In­trigue far ex­ceeds ev­i­dence in IT probe

House work­ers are at con­ver­gence of pol­i­tics, cy­ber­se­cu­rity and fear

The Washington Post Sunday - - FRONT PAGE - BY SHAWN BOBURG

In late Septem­ber 2016, lead­ers in the House of Rep­re­sen­ta­tives met be­hind closed doors for brief­ings on a closely held in­ves­ti­ga­tion into a group of com­puter tech­ni­cians work­ing on Capi­tol Hill.

In­ves­ti­ga­tors with the In­spec­tor Gen­eral’s Of­fice had been qui­etly track­ing the five IT work­ers’ dig­i­tal foot­prints for months. They were alarmed by what they saw. The em­ploy­ees ap­peared to be ac­cess­ing con­gres­sional servers with­out au­tho­riza­tion, an in­di­ca­tion that they “could be read­ing and/or re­mov­ing in­for­ma­tion,” ac­cord­ing to doc­u­ments dis­trib­uted at the pre­vi­ously un­re­ported pri­vate brief­ings.

For some who lis­tened to the find­ings, the fact that the em­ploy­ees were born in Pak­istan set off alarms about na­tional se­cu­rity, ac­cord­ing to two par­tic­i­pants who spoke on the con­di­tion of anonymity. Oth­ers thought it more likely that the IT work­ers, nat­u­ral­ized U.S. cit­i­zens, were bend­ing rules on net­work ac­cess to share job du­ties — vi­o­la­tions of House pro­to­col, per­haps, but not es­pi­onage.

The mat­ter was soon re­ferred to the Capi­tol Po­lice, who have been as­sisted in their in­ves­ti­ga­tion by the FBI’s Joint Ter­ror­ism

Task Force. In Fe­bru­ary, the IT work­ers were barred from ac­cess­ing the House net­work, a de­vel­op­ment that quickly made head­lines.

Since then, the story of the House IT work­ers — broth­ers Im­ran Awan, Abid Awan and Ja­mal Awan, as well as Im­ran Awan’s wife, Hina Alvi, and friend Rao Ab­bas — has become a light­ning rod charged by the con­ver­gence of pol­i­tics, cy­ber­se­cu­rity and fears of for­eign in­tru­sion.

It has at­tracted un­founded con­spir­acy the­o­ries and in­trigue. Far-right news or­ga­ni­za­tions seized on it as a po­ten­tial coverup of an es­pi­onage ring that plun­dered na­tional se­crets and might have been re­spon­si­ble for the cam­paign hack­ing of the Demo­cratic Na­tional Com­mit­tee, a breach that in­tel­li­gence agen­cies have linked to Rus­sia. Pres­i­dent Trump has fanned its em­bers from his Twit­ter ac­count, re­post­ing an ar­ti­cle that claimed the main­stream me­dia were ig­nor­ing a scan­dal “en­gulf­ing” Rep. Deb­bie Wasserman Schultz, a Florida Demo­crat who was slow to fire Im­ran Awan af­ter news of the in­ves­ti­ga­tion broke.

Yet, ac­cord­ing to a se­nior con­gres­sional of­fi­cial fa­mil­iar with the probe, crim­i­nal in­ves­ti­ga­tors have found no ev­i­dence that the IT work­ers had any con­nec­tion to a for­eign gov­ern­ment. In­ves­ti­ga­tors look­ing for clues about es­pi­onage in­stead found that the work­ers were us­ing one con­gres­sional server as if it were their home com­puter, stor­ing per­sonal in­for­ma­tion such as chil­dren’s home­work and fam­ily photos, the of­fi­cial said.

Even so, the story — re­con­structed here af­ter The Washington Post re­viewed con­fi­den­tial doc­u­ments and in­ter­viewed more than a dozen peo­ple, in­clud­ing House of­fi­cials, wit­nesses and oth­ers, many of whom spoke on the con­di­tion of anonymity to dis­cuss the sen­si­tive in­ves­ti­ga­tion — high­lights ur­gent and per­sis­tent ques­tions about how well Congress safe­guards com­puter equip­ment and data.

Lawyers for some of the IT work­ers told The Post that their clients had done noth­ing wrong.

Christo­pher J. Gowen, one of Im­ran Awan’s lawyers, called the es­pi­onage claims “lu­di­crous.”

“There’s noth­ing that Im­ran did that wasn’t re­quested by one of his clients on House staff,” he said.

Jim Ba­con, a lawyer rep­re­sent­ing Abid Awan, said “a very lax en­vi­ron­ment” sur­rounds se­cu­rity pro­to­cols in the House. “I can tell you what they were do­ing was not un­usual,” he said.

The nearly one-year-old in­ves­ti­ga­tion has thus far re­sulted in no charges re­lated to the group’s House IT work. It has bur­rowed deeply into their per­sonal fi­nances and out­side busi­ness ven­tures.

In July, pros­e­cu­tors in the U.S. District At­tor­ney’s Of­fice for the District of Columbia charged Im­ran Awan and Alvi with bank fraud, al­leg­ing that the cou­ple made mis­rep­re­sen­ta­tions on an ap­pli­ca­tion for a home-eq­uity loan.

Im­ran Awan was ar­rested at the air­port as he was pre­par­ing to board a flight to Pak­istan, where his wife and three chil­dren — ages 4, 7, and 10 — have been since March. He has pleaded not guilty. Alvi is plan­ning to re­turn to the United States in the com­ing weeks to face bank-fraud charges, ac­cord­ing to court records. None of the other IT work­ers has been ac­cused of wrong­do­ing.

The in­ves­ti­ga­tion is on­go­ing. Both the FBI and the U.S. At­tor­ney’s Of­fice de­clined to com­ment.

Cho­sen in a lot­tery

Im­ran Awan, now 38, was a 14-year-old liv­ing in Pak­istan when he filled out an ap­pli­ca­tion for a U.S. pro­gram that pro­vides lim­ited green cards through a lot­tery sys­tem, his lawyers said. He and his fam­ily were cho­sen. He ar­rived at 17, got a job work­ing at a fast-food restau­rant and went to com­mu­nity col­lege in North- ern Vir­ginia. He trans­ferred to Johns Hop­kins Univer­sity in Bal­ti­more and earned a de­gree in in­for­ma­tion technology.

Awan be­came a U.S. cit­i­zen in 2004, his lawyers said, the same year he was hired for a part-time job as an IT spe­cial­ist in the of­fice of Rep. Robert Wexler (D-Fla.). Awan had got­ten to know some of Wexler’s staffers as an in­tern for a com­pany that pro­vided ser­vices to the of­fice.

As an IT spe­cial­ist, Awan set up prin­ters and work email ac­counts for new em­ploy­ees, and did tech­ni­cal trou­bleshoot­ing. Charis­matic and ac­com­mo­dat­ing, he be­came a pop­u­lar choice among House Democrats and soon cob­bled to­gether more than a dozen part-time jobs as what is known as a “shared em­ployee” on the Hill, float­ing be­tween of­fices on an as-needed ba­sis.

Such ar­range­ments came un­der scru­tiny in 2008 when House In­spec­tor Gen­eral James J. Cor­nell tes­ti­fied that there was “in­ad­e­quate over­sight” over shared em­ploy­ees.

“In most in­stances, they have all the free­dom of a ven­dor and all the ben­e­fits of an em­ployee with­out the ac­count­abil­ity one would ex­pect with an em­ployee,” Cor­nell told law­mak­ers. IT spe­cial­ists, he noted, “present an ad­di­tional risk in that they of­ten have ac­cess to mul­ti­ple of­fice’s data out­side of both the over­sight of con­gres­sional of­fice staff and the vis­i­bil­ity of House se­cu­rity per­son­nel.”

As de­mand for Awan’s ser­vices grew, he be­gan rec­om­mend­ing his fam­ily mem­bers, who had less for­mal train­ing. His brother Abid, 33, started work­ing on Capi­tol Hill in 2005. His wife, 33, joined in 2007. A friend, Rao Ab­bas, 37, who had most re­cently worked as a man­ager at a McDon­ald’s, was hired in 2012. And Im­ran’s youngest brother, Ja­mal, 24, started in 2014. Each held part-time jobs in mul­ti­ple Demo­cratic con­gres­sional of­fices.

“At the end of the day, whether they had for­mal train­ing or not, they were trained on the job by Im­ran,” said one of Im­ran Awan’s lawyers, Aaron Marr Page.

By 2016, the five worked for a com­bined three dozen law­mak­ers un­der sep­a­rate part-time con­tracts with each of­fice. The Awan fam­ily mem­bers were each paid be­tween $157,000 and $168,000 that year, mak­ing them among the high­est-paid staffers on the Hill. The salary cap for a con­gres­sional staffer is $174,000.

Un­der House rules, em­ploy­ees in each con­gres­sional of­fice are pro­hib­ited from shar­ing their job du­ties with oth­ers who are not di­rectly em­ployed by that of­fice.

In his 2008 tes­ti­mony, Cor­nell warned that a “grow­ing num­ber of shared em­ploy­ees are work­ing in il­le­gal team­ing ar­range­ments where they pass the work off to other shared em­ploy­ees not on the pay­roll of the con­gres­sional of­fice they are serv­ing.”

Gowen, the other at­tor­ney rep­re­sent­ing Im­ran Awan, ac­knowl- edged that the group filled in for each other at times.

“He’s work­ing with fam­ily and friends, so there was some cov­er­age by col­leagues,” Gowen said.

Odd in­voices

In March 2016, au­di­tors in the House’s Chief Ad­min­is­tra­tive Of­fice dis­cov­ered strange in­voices for com­puter equip­ment — pur­chases that were bro­ken into mul­ti­ple pay­ments of less than $500. Any pur­chases over that amount re­quire equip­ment to be placed on an in­ven­tory that helps to track it.

Af­ter a re­fer­ral to the in­spec­tor gen­eral’s of­fice, in­ves­ti­ga­tors found that the IT work­ers had asked ven­dors “to split the cost of equip­ment among mul­ti­ple items and charged these items as of­fice sup­plies in­stead of equip­ment,” ac­cord­ing to the Septem­ber brief­ing doc­u­ment.

As of Sept. 1, 2016, there had been 34 pur­chases to­tal­ing nearly $38,000 “where the costs of the item was ma­nip­u­lated to ob­tain a pur­chase price of $499.99,” ac­cord­ing to the doc­u­ment. There were $799 iPads and a $640 tele­vi­sion on the list, records show.

Most of that equip­ment was left off the of­fi­cial House in­ven­tory, in­ves­ti­ga­tors found. And in­ves­ti­ga­tors found that some of it had been de­liv­ered to the homes of the Awan broth­ers, ac­cord­ing to a per­son fa­mil­iar with the in­ves­ti­ga­tion.

One ven­dor, CDW, re­ceived a sub­poena from fed­eral pros­e­cu­tors in De­cem­ber, an­other per­son fa­mil­iar with the pro­cure­ment part of the probe said. The com­pany said in a state­ment to The Post that it was co­op­er­at­ing with au­thor­i­ties and that pros­e­cu­tors had as­sured the com­pany it was not a tar­get of the in­ves­ti­ga­tion.

Page, Im­ran Awan’s lawyer, said that the home-equip­ment de­liv­er­ies were rare and made when his client planned to be away from the Capi­tol dur­ing the de­liv­ery. He de­clined to com­ment on other as­pects of the equip­ment pur­chases.

When asked if his client was au­tho­rized to split equip­ment pur­chases into in­cre­ments less than $500, Ba­con, Abid Awan’s lawyer, said: “In a fluid sit­u­a­tion you do what you’re or­dered to do.” Any miss­ing equip­ment, Ba­con said, “dis­ap­peared af­ter it was brought to the folks who were de­mand­ing it . . . . It sounds to me like there’s a lot of scape­goat­ing here.”

The House is gen­er­ally bad at keep­ing track of the mil­lions of dol­lars worth of of­fice equip­ment in its care, ac­cord­ing to in­de­pen­dent au­di­tors. The past four an­nual au­dits have cited “in­ef­fec­tive con­trols over prop­erty and equip­ment” as a “sig­nif­i­cant de­fi­ciency” in the House, records show. “In­ven­tory pro­cesses are not prop­erly de­signed and are not op­er­at­ing ef­fec­tively,” an au­dit found in 2014.

A spokesman for the Chief Ad­min­is­tra­tive Of­fice, which is re­quired to do reg­u­lar au­dits of House equip­ment, de­clined to com­ment.

Pa­trick J. Sow­ers, a part-time sys­tems ad­min­is­tra­tor for two House Repub­li­cans, said that it is com­mon for IT work­ers to have equip­ment de­liv­ered off cam­pus be­cause de­liv­er­ies at the Capi­tol re­quire a time-con­sum­ing se­cu­rity screen­ing process that is not nec­es­sary if an em­ployee brings the equip­ment into the build­ing.

“It’s pos­si­ble that ev­ery­thing was done in­no­cently,” Sow­ers said. “But when you add it all to­gether, it does give the ap­pear­ance that some­thing was done in­ap­pro­pri­ately.”

Map­ping a trail

By mid­sum­mer, with the ap­proval of the House Administration Com­mit­tee, the In­spec­tor Gen­eral’s Of­fice was track­ing the five em­ploy­ees’ lo­gins. In Oc­to­ber, they found “mas­sive” amounts of data flow­ing from the net­works they were ac­cess­ing, rais­ing the pos­si­bil­ity that an au­to­mated pro­gram was vac­u­um­ing up in­for­ma­tion, ac­cord­ing to a se­nior House of­fi­cial fa­mil­iar with the probe.

Ini­tially, in­ves­ti­ga­tors could not see pre­cisely what kind of data was mov­ing off the server due to le­gal pro­tec­tions af­forded by the Con­sti­tu­tion’s “speech and de­bate” clause, which shields law­mak­ers’ de­lib­er­a­tions from in­ves­ti­ga­tors’ eyes.

In­ves­ti­ga­tors found that the five IT em­ploy­ees had logged on at one server for the Demo­cratic Cau­cus more than 5,700 times over a seven-month pe­riod, ac­cord­ing to doc­u­ments re­viewed by The Post. Alvi, the only one of the five who was au­tho­rized to ac­cess that server, ac­counted for fewer than 300 of those lo­gins, doc­u­ments show.

The con­gres­sional net­works they were ac­cess­ing do not con­tain any clas­si­fied in­for­ma­tion, which is held on sep­a­rate servers that have rigid pro­tec­tions and very lim­ited ac­cess. The House net­work does con­tain law­mak­ers’ email, but a se­nior House of­fi­cial said IT work­ers could not ac­cess it un­less law­mak­ers pro­vided their pass­words.

The In­spec­tor Gen­eral’s Of­fice re­ported on its find­ings in a se­ries of brief­ings in late Septem­ber and early Oc­to­ber in the of­fices of the House speaker, the Demo­cratic leader, the House Administration Com­mit­tee, the sergeant at arms and the Capi­tol Po­lice. The lead­er­ship agreed to re­fer the probe to Capi­tol Po­lice and the FBI, who had the tools to con­duct more thor­ough back­ground checks and to ac­cess their fi­nan­cial records. The crim­i­nal in­ves­ti­ga­tion be­gan in Oc­to­ber.

At the time, the pres­i­den­tial elec­tion was un­der­way, and Hil­lary Clin­ton was un­der FBI in­ves­ti­ga­tion to de­ter­mine whether she had mis­han­dled clas­si­fied in­for­ma­tion by us­ing a pri­vate email server in the base­ment of her house while she was sec­re­tary of state. About two weeks later, af­ter Trump won the elec­tion, House lead­ers de­cided to take the highly un­usual step of bar­ring the five IT work­ers from the net­work.

The House sergeant at arms con­vened chiefs of staff in early Fe­bru­ary and told them that the IT work­ers were un­der in­ves­ti­ga­tion for sus­pi­cion of steal­ing equip­ment and po­ten­tial se­cu­rity vi­o­la­tions re­lated to the House net­work. Most of­fices fired the IT staffers. But a few Demo­cratic law­mak­ers de­fended the Awans, say­ing that they had not seen definitive ev­i­dence that the Awans did any­thing wrong.

“As of right now, I don’t see a smok­ing gun,” Rep. Gre­gory W. Meeks (D-N.Y.) told Politico in March. “I have seen no ev­i­dence that they were do­ing any­thing that was ne­far­i­ous.”

Wasserman Schultz found a new con­sult­ing job for Im­ran Awan that did not re­quire ac­cess to the House net­work and said pub­licly that she was con­cerned that the in­ves­ti­ga­tion was driven by eth­nic and re­li­gious bias. The Awans are Mus­lims.

Her fierce de­fense of the Awans at times puz­zled even some in her own party. In May, Wasserman Schultz chided the Capi­tol Po­lice chief dur­ing a pub­lic hear­ing af­ter of­fi­cers con­fis­cated a lap­top that had been left in a Capi­tol Build­ing hall­way. It be­longed to her of­fice and had been is­sued to Im­ran Awan.

“I think you’re vi­o­lat­ing the rules when you con­duct your busi­ness that way and should sus­pect there will be con­se­quences,” Wasserman Schultz told the chief.

She has also sug­gested that data mov­ing off her of­fice’s server might have been files the of­fice rou­tinely stored on Drop­box, an In­ter­net-based doc­u­ment-shar­ing ser­vice. House rules pro­hibit mov­ing data off the main server, but Wasserman Schultz has said in a pub­lic hear­ing that House ad­min­is­tra­tors had not made those rules clear.

“My con­cern was they were be­ing sin­gled out,” Wasserman Schultz told The Post.

Wasserman Schultz’s of­fice has said it is co­op­er­at­ing with the in­ves­ti­ga­tion. It has hired an out­side lawyer, Wil­liam Pit­tard, and for a time con­sid­ered whether to shield any in­for­ma­tion sought by in­ves­ti­ga­tors by as­sert­ing “speech and de­bate” pro­tec­tions.

“Ul­ti­mately, the con­gress­woman chose not to re­tain a sin­gle doc­u­ment on speech or de­bate or any other grounds in this in­ves­ti­ga­tion,” said David Dam­ron, Wasserman Schultz’s com­mu­ni­ca­tions di­rec­tor. Pit­tard is be­ing paid by the con­gress­woman’s cam­paign for re­elec­tion.

Sow­ers, the sys­tems ad­min­is­tra­tor, said that while stor­ing con­gres­sional data on Drop­box or other file-shar­ing ser­vices may be con­ve­nient, “any­one who is do­ing it is putting them­selves at risk.”

“Hack­ers are out there con­stantly,” he said.

Page said he is con­fi­dent the net­work­ing is­sues that helped kick off the crim­i­nal in­ves­ti­ga­tion will not re­sult in charges.

“Ev­ery­thing we have heard, once stripped of any con­spir­a­to­rial over­tone, is con­sis­tent with how sys­tems were set up and used in mem­ber of­fices,” the lawyer said. “None of this was in­vented by Im­ran. We don’t think that any of the sys­tems were in vi­o­la­tion of any rules or poli­cies, and cer­tainly Im­ran didn’t think so at the time.”

House staffers, mean­while, have pro­posed a se­ries of re­forms in re­sponse to the con­tro­versy. They are un­der con­sid­er­a­tion by the House Administration Com­mit­tee, ac­cord­ing to two peo­ple with knowl­edge of the pro­posal. Those rec­om­men­da­tions have not been re­leased pub­licly, and of­fi­cials de­clined to pro­vide them.

The af­ter­math

The dis­clo­sure of the in­ves­ti­ga­tion led to a tor­rent of news sto­ries in the con­ser­va­tive press, led by the Daily Caller. The cov­er­age has delved into the Awans’ per­sonal fi­nances, side busi­nesses and fam­ily dis­putes — pro­duc­ing an un­flat­ter­ing por­trait.

Right-wing con­spir­acy the­o­rists with large fol­low­ings on the In­ter­net have spun the rev­e­la­tions into in­tri­cate tales, try­ing to make the case that Im­ran Awan was the source of leaked emails from the Demo­cratic Na­tional Com­mit­tee that were pub­lished by Wik­iLeaks dur­ing last year’s pres­i­den­tial elec­tion. U.S. in­tel­li­gence agen­cies have con­cluded that Rus­sia was be­hind the hack­ing.

The un­founded spec­u­la­tion has found its way into cov­er­age by Fox News.

“What if he was the source to Wik­iLeaks?” Fox News’ Ger­aldo Rivera said of Im­ran Awan dur­ing a July seg­ment with host Sean Han­nity af­ter Awan’s ar­rest on bank-fraud charges. “He has all the pass­words, he has all of the in­for­ma­tion. This is a huge story.”

Ac­cord­ing to charg­ing doc­u­ments, Im­ran Awan and Alvi took out two home-eq­uity loans in De­cem­ber 2016, to­tal­ing $283,000, and wired the money to Pak­istan on Jan. 18, about a week be­fore they were banned from the House net­work.

On bank-loan ap­pli­ca­tions to the Con­gres­sional Fed­eral Credit Union, Alvi in­di­cated that the cou­ple lived in the two homes that were of­fered as col­lat­eral — but the homes were ac­tu­ally rental prop­er­ties, ac­cord­ing to the fed­eral in­dict­ment. The bank does not of­fer home-eq­uity loans on rental prop­er­ties.

Im­ran Awan’s lawyers said Awan and Alvi have re­paid the loans by cash­ing out their re­tire­ment funds. Page, Awan’s lawyer, would not ad­dress the wire trans­fers, but said that at the time Awan “was strug­gling to ar­range an elab­o­rate funeral for his fa­ther in Pak­istan and fight­ing le­gal bat­tles over in­her­ited fam­ily prop­erty there.”

They were charged with bank fraud on July 24. Wasserman Schultz fired Im­ran Awan the same week.

Alvi had al­ready left the United States for Pak­istan, in March. Im­ran Awan’s lawyers said Alvi left to al­low the fam­ily to rent out their home be­cause they had lost their jobs and “to tem­po­rar­ily es­cape the me­dia frenzy,” which in­cluded “ha­rass­ment” of her three chil­dren at home and at school.

Fed­eral agents and Capi­tol Po­lice tried to ques­tion her at Dulles In­ter­na­tional Air­port, but ul­ti­mately let her and her chil­dren board the plane. An FBI agent wrote in a court doc­u­ment that he did not be­lieve she in­tended to come back. Alvi has agreed to re­turn to the United States in late Septem­ber, ac­cord­ing to court doc­u­ments.

Im­ran Awan is liv­ing with a rel­a­tive in Vir­ginia and wear­ing a GPS track­ing de­vice. He has given up his pass­port and is re­stricted from trav­el­ing far­ther than 50 miles from the home where he is stay­ing.

Ap­pear­ing at Im­ran Awan’s first court ap­pear­ance on Sept. 1 was Ge­orge Webb, a self-de­scribed cit­i­zen jour­nal­ist from Fort Wayne, Ind., who has cul­ti­vated 40,000 fol­low­ers by post­ing hun­dreds of con­spir­a­to­rial videos on YouTube.

He filed pa­pers ask­ing the judge if he could present ev­i­dence in the bank-fraud case that would re­veal a host of other crimes, in­clud­ing money laun­der­ing to ter­ror­ist or­ga­ni­za­tions. The judge de­nied the un­usual re­quest. Out­side the court­house, Webb said that he be­lieved pros­e­cu­tors were con­spir­ing with Awan’s lawyers to min­i­mize the case.

“They’re or­ches­trat­ing this thing, mak­ing it look like there’s a trial here,” Webb said. “There’s no trial here. They are try­ing to make this look like a small, sim­ple bank fraud case. It’s not. It’s a spy ring in Congress.”

BON­NIE JO MOUNT/THE WASHINGTON POST

Im­ran Awan, a technology worker in Congress for 13 years, is — along with his wife, two broth­ers and a friend — the sub­ject of a fed­eral in­ves­ti­ga­tion that has become a light­ning rod for some con­ser­va­tives.

Newspapers in English

Newspapers from USA

© PressReader. All rights reserved.