In late 2011 and early 2012, the FBI considered Espionage Act charges on an alleged “WikiLeaks breach” in which “classified information may have been downloaded” according to a newly released document under a Freedom of Information Act (FOIA) request. The FBI “discovered”  that this “may have” happened and approached the National Archives and Records Administration (NARA) with allegations that what WikiLeaks would internally refer to as “Project K” involved alleged violations of the Espionage Act and the Computer Fraud and Abuse Act.

While NARA’s Office of the Inspector General (OIG) concluded that the files had been declassified and downloaded from NARA’s public website and closed their investigation, the FBI claims the specifics of the investigation “could reasonably be expected to interfere with enforcement proceedings.”

This previously unknown element of the FBI’s investigations into WikiLeaks was uncovered by comparing two different FOIA releases of the same document, one filed in 2013 and one in 2019. References to WikiLeaks are redacted in the 2013 release (obtained by the Government Attic and posted in 2016) along with the description of the FBI’s briefing and a few names, though the rest of the document was unredacted. The 2019 release has more details of the investigation redacted, but leaves the case title unredacted – “WikiLeak Breach.” By comparing the two documents, a clearer picture of part of the FBI’s WikiLeaks investigation emerges.

According to NARA’s Report of Investigation, labeled “For Official Use Only / Law Enforcement Sensitive,” their investigation began on October 4, 2011 when the FBI met with the NARA Office of Investigations and were told that the FBI had “discovered that classified information may have been downloaded from NARA systems and then transmitted to other unauthorized individuals” while investigating something else.

FBI alleged that there may have been violations of 18 U.S.C. § 793, 794, 798 and 1030 – espionage and computer hacking. Assange is currently charged on unrelated matters under 18 U.S.C. 793 and 1030. The description of the FBI Briefing in the Investigation Summary section of the document is completely redacted in both versions, though the Forensic Analysis section reveals that the FBI was able to give NARA a CD containing copies of the files which they believed had been compromised by a ‘WikiLeaks Breach’ of NARA’s networks.

While the source of the information isn’t identified in the document, the timing strongly suggests Sigurdur Thordarson, a former WikiLeaks employee who became an FBI informant and provided them with several hard drives which belonged to Assange and WikiLeaks.

On June 6th, the Dutch broadcaster Nederlandse Omroep Stichtin (NOS) revealed that the FBI had been interviewing Thordarson once again, specifically about contacts that he and Assange had with hacker groups such as Anonymous and LulzSec.

In describing the FBI’s questions, the Dutch outlet linked to an exclusive 2018 report by the author that “sealed transcripts allege Assange and WikiLeaks solicited hacks against governments, politicians and corporations – and received files as a result.” A Washington Post article in September 2019 reported that former officials confirmed the government’s interest in and awareness of it.

On June 7th, WikiLeaks published a press release about the Dutch news report, stating that in addition to being an FBI informant, “Thordarson had served a three-year sentence for multiple counts of embezzlement and fraud, including against WikiLeaks and sex crimes against nine minors. Thordarsson stole tens of thousands of dollars from WikiLeaks, and impersonated Julian Assange in order to carry out the embezzlement.”

Since Thordarson’s departure from the group, WikiLeaks has attempted to distance themselves from him and to minimize his personal and professional relationship with Assange.

On June 8th, Thordarson wrote in a text message to the author that “The FBI knows everything, asked me about hacks against NATO, U.N., NARA, Stratfor, Icelandic Parliament, Icelandic State Police, U.S. Senate stuff I didn’t tell anyone and hopefully neither did Julian. They had copies of my own personal server. I never gave them knowledge about that server.” Thordarson didn’t explain what he meant about a NARA hack at the time.

Several months after Thordarson sent that message, former Anonymous and LulzSec member Jeremy Hammond was summoned before the WikiLeaks grand jury to testify, extending the sentence he was serving for his role in the Stratfor hack.

On June 22nd, identical FOIA requests were sent through MuckRock to over 100 agencies for records relating to WikiLeaks. On September 16th, they responded with the second release of NARA’s Report of Investigation, revealing its focus on WikiLeaks. Asked what the NARA hack was in a text message on September 17th, Thordarson wrote that it was the “Kissinger Cables,” the public name for what WikiLeaks had internally called Project K and it had been among the files he gave to the FBI.

NARA’s report confirms that the files were the State Department cables and that they “were declassified in June 2005 and made publically [sic] available in September 2010.” The report also confirms that the files were downloaded from NARA’s public website in January, February and December 2011 by “an IP address originating from Amsterdam.”

The report concluded that,

“The OI found no evidence classified information was obtained from NARA computer systems or that any NARA systems were compromising to gather the information. All information gathered from the AAD is publically [sic] accessible and available. The OI provided all investigative results to the FBI and that FBI [sic] has requested no further investigation.”

All details of the incident except the conclusion are redacted in the 2019 release of the report, citing FOIA exemption b(7)A and the potential that the information “could reasonably be expected to interfere with enforcement proceedings.” However, the claimed exemption doesn’t necessarily confirm the FBI’s ongoing interest in the matter. Courts have held that even if the files are “not directly related to an ongoing investigation,” they may be withheld if they “contain information that is intertwined with or related to other ongoing investigations.”

Thordarson, who has been accused of being a “pathological liar” by WikiLeaks’ current editor-in-chief, appeared to briefly contradict himself on the matter. When asked in September to confirm that the FBI asked him about the NARA files, Thordarson denied it.

After being shown a copy of his message in June, he wrote that the FBI wanted to know if the files had come from someone in Texas. He off-handedly explained his contradiction as a lapse brought on by the FBI asking “about so many things.” In another one of Thordarson’s messages, he wrote that “were were under the impression that NARA was a hack” without explaining whether “we” meant the FBI or WikiLeaks or what “NATO stuff” the same person allegedly worked on.

It’s unclear from the released document how concerned the FBI was about the alleged violations and whether they believed it was a hack or were merely ruling things out. Despite alleging violations including the disclosure of classified information, the PDFs in question are all marked with “Declassified/Released US Department of State EO Systematic Review” along with the date and the name of the person marking them declassified and released as well as a full page of identifying metadata. This is unacknowledged in the Report of Investigation, which simply states that the FBI “discovered that classified information may have been downloaded” and that the alleged violations were of the Espionage and Computer Fraud and Abuse Acts.

This is not the first time the U.S. Government has considered Espionage Act charges over the journalistic use of public records. National Security Agency (NSA) files from the late 1970s and early 1980s document the NSA’s interest in pursuing Espionage Act charges against James Bamford for his use of FOIA. The Department of Justice declined to pursue charges, disagreeing with the NSA over the viability of charges against Bamford. Additional FOIA requests have been filed with the Attorney General, FBI and NARA. Copies of the files can be viewed here.

Cover image: Photo of Wikileaks Truck at Occupy Wall Street by Jagz Mario.

Please consider a tax-deductible donation to help sustain our horizontally-organized, non-profit media organization: