U.S. says accused Vault 7 leaker tried orchestrating PR campaign from jail cell

Schulte's trial is scheduled to begin Feb. 3 after years of delays.

With less than two weeks before a former Central Intelligence Agency contractor is scheduled to strand trial for allegedly leaking classified information to WikiLeaks, U.S. prosecutors on Tuesday asked a judge to admit evidence detailing the defendant’s behavior behind bars, including alleged communications with reporters.

The defendant, Joshua Schulte, has been charged with stealing national defense information, then providing it to WikiLeaks, which then published a trove of CIA hacking tools known as the Vault7 files. Schulte was arrested in August 2017 and has been awaiting his trial in Manhattan’s Metropolitan Correctional Center.

While detained, Schulte sought to “drum up media attention for his case and to paint himself as an innocent man,” prosecutors wrote in a Jan. 21 court filing. This public relations campaign involved writing a series of articles that he sought to distribute to the media, urging family members to post his missives on a public Facebook page, and using contraband phones to communicate with people outside the jail, the government says.

“[P]ortions of these documents…show the defendant’s rage at being imprisoned, his declaration of an ‘information war,’ and his avowed intention to destroy the United States’ diplomatic relationships demonstrate conclusively that the defendant has reason to believe these transmissions would or could harm the United States[,]” prosecutors wrote.

This court filing is the latest update to the ongoing and at times contentious pre-trial in which attorneys for the government and defense have sparred over what constitutes classified material, the timing of the trial and whether the defense fully understands the nature of the charges against the defendant.

The trial is scheduled to begin in the U.S. Southern District of New York on Feb. 3.

In Tuesday’s court filing, prosecutors detail some of what FBI investigators found when they seized notebooks Schulte had kept while detained. There, Schulte describes how, while texting his father via the encrypted messaging programs WhatsApp and Signal, he “finally got a response @ 1% battery.” He urged his father to add the articles to a gmail draft file, presumably for safekeeping, while his lawyer urged him not to follow through on the plan.

At another point in the filing, prosecutors say Schulte emailed a Washington Post reporter, at which point the defendant learned the Post did not intend to publish Schulte’s writings. “Isn’t that incredible?” he allegedly wrote, chastising the publication for “withholding” the articles.

Based on the prosecutors’ memo, Schulte’s apparent “information war” from behind bars consisted largely of posting links to articles and blog posts on his social media accounts, including from one Facebook page he allegedly planned to name “Who Is Josh Schulte?” He also wrote reminders to himself to schedule tweets from a Twitter page called “FreeJasonBourne,” the filing states. (Twitter has suspended the FreeJasonBourne account.)

The court filing is available in full below.

[documentcloud url=”http://www.documentcloud.org/documents/6664555-SchulteMCC.html” responsive=true]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure