U.S. A former software engineer for the Central Intelligence Agency (CIA) has been sentenced to 40 years in prison by the Southern District of New York (SDNY) for disseminating classified documents to WikiLeaks and possessing child pornography.
Joshua Adam Schulte, 35, was originally charged in June 2018. He was found guilty in July 2022. On September 13, 2023, he was convicted of receiving, possessing and transporting child pornography. In addition to the prison sentence, Schulte was sentenced to a lifetime of supervised release.
“Schulte’s theft is the largest data breach in the history of the CIA, and his transmission of that stolen information to WikiLeaks is one of the largest unauthorized disclosures of classified information in the history of the US,” the US Department of Justice (DoJ) said.
The sensitive information shared by Schulte included a series of hacking tools and exploits, which were designated as Vault 7 and Vault 8. It was published by WikiLeaks over a period of eight months from March 7, 2017.
Schulte was employed as a software developer in the Center for Cyber Intelligence (CCI) from 2012 to 2016, where he worked on tools pertaining to offensive cyber operations conducted by the CIA, subsequently abusing his administrator privileges to plunder “copies of the entire CCI tool development archives” in 2016.
This information included methods to “collect foreign intelligence against America’s adversaries,” including an arsenal of cyber weapons and zero-day exploits that made it possible to compromise cars, smart TVs, web browsers, and widely-used desktop and mobile operating systems.
Prosecutors said the leak, described as a “digital Pearl Harbor,” cost the agency “hundreds of millions of dollars” and “seriously harmed U.S. national security and directly endangered the lives of CIA personnel.”
Schulte was also accused of repeatedly lying to the U.S. Federal Bureau of Investigation (FBI) about his involvement as well as “spinning fake narratives” about how the information could have been obtained from CIA computers in an attempt to deflect suspicion.
A subsequent search of his New York apartment in March 2017 unearthed a stockpile of child sexual abuse material (CSAM) encompassing approximately 3,400 images and videos, some of which were collected during his employment with the CIA from the dark web and Russian websites.
During detention pending trial, he was found to have used contraband cell phones in jail to create anonymous, encrypted email, and social media accounts, and attempted to transmit protected discovery materials to WikiLeaks and publish classified information about CIA cyber techniques and tools.
Schulte’s goal, the DoJ said, quoting a journal maintained by him, was to “break up diplomatic relationships, close embassies, [and] end U.S. occupation across the world.”
James Smith, assistant director in charge of the FBI, said, “Joshua Schulte was appropriately punished not only for his betrayal of our country, but also for his substantial possession of horrific child pornography.” “The seriousness of his actions is clear, and the sentence imposed reflects the magnitude of the disturbing and harmful threat posed by his criminal conduct.”
