin initially denied to investigators that he took documents home, but once confronted with specific examples, he admitted he did so and that he knew the materials were classified. The complaint alleged that Martin “stated that he knew what he had done was wrong.”
If convicted, Martin would face a maximum of 11 years in prison. The U.S. attorney’s office in Maryland said he appeared in court on Aug. 29 and remains detained.