---
title: Former IT administrator at the NRO, State and Justice pleads guilty to passing Top Secret material to Ethiopia, using his admin access to pull files from classified systems | ctxsec
url: https://ctxsec.com/items/doj-lemma-it-admin-contractor-pleads-guilty-espionage-ethiopia-nro-state
description: "Abraham Teklu Lemma, 53, of Maryland, a former IT contractor with a Top Secret clearance at the National Reconnaissance Office, the State Department and the Justice Department, pleaded guilty on Nov 3 to conspiring to transmit national defense information to Ethiopia. DOJ says that from 2021 until his August 2023 arrest he sent dozens of documents, notes and photos classified up to TS/SCI to senior Ethiopian officials, both by hand-copying notes and by using his IT administrator access to remove electronic files from classified repositories. His plea deal calls for 120 to 262 months; sentencing is April 14, 2027."
status: "official (DOJ Office of Public Affairs, Nov 3)"
published: 2026-11-03
---

> Abraham Teklu Lemma, 53, of Maryland, a former IT contractor with a Top Secret clearance at the National Reconnaissance Office, the State Department and the Justice Department, pleaded guilty on Nov 3 to conspiring to transmit national defense information to Ethiopia. DOJ says that from 2021 until his August 2023 arrest he sent dozens of documents, notes and photos classified up to TS/SCI to senior Ethiopian officials, both by hand-copying notes and by using his IT administrator access to remove electronic files from classified repositories. His plea deal calls for 120 to 262 months; sentencing is April 14, 2027.

[← Cybersecurity News](/news) · [markdown](/items/doj-lemma-it-admin-contractor-pleads-guilty-espionage-ethiopia-nro-state.md)

official (DOJ Office of Public Affairs, Nov 3)

2026-11-03

### Former IT administrator at the NRO, State and Justice pleads guilty to passing Top Secret material to Ethiopia, using his admin access to pull files from classified systems

**Why it matters for defenders:** this is an insider case where the access that made the theft possible was administrative, not analytic. Privileged IT staff can usually read far more than their job requires. Controls worth checking: separate admin rights from read access to the data itself, log and review bulk reads or exports by admin accounts, require two-person approval for moving data off classified or sensitive systems, and watch for removable-media or print activity that doesn't match a ticket.

Sources: [DOJ: Former U.S. Government Contractor Pleads Guilty to Spying for Ethiopia (Nov 3, 2026)](https://www.justice.gov/opa/pr/former-us-government-contractor-pleads-guilty-spying-ethiopia)