A former software engineer with the U.S. Central Intelligence Agency (CIA) has been sentenced to 40 years in prison by the Southern District of New York (SDNY) for transmitting classified documents to WikiLeaks and for possessing child pornographic material.
Joshua Adam Schulte, 35, was originally charged in June 2018. He was found guilty in July 2022. On September 13, 2023, he was convicted on charges of receiving, possessing, and transporting child pornography. In addition to the prison term, Schulte has been sentenced to a lifetime of supervised release.
“Schulte’s theft is the largest data breach in the history of the CIA, and his transmission of that stolen information to WikiLeaks is one of the largest unauthorized disclosures of classified information in the history of the U.S.,” the U.S. Department of Justice (DoJ) said.
The sensitive information shared by Schulte included a tranche of hacking tools and exploits that were denominated as Vault 7 and Vault 8. It was published by WikiLeaks starting March 7, 2017, over a period of eight months.
The charges stem from Schulte’s actions when he was working as a software developer in the Center for Cyber Intelligence (CCI) from 2012 to 2016, where he developed tools pertaining to offensive cyber operations conducted by the CIA. According to evidence presented at the trial, he abused his administrator privileges to plunder “copies of the entire CCI tool development archives” in 2016.
This information included methods to “collect foreign intelligence against America’s adversaries,” including an arsenal of cyber weapons and zero-day exploits that made it possible to compromise cars, smart TVs, web browsers, and widely-used desktop and mobile operating systems.
The leak, described as a “digital Pearl Harbor,” cost the agency “hundreds of millions of dollars” and “severely harmed U.S. national security and directly risked the lives of CIA personnel,” prosecutors said.
Schulte was also accused of repeatedly lying to the U.S. Federal Bureau of Investigation (FBI) about his involvement as well as “spinning fake narratives” about how the information could have been obtained from CIA computers in an attempt to deflect suspicion.
A subsequent search of his New York apartment in March 2017 unearthed a stockpile of child sexual abuse material (CSAM) encompassing approximately 3,400 images and videos, some of which were collected during his employment with the CIA from the dark web and Russian websites.
During detention pending trial, he was found to have used contraband cell phones in jail to create anonymous, encrypted email, and social media accounts, and attempted to transmit protected discovery materials to WikiLeaks and publish classified information about CIA cyber techniques and tools.
Schulte’s goal, the DoJ said, quoting a journal maintained by him, was to “break up diplomatic relationships, close embassies, [and] end U.S. occupation across the world.”
“Joshua Schulte was rightly punished not only for his betrayal of our country, but for his substantial possession of horrific child pornographic material,” FBI Assistant Director in Charge James Smith said. “The severity of his actions is evident, and the sentence imposed reflects the magnitude of the disturbing and harmful threat posed by his criminal conduct.”
