He Pocketed Top Secrets and Asked Ethiopia to "Send Drones": The Help-Desk Spy Pleads Guilty

Illustrative editorial image of an unmarked disc and jacket near a secure facility entrance

Run: Thursday, November 5, 2026 | Byline: Dakota Jones
Desk: Crime, Law & Justice

A secure facility can have layers of controls, restricted rooms and classified computer systems. But if someone with trusted access can copy sensitive material, carry it out and pass it to a foreign government, the problem is not just digital. It is also about who gets access, and how closely that access is watched.

Abraham Teklu Lemma, a 53-year-old former U.S. government IT contractor from Maryland, pleaded guilty on November 3 to conspiring to transmit national defense information to Ethiopia. The Justice Department says he supplied classified material to Ethiopian officials during an armed conflict. The case is a sobering reminder that insider threats do not always arrive as malware. Sometimes they come with administrator permissions and a jacket pocket.

Here is what the public record says, and what this guilty plea means.

What happened: Classified information left secure systems

Lemma worked as an IT contractor at the National Reconnaissance Office, the State Department and the Justice Department. The Register, citing court documents, reports he was a naturalized U.S. citizen, worked for the government from 2019 to 2023 and held a Top Secret clearance from 2020.

The DOJ says that from 2021 until his arrest in August 2023, Lemma conspired with senior Ethiopian government officials in political, military and intelligence branches to collect and transmit dozens of highly classified documents, notes, materials and photographs. Some were classified up to Top Secret/Sensitive Compartmented Information, or TS/SCI. A designation for exceptionally sensitive material requiring special handling. Much of the information concerned an armed conflict in Ethiopia.

According to the DOJ, Lemma wrote classified information by hand and carried the notes out of secure facilities. As an IT administrator, he also removed electronic information from classified repositories and secure facilities.

The Register’s account of court documents describes the mechanics in more detail. Lemma reportedly worked evening hours as a State Department help-desk technician and daytime as a Justice Department contract-management analyst. He had “downdraft” authority: permission to move files between classified systems and move certain unclassified files from classified to unclassified systems. That was not blanket permission to browse classified material on other systems; court documents reportedly said he needed written approval for that access.

Prosecutors alleged he accessed intelligence reports without authorization, copied material from at least 133 reports without a need-to-know, and downloaded more than 100 documents. The Register reports that he burned files to CDs or DVDs, removed classification markings and used green-labeled discs meant for unclassified material. He allegedly tucked discs into his jacket when leaving a Sensitive Compartmented Information Facility, or SCIF. A secure space for handling classified information. On other occasions, he reportedly took handwritten notes and folded them into his pocket.

Illustrative editorial image of an IT help-desk workstation in a secure office

The chronology deserves care. The DOJ says the conspiracy ran from 2021 until Lemma’s arrest. The Register reports that the original criminal complaint described alleged conduct beginning in July 2022. Those dates come from different stages of the case; they should not be blurred into one neat timeline.

The Register also reports that Lemma began sending information to Ethiopian officials through an encrypted messaging app around August or September 2022. Prosecutors alleged that officials sought details about command centers, logistics centers and military compounds, and that copies stored on Lemma’s personal drives were accessed remotely by Ethiopian officials multiple times between April and June 2023.

The DOJ included two stark messages dated December 18, 2021. Lemma wrote to a conspirator, “We have to finish these people once and for all, otherwise there will never be peace in Ethiopia.” Later that day, after sharing more information, he wrote, “Please send Dro[nes].”

The Register also reports prosecutors described bank deposits exceeding $66,000 during the period of alleged activity. On one occasion, he reportedly tried to deposit more than $10,000 and angrily discouraged bank staff from filing a currency transaction report. That detail comes from the court-document reporting, not the DOJ’s summary of the plea.

Why it matters: Trusted access is still a security risk

This case is not a lesson that help desks are inherently dangerous. It is a reminder that privileged access creates responsibility, and risk. IT administrators often need broad system permissions to keep networks working. But technical ability to reach a file is not the same as authorization to read, copy or move it.

The reported use of removable media makes the case especially uncomfortable. In an era of sophisticated cyber threats, alleged exfiltration involved discs labeled for unclassified material and notes carried by hand. The security failure was not a cutting-edge exploit. It was a breakdown across access controls, monitoring and physical security. A jacket pocket is not an audit log.

Illustrative editorial image of a secure facility door and an unmarked disc

The stakes go beyond classified information being disclosed. FBI Assistant Director Roman Rozhavsky said Ethiopian officials used the information in military operations during an ongoing conflict. The DOJ says Lemma hoped officials would use information to target and kill paramilitary fighters. The public DOJ release does not identify a specific strike or establish a particular casualty outcome, so this report will not pretend otherwise.

For organizations handling sensitive information, the practical questions are direct:

  • Is access limited by need-to-know, not just job title or system capability?
  • Are unusual searches, downloads and transfers reviewed and acted on?
  • Are removable media controls enforced in practice, not merely printed on a policy?
  • Do audit systems cover both electronic activity and physical movement into and out of secure spaces?

These are not flashy fixes. They are the unglamorous controls that help prevent trusted access from becoming an open door.

The plea and what comes next

Lemma pleaded guilty to conspiracy to transmit national defense information to a foreign government. He agreed to an incarceration range of 120 to 262 months-10 years to about 21 years and 10 months: subject to court acceptance. Sentencing is scheduled for April 14, 2027. He has not yet been sentenced.

Assistant Attorney General for National Security John A. Eisenberg said Lemma “betrayed the United States to an extraordinary degree,” and that he exploited IT administrator access to remove classified information, including Top Secret material. U.S. Attorney Jeanine Ferris Pirro said Lemma exploited a position of trust for more than two years. The FBI Washington Field Office investigated the case. Assistant U.S. Attorneys Tejpal Chawla and Adam P. Barry, and National Security Division Trial Attorney Kathryn DeMarco, are prosecuting it.

Verdict

The guilty plea establishes a serious breach of trust. The details reported from court documents show how ordinary administrative tools and physical access can become part of an alleged espionage operation. That is the uncomfortable takeaway: security is not proven by having a locked door, a clearance badge or a policy about discs. It depends on whether access is properly limited, monitored and challenged when it does not make sense.

For readers following this beat, LD3’s Crime, Law & Justice desk collects related coverage. In this case, the most important next date is sentencing, not speculation about what may have happened beyond the public record.

Sources