Joshua Adam Schulte, a former CIA software developer, was sentenced to 480 months (40 years) in prison on Friday for what the Department of Justice called “some of the most brazen, heinous crimes of espionage in American history.”
The 35-year-old New York man was convicted in three separate trials that concluded in March 2020, July 2022, and September 2023. His crimes include stealing and leaking classified files to WikiLeaks, hacking agency systems, contempt of court, making false statements to the FBI, and child pornography possession.
Prosecutors said Schulte’s actions represent the largest data breach in CIA history. His leak of the stolen data to WikiLeaks was one of the biggest unauthorized disclosures of classified U.S. information ever.
“Schulte severely harmed U.S. national security and directly risked the lives of CIA personnel, persisting in his efforts even after his arrest,” said Assistant Attorney General Matthew G. Olsen.
U.S. Attorney Damian Williams called Schulte’s crimes “some of the most brazen, heinous crimes of espionage in American history.” He said Schulte “caused untold damage to our national security in his quest for revenge against the CIA.”
The FBI said Schulte “exploited the U.S. government” as well as “vulnerable children by collecting images and videos capturing their horrific abuse for his own pleasure.”
Ex-Employee Stole Tools, Leaked to WikiLeaks
Schulte worked from 2012 to 2016 as a developer in the CIA’s Center for Cyber Intelligence. He helped build tools used in human-enabled cyber operations against terrorist groups and foreign governments.
After being moved to another department over personnel disputes in 2016, Schulte abused his administrator access to restore his revoked privileges. He then stole copies of the center’s entire development archives – the largest data breach ever at the CIA.
From home, Schulte sent the stolen files to WikiLeaks using anonymizing tools like Tails OS and Tor browser. On March 7, 2017, WikiLeaks began publishing the classified data in what it called “Vault 7” and “Vault 8.”
The disclosures represented one of the biggest unauthorized leaks in U.S. history. They immediately damaged the CIA’s foreign intelligence capabilities, endangered personnel and assets, and cost the agency hundreds of millions of dollars. A former CIA official described it as a “digital Pearl Harbor.”
More Read
Lied to FBI, Leaked from Jail
When interviewed by the FBI in March 2017, Schulte repeatedly lied and tried to pin the theft on others to divert suspicion, prosecutors said. A search of his New York apartment revealed encryption-protected child abuse images and videos.
While in jail awaiting trial in 2018, Schulte leaked protected discovery materials to reporters and planned to publish classified information online. He obtained contraband phones and created anonymous accounts for what he called an “information war” against the government.
In recorded calls, Schulte acknowledged he knew he was banned from sharing protected materials. But he still sent emails containing classified CIA data to a reporter from jail.
Schulte was convicted of contempt of court and false statements in March 2020. In July 2022, he was found guilty of espionage and hacking related to the CIA breach. And in September 2023, he was convicted on child pornography charges.
The FBI commended its cyber experts and prosecutors who unmasked Schulte and held him accountable. The 40-year sentence reflects the “enormity of his crimes,” the U.S. Attorney’s Office said.