A U.S. government contractor who worked as an IT help desk technician was charged with espionage for transferring classified defense intelligence such as satellite images, maps and notes to an intelligence official from an African country, the justice department announced Thursday. 

Abraham Teklu Lemma, 50, a naturalized U.S. citizen of Ethiopian descent from Silver Spring, Maryland, was arrested on Aug. 24 for sending and conspiring to send national defense information to aid another country and for the willful retention of sensitive documents, according to a federal affidavit.

U.S. officials did not specify where the man sent the information, but the New York Times identified the country as Ethiopia.

At the time of his arrest, Lemma worked IT in the U.S. Department of State Bureau of Intelligence and Research since at least 2021, according to the affidavit. He also worked as a contract management analyst in the U.S. Department of Justice during the day and had top secret security clearance since at least 2020.

If convicted, Lemma faces the death penalty or up to life in prison with a minimum ten years.

According to the affidavit, Lemma copied, removed and retained secret and top secret information from at least 85 intelligence reports, most relating to the African country, without authorization between Dec. 19, 2022, and Aug. 7, 2023. 

Documents included intelligence related to military operations in the African country and were shared “believing that such information would be used to the injury of the United States and to the advantage of a foreign nation,” officials said.

Suspicious activity spotted in state department

U.S. government officials first noticed the suspicious activity in 2022. In February that year, Lemma traveled to the African country and returned to his U.S. contractor job about five months later. 

In August and September last year, Lemma allegedly transmitted classified documents over an encrypted messaging application to an official believed to be connected with intelligence in the African country. The material sent included satellite imagery of the African country and information about a third party conducting business in the country.

Lemma traveled to the African country again in April and returned to work in June. Since then, according to prosecutors, Lemma copied and pasted dozens of classified reports into Microsoft Word documents and deleted U.S. classification markings. 

Correspondence with an intelligence official in Ethiopia

An FBI agent wrote in the affidavit that Lemma was in contact with and sent classified information to an intelligence official in the African country. The federal agent's name was blacked out in the affidavit and kept secret from the public.

In May 2022, the official that Lemma met applied for a visa to the U.S., listing their title and using a phone number that matched the profile Lemma had been corresponding with on the encrypted messaging application. 

According to the affidavit, Lemma and the foreign official discussed reports on military activities of an armed rebel group in the African country. 

One text from the official said, “this beautiful country have [sic] some special people who scarify [sic] their life to protect our proud history. You always remembered. It doesn’t matter the results.”

In the weeks leading to his arrest in August this year, officials observed Lemma accessing classified information on a work computer and taking notes on a sheet of paper. He was seen folding the note and placing it into his pants pocket before leaving the office to his car, which he stayed in for more than 20 minutes with the lights on, according to the affidavit.

On Aug. 7, officials allegedly saw Lemma reviewing and copying classified materials to a Microsoft Word document, burning it onto a CD and leaving work early with the information hidden in his jacket.

About a week later, officials said they saw him accessing classified information. Lemma took notes on paper for 15 minutes before leaving work. According to the affidavit, Lemma downloaded 10 documents, most classified as secret or top secret, on Aug. 18.

A search of Lemma’s non-government online accounts revealed digital copies, notes, and maps of classified information. Prosecutors said they determined that the electronic account had been accessed from the African country’s IP address 31 times between April and June – including when Lemma wasn’t in the country and on days when he was observed burning CDs.