A former CIA employee was sentenced to 40 years in prison after carrying out the largest data breach in the agency’s history, the U.S. Attorney’s Office for the Southern District of New York announced Thursday.
Joshua Schulte – who was accused of turning over a large amount of classified data to WikiLeaks in 2016 – was convicted in 2022 of illegally collecting and transmitting national defense information and obstructing a criminal investigation and grand jury proceeding, among other charges. He was also convicted in 2023 of receiving, possessing and transporting child pornography, according to the U.S. Attorney’s Office.
He had worked as a computer engineer at the CIA’s Cyber Intelligence Center and had created cyber tools that could capture data from computers without detection. Schulte defended himself at trial. A previous trial ended with a hung jury in 2020.
“Joshua Schulte betrayed his country by committing some of the most brazen and heinous espionage crimes in American history,” U.S. Attorney Damian Williams said in a statement. “He caused untold damage to our national security in his pursuit of revenge against the CIA for its response to Schulte’s security breaches while he worked there.”
“When the FBI caught up with him, Schulte doubled down and sought to do even more damage to this nation by waging what he described as an ‘information war’ of releasing top secret information from behind bars,” Williams added. “And all the while, Schulte collected thousands and thousands of videos and images of children subjected to sickening abuse for his own personal gratification.”
“Today, Joshua Schulte was rightly punished not only for his betrayal of our country, but also for his substantial possession of horrific child pornographic material,” FBI Assistant Director in Charge James Smith said in a statement. “The seriousness of his actions is evident and the sentence imposed reflects the magnitude of the disturbing and damaging threat posed by his criminal conduct.”
Schulte’s troubles at the CIA began in the summer of 2015, when he began fighting with management and a co-worker, eventually filing a restraining order against the co-worker in state court, court records show. Schulte and his co-worker were transferred as a result of the dispute.
Investigators alleged that Schulte became enraged when CIA officials wanted to hire a contractor to build a cyber tool similar to the one he was building, prosecutors said.
A year later, investigators said Schulte stole cyber tools and source code and transferred them to WikiLeaks, according to court records. He then tried to cover his tracks, erasing any and all traces of his access to the computer system, prosecutors said.
Schulte resigned from the CIA in November 2016. But in March 2017, WikiLeaks published the first installment of its Vault 7 leaks, which originated from two programs that Schulte had access to, court records show.
WikiLeaks published a press release to accompany the information, saying that the data had been provided anonymously by a source who wanted to raise policy questions, specifically about whether the CIA had overstepped its hacking capabilities and authority.
Schulte, who also allegedly lied to CIA and FBI investigators to cover his tracks, was arrested in August 2017 on child pornography charges. Months later he was indicted on charges related to the data breach.
For more CNN news and newsletters, create an account at CNN.com