Case Document 1 Filed 03/07/19 Page 1 of 17 PagelD# 1 UNDER SEAL IN THE UNITED STATES DISTRICT COURT FOR EASTERN DISTRICT OF VIRGINIA Alexandria Division men ova: scum mangle count ?henna GM UNITED STATES OF AMERICA Criminal No. v. Count 1: 18 U. S. 793(c) Obtaining National Defense DANIEL EVERETTE HALE, Information Defendant. Count 2: 18 U.S.C. 793(e) Retention and Transmission of National Defense Information Count 3: 18 U.S.C. 793(e) Causing the Communication of National Defense Information Count 4: 18 U.S.C. 798(a)(3) Disclosure of Classi?ed Communications Intelligence Information Count 5: 18 U.S.C. 641 Theft of Government Property INDICTMENT March 2019 Term At Alexandria THE GRAND IURY CHARGES THAT: GENERAL ALLEGATIONS A. The Defendant and His Access to Classi?ed National Defense Information 1. Defendant DANIEL EVERETTE HALE, age 31, is a resident of Nashville, Tennessee. 2. From July 2009 through in or about July 2013, HALE was enlisted in the United States Air Force, where after receiving language and intelligence training, he became a Language Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 2 of 17 PagelD# 2 Analyst. While serving on active duty, HALE was assigned to work at the National Security Agency (N SA) from December 2011 to May 2013. HALE deployed in support of a Department of Defense Joint Special Operations Task Force from March 2012 to August 2012, at Bagram Air?eld, Afghanistan, working for most of that time as an Intelligence Analyst responsible for identifying, tracking, and targeting threat networks and targets. In connection with his active duty service and work for NSA, HALE held a TOP COMPARTMENTED INFORMATION security clearance, and had access to classi?ed national defense information. 3. From December 2013 until August 2014, HALE was employed by a defense contractor known as Leidos. While working for Leidos, HALE was assigned to the National Geospatial-Intelligence Agency (N GA), in Spring?eld, Virginia, where he worked as a Political Geography Analyst. HALE was required to receive and maintain a TOP security clearance in order to work at NGA. 4. Over his many years holding a security clearance, HALE received training regarding classi?ed information, including the de?nitions of classi?ed information, the levels of classi?cation, and SCI, as well as the proper handling, marking, tranSportation, and storage of classi?ed materials. HALE received training on his duty to protect classi?ed materials from unauthorized disclosure, which included complying with handling, transportation, and storage requirements. HALE knew that unauthorized removal and retention of classi?ed materials and transportation and storage of those materials in unauthorized locations risked disclosure and transmission of those materials, and therefore could cause injury to the United States or be used to the advantage of a foreign nation. In particular, HALE had been advised that the unauthorized disclosure of TOP SECRET information reasonably could be expected to cause exceptionally Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page Bot 17 PagelD# 3 grave damage to the national security of the United States, and unauthorized disclosure of SECRET information reasonably could be expected to cause serious damage to the national security of the United States, and that violation of the rules governing the handling of classi?ed information could result in criminal prosecution. 5. work at NGA required the use of classi?ed government computer systems and networks that provided access to classi?ed national defense information. HALE was noti?ed that these computers were monitored for ?personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations? by a banner that HALE had to acknowledge by clicking on the button every time he logged on to his computer. 6. Because HALE held a security clearance and was assigned to NGA as a cleared defense contractor, the United States government entrusted HALE with access to closely held classi?ed national defense information. B. Background on Classi?ed Information 7. Classi?ed information is de?ned by Executive Order 13526, 75- Fed. Reg. 707 . (Jan. 5, 2010) as information in any form that is owned by, produced by or for, or under the control of the United States government; (2) falls within one of more of the categories of information set forth in the order; and (3) is classi?ed by an original classi?cation authority who determines that its unauthorized disclosure reasonably could be expected to result in damage to the national security that the original classi?cation authority can identify and describe. - 8. Under Executive Order 13526, the designation SECRET (S) shall be applied to information, the unauthorized disclosure of which could reasonably be expected to cause serious damage to the national security. The designation TOP SECRET (TS) shall be applied to information, the unauthorized disclosure of which could reasonably be expected to cause Case Document 1 Filed 03/07/19 Page 4 of 17 Page D# 4 exceptionally grave damage tornational security. NOFORN stands for ?No Foreign Dissemination? and denotes that dissemination of that information is limited to United States persons. ORCON stands for ?Originator Controlled,? which denotes that the information should not be further disseminated to any third party without the concurrence of the original classi?cation authority. 9. Executive Order No. 13526 also provides that speci?ed of?cials may create special access programs upon a ?nding that the vulnerability of, or threat to, speci?c information is exceptional, and the normal criteria for determining eligibility for access applicable to information classi?ed at the same level are not suf?cient to protect the information from unauthorized disclosure. Special access programs pertaining to intelligence sources, methods, or analytical processes are called SCI programs. One such SCI control system is. SI information, . which refers to ?Special Intelligence.? SI protects information relating to technical and intelligence information derived from the monitoring of foreign communication signals by someone other than the intended recipients. The term COMINT describes communications intelligence. 10. Pursuant to Executive Order No. 13526, classi?ed information can generally only be disclosed to those persons who have been granted an appropriate level United States government security clearance and who possess a valid need to know to perform a lawful and authorized government function. Additionally, classi?ed information only may be processed and retained in and on facilities approved for processing and storage at the appropriate classi?cation level. Classi?ed information may not be removed from of?cial premises without proper authorization. Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 5 of 17 'Page D# 5 C. Communications with an Online News Outlet 11. In April 2013, HALE used his unclassi?ed NSA work computer to search the internet for information on a reporter (the Reporter). Among the results of his search was information pertaining to a scheduled appearance of the Reporter on or about April 29, 2013 at a Washington, DC. restaurant/beekstore (Bookstore). 12. On or about April 29, 2013, HALE attended a book tour event at the Bookstore, where he met with the Reporter. The next day, on or about April 30, 2013, HALE used his TOP SECRET NSA computer to search for classi?ed information concerning individuals and issues about which the Reporter wrote. 13. In May 2013, HALE sent a text to a close friend and con?dant (Con?dent) stating ?[the Reporter] wants me to tell my story about working with drones at the opening screening of his documentary about the war and the use of drones.? 14. On or about June 8, 2013, HALE sat next to the Reporter at a public event at the Bookstore to promote the Reporter?s book (Book 1). After the event, HALE texted a friend that he was then with the Reporter and headed to a restaurant. 15. On or about June 9, 2013, the Reporter sent HALE an email with a link to an article about Edward Snowden in an online publication. That same day, Hale texted a ?iend that the previous night he had been hanging out with journalists who were focused on his story. Hale wrote that the evening?s events might provide him with ?life long connections with people who publish work like this.? 16. On or about July 14, 2013, HALE called the Reporter. Three days later, the Reporter sent HALE an email with the subject line, ?did you try calling me?? The body of the email consisted of ?I?m around.? A few hours later, HALE called the Reporter again. Case Document 1 Filed 03/07/19 Page 6 of 17 PagelD# 6 17 . on or about July 19, 2013, I-LALE sent a text message to the Confidant stating that he was going to New York to meet with the Reporter and two other journalists. The next day, the same day HALE separated from the Air Force, HALE sent an email to the Reporter stating he would take a train to New York City the following week. HALE told the Reporter he would text him when he arrived so they could determine where to meet. Later the same day, HALE emailed the Reporter about watching a ?plug? about the Reporter?s book on television. Attached to the email was a link to a news article entitled, ?Court rules journalists can?t keep their sources secret,? about the Fourth Circuit Court of Appeals ruling that a ?New York Times journalist . . . must testify in the trial of a former Central Intelligence Agency of?cer accused of leaking classi?ed national defense information to the media.? 18. On or about July 23 and 24, 2013, HALE was in New York City. 19. On or about July 25, 2013, HALE sent the Reporter an email with a copy of his resume attached and subject line, ?Hale unclass resume.? The resume stated that HALE was looking for positions ?within the Intelligence Community. . . [and was] [e]specially interested in Counter Terrorism, Counter Intelligence, Electronic Warfare, or stand up and maintenance of SIGINT oriented missions.? HALE listed his ?Active clearance counter intelligence (CI) polygraph? and ?4 years active duty Air Force? where he ?[p]rocessed numerous documents critical to National Defense.? As part of his duties as an Intelligence Analyst, HALE highlighted his experience operating ?payloads on remotely piloted vehicles (RPV) used to support real-time kill/capture operations over 1540 hours, over 200 speci?c mission? and his experience as a Intelligence De-con?iction Officer for Operation Enduring Freedom?s (OEF) intelligence, surveillance and reconnaissance (ISR) platforms 80 hours, monitored 750 on- Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 7 of 17 PagelD# 7 going missions.? Finally, HALE listed his experience working with original classi?cation authorities to declassify information to be used against detainees in trial. 20. On or about August 18, 2013, the Reporter called HALE. The call lasted approximately 35 minutes. 21. On or about September 20, 2013, the Reporter asked HALE to ?[i]ust set up a [Jabber] account [so] we can chat on Jabber is a free instant messaging program that uses to protect the content of the messages. 22. In November 2013, HALE texted the Reporter to ask whether he would ?be in DC. this weekend for the anti drone summit.? 23. Between in and about September 20, 2013, and February 27, 2014, HALE and the Reporter had at least three conversations via Jabber. D. HALE Prints Multiple Classi?ed Documents Unrelated to His Assigned Work at NGA That Are Published by the Reporter?s News Outlet 24. On or about February 27, 2014, HALE sent a text message to the Reporter asking, ?Are you able to get on chat?? 25. On or about February 28, 2014, HALE used a classi?ed work computer assigned to him by NGA to print ?ve documents marked as SECRET and one document marked as TOP SECRET, which were unrelated to his work at NGA. 26. Approximately four hours after printing the six documents, HALE and the Reporter had the following conversation via text message: . HALE: Can you be here Monday? The Reporter: Where? The Reporter: I am out in LA for oscars. Back Tuesday. HALE: Right, I understand, do you have time to stop by 1 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 8 of 17 PagelD# 8 The Reporter: let me see if I can change ?ight. HALE: Please do and lemme know. 27. Each of the six classi?ed documents that HALE printed on February 28, 2014, was later published by the Reporter?s Online News Outlet. 28. HALE continued to print documents from his TOP SECRET computer unrelated to his work as an NGA contractor that were later published by the Reporter?s Online News Outlet. 29. While employed as a cleared defense contractor for NGA, HALE printed from his TOP SECRET computer 36 documents, including four duplicates. Nine documents related to work at NGA, but 23 did not. 30. Of the 23 documents unrelated to his work that he printed at NGA, HALE provided at least 17 to the Reporter andlor the Reporter?s Online News Outlet, which published the documents in whole or in part. 31. Eleven of the published documents were marked as SECRET or TOP SECRET (the Classi?ed Documents). Relevant original classi?cation authorities have since determined that the documents were correctly marked at the appropriate classi?cation level at the time they were printed, and that they remain classi?ed at the same level today. 32. The table displayed on the next page lists the 23' printed documents, unrelated to work at NGA, with the print job numbers assigned by NGA, the dates of printing, initial publication dates, and classi?cations: 5 Case Document 1 Filed 03/07/19 Page 9 of 17 PagelD# 9 Document NGA Print Job# Date Printed Date of Initial Publication Classi?cation A 108511 February 28, 2014 October 2015 SECRET 12 February 28, 2014 October 2015 SECRET . 13 February 28, 2014 October 2015 SECRET 14&15 February 28, 2014 October 2015 SECRET 16 February 28, 2014 October 2015 TOP SECRET 17 February 28, 2014 October 2015 SECRET 18 April 3, 2014 April 2015 TOP SECRET 19 April 19, 2014 TOP SECRET I 20 April 20, 2014 August 2014 SECRET 21 April 20, 2014 December 2015 SECRET 22 April 20, 2014 April 2015 TOP SECRET 23 8524 April 30, 2014 July 2014 UNCLASSIFIED 25 May 14, 2014 August 2014 SECRET 26 May 14, 2014 August 2014 UNCLASSIFIED 27 May 15, 2014 December 2016 UNCLASSIFIED 28 May 15, 2014 December 2016 UNCLASSIFIED 29 May 15, 2014 December 2016 UNCLASSIFIED 30 May 15, 2014 'December 2016 UNCLASSIFIED 31 June 20, 2014 SECRET 32 June 27, 2014 UNCLASSIFIED 33 July 31, 2014 SECRET 34 August 5, 2014 SECRET 358536 Aggust 5,2014 UNCLASSIFIED 33. The 11 Classi?ed Documents that were published by the Reporter?s Online News Outlet, and later in a book authored by the Reporter, are described in further detail below: 0 DOCUMENT A A PowerPoint presentation on counterterrorism operations classi?ed 0 DOCUMENT A document describing a military campaign targeting Al-Qaeda overseas classi?ed SECRET 0 DOCUMENT A March 2013 PowerPoint on military operations classi?ed SECRET 0 DOCUMENT A PowerPoint presentation on counterterrorism operations classi?ed SECRET Case Document 1 Filed 03/07/19 Page 10 of 17 PagelD# 10 0 DOCUMENT Information gathered by NSA on speci?c named targets classi?ed TOP SECRET 0 DOCUMENT A PowerPoint slide outlining the effects of the military campaign targeting Al?Qaeda overseas classi?ed SECRET - DOCUMENT PowerPoint presentation out?tting US. military technical capabilities classi?ed TOP SECRET 0 DOCUMENT I A report listing the accomplishrnents of an intelligence agency tasked with preventing terrorist attacks classi?ed SECRET 0 DOCUMENT - A PowerPoint presentation classi?ed SECRET 0 DOCUMENT An intelligence report on an Al?Qaeda operative classi?ed TOP SECRET DOCUMENT Information on the Terrorist Identities Datamart Environment classi?ed SECRET 34. HALE did not have a ?need to know? the classi?ed information contained in the 11 Classi?ed Documents he printed. 35. All of the Classi?ed. Documents HALE printed bore standard markings indicating they contained highly classi?ed information of the United States, including SECRET, and TOP SECRET, as well as SCI, information. 36. At the time HALE obtained the documents, he knew that they had been or would be obtained, taken, made, or disposed of unlaw?illy. 37. HALE was never authorized to remove the Classi?ed Documents from NGA and retain or transmit them, and neither the Reporter nor any of the employees at the Reporter?s Online News Outlet were entitled to?receive or possess them. 10 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 11 of 17 Page D# 11 38. The documents provided to the Reporter by HALE and published by the Reporter?s Online News Outlet were compiled and published in a book authored by the Reporter (Book 2). E. Evidence Stored in Home 39. On August 8, 2014, HALE possessed Document on his home computer. HALE also possessed two thumb drives. The ?rst thumb drive contained one page of Document A that HALE had attempted to delete. This page was marked The second thumb drive contained the ?Tor? software and ?Tails? operating system. 40. Tor and Tails were recommended by the Reporter?s Online News Outlet in an article published on the Reporter?s Online News Outlet?s website, which provided readers with instructions on how to anonymously ?leak? documents to the Reporter?s Online News Outlet. The article published by the Reporter?s Online News Outlet explained that the Tor browser allows users to anonymously surf the web by ?hiding your real IP address from the websites that you visit. If your network is being monitored, the eavesdroppers will only know that you are using Tor but not what you?re doing.? The article went on to explain that the Tails operating system, which can be installed via a USB stick, will prevent someone who has hacked into your computer from ?spy[ing] on everything you do.? It ?strip[s] metadata from a variety of types of documents. . .[and] leaves no traces that it was ever run on your computer.? 41. On or about August 8, 2014, cell phone contact list included the contact information for the Reporter. 11 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 12 of 17 PagelD# 12 COUNT 1 (18 U.S.C. National Defense Information) THE GRAND JURY FURTHER CHARGES THAT: 42. The General Allegations within Paragraph 1 through 41 of this Indictment are re- alleged and incorporated by reference. 43. Beginning on or about February 28, 2014, and continuing to on or about May 14, 2014, in the Eastern District of Virginia and elsewhere, the defendant, DANIEL EVERETTE HALE, for the purpose of obtaining information respecting the national defense, unlawfully . obtained documents connected with the national defense, namely: Document Date Printed Date of Initial Publication Classi?cation A February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 TOP SECRET February 28, 2014 October 2015 SECRET April 3, 2014 April 2015 TOP SECRET I April 20, 2014 August 2014 . SECRET April 20, 2014 December 2015 SECRET April 20, 2014 April 2015 TOP SECRET May 14, 2014 August 2014 SECRET knowing and having reason to believe at the time he obtained Documents A-G, and that they had been or would be obtained, taken, made, or disposed of by any person contrary to the provisions of Title 18,1 United States Code, Chapter 37. (In violation of Title 18, United States Code, Section 12 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 13 of 17 Page D# 13 COUNT 2 (18 U.S.C. and Transmission of National Defense Information) THE GRAND JURY FURTHER CHARGES THAT: 44. The General Allegations within Paragraph 1 through 41 of this Indictment are incorporated by reference. 45. Beginning on or about February 28, 2014, and continuing to on or about. December 17, 2015, in the Eastern DiStn'ct of Virginia and elsewhere, the defendant, DANIEL EVERETTE HALE, having unauthorized possession of, access to, and control over the following documents related to the national defense, willfully: retained the documents and failed to deliver them to the of?cer or employee of the United States entitled to receive them; and communicated, delivered, and transmitted such documents to a person not entitled to receive them. Speci?cally, HALE retained the following documents relating to the national defense, and transmitted them to the Reporter and! or the Reporter?s Online News Outlet: . Document Date Printed Date of Initial Publication Classi?cation A February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 TOP SECRET February 28, 2014 October 2015 SECRET April 3, 2014 April 2015 TOP SECRET 1 April 20, 2014 August 2014 SECRET April 20, 2014 December 2015 SECRET April 20, 2014 April 2015 TOP SECRET May 14, 2014 August 2014 SECRET (In violation of Title 18, United States Code, Section 13 1 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 14 of 17 PagelD# 14 COUNT 3 (18 U.S.C. the Communication of National Defense Information) THE GRAND JURY FURTHER CHARGES THAT: 46. The General Allegations within Paragraph 1 through 41 of this Indictment are incorporated by reference. 47. Beginning on or about February 28, 2014,.and continuing to on or about December 17, 2015, in the Eastern District of Virginia and elsewhere, the defendant, DANIEL EVERETTE HALE, having unauthorized possession of, access to, and control over documents related to the national defense of the United States, namely: Document Date Printed Date of Initial Publication Classi?cation A February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 TOP SECRET February 28, 2014 October 2015 SECRET April 3, 2014 April 2015 TOP SECRET I April 20, 2014 August 2014 SECRET April 20, 2014 December 2015 SECRET April 20, 2014 April 2015 TOP SECRET May 14, 2014 August 2014 SECRET did willfully communicate, deliver, transmit and cause tobe communicated, delivered, and transmitted, and attempt to communicate, deliver and transmit and cause to be communicated, delivered, and transmitted the same to persons not entitled to receive them, through the publication, dissemination, and distribution to the general public of articles and books concerning Classi?ed Documents A-G, 1-K, and M. (In violation of Title 18, United States Code, Section l4 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 15 of 17 PagelD# 15 COUNT 4 (18 U.S.C. of Classi?ed Communication Intelligence Information) THE GRAND JURY FURTHER CHARGES THAT: 48. The General Allegations within Paragraph 1 through 41 of this Indictment are incorporated by reference. 49. Beginning on or about February 28, 2014, and continuing to in or about October 2015, in the Eastern District of Virginia and elsewhere, the defendant, DANIEL EVERETTE HALE, did willfully communicate, furnish, transmit, and otherwise make available to an unauthorized person any classi?ed information concerning the communication intelligence activities of the United States, namely: Document Date Printed Date of Initial Publication Classi?cation A February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 TOP SECRET February 23, 2014 April 2015 TOP SECRET (In violation of Title 18, United States Code, Sections 15 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 16 of 17 Page D# 16 COUNT 5 (18 U.S.C. 641?Theft of Government Property) THE GRAND JURY FURTHER CHARGES THAT: 50. The General Allegations within Paragraph 1 through 41 of this Indictment are incorporated by reference. 51. Between on or about February 28, 2014, and continuing to in or about December 2016, in the Eastern District of Virginia, and elsewhere, the defendant, DANIEL EVERETTE HALE, did knewingly and unlawfully steal and convert another, and without authority, conveyed and disposed of records and things of value of the United States, namely: . Document Date Printed Date of Initial Publication Classi?cation A February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 SECRET February 28, 2014 October 2015 TOP SECRET February 28, 2014 October 2015, SECRET April 3, 2014 April 2015 TOP SECRET I April 20, 2014 August 2014 SECRET April 20, 2014 December 2015 SECRET April 20, 2014 April 2015 TOP SECRET April 30, 2014 July 2014 UNCLASSIFIED May 14, 2014 August 2014 SECRET May 14, 2014 August 2014 UNCLASSIFIED 0 May 15, 2014 December 2016 UNCLASSIFIED May 15, 2014 December 2016 UNCLASSIFIED May 15, 2014 December 2016 UNCLASSIFIED May 15, 2014 December 2016 UNCLASSIFIED June 27, 2014 UNCLASSIFIED The aggregate value of said records and things of value being more than $1,000. (All in violation of Title 18, United States Code, Section 641.) 16 Case 1:19-cr-00059-LO Document 1 Filed 03/07/19 Page 17 of 17 PagelD# 17 G. Zachary Terwilliger United States Attorney Eastern District of Virginia Gordon D. Kromberg Alexander P. Berrang Assistant United States Attorneys 17 A TRUE BILL: PERSON OFTHE GRAND JURY F0 John Demers . Assistant Attorney General National Security Division US. Department of Justice Heather M. Schmidt Senior Trial Attorney Counterintelligence-Export Control Section National Security Division US. Department of Justice