Federal probe into House technology worker Imran Awan yields intrigue, no evidence of espionage - Washington Post

Imran Awan, a technology worker in Congress for 13 years, is the subject of a federal investigation that has become a lightning rod for some conservatives. (Bonnie Jo Mount/The Washington Post)

In late September 2016, leaders in the House of Representatives met behind closed doors for briefings on a closely held investigation into a group of computer technicians working on Capitol Hill.

Investigators with the Inspector General’s Office had been quietly tracking the five IT workers’ digital footprints for months. They were alarmed by what they saw. The employees appeared to be accessing congressional servers without authorization, an indication that they “could be reading and/or removing information,” according to documents distributed at the previously unreported private briefings.

For some who listened to the findings, the fact that the employees were born in Pakistan set off alarms about national security, according to two participants who spoke on the condition of anonymity. Others thought it more likely that the IT workers, naturalized U.S. citizens, were bending rules on network access to share job duties — violations of House protocol, perhaps, but not espionage. 

The matter was soon referred to the Capitol Police, who have been assisted in their investigation by the FBI’s Joint Terrorism Task Force. In February, the IT workers were barred from accessing the House network, a development that quickly made headlines. 

Since then, the story of the House IT workers — brothers Imran Awan, Abid Awan and Jamal Awan, as well as Imran Awan’s wife, Hina Alvi, and friend Rao Abbas — has become a lightning rod charged by the convergence of politics, cybersecurity and fears of foreign intrusion.

It has attracted unfounded conspiracy theories and intrigue. Far-right news organizations seized on it as a potential coverup of an espionage ring that plundered national secrets and might have been responsible for the campaign hacking of the Democratic National Committee, a breach that intelligence agencies have linked to Russia. President Trump has fanned its embers from his Twitter account, reposting an article that claimed the mainstream media were ignoring a scandal “engulfing” Rep. Debbie Wasserman Schultz, a Florida Democrat who was slow to fire Imran Awan after news of the investigation broke.

Yet, according to a senior congressional official familiar with the probe, criminal investigators have found no evidence that the IT workers had any connection to a foreign government. Investigators looking for clues about espionage instead found that the workers were using one congressional server as if it were their home computer, storing personal information such as children’s homework and family photos, the official said. 

Even so, the story — reconstructed here after The Washington Post reviewed confidential documents and interviewed more than a dozen people, including House officials, witnesses and others, many of whom spoke on the condition of anonymity to discuss the sensitive investigation — highlights urgent and persistent questions about how well Congress safeguards computer equipment and data.

Lawyers for some of the IT workers told The Post that their clients had done nothing wrong.

Christopher J. Gowen, one of Imran Awan’s lawyers, called the espionage claims “ludicrous.”

“There’s nothing that Imran did that wasn’t requested by one of his clients on House staff,” he said.

Jim Bacon, a lawyer representing Abid Awan, said “a very lax environment” surrounds security protocols in the House. “I can tell you what they were doing was not unusual,” he said.

The nearly one-year-old investigation has thus far resulted in no charges related to the group’s House IT work. It has burrowed deeply into their personal finances and outside business ventures.

In July, prosecutors in the U.S. District Attorney’s Office for the District of Columbia charged Imran Awan and Alvi with bank fraud, alleging that the couple made misrepresentations on an application for a home-equity loan. 

[Congressional IT staffer charged with home equity loan fraud]

Imran Awan was arrested at the airport as he was preparing to board a flight to Pakistan, where his wife and three children — ages 4, 7, and 10 — have been since March. He has pleaded not guilty. Alvi is planning to return to the United States in the coming weeks to face bank-fraud charges, according to court records. None of the other IT workers has been accused of wrongdoing.

The investigation is ongoing. Both the FBI and the U.S. Attorney’s Office declined to comment.

Chosen in a lottery

Imran Awan, now 38, was a 14-year-old living in Pakistan when he filled out an application for a U.S. program that provides limited green cards through a lottery system, his lawyers said. He and his family were chosen. He arrived at 17, got a job working at a fast-food restaurant and went to community college in Northern Virginia. He transferred to Johns Hopkins University in Baltimore and earned a degree in information technology.

Awan became a U.S. citizen in 2004, his lawyers said, the same year he was hired for a part-time job as an IT specialist in the office of Rep. Robert Wexler (D-Fla.). Awan had gotten to know some of Wexler’s staffers as an intern for a company that provided services to the office. 

As an IT specialist, Awan set up printers and work email accounts for new employees, and did technical troubleshooting. Charismatic and accommodating, he became a popular choice among House Democrats and soon cobbled together more than a dozen part-time jobs as what is known as a “shared employee” on the Hill, floating between offices on an as-needed basis. 

Such arrangements came under scrutiny in 2008 when House Inspector General James J. Cornell testified that there was “inadequate oversight” over shared employees.

“In most instances, they have all the freedom of a vendor and all the benefits of an employee without the accountability one would expect with an employee,” Cornell told lawmakers. IT specialists, he noted, “present an additional risk in that they often have access to multiple office’s data outside of both the oversight of congressional office staff and the visibility of House security personnel.”

As demand for Awan’s services grew, he began recommending his family members, who had less formal training. His brother Abid, 33, started working on Capitol Hill in 2005. His wife, 33, joined in 2007. A friend, Rao Abbas, 37, who had most recently worked as a manager at a McDonald’s, was hired in 2012. And Imran’s youngest brother, Jamal, 24, started in 2014. Each held part-time jobs in multiple Democratic congressional offices. 

“At the end of the day, whether they had formal training or not, they were trained on the job by Imran,” said one of Imran Awan’s lawyers, Aaron Marr Page. 

By 2016, the five worked for a combined three dozen lawmakers under separate part-time contracts with each office. The Awan family members were each paid between $157,000 and $168,000 that year, making them among the highest-paid staffers on the Hill. The salary cap for a congressional staffer is $174,000. 

Under House rules, employees in each congressional office are prohibited from sharing their job duties with others who are not directly employed by that office.

(Source: Guidelines issued by the House Administration Committee)

In his 2008 testimony, Cornell warned that a “growing number of shared employees are working in illegal teaming arrangements where they pass the work off to other shared employees not on the payroll of the congressional office they are serving.”

Gowen, the other attorney representing Imran Awan, acknowledged that the group filled in for each other at times.

“He’s working with family and friends, so there was some coverage by colleagues,” Gowen said.

Odd invoices

In March 2016, auditors in the House’s Chief Administrative Office discovered strange invoices for computer equipment — purchases that were broken into multiple payments of less than $500. Any purchases over that amount require equipment to be placed on an inventory that helps to track it. 

After a referral to the inspector general’s office, investigators found that the IT workers had asked vendors “to split the cost of equipment among multiple items and charged these items as office supplies instead of equipment,” according to the September briefing document.

As of Sept. 1, 2016, there had been 34 purchases totaling nearly $38,000 “where the costs of the item was manipulated to obtain a purchase price of $499.99,” according to the document. There were $799 iPads and a $640 television on the list, records show. 

Most of that equipment was left off the official House inventory, investigators found. And investigators found that some of it had been delivered to the homes of the Awan brothers, according to a person familiar with the investigation. 

One vendor, CDW, received a subpoena from federal prosecutors in December, another person familiar with the procurement part of the probe said. The company said in a statement to The Post that it was cooperating with authorities and that prosecutors had assured the company it was not a target of the investigation.

Page, Imran Awan’s lawyer, said that the home-equipment deliveries were rare and made when his client planned to be away from the Capitol during the delivery. He declined to comment on other aspects of the equipment purchases.

When asked if his client was authorized to split equipment purchases into increments less than $500, Bacon, Abid Awan’s lawyer, said: “In a fluid situation you do what you’re ordered to do.” Any missing equipment, Bacon said, “disappeared after it was brought to the folks who were demanding it. . . . It sounds to me like there’s a lot of scapegoating here.”

 The House is generally bad at keeping track of the millions of dollars worth of office equipment in its care, according to independent auditors. The past four annual audits have cited “ineffective controls over property and equipment” as a “significant deficiency” in the House, records show. “Inventory processes are not properly designed and are not operating effectively,” an audit found in 2014.

(Source: House of Representatives Financial Audit Report 2016)

A spokesman for the Chief Administrative Office, which is required to do regular audits of House equipment, declined to comment.

Patrick J. Sowers, a part-time systems administrator for two House Republicans, said that it is common for IT workers to have equipment delivered off campus because deliveries at the Capitol require a time-consuming security screening process that is not necessary if an employee brings the equipment into the building.

“It’s possible that everything was done innocently,” Sowers said. “But when you add it all together, it does give the appearance that something was done inappropriately.” 

Mapping a trail

By midsummer, with the approval of the House Administration Committee, the Inspector General’s Office was tracking the five employees’ logins. In October, they found “massive” amounts of data flowing from the networks they were accessing, raising the possibility that an automated program was vacuuming up information, according to a senior House official familiar with the probe.

Initially, investigators could not see precisely what kind of data was moving off the server due to legal protections afforded by the Constitution’s “speech and debate” clause, which shields lawmakers’ deliberations from investigators’ eyes. 

Investigators found that the five IT employees had logged on at one server for the Democratic Caucus more than 5,700 times over a seven-month period, according to documents reviewed by The Post. Alvi, the only one of the five who was authorized to access that server, accounted for fewer than 300 of those logins, documents show.

The congressional networks they were accessing do not contain any classified information, which is held on separate servers that have rigid protections and very limited access. The House network does contain lawmakers’ email, but a senior House official said IT workers could not access it unless lawmakers provided their passwords. 

The Inspector General’s Office reported on its findings in a series of briefings in late September and early October in the offices of the House speaker, the Democratic leader, the House Administration Committee, the sergeant at arms and the Capitol Police. The leadership agreed to refer the probe to Capitol Police and the FBI, who had the tools to conduct more thorough background checks and to access their financial records. The criminal investigation began in October.

At the time, the presidential election was underway, and Hillary Clinton was under FBI investigation to determine whether she had mishandled classified information by using a private email server in the basement of her house while she was secretary of state. About two weeks later, after Trump won the election, House leaders decided to take the highly unusual step of barring the five IT workers from the network.

The House sergeant at arms convened chiefs of staff in early February and told them that the IT workers were under investigation for suspicion of stealing equipment and potential security violations related to the House network. Most offices fired the IT staffers. But a few Democratic lawmakers defended the Awans, saying that they had not seen definitive evidence that the Awans did anything wrong. 

“As of right now, I don’t see a smoking gun,” Rep. Gregory W. Meeks (D-N.Y.) told Politico in March. “I have seen no evidence that they were doing anything that was nefarious.”

Wasserman Schultz found a new consulting job for Imran Awan that did not require access to the House network and said publicly that she was concerned that the investigation was driven by ethnic and religious bias. The Awans are Muslims. 

Her fierce defense of the Awans at times puzzled even some in her own party. In May, Wasserman Schultz chided the Capitol Police chief during a public hearing after officers confiscated a laptop that had been left in a Capitol Building hallway. It belonged to her office and had been issued to Imran Awan.

“I think you’re violating the rules when you conduct your business that way and should suspect there will be consequences,” Wasserman Schultz told the chief.

She has also suggested that data moving off her office’s server might have been files the office routinely stored on Dropbox, an Internet-based document-sharing service. House rules prohibit moving data off the main server, but Wasserman Schultz has said in a public hearing that House administrators had not made those rules clear. 

“My concern was they were being singled out,” Wasserman Schultz told The Post.

[The story of Debbie Wasserman Schultz and an indicted IT staffer that’s lighting up the right, explained]

Wasserman Schultz’s office has said it is cooperating with the investigation. It has hired an outside lawyer, William Pittard, and for a time considered whether to shield any information sought by investigators by asserting “speech and debate” protections. 

“Ultimately, the congresswoman chose not to retain a single document on speech or debate or any other grounds in this investigation,” said David Damron, Wasserman Schultz’s communications director. Pittard is being paid by the congresswoman’s campaign for reelection.

Sowers, the systems administrator, said that while storing congressional data on Dropbox or other file-sharing services may be convenient, “anyone who is doing it is putting themselves at risk.”

“Hackers are out there constantly,” he said.

Page said he is confident the networking issues that helped kick off the criminal investigation will not result in charges.

“Everything we have heard, once stripped of any conspiratorial overtone, is consistent with how systems were set up and used in member offices,” the lawyer said. “None of this was invented by Imran. We don’t think that any of the systems were in violation of any rules or policies, and certainly Imran didn’t think so at the time.”

House staffers, meanwhile, have proposed a series of reforms in response to the controversy. They are under consideration by the House Administration Committee, according to two people with knowledge of the proposal. Those recommendations have not been released publicly, and officials declined to provide them. 

The aftermath

The disclosure of the investigation led to a torrent of news stories in the conservative press, led by the Daily Caller. The coverage has delved into the Awans’ personal finances, side businesses and family disputes — producing an unflattering portrait.

[Watchdog group asks Congress to investigate Wasserman-Schultz over fired IT aide]

Right-wing conspiracy theorists with large followings on the Internet have spun the revelations into intricate tales, trying to make the case that Imran Awan was the source of leaked emails from the Democratic National Committee that were published by WikiLeaks during last year’s presidential election. U.S. intelligence agencies have concluded that Russia was behind the hacking.

The unfounded speculation has found its way into coverage by Fox News.

“What if he was the source to WikiLeaks?” Fox News’ Geraldo Rivera said of Imran Awan during a July segment with host Sean Hannity after Awan’s arrest on bank-fraud charges. “He has all the passwords, he has all of the information. This is a huge story.”

According to charging documents, Imran Awan and Alvi took out two home-equity loans in December 2016, totaling $283,000, and wired the money to Pakistan on Jan. 18, about a week before they were banned from the House network.

On bank-loan applications to the Congressional Federal Credit Union, Alvi indicated that the couple lived in the two homes that were offered as collateral — but the homes were actually rental properties, according to the federal indictment. The bank does not offer home-equity loans on rental properties. 

Imran Awan’s lawyers said Awan and Alvi have repaid the loans by cashing out their retirement funds. Page, Awan’s lawyer, would not address the wire transfers, but said that at the time Awan “was struggling to arrange an elaborate funeral for his father in Pakistan and fighting legal battles over inherited family property there.”

(Source: Federal indictment)

They were charged with bank fraud on July 24. Wasserman Schultz fired Imran Awan the same week.

Alvi had already left the United States for Pakistan, in March. Imran Awan’s lawyers said Alvi left to allow the family to rent out their home because they had lost their jobs and “to temporarily escape the media frenzy,” which included “harassment” of her three children at home and at school.

Federal agents and Capitol Police tried to question her at Dulles International Airport, but ultimately let her and her children board the plane. An FBI agent wrote in a court document that he did not believe she intended to come back. Alvi has agreed to return to the United States in late September, according to court documents.

Imran Awan is living with a relative in Virginia and wearing a GPS tracking device. He has given up his passport and is restricted from traveling farther than 50 miles from the home where he is staying.

Appearing at Imran Awan’s first court appearance on Sept. 1 was George Webb, a self-described citizen journalist from Fort Wayne, Ind., who has cultivated 40,000 followers by posting hundreds of conspiratorial videos on YouTube.

He filed papers asking the judge if he could present evidence in the bank-fraud case that would reveal a host of other crimes, including money laundering to terrorist organizations. The judge denied the unusual request. Outside the courthouse, Webb said that he believed prosecutors were conspiring with Awan’s lawyers to minimize the case. 

“They’re orchestrating this thing, making it look like there’s a trial here,” Webb said. “There’s no trial here. They are trying to make this look like a small, simple bank fraud case. It’s not. It’s a spy ring in Congress.”

http://ift.tt/2jzAeWv