When it comes cybersecurity scandals, as tough as Congress is on private companies like Equifax and Facebook, you might be surprised to learn that they've been quietly dealing with a scandal of their own. Some claim it's the most important investigation you've never heard of in Washington D.C. It involves the FBI, an Inspector General, 42 members of Congress, and five Pakistani American IT workers.
Rep. Ron DeSantis: It's been really frustrating because this really has the makings of one of the all-time congressional scandals.
We spoke to three Republicans who are demanding answers about the alleged cyber threat: Five Pakistani American workers with unfettered access to everything from constituent email to private documents and work calendars for dozens of Democrats in Congress. Congressmen Ron DeSantis and Louie Gohmert were lawyers in the military. Scott Perry is an Army National Guard Brigadier General. They see both legal and national security implications.
Rep. Ron DeSantis: You have these Pakistanis doing this IT work. They were taking a lot of data off the network that was not authorized. They're making trips back and forth to Pakistan. So, this whole thing from top to bottom just absolutely stinks and it seems like, from the leadership perspective, there has not been a lot of zealousness to really put all this information out there and hold anyone accountable.
The allegations originated with House of Representatives Inspector General Terry Grafenstine, the first female IG, appointed under Democrat Nancy Pelosi. A globally-recognized cybersecurity expert, Grafenstine is seen here in a career advice video.
Terry Grafenstine video: My position with the House as the Inspector General is a very behind the scenes type of one.
In July 2016, during an equipment theft probe, Grafenstine discovered something she felt was more serious: "numerous violations of House security policies" allegedly committed by five system administrators: Imran Awan, the eldest of three brothers in the group, Imran's wife; and a friend. Together, they handled IT for at least 42 Democrats in Congress as well as the group representing all House Democrats: the Democratic Caucus. Under strict House rules, IT workers are only allowed to access computers of those who employ them.
But the Inspector General reported: The Awans routinely logged on with names and passwords of members of Congress they didn't work for. Ones who didn't work for the Democratic Caucus logged into the Democratic Caucus server more than five thousand times, often remotely. The "excessive logins" were considered "…an indication that the server is being used for nefarious purposes" and "individuals could be reading…or removing information." One investigative source says that access put members of Congress at high risk of blackmail.
Rep. Ron DeSantis: It could be anything from a constituents' data, uh, to members of Congresses' data. Could be information that would be helpful to people that that want to do America harm. We don't have the accounting on that.
Rep. Scott Perry: They could have privileged information about members that could be used against members. Many of the members- the Democrat members- were members of the foreign affairs committee and the intelligence committee and what might be on-what might be in their computers? Not just email, might be documents.
Despite the concerns, according to multiple sources and investigative notes, the Inspector General claimed Democrat and Republican staffers slow walked the investigation, wouldn't let her team question the IT workers or access their emails, and pulled her off as the lead on the case less than two weeks before the presidential election. The case was handed over to the Capitol Police and, eventually, the FBI.
Rep. Louie Gohmert: So it almost looked like they took it away from her because of course the Democrats didn't want how bad this problem was coming to light and apparently Republican leaders didn't want this coming out because if there's a really big scandal on your watch; This I what I think, Big scandal on your watch doesn't matter what party you're a part of. It looks bad so let's just tamp this all down.
Meantime, the Awan group retained access to Congressional computers.
Rep. Ron DeSantis: On the oversight committee, I and some others, wanted to really delve into this, particularly get all the national security implications and do oversight over that. We were not permitted to do that by the leadership.
Sharyl Attkisson: By your leadership?
Rep. Ron DeSantis: That's correct.
The whole scandal was largely kept quiet even from members of Congress until days after President Trump's inauguration in January 2017.
President Trump: Every four years we gather on these steps.
That's when authorities in the House finally banned the Awan group from Congressional computers. Chris Gowen is Imran Awan's attorney and a law professor at American University. He says Imran and his wife became U.S. citizens through the immigration lottery; achieving success through hard work.
Chris Gowen: What you keep seeing in all of these stories is sort of hypotheticals where they say, well, why, you know, it can't be that, he's from Pakistan and had logins. You know, that must mean he's working for al Qaeda or something, you know, like this is nonsensical.
The real problem, Gowen says, is Congress' inefficient and decentralized IT system.
Chris Gowen: So there's never been an accusation that he, that he or anybody in his group did anything to put the nation at risk or, or to break a rule in Congress or anything like that.
Sharyl Attkisson: Is it accurate to say you think that some of this stuff that was flagged as suspicious is actually just how things work on the House, is that what you think?
Chris Gowen: Yeah, absolutely.
Sharyl Attkisson: One of them was that some of this group had logged into the Democratic caucus computer, for example, thousands of times when they weren't employed by the caucus, which is against the rules.
Chris Gowen: That's all been checked out, like excruciatingly, they, there's been so many investigations into every single login. The FBI has taken, you know, an unbelievable amount of time investigating every single log in accusation. And that there's, it's been uncovered that he has not done any, my client didn't do, like didn't do anything illegal regarding logging in.
It turns out there are other allegations swirling around the Awans. Last July, the FBI arrested Imran at Dulles airport trying to leave the country and charged him and his wife with bank fraud. They've plead not guilty. Imran's wife has also accused him of threatening her and of polygamy, which he denies.
Sharyl Attkisson: Was he married to two people?
Chris Gowen: No.
Sharyl Attkisson: Did he threaten his wife?
Chris Gowen: No, absolutely not.
Then there's the matter of Imran Awan's biggest-name client: Congresswoman Debbie Wasserman Schultz.
Debbie Wasserman Schultz: Alright everybody now settle down.
The same time the cyber-investigation was gearing up, Wasserman Schultz had just been forced out as head of the Democratic National Committee. The group's emails had been stolen and published on WikiLeaks. When authorities banned Imran from the Congressional computers, Wasserman Schultz reportedly accused investigators of being anti-Muslim and kept him on the payroll even after he left one of her computers in a booth on Capitol Hill, where it was confiscated by police.
Which prompted an odd exchange at this hearing last May. Wasserman Schultz challenged the Capitol Police Chief over and over to return her computer as he explained it was part of a criminal probe.
Rep. Debbie Wasserman Schultz: So, if a member says they have equipment that's been lost and you find it, it would be returned to the member.
Police Chief Matthew Verderosa: In a general sense yes.
Rep. Debbie Wasserman Schultz: And the Capitol police is supposed to return it. Correct?
Police Chief Matthew Verderosa: Depends on the circumstances. Uh and if the circumstances are-
Rep. Debbie Wasserman Schultz: I don't understand how that's possible. Members' equipment is members' equipment. It is their equipment and it's supposed to be returned.
Police Chief Matthew Verderosa: Well I think there's extenuating circumstances in this case.
Rep. Debbie Wasserman Schultz: I think you're violating the rules when you when you conduct your business that way and should expect that there would be consequences. I yield back.
Two years into this strange case, the FBI continues work. Nobody has been charged with any cyber-crimes, and the Inspector General is said to have resigned in disgust over the handling of the case.
Sharyl Attkisson: From what I can tell members of Congress have not notified constituents that things they sent to their members of Congress may have been compromised.
Rep. Louie Gohmert: I hadn't even thought about that.
Rep. Scott Perry: We don't really know the extent of the data brea- we don't know any of that stuff. And that's important stuff for not only us to know but for citizens to know that they've been corresponding with their member of Congress and that information might be out there for anybody to use.
Chris Gowen: I would put Imran Awan's character, morals up against almost anybody I know. What's happened is we've ruined a person's life, he's lost his job, he's lost everything he ever had because of political accusations by fake reporters.
A lawyer for Abid Omar Awan told us the brothers have become “scapegoats” in a case of “shocking lack of IT and hardware security on Capitol Hill." The list of those we contacted who didn’t want to speak with us is long and includes House Democrat and Republican leaders, former Inspector General Grafenstine and Congresswoman Wasserman Schultz, who finally did terminate Imran’s employment after his arrest.