Source: No 'coincidence' Romanian hacker Guccifer extradited amid Clinton probe

Jan. 22, 2014: Marcel Lazar Lehel, 40, is escorted by masked policemen in Bucharest, after being arrested in Arad, 337 miles west of Bucharest. Lehel is allegedly the hacker using the nicknames "Guccifer" and "The Small Fume" and is suspected to have broken into several e-mail accounts of various politicians and celebrities and the head of Romania's Intelligence Service George Maior. (REUTERS/Mediafax/Silviu Matei)

The extradition of Romanian hacker “Guccifer” to the U.S. at a critical point in the FBI’s criminal investigation of Hillary Clinton’s email use is “not a coincidence,” according to an intelligence source close to the case.

One of the notches on Guccifer’s cyber-crime belt was allegedly accessing the email account of Clinton confidant Sidney Blumenthal, one of Clinton’s most prolific advice-givers when she was secretary of state. It was through that hack that Clinton's use of a personal account -- clintonemail.com -- first came to light.

Former law enforcement and cyber security experts said the hacker, whose real name is Marcel Lehel Lazar, could – now that he’s in the U.S. – help the FBI make the case that Clinton’s email server was compromised by a third party, one that did not have the formal backing and resources of a foreign intelligence service such as that of Russia, China or Iran.

“Because of the proximity to Sidney Blumenthal and the activity involving Hillary’s emails, [the timing] seems to be something beyond curious,” said Ron Hosko, former assistant director of the FBI’s Criminal Investigative Division from 2012-2014.

On Tuesday, Lazar appeared in an Alexandria, Va., federal courtroom for his detention hearing, attended by Fox News. He faces a nine-count federal indictment on computer hacking charges and, according to both Romanian and U.S. officials, is expected to be in the country for 18 months.

A spokesman for the FBI’s Washington Field Office, which led the Guccifer investigation, had no comment on the extradition, the timing, and any potential intersection with the Clinton email probe.

On or about March 31, Lazar was extradited 3,700 miles to Alexandria from a prison in Arad, Romania, where he has been serving a seven-year sentence for hacking crimes committed in his native country. His targets in Romania were prominent government officials and political figures whom he often taunted under the name of Micul Fum or “Little Smoke.”

Following his 2014 conviction, Lazar was effectively neutralized in prison and no longer a threat, which makes his transfer to the U.S. all the more noteworthy.

The 44-year-old entered the Alexandria courtroom wearing a green jumpsuit, with the yellow word "PRISONER" stenciled on the back. Lazar appeared confident and relaxed during the four-minute appearance, telling the court he did not need the translator provided for the hearing.

According to the 15-page federal indictment, Lazar "specialized in gaining unauthorized access to the online accounts of high-profile individuals" including Clinton ally Blumenthal, who appears to be identified as “Victim 5 … a journalist and former presidential advisor who was the true owner of an AOL account with subaccounts known to the grand jury.”

The indictment went on to note that using his alias of Guccifer on Blumenthal’s account, “Lazar attempted to conceal his identity by accessing the account from a proxy server located in Russia.”

In early 2013, news outlets including Russia Today and The Smoking Gun published memos from Guccifer, with excerpts of exchanges between Blumenthal and Hillary Clinton about Libya including details following the 2012 Benghazi terrorist attack.

In a 2015 prison interview from Romania with reporter Matei Rosca for Pando.com, Lazar told Rosca that, "I used to read [Clinton's] memos for six or seven hours ... and then do the gardening."

From London, Rosca told Fox News he is still in touch with Guccifer’s family, including his wife Gabriela. They “lived poor in a dusty town outside Arad. He did not profit from hacking,” he said.

Rosca emphasized that, “Guccifer has no programming skills and guessed passwords of prominent public figures after reading their biographies.” These included books written by Hillary Clinton, Colin Powell and former president George W. Bush, who were also victimized by Guccifer’s hacking.

“[Lazar] is a simple and delusional man who has a conspiratorial streak and perhaps wasn’t aware of the damage he was causing. His wife and daughter are back in Romania worrying about him and they have not received a phone call yet since he has been in the U.S.”

Rosca said Lazar also claimed to have stashed “unpublished hacked material in the cloud, some of it relating to the Middle East. … He said he was expecting to collaborate with U.S. security services when the time is right. Presumably that would be now.”

Cybersecurity and terrorism expert Morgan Wright told Fox News, “My question is, why now – why just these cases, and why was it so important to bring him [to the U.S.]? I go back to what’s in common, and that’s the exposure.”

The Romanian government told Fox News that the request to extradite Lazar came from the FBI, but when Fox News asked when the process began, a government spokesperson said they were not authorized to comment further.

Romanian media have reported the request came on or about Dec. 29, 2015. That would have been shortly after the intelligence community’s identification of emails beyond “top secret” on Clinton’s personal server, which became public in mid-January.

Clinton’s deliberate choice to use a private, unsecure server based in her home and a private email address for her government business as secretary of state remains under federal investigation by the FBI while she campaigns for president. It has been widely reported in the last month that the FBI is setting up interviews with Clinton and her associates, what is believed to be a final phase in the process.

The FBI declined comment on the case, and the timing, as did representatives from the U.S. Attorney’s office for the Eastern District of Virginia and his court-appointed federal public defender, Shannon Quill.

Hosko, who is not part of the current email probe, read the Guccifer indictment and told Fox News that Guccifer’s technical skills and intent “show the relative ease of getting very close to someone in a high place in government. Not only Hillary Clinton, but Colin Powell and George W. Bush. … It’s important on a couple of levels. Here is an individual in a relatively poor Eastern European country who was able to intrude on sensitive emails about activities in Benghazi.”

While imprisoned in Romania, Guccifer reportedly met with the FBI, members of the Secret Service and members of Cyber Command to discuss how he accessed and read memos marked “official use only.”

Hosko noted that commitment of resources by the FBI to extradite Guccifer to the U.S. with the cooperation of Romania is significant.

A review of recent federal cases by Fox News found that Guccifer’s extradition appears to be an outlier. Hackers typically are extradited in the event of major financial theft, such as a 2013 case where three Romanian men stole in excess of $2 million in a cyber-fraud ring – and not in cases involving a breach of personal privacy.