"Despite swearing an oath to defend the Constitution of the United States, Abraham Lemma betrayed our country by committing espionage on behalf of the Ethiopian government," the FBI's Roman Rozhavsky said after the guilty plea was announced.
The accused and the access he held
Abraham Teklu Lemma, 53, a naturalized U.S. citizen living in Maryland, has pleaded guilty to transmitting sensitive U.S. government files to Ethiopian officials, the Justice Department confirmed. According to court documents, Lemma worked across multiple U.S. agencies between 2019 and 2023 — including the National Reconnaissance Office, the State Department, and the Justice Department. He held Top Secret security clearance since 2020 and was granted so-called "downdraft" authority, permitting him to move classified files among classified systems and to move unclassified files from classified to unclassified systems.
The records say Lemma worked evenings as an IT help-desk technician at the State Department as of 2021 and held a daytime contract role as a management analyst at the Justice Department. He worked in a Sensitive Compartmented Information Facility (SCIF), where special controls apply to handling and removing classified material; written approval was required for him to access classified files on systems outside the State Department.
How classified material was removed and concealed
Prosecutors say Lemma copied material from at least 133 intelligence reports without need-to-know authorization and downloaded more than 100 documents. He allegedly burned those files to CD/DVDs and deleted classification markings. The complaint reports that material classified at the Secret and Top Secret levels was placed onto discs carrying green labels — labels approved for employees to signify unclassified contents — and that Lemma was observed leaving the SCIF with such discs in his jacket pocket at the end of shifts.
On other occasions, court filings say, Lemma was seen viewing classified material on his computer, taking handwritten notes, folding the notes and carrying them out in his pocket. He was also accused of storing copies of classified files on his personal storage drives; prosecutors allege Ethiopian officials remotely accessed those drives numerous times between April and June 2023. Financial activity noted in filings includes several bank deposits exceeding $66,000 during the period he allegedly worked for foreign officials, and a reported incident in which Lemma "angrily discouraged" bank staff from filing a currency transaction report after attempting to deposit more than $10,000.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat prosecutors say was transmitted to Ethiopian officials
According to the complaint, Lemma began transmitting classified information to Ethiopian officials via an encrypted messaging app in or around August and September 2022. The materials prosecutors attribute to those transfers include documents, photographs, handwritten notes, maps, and other information connected to Ethiopia. The filings say Ethiopian contacts — described by the Justice Department as senior officials across political, military and intelligence branches — asked for details about command centers, logistics centers, military compounds and related matters.
Prosecutors also say the communications touched on geopolitical topics, with messages referencing "situations" in an unspecified African country that shares a border with Ethiopia as a means to gain advantage, and discussing rebel groups in conflict with Ethiopia. The complaint quotes Lemma encouraging action against paramilitary groups: "We have to finish these people once and for all, otherwise there will never be peace in Ethiopia." It also records a message dated December 18, 2021: "Please send dro[nes]," following the sharing of additional information.
Timeline as alleged in court papers
The filings contain conflicting statements about when the conduct began. The initial criminal complaint said the alleged offending began in July 2022; the Justice Department more recently asserted it began in 2021. Prosecutors say the unauthorized copying continued until around August 2023, and that remote access to Lemma's personal storage drives by Ethiopian officials occurred repeatedly between April and June 2023.
Lemma has admitted to the espionage offenses and agreed to a custodial sentence range of 120 to 262 months, the Justice Department said when it announced the guilty plea.
What this means for the State Department, the Justice Department, and the FBI
- State Department: Officials responsible for SCIF operations and downdraft approval will face scrutiny over controls on removable media, labeling practices and cross-system access, given the allegation that classified files were transferred to discs and removed from a SCIF.
- Justice Department: As both an employer of the accused and the prosecuting authority, the department will contend with internal reviews of contractor oversight and the handling of classified information across departmental roles.
- FBI: The bureau's Counterintelligence and Espionage Division framed the plea as an example of enforcement; the assistant director, Roman Rozhavsky, said the information provided by Lemma was used in military operations during an ongoing conflict and pledged continued action against foreign intelligence activity.
The case draws a straight line from an individual with privileged access to classified systems to a conviction for providing those materials to foreign officials, and it leaves clear operational questions about how cross-agency access, removable media and personal storage were monitored. The Justice Department's announced sentence range — 120 to 262 months — and the documents the prosecution attributes to Lemma will now be central to sentencing and any related damage assessments.
