The arrest of a U.S. National Security Agency contractor in 2016 over the theft of top-secret documents came about thanks to a tipoff from Russian security firm Kaspersky Lab, according to a new report.

Politico, citing two anonymous sources familiar with the investigation, said Kaspersky Lab employees passed information on Harold T. Martin III to the U.S. government after he sent the company unusual direct messages via Twitter in 2016.

Martin is claimed to have used an anonymous Twitter account with the name “HAL999999999” to send five direct messages to two researchers at Kaspersky.

The first message asked one of the researchers to arrange a conversation with “Yevgeny” — Kaspersky Lab founder and Chief Executive Officer Eugene Kaspersky — while a second direct message shortly after stated only, “Shelf life, three weeks.”

The latter tweet is said to indicate that Martin had a limited-time offer but of what isn’t clear.

The timing of the tweets is where the story becomes more interesting. Both tweets were sent a half-hour before the hacking group known as The Shadow Brokers starting dumping hacked NSA tools online and then offered to sell access to others.

Martin has not been charged with sharing the documents and software to third parties, but he was at one stage the prime suspect in leaks of NSA documents and spy tools that were obtained and published by The Shadow Brokers.

The revelation that Kaspersky was helping the NSA is not without irony. The company was banned first by the Trump Administration and then later by the Department of Homeland Security over alleged links to Russian intelligence services.

Kaspersky himself has long denied claims of Russian collusion, even going as far as attempting to have the ban overturned in court. The case was dismissed in May.

This isn’t the first time the NSA and Kaspersky have been entwined in a hacking story. In December 2017 it was revealed that an NSA employee who had illegally taken classified data home on his personal computer exposed secret hacking tools that were picked up in a Kaspersky virus scan.

As for Martin, he offered to plead guilty to one charge of stealing a classified document in an apparent attempt to have multiple other charges dropped Jan. 3. He is due back in court Jan. 22.

Photo: Wikimedia Commons