Former CIA hacker sentenced to 40 years in prison over largest data leak in agency's history

Hind Al Soulia - Riyadh - NEW YORK — A former CIA employee was sentenced to 40 years in prison after carrying out the largest data leak in the agency’s history, the US Attorney’s Office of the Southern District of New York announced Thursday.

Joshua Schulte – who was accused of handing over reams of classified data to WikiLeaks in 2016 – was convicted in 2022 of illegally gathering and transmitting national defense information and obstructing a criminal investigation and grand jury proceeding, among other charges. He was also found guilty in 2023 of receiving, possessing and transporting child pornography, according to the US Attorney’s Office.

He had worked as a computer engineer within the CIA’s Center for Cyber Intelligence, and created cyber tools that could grab data undetected from computers. Schulte defended himself at trial. An earlier trial ended in a hung jury in 2020.

“Joshua Schulte betrayed his country by committing some of the most brazen, heinous crimes of espionage in American history,” US Attorney Damian Williams said in a statement. “He caused untold damage to our national security in his quest for revenge against the CIA for its response to Schulte’s security breaches while employed there.”

“When the FBI caught him, Schulte doubled down and tried to cause even more harm to this nation by waging what he described as an ‘information war’ of publishing top secret information from behind bars,” Williams added. “And all the while, Schulte collected thousands upon thousands of videos and images of children being subjected to sickening abuse for his own personal gratification.”

“Today, Joshua Schulte was rightly punished not only for his betrayal of our country, but for his substantial possession of horrific child pornographic material,” FBI assistant director in charge James Smith said in a statement. “The severity of his actions is evident, and the sentence imposed reflects the magnitude of the disturbing and harmful threat posed by his criminal conduct.”

Schulte’s issues at the CIA began in the summer of 2015 when he began to feud with management and a co-worker, ultimately filing a restraining order against the co-worker in state court, court records show. Schulte and the co-worker were both transferred as a result of the feud.

Investigators alleged that Schulte became enraged when CIA officials wanted to hire a contractor to build a cyber tool similar to one he was building, prosecutors said.

A year later, investigators said Schulte stole cyber tools and source code and transferred them to WikiLeaks, according to court records. He then tried to cover his tracks, erasing any and all traces of him accessing the computer system, prosecutors said.

Schulte quit the CIA in November 2016. But in March 2017, WikiLeaks published the first installment of its Vault 7 leaks, which originated from two programs that Schulte had access to, court records show.

WikiLeaks put out a news release to go with the information, saying that the data had been provided anonymously by a source who wanted to raise policy questions, specifically about whether the CIA had overstepped its hacking capabilities and exceeded its authority.

Schulte, who also allegedly lied to CIA and FBI investigators to cover his tracks, was arrested in August 2017 on child pornography charges. He was indicted on the charges related to the data breach months later. — CNN