Joshua Schulte

WikiLeaks published the documents as Vault 7, which The New York Times called "the largest loss of classified documents in the agency's history and a huge embarrassment for C.I.A. officials." After his conviction, the Department of Justice called it "one of the most brazen and damaging acts of espionage in American history."

Joshua Schulte
Schulte incarcerated inside the Metropolitan Correctional Center, New York
Born	(1988-09-25) September 25, 1988 (age 35)
Nationality	American
Other names	Kinetic Panda Nuclear Option Voldemort
Occupation	Software Engineer
Employer	Central Intelligence Agency
Known for	Convicted of the leak of classified information known as Vault 7 to WikiLeaks
Criminal charges	Transmission of a harmful computer command unauthorized access to a computer to obtain national defense information gathering and transmitting unlawfully possessed national defense information receiving, possessing, and transporting child pornography

On September 13, 2023, Schulte was also convicted of receiving, possessing, and transporting child sexual abuse images. On February 1, 2024, he was sentenced to 40 years in prison for espionage and child pornography.

Schulte grew up in Lubbock, Texas, with three younger brothers. His father, Roger, is a financial adviser and his mother, Deanna, is a high-school guidance counselor. He was fascinated by computers as a child, and by the time he was in high school, had begun building them. According to former classmates, Schulte was infamous for drawing swastikas around school and in the yearbook of a Jewish student. Some former students recalled Schulte exposing his genitals and trying to touch others or get them to touch him. On one occasion, he and some of his friends got in trouble for trying to put their hands into the pants of a sleeping female student on a bus during a field trip.

Schulte graduated from the University of Texas at Austin in 2011 with a degree in computer engineering. While studying at the University of Texas, he began an internship for IBM.

From January 2010 to May 2010, Schulte was employed as a systems engineer by the National Security Agency (NSA), including time spent within the Technology Directorate. According to his LinkedIn profile, he began working for the CIA in May 2010 and was "employed within the National Clandestine Service (NCS) as a Directorate of Science and Technology (DS&T) Intelligence Officer." After his arrest, it was revealed he had been a software engineer at the classified Operations Support Branch (OSB) at a secret CIA cyber facility in Virginia. The OSB built "quick-reaction tools" based on ideas and prototypes for almost immediate use in missions. After Schulte showed his skills as a programmer, he was made a system administrator for the CIA's developer network, Devlan, in 2015. This gave him access to the network storing the source for OSB projects, and he could control who else had access.

Schulte's unit at the OSB was very social, and coworkers gave each other nicknames. Schulte tried to give himself the nickname "Bad Ass", but others called him "Voldemort", and his temper earned him the nickname "the Nuclear Option". He and other employees had Nerf wars at work, which sometimes escalated. A rubber-band war between Schulte and a coworker named Michael escalated until they were "trash[ing]" each other's desks and began throwing punches. Conflicts with another employee, which included Schulte making fat jokes and claiming the other had made death threats, led to both being reassigned. According to testimony, an investigation found Schulte's claims to be meritless. Schulte was infuriated that he had to switch desks. After he filed for a restraining order against the other employee, the CIA's Threat Management Unit separated them further. His manager said Schulte refused to work from his new desk. According to the CIA's Office of Security, Schulte's "escalating behavior" kept "going on and on".

By November 2016, Schulte left the CIA to move to New York, and, until his arrest and detention on August 24, 2017, worked as a senior software engineer for Bloomberg LP.

In 2013, Schulte posted snippets of code from OSB Project Wizard on his public GitHub page. A description of the same project name and purpose appeared in the Vault 7 release. According to The Daily Beast, it was unclear whether the project was developed externally and brought into OSB, or developed internally and exported to GitHub. In February 2014, Schulte uploaded at least five copies of Project Wizard to his public website.

The prosecution alleged that Schulte was motivated by spite and revenge to steal backup files on April 20, 2016. On March 7, 2017, WikiLeaks began to publish content code-named "Vault 7". The confidential documents, dated from 2013 to 2016, included details on the CIA's software capabilities, such as the ability to compromise cars, smart TVs, web browsers, and popular operating systems. Schulte had not returned his special black government passport^{[clarification needed]} when he left the CIA and was scheduled to fly to Mexico days later, but was stopped when the FBI confiscated his passport.

On May 15, 2018, both The Washington Post and The New York Times published articles about Schulte being a suspect in a federal investigation concerning the unauthorized disclosure of classified information to WikiLeaks. Later that day, the government "alerted the court to a violation, a potential breach of the protective order" in which "various search warrants and search warrant affidavits" were leaked to the press. The government alleged that Schulte, while making phone calls from prison in May 2018, had distributed "Protected Search Warrant Materials to his family members for purposes of dissemination to other third parties, including members of the media", some of which included classified information. In the government's view, this was "a clear breach of the protective order. It is unacceptable, particularly unacceptable given that this defendant has a pattern of violating the Court's orders."

On June 18, 2018, a grand jury issued a superseding indictment, adding ten more counts to the original three: illegal gathering of national defense information, illegal transmission of lawfully possessed national defense information, illegal transmission of unlawfully possessed national defense information, unauthorized access to a computer to obtain classified information, theft of government property, unauthorized access to a computer to obtain information from a department or agency of the United States, causing transmission of a harmful computer program, information, code, or command, making false statements, obstruction of justice, and criminal copyright infringement.

An additional superseding indictment was issued on October 31, 2018, that added two more charges—contempt of court, and illegal transmission and attempted transmission of unlawfully possessed national defense information—bringing the total to 15. In a letter to the court later that day, the government wrote that in early October 2018 Schulte had been discovered using "one or more smuggled contraband cellphones to communicate clandestinely with third parties" outside of New York's Metropolitan Correctional Center, where he was being held, and that the grand jury had issued "dozens of subpoenas and pen register orders" revealing that Schulte was using "approximately 13 email and social media accounts (including encrypted email accounts)." The social media accounts included a Twitter account under the name Jason Bourne, which Schulte had used to draft tweets about CIA cyber tools.

According to a letter written by prosecutors in January 2020, one of Schulte's seized notebooks contained the phrase "DL Disc. UL WL", which they argued was a reference to "download discovery" and "upload to WikiLeaks".

During a raid of Schulte's Manhattan apartment on March 15, 2017, as well as at least one more on March 23, 2017, federal agents confiscated approximately 60 electronic devices, including a desktop computer locked under three layers of encryption.

On March 20, 2017, investigators returned to Schulte's apartment and asked for consent to search his cell phone. According to his counsel, "Schulte, in front of the agents, opened the phone, put in the password, handed it over to them to make sure that nothing on the phone could be destroyed or altered and handed it right to the authorities." Afterward, through technical analysis, agents retrieved passwords from his cell phone that unlocked multiple layers of encryption on his desktop computer, where investigators discovered a single classified document as well as over 10,000 images and videos depicting child pornography, including "sadistic and masochistic images and videos of children as young as a few years old who had been brutally sexually assaulted."

Schulte called the possession of child pornography, with which he was charged, a "victimless crime", and said the images and videos were not his, but had been uploaded without his knowledge by others onto a server he operated and let them host whatever they wanted on it. Court papers quoted from messages by Schulte suggesting he was aware of the images.

The government found that Schulte had "neatly organized" this material "according to his preferences, and stored it for a period of years." In the government's view, there was "no set of circumstances that can confidently assure the Court that he's not going to continue to try to download child pornography, encourage others to download it and share it and just generally engage in very dangerous sexual activity."

According to the criminal complaint, in 2011 and 2012 Schulte did several Google searches for videos of child pornography and incest.

The government argued that Schulte was "both a flight risk and a danger to the community." Defense counsel countered that Schulte "had no basis of knowing if there's any alleged child pornography or had any reason to believe that he was in any way, shape or form in contact with any child pornography." The court concluded that Schulte's contention that he had been victimized by people who used his servers to store child pornography without his knowledge or consent "just doesn't seem likely" and ordered that he be detained.

On September 6, 2017, a grand jury in the Southern District of New York indicted Schulte on suspicion of receipt of child pornography, possession of child pornography, and transportation of child pornography. A week later, he entered a plea of not guilty, and he was released on bail two days later.

When the government searched Schulte's phone, they found a photograph taken inside the bathroom of his old home. The picture showed an unconscious woman whose underwear had been removed and whose genitals were being touched. She was not publicly named, but was identified as Schulte's roommate at the time. She informed investigators that she passed out one night with no memory of what happened, and that the photograph was not consensual. She was unable to identify the person who took the picture and molested her. Prosecutors in Loudoun County said an analysis of Schulte's hands confirmed they were the hands in the picture.

As a result, on November 15, 2017, the Loudoun County Commonwealth's Attorney's Office determined that it had enough evidence based on pictures supplied by the FBI to charge Schulte with two crimes: object sexual penetration and the unlawful creation of an image of another. On December 7, 2017, at the FBI's request, NYPD officers arrested Schulte in connection with the charges in Virginia.

On December 14, 2017, Senior U.S. District Judge Paul A. Crotty revoked bail in New York and had Schulte remanded to the custody of the United States Marshal of the Southern District of New York. Schulte has since been detained at the Metropolitan Correctional Center in Manhattan.

In October 2022, the FBI allegedly found approximately 2,400 files on Schulte's discovery laptop containing Child Sexual Abuse Material.

Leaks of classified information trials

Schulte's trial on charges of disclosing classified information to WikiLeaks, after allegedly stealing it from the secretive CIA unit where he worked, began in New York on February 4, 2020, with opening statements by the respective sides. Federal prosecutors asserted that Schulte committed "the single biggest leak of classified national defense information in the history of the CIA" to take revenge on his former colleagues and bosses. Schulte's lead defense attorney, Sabrina Shroff, told jurors that her client was "a pain in the ass to everyone at the CIA", but argued that "being a difficult employee does not make you a criminal." Schulte pleaded not guilty.

First trial

During his first trial, Schulte was placed in solitary confinement and under special administrative measures after he was caught with a contraband cellphone that prosecutors said he attempted to use to leak classified information in an "information war", saying he was "prepared to burn down the United States government." Using the contraband cellphone, he told a journalist he was a member of Anonymous and created encrypted email accounts and secret social media accounts. He wrote articles that prosecutors said were misleading and contained misinformation and classified information. In a notebook later seized by officials, Schulte wrote that if the government didn't pay him $50 billion, he would try "to breakup diplomatic relationships, close embassies, and U.S. occupation across the world & finally reverse U.S. jingoism. If this is the way the U.S. govt treats one of their own, how do you think they treat allies?" The notebook also contained a note to his lawyers that said "if you need help ask WikiLeaks for my code."

On March 9, 2020, after hearing four weeks of testimony and deliberating for six days, the jury convicted Schulte on two counts: contempt of court and making false statements to the FBI. The jury was deadlocked on eight other counts, including the most serious: illegal gathering and transmission of national defense information. The judge declared a mistrial, and the government chose to retry the case. The hung jury has been credited to Shroff.

Schulte faced a separate federal trial on charges of possessing child pornography.

Retrial

During the retrial, Schulte represented himself, a decision that has been attributed to his belief that he could do a better job than his lawyers, the case's digital forensics, and his desire to have access to a computer and let the jury get to know him without having to testify. During the retrial, prosecutors said that Schulte was requesting access to a far larger cache of heavily classified information than he was accused of leaking. While he acted as his own attorney, Shroff and Deborah Colson were available to help him as standby counsel.

On July 13, 2022, Schulte was convicted at retrial on nine counts related to illegal handling of classified information as well as obstruction of justice. In an interview after the trial, one of the jurors said that Schulte seemed arrogant and acted like he thought he was better than everyone else. The New Yorker summarized the juror's description as, "Schulte's caustic belittling of one witness after another came to sound like the eye-rolling derision of a smug I.T. guy lording his technical prowess over everyone he encounters." The jurors were unaware of the child pornography charges.

In August 2023, the obstruction conviction was overturned, citing the Supreme Court decision U.S. v. Aguilar. The judge wrote: "at best the government proved that Schulte, knowing of the existence of a federal grand jury investigation, lied to federal investigators regarding issues pertinent to the grand jury's investigation. Under Aguilar, that does not suffice". The decision upheld the other convictions, finding there was "more than sufficient" evidence to support the espionage and hacking charges.

Sex crimes allegations trials

Child pornography trial

On September 6, 2017, a grand jury in the Southern District of New York indicted Schulte on suspicion of receipt of child pornography, possession of child pornography, and transportation of child pornography. He entered a plea of not guilty a week later and was released on bail two days later. At trial, prosecutors presented evidence that Schulte had over 3,000 encrypted images and videos of sexual abuse of children as young as age 2 on his home computer. On September 13, 2023, Schulte was found guilty of receiving, possessing, and transporting child sexual abuse images.

On February 1, 2024, he was sentenced to 40 years in prison and lifetime supervised release for espionage, computer hacking, contempt of court, making false statements to the FBI, and possession of child abuse images.

Sentencing

Schulte was imprisoned in Metropolitan Correctional Center, New York and Metropolitan Detention Center, Brooklyn. In his sentencing letter, Schulte's defense lawyer César de Castro argued that Schulte was subjected for almost five years to "unconscionably punitive conditions" while being detained under "physically and psychologically torturous" Special Administrative Measures. Schulte called the prison "New York City’s very own Auschwitz", which Judge Furman called “offensive”. Furman sentenced Schulte to 400 months imprisonment on the espionage counts and separately to 80 months for child pornography counts.

• Edward Snowden
• The Shadow Brokers