Joshua Schulte, a software engineer and later system administrator for the CIA’s Developer Network, Devlan, was convicted of stealing and transmitting classified material from the agency’s Operations Support Branch. Prosecutors said he exploited privileged access to source code and backup files after leaving the CIA in November 2016, motivated by resentment toward former colleagues and managers. WikiLeaks began publishing the Vault 7 archive on March 7, 2017; the documents, dated from 2013 through 2016, described CIA capabilities for compromising cars, smart televisions, web browsers, and widely used operating systems. The New York Times described the disclosure as the largest loss of classified documents in CIA history, while the Justice Department called it one of the most damaging acts of espionage in American history.
Schulte’s first trial ended in March 2020 with convictions for contempt of court and making false statements, but a jury deadlocked on the central espionage charges. At a retrial, he was convicted on July 13, 2022, on nine counts involving illegal handling of national-defense information and computer hacking; an obstruction conviction was overturned in August 2023 under the Supreme Court’s United States v. Aguilar standard, while the espionage convictions remained intact. On February 1, 2024, Judge Jesse Furman sentenced him to 400 months for espionage-related offenses and a separate 80 months for possessing child sexual-abuse material, totaling 40 years, plus lifetime supervised release. The case exposed the security risks of concentrated insider access to highly classified cyber tools and prompted lasting scrutiny of CIA information controls.
