The Romanian hacker who claimed he easily breached Hillary Clinton’s personal email server is finalizing a plea deal with the FBI and U.S. attorney, Fox News has learned.
Marcel Lehel Lazar, the 44-year-old hacker also known as “Guccifer,” first gave indications he wanted to cooperate with the U.S. government in mid-April, during an interview with Fox News. Lazar, in a subsequent discussion, said he was working on a plea deal – he then suspended media contact earlier this month.
On Monday, a spokesman for the U.S. attorney in the Eastern District of Virginia confirmed that a change of plea hearing is now scheduled for Lazar on Wednesday morning. He originally had pleaded not guilty to the nine-count indictment when he was extradited to the U.S.
He is now expected to plead guilty to some charges.
It is not publicly known whether the deal being worked out has a provision for cooperating with federal authorities – and whether that has anything to do with the investigation into Clinton’s exclusive use of a private email server for government business while secretary of state.
But an intelligence source familiar with the FBI probe said if Guccifer pleads guilty to compromising Clinton aide Sidney Blumenthal’s AOL account – which is one of the nine charges – it will show that Clinton’s use of a personal server put sensitive information outside secure government channels and made it accessible to foreign hackers.
“[Clinton’s] gross negligence allowed this material to get out to an adversary,” the source said. “Through her communications with Blumenthal, [Clinton] contributed exposure and risk.”
Fox News was first to report about Lazar’s claims that he breached former secretary of state Clinton’s server. Lazar said he breached Blumenthal's AOL account by correctly guessing his security questions, and then using it as a stepping stone to the Clinton server.
While his claims could not be independently verified and he offered no hard evidence, he made similar statements during another interview in Romania with NBC News which aired after Fox’s reporting. Further, it was through Lazar’s hack of Blumenthal’s account that Clinton’s personal account was first revealed.
During an April 29 phone call with Fox News, Lazar said he wanted to work with the U.S. government.
"I was always showing that I want to cooperate … like two years [ago] when I met with the American authorities,” he said, adding that he showed he wanted to “cooperate and talk to the FBI agents” during the plane journey to the U.S. when he was extradited.
Though Lazar had agreed to meet again with Fox News the week of May 16, an official at the detention center in Alexandria, Va., where he’s being held, later informed Fox News Lazar was no longer taking visitors at this time.
A former Justice Department official, who declined to speak on the record due to the sensitivity of the FBI investigation, said it is not usual for defense attorneys to advise their clients to cut contact with the media as a plea agreement is finalized – as any discrepancies between the agreement and comments to the media can diminish the value of a client’s statement.
National security defense attorney Edward MacMahon Jr., agreed.
“If he was my client, I would strongly advise against talking to press,” he said. MacMahon recently represented former CIA officer Jeffrey Sterling, who was convicted of leaking classified information. “You want to be in control of the process as best you can, having different people interact with your client does not serve your purpose.”
Lazar, who was extradited to the U.S. before his Romanian jail term was complete, currently faces a September trial for separate hacking charges. The charges, made public in June 2014, include alleged hacking of accounts belonging to a member of George W. Bush’s family, former Secretary of State Colin Powell, and longtime Clinton confidant Blumenthal.
A review of recent federal cases by Fox News found that Guccifer’s extradition appears to be an outlier. Hackers typically are extradited once their prison terms are over in their native countries -- and typically for major financial theft.
The former Justice Department official said the U.S. government would not go to such extremes, “unless [Guccifer] has something they want.” Guccifer was effectively neutralized in a Romanian jail, when he was extradited to the U.S.
Lazar, speaking with Fox News, said he accessed the former secretary of state’s private server “like twice,” though he described the contents as “not interest[ing]” to him at the time.
Throughout the interviews, Lazar stressed that he used Russian proxy servers for his hacking because “they are the best” and claimed he could determine who else was inside by the looking at the IP addresses. Lazar said this included IP addresses from other countries.
"As far as I remember, yes, there were … up to 10, like, IPs from other parts of the world,” he said.
After Lazar was flown to the U.S. on March 31, U.S. government officials confirmed that federal agents from three agencies previously met with Lazar in Romania where he was serving a seven-year sentence for breaching the accounts of Romanian officials.
Two independent sources also confirmed in recent weeks that Lazar spoke at length to an FBI agent during his extradition flight from Romanian to Virginia.
Asked why he agreed to be extradited when he faces the possibility of more than five decades in an American prison, Lazar said, "It was not my call." Then Lazar claimed that his extradition agreement contains conditions that block further charges.
While the claim cannot be independently verified, the statement could help explain why Lazar felt comfortable discussing his supposed hacking of the Clinton server – which was not mentioned in the nine-count federal indictment.
During an interview Sunday on NBC’s “Meet the Press,” Clinton was not asked about the FBI investigation or claims the server was hacked, but her campaign said in early May: "There is absolutely no basis to believe the claims made by this criminal from his prison cell. … We have received no indication from any government agency to support these claims, nor are they reflected in the range of charges that Guccifer already faces and that prompted his extradition in the first place.”
A review of her emails found more than 2,100 containing classified information – though she claims nothing was considered classified at the time.