USA vs. Unkenholz

This story is about the strange case of Mark Unkenholz and 13 specific emails he sent between February 2018 and June 2020. For sending these 13 emails, Mark was charged with 26 felony counts in March 2022: thirteen counts for “Willful Transmission of National Defense Information” and thirteen counts of “Willful Retention of National Defense Information.”  All 26 counts were charged under the Espionage Act of 1917 (18 U.S.C. 793 parts d and e).  After a 4 years battle with the Justice Department, all 26 Espionage Act charges were dismissed and Mark plead guilty to one count of mishandling classified information under (18 U.S.C. 1924).  Mark was sentenced to one year of probation and given now fine.  The court and prosecution agreed to terminate the probation early.

On 30 March 2022 when Mark was arrested by the FBI he was a 39-year veteran of the National Security and had been a Defense Intelligence Senior Level expert for 22 years.  At the time he was serving as the Technical Director of NSA’s Commercial Engagement Center (CEC) which maintains strategic relationships with U.S. companies of interest to NSA’s cybersecurity and signals intelligence missions as well as acquiring non-standard and often unique products and services from these companies.  Mark had served in this exact role with the CEC and predecessor organizations for over 20 years.

The 13 emails mentioned in the Federal indictment were sent to one person while they worked at two different U.S. companies.  In order to preserve their privacy, we will refer to this person as RF (as they were in the indictment).   The first six emails in the indictment were sent to RF when they worked at a company that was working on an unclassified contract with the NSA commercial engagement center.  RF was the project lead for the company on their engagement and contract with the NSA Commercial Engagement Center.  Mark’s emails to RF were focused on future work that NSA might want to do with this company.  Many of the ideas never moved forward to become actual projects of tasks on the contract.  Those ideas that did move forward were put on contract as new tasks on the unclassified contract.  Importantly, all of the discussion in Mark’s emails were directly related to the scope of work being done on the contract with RF's company.  Moreover, Mark was not the only person from the CEC to be communicating with RF.  At least two other CEC employees sent emails to RF.  Their emails focused primarily on the tasks that were currently on contract.

The remaining 7 emails in the were sent to RF when they moved to a new company in the summer of 2019.  At the time, NSA’s Commercial Engagement Center did not have a relationship with this new company.  Through the 7 emails, Mark presented some ideas about how NSA might work with RF’s new company in ways that would benefit NSA’s Cybersecurity or Signals Intelligence missions.  Some of the ideas were carry-over ideas from the work RF had been doing at their previous employer.  Other ideas were about some of the unique services that RF’s new employer might provide NSA in areas of high mission interest.  Though the series of emails Mark hoped to gain an understanding of what RF’s new company had to offer NSA and what they might be willing to do for NSA.

At this point in the story, it is important to note that the NSA Commercial Engagement Center acquires things of mission value to NSA both through contracts like the one in place with RF’s first employer and through voluntary cooperation in areas of interest to NSA’s missions.  Generally, a CEC partnership involves a mix of both voluntary cooperation and contracted services. The information Mark gathered via sending emails and getting replies from RF formed part of the basis for seeking approval from the leadership of the CEC to first establish a formal relationship with this new company and then, possibly, enter into a contract for some of their services.  Within the CEC there is a process for accepting new companies which is overseen by the CEC management and NSA OGC, Security and Civil Liberties and Privacy.  Some of the information Mark gathered went into the documentation reviewed by CEC leadership in deciding whether to establish a relationship.  Other information would go into the approval process for a contract with the company if the relationship was first approved.  As was true when RF worked at the first company, Mark was not the only CEC person corresponding and talking with RF about potential work between NSA and this new company.  Internal NSA emails show that Mark was informing both CEC leadership and other CEC personnel about the information he was gathering.

Mark began his career in NSA's cryptographic analysis and research organizations, and in 1996 he became Deputy Chief of Cybersecurity Research at NSA. He then headed a division at the agency assisting industry with U.S. cryptographic export controls. Years later, he took the position of Technical Director of an agency organization created to provide strategic engagement with industry to enhance NSA’s cybersecurity and signals intelligence mission. He’d been in this position, guiding the technical side the offices mission for 15 years at the time of his arrest.

At this time he’d been a Defense Intelligence Senior Level (DISL) expert for 20 years and served as NSA’s "Equities Champion" as well as a member of NSA’s "Technology Transfer Advisory Panel", charged with reviewing the sensitivities and classification of technology the agency was considering for release. In both these roles Mark served as a agency resource for classification of technologies that had both unclassified cybersecurity and classified signals intelligence implications

On the last day of March in 2022, Mark was arrested and charged with 13 counts of ‘Willful Transmission of National Defense Information’ and 13 counts of ‘Willful Retention of National Defense Information’. These emails were sent in the execution of his job and were done according to standard working practices of his office. To those who knew Mark’s office and the work he did, the indictment itself read like a portion of his job description. He was arrested, essentially, for doing his job.

Mark’s office was the Commercial Engagement Center at NSA. Its mission is to “obtain non-standard and often unique products and services from U.S. industry in support of NSA’s cybersecurity and signals intelligence mission areas”. The procedures and policies under which the Commercial Engagement Center (CEC) operates are complicated and classified. The CEC develops partnerships with U.S. companies and the products and services that companies provide are sometimes acquired under a contract or sometimes free of charge. The CEC includes at least two lawyers from NSA Office of General Counsel (OGC) and several contracting officers from NSA’s Business Management and Acquisition Directorate to ensure that all of these partnerships are done properly. It is not a large office, and it’s mission, while not classified or covert is also not widely advertised. Many inside of NSA do not even know of its existence.

It is important to note that Mark did not work alone, nor was he the only one in the office communicating with these companies, orRF. Others in the Mark’s office also had email communications with both the companies and RF . A partnership manager and cryptographic expert from his office were assigned to oversee the relationship, and corresponded with RF using the exact same tools and process that Mark used. Several people held these positions and were in communication with RF during the same time period. Other technical experts from the CEC were in communication with the companies during contract exploration. Senior leadership at the CEC office were aware of the contracts and work that was being done with the companies and RF – all of this is documented with internal CEC documents.

Over the course of time, RF worked at two separate companies. The first company had unclassified contracts with NSA in place and six of the emails in question related to these contracts. When Stanley moved to a new company, it seemed like a good fit for continued work. The remaining emails were sent to explore what work would be done at this new company, according to the CEC’s standard process for forming new partnerships. It seemed obvious to anyone looking at the indictment who had any previous knowledge of Mark or of the work his office did, that the indictment was truly for doing his official duties. For example, Stuart Baker, a lawyer who previously worked as NSA General Counsel, commented about this in one of his podcasts shortly after Mark’s arrest. Others in the technical community who know about the CEC’s work but who’ve never met Mark also commented about this.

Communication from CEC to outside companies is performed by the employees of the CEC. Their emails are not individually reviewed before hand for classification as the employees are careful, as was Mark, to insure that none of the information being sent is classified. The problem that faces Mark and his colleagues in the CEC is that while they may be sure that their communication is unclassified, the government can claim that just about anything that is transmitted by one of it’s employees with a clearance is classified.  Inside the intelligence community there is a formal process for adjudicating classification disputes.  Once Mark was arrested that process was no longer available to him

Mark served his country for nearly forty years. To the best of his knowledge, all of his emails were consistent with the ongoing mission of the NSA dating from February 2018 to March 2019 Commercial Engagement Center to acquire non-standard and often unique products and services from U.S. industry in support of NSA’s cybersecurity and signals intelligence missions. The question that does need answering in this story is how all came to be? How did these innocuous work-related emails become the subject of a federal investigation much less a criminal indictment? If this could happen to someone with Mark’s background and experience, what does that mean for others in the CEC who do the same work? If the methods of communication that the FBI has an issue with, then what does that mean for the most senior leadership at NSA who use the exact same methods when communicating with those outside the NSA?

This web page provides some of the documentation that can shed partial light on these questions.  However, most of the rationale for the government's actions remains shrouded in secrecy.  It is important to note that at the same time that the Justice Department was deciding whether or not to indict Mark over his work related emails,  the Justice Department was also in the process of considering indicting two other high ranking former government official on similar charges:  Donald J. Trump and John R. Bolton.  One might imagine that Mark was indicted so as not to make the potential prosecution of those two high profile individuals appear to be "selective prosecution" with a political motivation.  Both Trump and Bolton were Republicans and the Justice Deparment was run by Democrat political appointees.