WASHINGTON \u2014 Federal agents descended on the suburban Maryland house with the flash and bang of a stun grenade, blocked off the street and spent hours questioning the homeowner about a theft of government documents that prosecutors would later describe as \u201cbreathtaking\u201d in its scale.<\/p>\n\n\n\n
The suspect, Harold Martin, was a contractor for the National Security Agency. His arrest followed news of a devastating disclosure of government hacking tools by a mysterious internet group calling itself the Shadow Brokers. It seemed to some that the United States might have found another Edward Snowden, who also had been a contractor for the agency.<\/p>\n\n\n\n
\u201cYou\u2019re a bad man. There\u2019s no way around that,\u201d one law enforcement official conducting the raid told Martin, court papers say. \u201cYou\u2019re a bad man.\u201d<\/p>\n\n\n\n
Later this month, about three years after that raid, the case against Martin is scheduled to be resolved in Baltimore\u2019s federal court. But the identity of the Shadow Brokers, and whoever was responsible for a leak with extraordinary national security implications, will remain a public mystery even as the case concludes.<\/p>\n\n\n\n
Authorities have established that Martin walked off with thousands of pages of secret documents over a two-decade career in national security, most recently with the NSA, whose headquarters is about 15 miles from his home in Glen Burnie, Maryland. He pleaded guilty to a single count of willful retention of national defense information and faces a nine-year prison sentence under a plea deal.<\/p>\n\n\n\n
Investigators found in his home and car detailed description of computer infrastructure and classified technical operations in a raid that took place two weeks after the Shadow Brokers surfaced online to advertise the sale of some of the NSA\u2019s closely guarded hacking tools. Yet authorities have never publicly linked Martin or anyone else to the Shadow Brokers and the U.S. has not announced whether it suspects government insiders, Russian intelligence or someone else entirely.<\/p>\n\n\n\n
The question is important because the U.S. believes North Korea and Russia relied on the stolen tools, which provide the means to exploit software vulnerabilities in critical infrastructure, in unleashing punishing global cyberattacks on businesses, hospitals and cities. The release, which occurred while the NSA was already under scrutiny because of Snowden\u2019s 2013 disclosures, raised questions about the government\u2019s ability to maintain secrets.<\/p>\n\n\n\n
\u201cIt was extraordinarily damaging, probably more damaging than Snowden,\u201d cybersecurity expert Bruce Schneier said of the Shadow Brokers leaks. \u201cThose tools were a lot of money to design and create.\u201d<\/p>\n\n\n\n
Yet none of that is likely to be mentioned at Martin\u2019s July 17 sentencing. The hearing instead will turn on dramatically different depictions of the enigmatic Martin, a Navy veteran, longtime government contractor \u2014 most recently at Booz Allen Hamilton \u2014 and doctoral candidate at the time of his arrest.<\/p>\n\n\n\n
Prosecutors allege Martin jeopardized national security by bringing home reams of classified information even as, they say, he once castigated colleagues as \u201cclowns\u201d for lax security measures. Soon after his arrest, they cast aspersions on his character and motives, citing a binge-drinking habit, his arsenal of unregistered weapons and online communication in Russian and other languages.<\/p>\n\n\n\n
The agents who searched his house that August 2016 afternoon found a trove of documents in his car, home and a dusty, unlocked shed. The 50 terabytes of information from 1996 to 2016 included personal details of government employees and \u201cTop Secret\u201d email chains, handwritten notes describing the NSA\u2019s classified computer infrastructure, and descriptions of classified technical operations.<\/p>\n\n\n\n
Defense lawyers paint him as a compulsive hoarder whose quirky tendencies may have led him astray but who never betrayed his country.<\/p>\n\n\n\n
\u201cWhat began as an effort by Mr. Martin to be good at his job, to be better at his job, to be as good as he could be, to see the whole picture at his job, became something more complicated than that,\u201d public defender James Wyda said at a 2016 detention hearing. “It became a compulsion.<\/p>\n\n\n\n
\u201cThis was not Spycraft behavior,\u201d he added. \u201cThis is not how a Russian spy or something like that would ever conduct business.\u201d<\/p>\n\n\n\n
It\u2019s unclear how Martin came to the FBI\u2019s attention, but a redacted court order from a judge suggests agents may have been looking for a Shadow Brokers link when they obtained search warrants for his Twitter account and property before the raid.<\/p>\n\n\n\n
The December 2018 ruling from U.S. District Judge Richard Bennett notes that the FBI was investigating the online disclosure of stolen government property. It cites a Twitter message from an account allegedly belonging to Martin \u2014 @HAL_999999999 \u2014 that requested a meeting with someone whose name is blacked out and stated \u201cshelf life, three weeks.\u201d<\/p>\n\n\n\n
In a likely reference to the Shadow Brokers disclosures, investigators said tweets from Martin\u2019s account were sent hours before stolen government records were advertised and posted online. Investigators also alleged that Martin would have had access to the same classified information as what appeared online.<\/p>\n\n\n\n
The recipient of the message is redacted, although Politico reported it went to the Moscow-based cybersecurity firm Kaspersky Lab, which in turn notified the U.S. Kaspersky declined to discuss the Martin case.<\/p>\n\n\n\n
The roughly 20 officers who stormed Martin\u2019s home did so with dramatic force, arriving with a battering ram and a \u201cflash bang\u201d device meant to cause temporary disorientation. State troopers shut down the road as agents interrogated Martin for four hours.<\/p>\n\n\n\n
Martin was never charged with disclosing information and was accused only of unlawfully retaining defense information. The Shadow Brokers, which two weeks before Martin\u2019s arrest surfaced on Twitter with the warning that it would auction off NSA hacking tools online, continued trickling out disclosures after Martin was in custody, a seeming indication that someone else may have been responsible.<\/p>\n\n\n\n
Even so, his case refocused public attention on repeated government failures to safeguard some of the nation\u2019s most highly classified information, with Martin one of several contractors accused of mishandling or spilling government secrets. Most notable is Snowden, a fellow Booz Allen contractor facing U.S. charges and living in Russia.<\/p>\n\n\n\n
The NSA has since done more to protect its network and security and increased the monitoring of its employees, said security and counterintelligence director Marlisa Smith.<\/p>\n\n\n\n
\u201cI won\u2019t tell you we\u2019ve erased the risk of insider threat, it will never be down to zero, but we\u2019ve worked very hard to mitigate and minimize the risk,\u201d Smith said.<\/p>\n\n\n\n
Booz Allen scrambled to respond to Martin\u2019s arrest, hiring ex-FBI director Robert Mueller to investigate. Since Martin\u2019s arrest, the company said it has added policies to improve its review process of employees at hiring and to ensure managers are more in touch with their subordinates.<\/p>\n\n\n\n
As for the mystery of who or what is behind the Shadow Brokers, there\u2019s little certainty that the government will ever publicly resolve that lingering question, especially given the classified nature of the theft and the embarrassment it caused the U.S.<\/p>\n\n\n\n
\u201cI don\u2019t know if anybody knows other than the Russians,\u201d said former NSA computer scientist Dave Aitel. \u201cAnd we don\u2019t even know if it\u2019s the Russians. We don\u2019t know at this point; anything could be true.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The arrest of a contractor for the National Security Agency followed news of a devastating disclosure of government hacking tools by a mysterious internet group calling itself the Shadow Brokers.<\/p>\n","protected":false},"author":7,"featured_media":39793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":39,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,29,32],"tags":[],"coauthors":[5662],"class_list":["post-22134","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"P2W5JVZGBJA2HPQEDBRPD6NL3I","arc_canonical_url":"\/federal-oversight\/doj-fbi\/2019\/07\/08\/mystery-of-nsa-leak-lingers-as-stolen-document-case-winds-up\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n