AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT

IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

UNITED STATES OF AMERICA ) UNDER SEAL

)

v. ) Criminal No. 1:23-CR-____

)

ABRAHAM TEKLU LEMMA, )

)

Defendant )

AFFIDAVIT IN SUPPORT OF

AN APPLICATION FOR A CRIMINAL COMPLAINT AND ARREST WARRANT

I, Special Agent of the Federal Bureau of Investigation (“FBI”) being

duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

1. I am an investigative or law enforcement officer of the United States, within the

meaning of Section 2510(7) of Title 18, United States Code, and am empowered by law to conduct

investigations of, and to make arrests for offenses enumerated in Title 18, United States Code,

Section 2516.

2. I am a Special Agent with the FBI assigned to the Washington Field Office. During

my time with the FBI, I have received training at the FBI Academy located at Quantico, Virginia,

specific to counterintelligence and espionage investigations. Since 2021, I have been assigned to

a counterintelligence squad at the Washington Field Office where my primary duties include the

investigation of espionage and other national security matters, including violations of Title 18,

United States Code, Sections 794 and 793. I currently am assigned to investigate

counterintelligence and espionage matters.

3. I have training in the preparation, presentation, and service of criminal complaints,

and have been involved in the investigation of numerous types of offenses against the United

States. I have also been trained in the preparation, presentation, and service of arrest and search

warrants, and have executed both arrest warrants and search warrants in previous cases.

PURPOSE OF AFFIDAVIT

4. Based on my training and experience and the facts as set forth in this affidavit, there

is probable cause to believe that Abraham Teklu Lemma (“Lemma”) violated 18 U.S.C. § 794(a)

(gathering or delivering defense information to aid a foreign government); 18 U.S.C. § 794(c)

(conspiracy to gather or deliver defense information to aid a foreign government); and 18 U.S.C.

§ 793(e) (having unauthorized possession of National Defense Information (“NDI”)). I therefore

make this affidavit in support of a criminal complaint charging Lemma with these offenses.

5. These acts occurred in the District of Columbia and elsewhere, involved the

transportation of classified NDI from and through the District of Columbia to another state or

country, and involved electronic communications from or through the District of Columbia

and another state or country in furtherance of the conspiracy, and are thus within the venue

of the United States District Court for the District of Columbia, pursuant to 18 U.S.C. § 3237.

Additionally, as classified NDI was transmitted to another country, which is outside the

jurisdiction of any State or district, venue is proper in this District pursuant to 18 U.S.C.

§ 3239.

6. The facts in this affidavit come from your affiant’s personal observations,

training and experience, and information obtained from other U.S. Government officers and

witnesses. This affidavit is intended merely to show there is sufficient probable cause for

Lemma’s arrest and does not set forth all your affiant’s knowledge about this matter.

STATUTORY AUTHORITY AND DEFINITIONS

7. For the reasons set forth below, there is probable cause to believe that Lemma

committed violations of 18 U.S.C. §§ 794 (a), and (c), and 793(e).

8. Under 18 U.S.C. § 794(a), “[w]however, with intent or reason to believe that it is

to be used to the injury of the United States or to the advantage of a foreign nation, communicates,

delivers or transmits, or attempts to communicate, deliver or transmit, to any foreign government

. . . or to any representative, officer, agent, employee, subject, or citizen thereof . . . any document,

writing, . . . or information relating to the national defense” shall be imprisoned “for any term of

years or for life[.]”

9. Under 18 U.S.C. § 794(c), “[i]f two or more persons conspire to violate this section,

and one or more of such persons do any act to effect the object of the conspiracy, each of the

parties to such conspiracy shall be subject to the punishment provided for the offenses which is

the object of such conspiracy.”

10. Under 18 U.S.C. § 793(e), “[w]hoever having unauthorized possession of, access

to, or control over any document . . . or information relating to the national defense which

information the possessor has reason to believe could be used to the injury of the United States or

to the advantage of any foreign nation, . . . willfully retains the same and fails to deliver it to the

officer or employee of the United States entitled to receive it” shall be fined or imprisoned not

more than ten years, or both.

11. Under Executive Order 13526, the unauthorized disclosure of material classified at

the “TOP SECRET” level (“TS”), by definition, “reasonably could be expected to cause

exceptionally grave damage to the national security” of the United States. Exec Order 13526 §

1.2(a)(1), 75 Fed Reg. 707, 707-08 (Jan. 5, 2010). The unauthorized disclosure of information

classified at the “SECRET” level (“S”), by definition, “reasonably could be expected to cause

serious damage to the national security” of the United States. Exec. Order 13526 § 1.2(a)(2). The

unauthorized disclosure of information classified at the “CONFIDENTIAL” level (“C”), by

definition, “reasonably could be expected to cause damage to the national security” of the United

States. Exec. Order 13526 1.2(a)(3).

12. Sensitive Compartmented Information (“SCI”) is classified information related to

intelligence sources, methods, and analytical processes. SCI is to be processed, stored, used, or

discussed in an accredited Secured Compartmented information Facility (“SCIF”), and only

individuals with the appropriate security clearance and additional SCI permissions are authorized

to access such classified national security information. For a foreign government to receive access

to classified information, the originating United States agency must determine that such release is

appropriate.

13. Pursuant to Executive Order 13526, information classified at any level shall be

lawfully accessed only by persons determined by an appropriate United States government official

to be eligible for access to classified information, who has signed an approved non-disclosure

agreement, who has received a security clearance, and who has a “need to know” the classified

information. Classified information shall only be stored or discussed in an approved facility.

PROBABLE CAUSE

14. As described more fully below, there is probable cause to believe that Lemma did,

improperly and unlawfully, search for, access, secrete, remove, possess, obtain, and retain

classified NDI, and conspired to and did transmit classified NDI to a representative, officer, agent,

employee, subject, or citizen of a foreign nation, intending or believing that such information

would be used to the injury of the United States and to the advantage of a foreign nation.

Lemma’s U.S. Government Security Clearances and U.S. Government Employment

15. Lemma is a naturalized citizen of the United States who was previously a citizen of

an African country (the “Relevant Country”). Lemma currently resides in Maryland. Lemma is a

U.S. Government contractor who has worked with various U.S. Government agencies since at least

July 2019. Lemma indicated in his resume that he was employed by a bank in Maryland prior to

his employment as a U.S. Government contractor.

16. Lemma was previously employed by another U.S. Government agency (“U.S.

Agency 1”) starting in November 2020 and ending in December 2021.

17. Lemma has been working as a Help Desk Technician assigned to the Bureau of

Intelligence and Research with the U.S. Department of State (“DOS”) since at least 2021. Lemma

works at a State Department facility in Washington, D.C., as an Information Technology (“IT”)

administrator, and has access to DOS classified systems. In that capacity, Lemma has “downdraft”

authority, meaning he is authorized to move classified material between classified systems, and is

authorized to move unclassified information from a classified to an unclassified system. Lemma

is permitted to access non-DOS classified systems and portals, but only if required as part of his

work-related duties. To access non-DOS classified systems or portals, Lemma is required to have

a specific IT service request for those systems from a DOS employee. Absent a work-related

request to access those systems, Lemma is not authorized to access non-DOS classified systems

or portals. Lemma’s workspace at DOS is located in a SCIF.

18. In addition to DOS, where he works evening hours, Lemma is also currently

employed as a contract management analyst at the U.S. Department of Justice (“DOJ”) during the

day. He has been employed by his current DOJ component since in or around May 2022, and has

access to classified information.

19. Lemma has had a TOP SECRET security clearance since at least 2020, and

obtained SCI access in July 2021. As part of that clearance, Lemma was given instruction on the

proper handling of classified information, including the proper storage of classified information.

As part of his employment at both DOS and DOJ, Lemma has also been required to take regular,

annual training that includes refresher training on the proper marking and handling of classified

information.

20. Because Lemma held a security clearance and was assigned to various government

agencies, both as an employee and as a private contractor, the U.S. Government entrusted Lemma

with access to sensitive government materials, including classified NDI if he possessed a need to

know the classified NDI to perform his work functions.

Lemma Viewed Classified Information Outside the Scope of His Employment and

Removed Classified Materials from the SCIF

21. On numerous occasions since at least July 2022, while having authorized access to

the classified DOS computer system, Lemma has navigated and searched several non-DOS

classified portals through the classified DOS computer system without authorization and accessed

non-DOS intelligence reports (“Intelligence Reports”).

22. Between on or about December 19, 2022, and August 7, 2023, Lemma copied and

pasted information from at least 85 Intelligence Reports regarding many topics—the majority of

which relate to the Relevant Country. Lemma accessed these Intelligence Reports without a need-

to-know the classified information contained therein. During the same period, Lemma accessed

at least an additional 48 Intelligence Reports without a need-to-know. According to DOS records,

Lemma has, on multiple occasions, also printed and downloaded SECRET and TOP SECRET

classified information from the Intelligence Reports using the DOS system. The printed and

downloaded material related primarily to the Relevant Country. Lemma had no need-to-know this

information and was not authorized to print or download it.

23. On or about February 9, 2022, Lemma traveled to the Relevant Country, where

Lemma has family ties, and returned to work at DOS and DOJ in the United States in or around

July 2022. Review of Lemma’s activity by DOS has confirmed that since his return in July 2022,

Lemma has downloaded over 100 documents containing classified information from the DOS

classified system to CDs and/or DVDs. This activity was unauthorized and outside the scope of

Lemma’s job duties.

24. On or about April 12, 2023, Lemma again traveled to the Relevant Country, and

returned to DOS in June 2023.

25. Since at least June 2023, DOS has confirmed that Lemma copied and pasted

classified information f rom Intelligence Reports from non-DOS classified portals into Microsoft

Word (“Word”) documents on the classified DOS computer system without authorization or a

need-to-know the information. DOS’s review of Lemma’s activity showed that Lemma deleted

classification markings from the portions of the Intelligence Reports he copied into Word

documents. DOS records further show Lemma then downloaded those Word files from the DOS

classified system onto CDs and/or DVDs, which could then be taken out of the SCIF. The material

from Intelligence Reports that Lemma was reviewing and copying was classified at the TOP

SECRET and SECRET levels, and also related primarily to the Relevant Country.

26. More recently, between July 10, and August 18, 2023, Lemma copied classified

information from numerous Intelligence Reports onto CDs or DVDs from the DOS classified

system on at least three occasions. DOS records indicate Lemma completed approximately 10

downloads on August 18, 2023, most of which were classified at the TOP SECRET or SECRET

level.

27. On or about August 2, 2023, Lemma was observed using the DOS classified

computer system, and accessing non-DOS classified portals outside of his authorized access.

Lemma was observed accessing TOP SECRET Intelligence Reports about the same region o f the

world where the Relevant Country is located, without any request submitted to him at the IT help

desk or a need-to-know the specific classified information. As Lemma was reviewing the

classified material, he was observed writing on a sheet of paper in a manner that indicated to your

affiant that he was taking notes about the classified information. Lemma was then observed taking

the piece of paper and folding it multiple times before placing it in his right pants pocket. Lemma

was then observed leaving DOS and proceeding to his vehicle. At approximately 10:35 p.m., after

leaving his workplace and while parked in a parking garage near his residence, Lemma remained

in his vehicle for over twenty minutes with the interior vehicle lights on.

28. On or about August 7, 2023, Lemma was again observed at work using the DOS

classified computer system and accessing non-DOS classified portals to review classified

Intelligence Reports outside of his authorized access. Lemma copied portions of TOP SECRET

Intelligence Reports that he accessed within those portals, pasted them into one or more Word

documents, removed the classified portion markings from the pasted text in the Word documents,

and then burned the Word documents containing the classified information to a CD/DVD that

appeared to have a green label. Your affiant is aware that DOS maintains CD/DVDs with green

labels for its employees, which are plainly marked “Unclassified,” and which are for use to store

and maintain unclassified material only. The material copied by Lemma included material

classified at the TOP SECRET level. Lemma was observed placing the disk with the green label

inside his jacket pocket before leaving the classified area and exiting the building. At

approximately 8:35 p.m., Lemma left work before the end of his shift, entered his vehicle while

still wearing the jacket, remained stationary for several minutes, and then moved his vehicle to his

workplace garage. Lemma then traveled into Maryland and was observed walking into his

residence.

29. On or about August 15, 2023, Lemma was again observed at work using the DOS

classified computer system and accessing non-DOS classified portals to review Intelligence

Reports outside of his authorized access. The material reviewed by Lemma included material

classified at the TOP SECRET level. Lemma was observed taking a sheet of paper and writing

notes on the paper for approximately 15 minutes while viewing the classified portal. Lemma then

folded the paper and placed it in his right front pocket. He then left the SCIF and proceeded to his

vehicle. Lemma then traveled into Maryland and was observed walking into his residence.

30. On or about August 18, 2023, Lemma was again observed at work using the DOS

classified computer system and accessing non-DOS classified portals outside of his authorized

access. Lemma copied portions of Intelligence Reports accessed on those non-DOS portals, pasted

them into one or more Word documents, removed the classified portion markings from the pasted

text in the Word documents, and then burned the Word documents containing the classified

information to a CD/DVD with a green label. The material copied by Lemma included classified

material marked at the TOP SECRET level. Lemma was observed placing the disk with the green

label into his pocket before leaving the DOS building. Lemma then traveled into Maryland and

was observed walking into his residence.

31. DOS has confirmed that the above activities were not authorized as part of

Lemma’s IT administrator duties and that Lemma did not have authority to remove classified

information from DOS. DOS has also confirmed Lemma did not receive specific IT requests to

transfer classified material to Word, remove the classification markings, or download the

information onto CDs and/or DVDs.

Lemma Has Conspired with an Agent of a Foreign Government to Transmit NDI

32. In or around August and September 2022, Lemma transmitted classified NDI,

including documents, photographs, notes, maps, and information relating to the Relevant Country

and neighboring countries over an encrypted messaging application (“Encrypted Messaging

Application A”) to a particular account (“Account 1”) on multiple occasions, including on the

following two dates. First, in or around August 2022, Lemma transmitted satellite imagery from

the region of the Relevant Country. This information was classified at the TOP SECRET level.

Second, in or around September 2022, Lemma transmitted information related to a third-party

country’s activities in the region of the Relevant County. This information was classified at the

SECRET level.

33. Your affiant believes that Account 1, to which Lemma transmitted classified NDI,

is used by or on behalf of an official of an intelligence service of the Relevant Country (“Foreign

Official”) based upon information gathered through the course of this investigation, including the

following:

a. In May 2022, the Foreign Official applied for a visa to visit the United States;

that application listed the Foreign Official’s phone number (“Telephone Number

1”) and the Foreign Official’s official, government affiliation with the Relevant

Country.

b. According to open-source research, Telephone Number 1 is linked to a profile on

Encrypted Messaging Application A; the profile associated with Telephone

Number one includes a profile image of knot.

c. In September 2022, Account 1 had the same profile image of a knot; additionally,

the Foreign Official’s first name, which matches the name on his visa application,

is the name of the user of Account 1as displayed in communications with Lemma.

d. In or around August 2022, the profile picture associated with Account 1, which

was displayed during communications with Lemma, was a headshot of an

individual that resembles the Foreign Official’s appearance in his visa application

photo and other open-source photographs identifying the Foreign Official. This

includes photos from the Relevant Country’s official government website for its

intelligence service, which also identifies the Foreign Official by name and

official government title.

34. Lemma’s communications with the Foreign Official over Encrypted Messaging

Application A included a discussion of military activities of a rebel group involved in an armed

struggle against the government of the Relevant Country. In one communication, Lemma sent an

image relating to events in the Relevant Country and advised the Foreign Official, “[y]our team

analyze this and establish some sort of sense to this.” In another exchange, the Foreign Official

told Lemma, “[w]e making [sic] significant progress on averting the … in few days we will achieve

the critical milestones ….not to happen again. Therefore, it’s not a long time we are asking. Good

if you can check and [sic] back to me what u can do.” (ellipses in original). Similarly, the Foreign

Official advised Lemma, “[i]t is great to identify the forward deployed command centers and

logistic centers,” in response to Lemma discussing locations in the Relevant Country.

35. In other chats, the Foreign Official provided specific subjects where he would like

information from Lemma (e.g. logistic centers). Lemma responded, “[a]bsolutely, I have been

focusing on that all this week . . . .” In other chats with the Foreign Official, Lemma sent photos

of a “military compound.” In or around September 2022, the Foreign Official stated, “[i]t’s time

to continue ur support.” Lemma responded, “Roger that!” In another chat, the Foreign Official

Accordingly, consistent with this paragraph, I hereinafter refer to the user of Account 1 as the

Foreign Official.

praised Lemma’s efforts, stating “[a]lways this beautiful country have [sic] some special people

who scarify [sic] their life to protect our proud history. You always remembered. It doesn’t matter

the results.”

36. An authorized search of Lemma’s electronic accounts (“Electronic Accounts”)

confirmed Lemma possessed and retained digital photographic copies, notes, maps, and

information of the above-referenced classified NDI that he transmitted to the Foreign Official. The

Electronic Accounts were not government accounts or on a secure network authorized to store

classified NDI.

37. Additionally, between April 13, and June 21, 2023, Lemma’s Electronic Accounts

were accessed from the Relevant Country’s IP address 31 times, including when Lemma was no

longer present in the Relevant Country. As discussed above, Lemma traveled to the Relevant

Country in April through June 2023, and returned to the United States before June 16, 2023. The

investigation has revealed that on June 16, 20, and 21, 2023, Lemma badged into DOS to work on

those dates. Lemma then copied and burned a CD and/or DVD containing information from

Intelligence Reports using the DOS classified system without proper authorization. Records

provided by the Provider of the Electronic Accounts confirmed that the Electronic Accounts were

accessed from the Relevant Country on June 16, 2023 (while Lemma was in the United States).

38. Your affiant understands this activity is consistent with the account holder

providing another person in a foreign country with access to the account. Your affiant is also

aware of advanced Operations Security (“OPSEC”), where persons will surreptitiously

communicate with one another through shared access to an account with one user being in one

location and the other in a different location.

39. Furthermore, messages sent while Lemma was in the Relevant Country establish

Lemma was aware that the Foreign Official was located in the Relevant Country. Specifically, on

April 17, 2023, Lemma messaged the Foreign Official, “I hope we’re using current [Country A]

situations for our advantage” and that “I would like to talk.” Country A is a country that shares a

border with the Relevant Country. Two days later, the Foreign Official messaged Lemma with

the name of a hotel located in the capital of the Relevant Country and the time “5pm.” Lemma

responded, “Okay!”

Lemma Has Deposited Sums of Money in Several U.S. Banks that Coincide with His

Obtaining, Retaining, and Transmitting Classified Information

40. On or about July 15, 2023, Lemma entered a branch office of a U.S. bank in

Maryland (“Bank 1”) and attempted to deposit over $11,700. Lemma was observed angrily

discouraging an employee of Bank 1 from filing a Currency Transaction Report (“CTR”) with the

U.S. Department of Treasury.

Specifically, Lemma tried to convince the employee that his

transaction was not subject to reporting despite deposits in excess of $10,000. According to

records obtained during the investigation, Lemma deposited $11,773.84 in cash into his account

at Bank 1 on that date.

Subsequently, on or about July 24, 2023, Bank 1 issued a CTR for this

transaction. Lemma downloaded classified reports from DOS close in time to this July 15, 2023

deposit—specifically, Lemma copied at least 16 reports July 11-14, 2023.

41. Lemma’s cash deposits are also correlated to travel to the Relevant Country. On or

about February 6, 2022, Lemma printed a classified document and then travelled to the Relevant

U.S. Department of Treasury Regulations require the issuance of a CTR with the U.S. Department

of Treasury memorializing any cash transaction of more than $10,000. See 31 C.F.R. §1010.306

and 110.310 (requiring financial institution to file a CTR for cash transactions over $10,000 to be

made within 15 days).

Additional records from Bank 1 have been requested to confirm how much of this amount was

initially obtained from the cashing of checks before the full deposit, and how much was additional

cash.

Country three days later, on or about February 9, 2022. Lemma returned from his trip on or about

April 30, 2022, and deposited $4,300 in cash that same day.

42. Review of Lemma’s U.S. Bank 1 account records further revealed that Lemma

made several large deposits, totaling in excess of $55,000, into U.S. Bank 1 between January 1,

2022 until July 17, 2023. These deposits include: a deposit of $10,000 on or about December 7,

2022, in Silver Spring, Maryland; a deposit of $9,680.22 on or about August 17, 2022, on K Street,

N.W. in the District of Columbia; a deposit of $1,936.06 on or about August 18, 2022, in Metro

Center in the District of Columbia; and a cash deposit of $11,373.63 on or about February 23,

2023, in Silver Spring, Maryland.

Additional investigation revealed that on or about December

7, 2022, Lemma entered a branch office of a U.S. bank in Maryland (“Bank 2”) and opened two

joint accounts with another individual, providing $2,000 in cash as an opening deposit.

43. Lemma’s efforts to dissuade reporting by a bank employee and his previous

employment with a bank demonstrate Lemma was familiar with banking notification requirements,

such as CTRs. Lemma intentionally structured his transactions to avoid such reporting

requirements. Specifically, Lemma’s deposits on August 17, 2022, and August 18, 2022, which

in total exceeded over $11,000, were split across the two days. Lemma’s deposits on December

7, 2022, which in total exceeded over $12,000, were similarly split across two banks.

CHARGES

Conspiring to and Delivering Defense Information To Aid Foreign Government in

Violation of 18 U.S.C. §§ 794(a) and (c)

44. With the intent to and reason to believe it would be used to the injury of the United

States or to the Advantage of the Relevant Country, Lemma obtained documents, photographs,

A number of these cash deposits appear to involve Lemma cashing a check and depositing it

along with additional cash.

notes, maps, and information related to the national defense, and willfully communicated,

delivered, and transmitted that NDI to a representative, officer, agent, employee, subject, or citizen

of the Relevant Country, in violation of 18 U.S.C. § 794(a).

45. With the intent to and reason to believe it would be used to the injury of the United

States or to the advantage of the Relevant Country, Lemma conspired with a representative, officer,

agent, employee, subject, or citizen of the Relevant Country , to obtain and willfully communicate,

deliver and transmit, documents, photographs, notes, maps, and information related to the national

defense, in violation of 18 U.S.C. § 794(c).

Having Unauthorized Possession of NDI in Violation of 18 U.S.C. § 793(e)

46. With reason to believe it could be used to the injury of the United States or to the

advantage of the Relevant country, Lemma willfully retained and failed to deliver the NDI to an

officer or employee of the United States entitled to receive it, in violation of 18 U.S.C. § 793(e).

CONCLUSION

47. Your affiant submits that the facts set forth in this affidavit establish probable cause

to believe Lemma committed violations of 18 U.S.C. Sections 794(a) and (c), and 793(e).

48. I declare under the penalty of perjury that the information provided above is true

and correct.

Respectfully submitted,

Special Agent

Federal Bureau of Investigation

Washington, D.C.

Attested to by the applicant in accordance with the requirements of Fed. R. Crim. P. 4.1. by

telephone on August 23, 2023.

______________________________

THE HONORABLE G. MICHAEL HARVEY

UNITED STATES MAGISTRATE JUDGE