Insider Threat Case Study: State Department IT Help Desk Contractor Pleads Guilty to Spying for Ethiopia, and the Admin Access Checks to Run This Week

A former IT contractor who worked the evening help desk at the US State Department has pleaded guilty to spying for Ethiopia. He used his administrator access to copy classified material out of secure systems from 2021 until his arrest in August 2023. If your business gives IT staff, contractors or an outside provider access to everything, this case shows how that trust can be abused for a long time before anyone stops it.

What happened in this insider threat case

On Tuesday, November 3, 2026, the US Department of Justice announced that Abraham Teklu Lemma, 53, of Maryland, had pleaded guilty to conspiracy to transmit national defense information to a foreign government. DOJ describes him as a former information technology contractor at the National Reconnaissance Office, the State Department and the Justice Department who held a Top Secret security clearance.

According to DOJ, from 2021 until his arrest in August 2023 he worked with senior Ethiopian government officials to collect and pass on dozens of classified documents, notes, materials and photographs, up to the Top Secret/Sensitive Compartmented Information level. DOJ says he hid this by hand-writing notes and carrying them out of secure facilities, and that as an IT administrator he also removed electronic classified material from repositories and facilities.

What is confirmed and what is still open

Confirmed in DOJ's November 3 release:

• He pleaded guilty to conspiracy to transmit national defense information to the government of Ethiopia.
• The plea agreement calls for 120 to 262 months in prison (10 to about 22 years), if the court accepts it.
• He has not been sentenced. Sentencing is set for Wednesday, April 14, 2027.
• The FBI Washington Field Office investigated, with help from the State Department's Diplomatic Security Service.

Alleged in the FBI affidavit filed in August 2023. These are the government's allegations at the time of arrest. The plea announcement does not repeat each detail.

• He worked as a Help Desk Technician for the State Department's Bureau of Intelligence and Research and had "downdraft" authority. That meant he was allowed to move classified material between classified systems, and to move unclassified information from a classified system to an unclassified one.
• He was allowed into other agencies' classified portals only when a State Department employee had raised a specific IT service request for them. The FBI says he searched those portals anyway. Between December 19, 2022 and August 7, 2023 he copied information from at least 85 intelligence reports, and he accessed at least 48 more without a need to know.
• The State Department's own review of his activity showed that, starting in July 2022, he downloaded more than 100 documents containing classified information to CDs and DVDs. He pasted report text into Word, deleted the classification markings and burned the files to discs with green labels, which the department uses for unclassified material.
• His personal online accounts were accessed 31 times from an IP address in Ethiopia between April 13 and June 21, 2023, including at least one time while he was in the United States.

Not known: The public records we reviewed do not say what first raised suspicion, how long the activity records sat before anyone reviewed them, or what sentence the judge will give.

How an IT help desk role made it possible

Almost every safeguard in this story limited what he was allowed to do. Very few limited what he was able to do. His job gave him the technical ability to reach systems, move data across security boundaries and write to removable discs. The rule that he needed a ticket before opening other agencies' portals was a policy, not a technical block.

The records also existed. The affidavit cites State Department records again and again: what he downloaded, when and how many files. The weak spot was the time between the logs recording the activity and someone acting on it.

CISA defines an insider as "any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems." It defines insider threat as "the potential for an insider to use their authorized access or understanding of an organization to harm that organization." CISA's categories include unintentional threats (negligence and accidents), intentional threats, and other threats such as collusive and third-party threats.

Why insider threat matters for a business network

Most companies do not hold classified files. They do hold customer records, payroll, bids, source code, banking details and the admin passwords that unlock all of it. The person who runs IT, on staff or at an outside provider, usually has the keys to every system, a good reason to be in all of them and the ability to work after hours. When that person copies data, it can look like ordinary work.

The same steps work whether the risk is a dishonest insider, a careless one or an attacker who has stolen an admin's login.

Insider threat checklist for this week

Insider threat questions people are asking

What is an insider threat?

CISA defines it as the potential for someone with authorized access to, or understanding of, an organization to use it to harm that organization. The harm can be deliberate or accidental.

Who is the State Department IT worker who pleaded guilty?

Abraham Teklu Lemma, 53, of Maryland, a former IT contractor at the National Reconnaissance Office, the State Department and the Justice Department. DOJ announced his guilty plea on November 3, 2026.

Was he sentenced to 10 years?

No. His plea agreement calls for 120 to 262 months if the court accepts it. Sentencing is set for April 14, 2027.

How do you detect an insider threat from IT staff?

Keep audit logs, separate admin accounts from daily accounts, and alert on bulk downloads, unusual exports and access with no ticket behind it. Then make sure someone actually reviews the alerts.

Should a business monitor its own IT administrators?

Yes. Admin activity should be logged and reviewed, and that includes outside providers. Put it in a written policy that staff know about, and check with your counsel on monitoring rules where you operate.

Does least privilege work for IT staff who need admin rights?

Yes, if admin rights are granted for a task and a set time rather than permanently. That way most of an administrator's day runs without full rights.

The bigger lesson

Trust is not a control. The State Department had clearances, need-to-know rules, ticket requirements and activity records. They still did not stop the copying, because the rules relied on him following them and the records relied on someone reading them. In any business, the people with the most access need the most visible access: logged, time-limited and checked by someone else.

See how we lock down admin access at /tech/security-hardening, or get a quote for a review of who holds the keys to your systems.

Get security alerts by email, plus our free checklist, at /security-alerts.

Sources: US Department of Justice: Former U.S. Government Contractor Pleads Guilty to Spying for Ethiopia; FBI affidavit, United States v. Lemma, Case 1:23-mj-00227 (CourtListener); CISA: Defining Insider Threats.