Ex-CIA employee identified as suspect in 'Vault 7' leaks

The suspect was once employed in technical directorates inside the CIA and NSA.

U.S. government officials are looking into a former CIA employee for his possible role in leaking a trove of the agency’s cyber espionage tools to WikiLeaks.

Joshua Adam Schulte, who has worked for technical directorates at National Security Agency and the CIA, was charged with child pornography possession in August 2017. However, prosecutors have publicly revealed Schulte to be a key suspect in the Vault 7 leaks after seizing computer equipment, notebooks and handwritten notes from his apartment.

The Washington Post first reported on Schulte’s relation to the case.

Schulte, 29, has pleaded not guilty to the child pornography charges. His lawyers maintain he had nothing to do with the Vault 7 leaks, and he has not been charged with any crimes related to the case.

Starting in March 2017, the Vault 7 leaks gave access to a trove of hacking tools and documentation on electronic surveillance capabilities that was initially developed for the CIA. Posted on WikiLeaks, there were numerous releases that detailed highly classified government tools for the public to access.

Schulte worked for five months at the NSA and then for over six years at the CIA before leaving in November 2016 to work at Bloomberg as a software engineer, according to his LinkedIn profile. During his time at CIA, Schulte was employed at National Clandestine Service (NCS) as a Directorate of Science and Technology (DS&T) Intelligence Officer. He states that he “developed a multitude of Quick Reactions Capabilities (QRCs) in C/C++ for both Windows and Linux systems to support clandestine operations.”

Schulte told the Washington Post that he left the CIA on bad terms after reporting “incompetent management and bureaucracy,” as well as multiple oversight authorities. It was then a series of unlucky coincidences, he said, that led the government to focus in on him as a suspect in the leak investigation.

U.S. federal prosecutor Matthew Laroche detailed the investigation during a Jan. 8, 2018 hearing in a New York federal courtroom.

“In March of 2016, there was a significant disclosure of classified material from the Central Intelligence Agency,” Laroche said in January. “The material was taken during a time when the defendant was working at the agency. The government immediately had enough evidence to establish that he was a target of that investigation. They conducted a number of search warrants on the defendant’s residence. And I would disagree with the defense counsel’s characterization that those search warrants haven’t yielded anything that is consistent with his involvement in that disclosure. In fact, our investigation is ongoing. He remains a target of that investigation.”

Schulte’s defense attorney said in court that the government’s reasoning used to obtain search warrants for Schulte’s property were “just flat inaccurate and not true.”

The full scope of the case against Schulte is unclear. What’s on the public record currently is that Schulte uses Tor, anonymity software used by millions of people, and that he planned to leave the country last year — a trip he says was for a family vacation to Cancun.

Prosecutors said they plan to file a new indictment by July.

The CIA declined to comment.

You can read the prosecution’s statements about the case below:

https://www.documentcloud.org/documents/4463188-Gov-Uscourts-Nysd-480183-29-0.html#document/p13/a423229

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure