Yesterday the U.S. Department of Justice (DoJ) charged Mariam Taha Thompson, 61, formerly of Rochester, MN with transmitting highly sensitive and classified national defense information to a foreign national with connections to Hezbollah, a designated foreign terrorist organization. She had been arrested abroad, on February 27 at the U.S. military facility (Erbil) where she conducted her work and held a Top Secret clearance.
Thompson’s treachery is straight forward.
She was assigned to the Special Operations Task Force, located in Erbil, Iraq and while there shared with her Lebanese national paramour classified information including the identifies of U.S. intelligence human sources. She was fully aware her paramour had ties to the Lebanese government, and based on her collaborative nature knew that the information could be passed onward to Hezbollah, an organization with deep ties to Iran and Iran’s Islamic Revolutionary Guard Corps (IRGC) or other terrorist organizations with Iranian ties.
Insider threat realized
Thompson was a forward deployed contract Arab language linguist. She had access to classified information in the course of her duties. She used this position of trust to access information to provide her Lebanese “friend” with whom she had a romantic interest with classified information to which he had no need to know.
The sequence of events as detailed in court documents guides us along, demonstrating what appears to be a collaborative relationship.
On December 29, U.S. airstrikes occurred against Iranian-backed forces in Iraq. The next day Iranian-backed militia fomented protests at the U.S. Embassy Baghdad, attacking the mission. On the same day of the protests, forensic examination of Thompson’s activities within the classified system to which she had access showed her making queries concerning information to which she had no “need to know.”
Then on January 3, the Iranian major general Qasem Soleimani was killed via a U.S. drone strike in Baghdad. No speculation is necessary to conclude the IRGC went into a hyper counterintelligence mode trying to determine who may have provided the information which allowed the targeting of Soleimani to have occurred with such precision.
On January 7, the base in Erbil is on the receiving end of an Iranian missile attack.
The investigation reveals to us her inquiry of December 30 was not a one-off fluke, but rather from December 30 2019 through February 10 Thompson made multiple inquiries, accessing 57 files concerning eight human intelligence sources. She acquired their true names, their personal identifying information, and photographs of the human sources. She also acquired operational cables detailing the information which these assets had provided to the United States.
In a nutshell, she had in her possession everything necessary for the Hezbollah, and by extension Iran, to fully identify and neutralize the U.S. clandestine sources. It is not beyond the pale that she was a key tool in the Iranian IRGC counterintelligence investigation following Soleimani’s death.
Collaborative asset
While searching her quarters in Erbil, an Arab language note was found under her mattress which contained information on three human sources, including their true names. Cementing the hypothesis as to the level of her collaboration was the instruction written on the note on how their phones should be monitored, and that a named terrorist entity should be warned (Note: The court documents note that the named organization is not Hezbollah, and given the sequence of events, one may conclude that it may have been Iran’s IRGC or another Iranian backed organization.).
During the interview with Thompson, she admitted sharing information with her Lebanese suitor. Her methodology was not highly sophisticated, but effective.
She would memorize details from the classified cables and files and then write them down. She would then share them via the video feature of a commercially available secure direct messaging application on her cell phone.
Investigators confirmed via pen register and trap trace court ordered inquiries that Thompson and her Lebanese co-conspirator were in regular contact, including via the direct messaging application.
In every counterintelligence investigation there is always a slim hope that the information which the insider has accessed and captured may not have yet been shared with the adversary. This was not to be, as FBI investigators learned when they accessed the Lebanese’s internet accounts and found information on the human assets which originated from Thompson’s foray within the classified systems.
At this time, the fate of the seven assets identified to the Hezbollah by their indirect spy within the U.S. Special Operations Task Force is not known. Nor do we know if she provided the targeting information on the U.S. base at which she worked in Erbil which enabled the the targeting of the U.S. offices within the facility during the January 7 missile attack.
