Congressional IT staffers who are the subject of a criminal investigation into misusing their positions had full access to members’ “correspondence, emails, confidential files,” and there was almost no tracking of what they did, a former House technology worker said.
Imran Awan bullied central IT to bend the rules for him so there wouldn’t be a paper trail about the unusually high permissions he was requesting. And their actions were not logged, so members have no way of knowing what information they may have taken, the central IT employee said.
Awan ran technology for multiple House Democrats, and soon four of his relatives—including brothers Abid and Jamal—appeared on the payroll of dozens of other members, collecting $4 million in taxpayer funds since 2010.
U.S. Capitol Police named him and his relatives as subjects of a criminal probe on Feb. 2, and banned them from the complex’s computer networks. But members of Congress for whom they worked have downplayed their access or publicly ignored the issue.
“They had access to everything. Correspondence, emails, confidential files—if it was stored on the member system, they had access to it,” the former House Information Resources technology worker with firsthand knowledge of Imran’s privileges told The Daily Caller News Foundation.
Technology employees who work for members must initially get authority from House Information Resources, a component of the House’s chief administrative officer, which maintains campus-wide technology systems.
“There were some things—like access to the House email system that were totally controlled by the technicians at [House Information Resources]. In order for certain permissions to be granted, a form was required to ensure that there was a paper trail for the requested changes. Imran was constantly complaining that he had to go through this process and trying to get people to process his access requests without the proper forms. Some of the permissions he wanted would give him total access to the members’ stuff.”
“IT staff at [House Information Resources] can be tracked for every keystroke they make,” the worker said. But by comparison, “when these guys were granted access to the member’s computer systems there is no oversight or tracking of what they may be doing on the member’s system. For example they could make a copy of anything on the member’s computer system to a thumb drive or have it sent to a private server they had set up and no one would know.”
That raises questions about why members are so quick to brush off the seriousness of the investigation.
“After being notified by the House Administration Committee, [Abid] was removed from our payroll. We are confident that everything in our office is secure,” Hilarie Chambers, chief of staff for Democratic Rep. Sander Levin of Michigan, told The Daily Caller News Foundation.
Multiple House IT workers said it is impossible for members’ offices to make that judgment, and that Capitol Police—who are running an investigation that involves cybercrimes and current and potential international fugitives, despite their primary duties being providing physical security—aren’t capable of determining what actually occurred either.
The Capitol Police webpage listing its authority, scope of work, and expertise does not mention the word “computers.”
A Fairfax County, Virginia, police report shows that the brothers’ stepmother called the police on them in January, and a relative said Imran has been out of the country attempting to access assets stored in Pakistan in his deceased father’s name. The relative said they forced her to sign power of attorney documents against her will.
After naming them as suspects in a criminal investigation, the Capitol Police have not taken their passports or arrested them. The brothers previously took a $100,000 loan from a fugitive wanted by U.S. authorities, Dr. Ali Al-Attar, who has fled to Iraq and been linked to Hezbollah.
Imran ran technology for Florida Rep. Debbie Wasserman Schultz—who resigned as head of the Democratic National Committee after a disastrous email hack she blamed on Russians—and had the password to an iPad used for DNC business.
Politico described the investigation this way: “Five House staffers are accused of stealing equipment from members’ offices without their knowledge and committing serious, potentially illegal, violations on the House IT network.”
But it later said Hill staffers were downplaying the information security component, writing, “Sources close to the House investigation said the former staffers, while able to view some member data, did not have access to any classified information.”
That description rankled multiple House IT workers, who told The Daily Caller News Foundation those semantics misleadingly made it seem like they didn’t have access to extremely sensitive information.
“Classified” is a term used by spy agencies and other executive branch agencies, not generally Congress, with the exception of the intelligence committee. The full email correspondence and hard drives of members of Congress are nonetheless sensitive, extremely private, and likely to contain privileged information of the utmost import.
And an email need not deal with national security to open that member to blackmail or extortion. All a rogue IT staffer would need to do is threaten to release emails that are politically embarrassing.
The central IT staffer said any suggestion that the brothers’ access didn’t span the full gamut of congressional intrigue was silly because they were the ones giving out permissions.
“When a new member begins, they guide them on everything from which computer system to purchase to which constituent management system to go with and all other related hardware purchases. Then they install everything and set up all the accounts and grant all the required permissions and restrictions,” the staffer said.
“In effect, they are given administrative control of the members’ computer operations. They then set up a remote access so they can connect from wherever they are and have full access to everything on the member’s system.”
Numerous members of Congress who employed the suspects wouldn’t say whether they’ve been fired or what steps they’ve taken to examine whether their information is safe.
Spokesmen for Reps. Diana Degette, Frederica Wilson, Jackie Speier, Julia Brownley, Karen Bass, Pete Aguilar, and Ted Lieu all ignored requests or refused to say.
The central IT worker said they are ignoring the problem in the hopes that it will go away, but that their apathy speaks to the problem.
“Unfortunately, as the recent election has shown, security of computer systems on the Hill is not really taken seriously.”
Content created by The Daily Caller News Foundation is available without charge to any eligible news publisher that can provide a large audience. For licensing opportunities of our original content, please contact licensing@dailycallernewsfoundation.org.