Joshua Schulte.
Credit: X/@FonsiLoaiza
New York: Information stolen from the CIA began showing up in 2017 on a website called WikiLeaks.
Over eight months, the site published more than two dozen groups of classified documents that it called Vault 7, outlining the secret methods that the United States used to break into computer networks used by foreign governments and terrorists. The disclosures caused what the government termed “catastrophic” damage to national security and set off an intensive hunt for the person responsible.
On Thursday, that person, Joshua Schulte, 35, was sentenced in US District Court in Manhattan to 40 years in prison. Schulte, a computer engineer, had worked for the spy agency for six years, holding the highest security clearances and designing hacking tools.
He was convicted in 2022 of charges including illegally gathering and transmitting national defense information. That followed convictions in 2020 for contempt of court and making false statements. He was also convicted of receiving and transporting child pornography.
Judge Jesse Furman said Schulte’s actions amounted to a “digital Pearl Harbor” that caused “untold damage to national security.”
“I’m blown away, to put it mildly, by Mr Schulte’s lack of remorse,” the judge added.
Addressing the court for 30 minutes just before Furman handed down his sentence, Schulte did not apologize but asked that he be sentenced to time served.
He complained at length that he had been held in deplorable conditions for several years while awaiting trial, deprived of heat and hot water and subject to constant noise and artificial light. And he accused prosecutors, who had asked for a sentence of life in prison, of “nothing short of old-fashioned Mafia-style bullying.”
Schulte’s lawyers had asked for leniency, noting that their client, who they wrote “maintains his innocence,” most likely had “an undiagnosed neurodivergence.”
“Mr Schulte’s convictions were aberrant behavior in an otherwise law-abiding life,” they wrote.
Federal prosecutors had called his crimes “virtually unprecedented in their scope and harm” to the national security of the United States and said he was spurred by personal animus.
“Schulte did not act out of any misguided altruism, in some false belief that he would be a whistleblower,” they added. “He acted out of pure spite and ego, and he chose to take his perceived grievance out on the country that he swore to defend.”
The Vault 7 saga and resulting investigation afforded a glimpse into the inner workings of one of the world’s most potent intelligence agencies, revealing the raucous atmosphere and personal resentments of programmers and the failures and security flaws that a rogue employee exploited.
Schulte and other elite programmers worked in a secret building protected by armed guards. Among other things, they designed programs that targeted the computers of suspected terrorists. While engaged in that weighty work, they also indulged in decidedly juvenile behavior, according to testimony in Schulte’s first espionage trial: sending prank emails, taunting colleagues about their physical appearances and shooting each other with Nerf guns and rubber bands.
Prosecutors said that Schulte feuded with co-workers and became angry when he was moved from one branch to another, and his status as a project administrator was revoked. As his grievances accumulated, prosecutors said, Schulte used a back door in the CIA computer network to gain access to sensitive projects that matched the information WikiLeaks published nearly a year later. Prosecutors said that he later tried to erase his digital fingerprints and gave the files to WikiLeaks.
An internal CIA report in 2020 said the agency bore some blame for failing to prevent Schulte’s actions, adding that it had not installed safeguards and that its officials had ignored the lessons of other agencies where employees stole secrets.
Schulte became the primary suspect within days of the WikiLeaks disclosure. When the FBI searched his New York City apartment, prosecutors said, agents found encrypted containers containing tens of thousands of “child sexual abuse materials,” including about 3,400 images and videos that met the definition of child pornography.
He was arrested in 2017 on child pornography charges while working as a senior software engineer for Bloomberg LP. Schulte was released on the condition he remain at home but was jailed after a few months when he violated a federal judge’s order not to use the internet without the court’s permission.
Prosecutors said that while Schulte was in jail he used a smuggled cellphone to create a Twitter account under the name Jason Bourne — a fictional character who worked as a CIA operative — then used social media to accuse the government of planting child pornography on his computer.
“Joshua Schulte betrayed his country by committing some of the most brazen, heinous crimes of espionage in American history,” Damian Williams, the US attorney for the Southern District of New York, said in a news release, adding: “He will spend 40 years behind bars — right where he belongs.”