On November 3, 2026, the Justice Department announced that Abraham Teklu Lemma, 53, of Maryland, a former information technology contractor who held a Top Secret U.S. security clearance, pleaded guilty to conspiring to transmit national defense information to the government of Ethiopia. Lemma had worked as an IT contractor at the National Reconnaissance Office, the U.S. Department of State, and the U.S. Department of Justice. The case shows how a trusted administrator can use both privileged system access and something as simple as pen and paper to move classified information out of secure facilities.
What happened
According to the Justice Department press release:
- Trusted access. Lemma was a former IT contractor at the National Reconnaissance Office, the State Department, and the Justice Department, and he held a Top Secret U.S. security clearance.
- A conspiracy lasting more than two years. From 2021 until his arrest in August 2023, Lemma conspired with senior officials within the political, military, and intelligence branches of the Ethiopian government to collect and transmit dozens of classified documents, notes, materials, and photographs, classified up to the Top Secret/Sensitive Compartmented Information (TS/SCI) level.
- Handwritten notes. He wrote notes by hand containing classified information and hand-carried those notes out of the secure U.S. government facilities where he worked.
- Administrator access misused. He also used his IT administrator access to remove electronic versions of the same classified information from classified government repositories.
- The subject matter. Much of the information concerned an armed conflict in Ethiopia. Lemma encouraged his Ethiopian government conspirators to take direct action against paramilitary groups. On December 18, 2021, he wrote, “Please send Dro[nes].”
- Plea and sentencing. Lemma pleaded guilty to conspiracy to transmit national defense information to a foreign government. Under the plea agreement, he agreed to a prison term of between 120 and 262 months, if the court accepts it. Sentencing is set for April 14, 2027.
- Investigators. The FBI Washington Field Office investigated the case, which is being prosecuted by the U.S. Attorney’s Office for the District of Columbia and the Justice Department’s National Security Division.
Assistant Attorney General for National Security John A. Eisenberg said, “Lemma betrayed the United States to an extraordinary degree.”
Lessons for every insider threat program
- Give privileged users their own monitoring baseline. Administrators can reach repositories that ordinary users cannot, and their activity often looks like routine maintenance. User activity monitoring (UAM) should capture what administrators open, copy, and export, from which repositories, and whether each action ties back to an approved ticket or tasking. Two-person review for bulk access or transfers from classified repositories closes an easy gap.
- Plan for the analog channel. Handwritten notes never trip a data loss prevention (DLP) rule. Technical controls must be paired with behavioral indicators, such as interest in sensitive material outside assigned duties, and with consistent enforcement of the rules on what may leave a secure space. Supervisors and coworkers are often the only sensor for this channel, so they need training on what to report and how.
- Correlate across the whole contract footprint. Lemma worked at three agencies. When a cleared contractor supports several customers, each program may see only part of the picture. Contractor insider threat programs should keep an inventory of every system and facility where their people hold privileged access, and share reportable information with customers as NISPOM (32 CFR Part 117) and contract requirements direct.
- Do not assume the motive is money. The press release does not describe payments. It describes a cleared insider actively urging foreign officials to take action in an armed conflict. Programs should train people to recognize and report concerning statements and unreported foreign contacts, and keep the focus on behavior, never on heritage or national origin.
- Shorten time to detection. This conspiracy ran from 2021 until August 2023. Continuous monitoring is only as good as the analysis behind it. Alerts need trained analysts, timely triage, and a clear path to security, counterintelligence, and law enforcement referral when indicators line up.
How TMPC helps
Our team brings more than 30 years of combined insider threat experience and the proprietary processes built from it. For 8 years, TMPC has delivered continuous counter-insider threat and user activity monitoring support to USSOCOM and JSOC, work that drove that program to a #1 ranking among 24 DoW (DoD) components by DCSA and DIA.
- Continuous user activity monitoring and analysis, including privileged-user activity on classified and unclassified networks.
- Insider threat program development and training aligned with NISPOM (32 CFR Part 117) and DoW requirements, including supervisor and workforce reporting.
- Counter-insider threat analysis that brings technical, behavioral, and reporting data together so analysts can act before information walks out the door.
To talk with our team, contact info@tmpcinc.com or 813.524.6935.