What we've learned about arrested NSA contractor Harold Martin

The man arrested by the FBI in connection with elite hacking tools being publicly leaked was found with a massive library of government data, had multiple unregistered firearms in his possession and was found to be communicating online with various individuals in Russian.

The man arrested by the FBI in connection with elite hacking tools being publicly leaked was found with a massive library of government data, had multiple unregistered firearms in his possession and was found to be communicating online with various individuals in Russian.

Government prosecutors are fighting to keep former defense contractor Harold Martin — who now stands accused of stealing classified information — in custody pending a trial, new documents filed to a Maryland court reveal.

Investigators say Martin stole approximately 50 terabytes worth of data over the course of two decades while working for the nation’s most secretive spy organizations, including the National Security Agency and Office of the Director of National Intelligence.

During Martin’s time with the NSA, it is believed he worked within the agency’s elite hacking unit known as Tailored Access Operations, or TAO.

Estimates regarding the sheer volume of classified information taken off premise by Martin suggests it far exceeds what was taken by Edward Snowden, the infamous NSA whistleblower and former Booz Allen Hamilton contractor.

A warrant for Martin was executed on Aug. 27 at his home in Glen Burnie, Maryland, where FBI agents ultimately found both digital and paper copies of top-secret intelligence documents.

A U.S. Navy veteran, Martin had previously been described as an “enigmatic loner” by former colleagues and other acquaintances.

According to the New York Times and Washington Post, FBI investigators in coordination with the NSA uncovered inconclusive connections between Martin and a mysterious organization dubbed the Shadow Brokers. The group published a trove of NSA-linked cyberweapons for download earlier this summer and have since remained active on social media, where they are now demanding $6 million worth of bitcoin for the release of other exploits.

Although investigators have yet to definitively link Martin to the Shadow Brokers, he remains the prime suspect, according to The Washington Post.

Here are five things to know about the case against Martin:

1. Investigators found an “arsenal” of firearms in Martin’s residence and vehicle. Martin’s wife was unaware of some of the weaponry that was stored within their household. Only two of the firearms were legally registered.

2. Martin learned to speak Russian at some point in time and proceeded to communicate with unnamed individuals online in Russian and potentially other foreign languages.

3. Handwritten notes were found detailing basic elements of classified operations. Authorities believe these notes were “intended for an audience outside of the intelligence community unfamiliar with the details.”

4. An unsent “letter to coworkers” written in 2007 was found on one of Martin’s laptops. The letter reads: “I’ve seen pretty much all your tech secrets.”

5. According to court documents, Martin’s own operations security was extensive. He used VPNs and encrypted messaging channels among other proxies to hide his identity online and while in communication with unknown actors.

You can read the full court document here.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure