The Vault 7 release exposed the CIA's offensive-cyber-operations toolkit — the malware, the implants, the zero-day exploits the agency uses against foreign and U.S.-adjacent targets. Schulte was convicted in 2022 of nine counts including espionage and computer-intrusion charges. The 40-year sentence imposed in February 2024 is the federal government's answer to the entire post-Snowden generation of national-security leak prosecutions.
The sentence
U.S. District Judge Jesse M. Furman, sitting in the Southern District of New York, imposed the sentence on February 1, 2024. Forty years federal time. Schulte will not be eligible for release before his late 70s. He will serve approximately every additional day of his life on supervised release after that.
The case
Schulte was a CIA software engineer in the Office of Operations Support / Engineering Development Group (EDG) — the unit that developed the offensive cyber tools the CIA uses against foreign targets. In March 2016 he was reassigned within EDG following internal disputes; in April 2016 he is alleged to have copied the entire EDG repository — the "Vault 7" trove — and transmitted it to WikiLeaks, which began publishing it in March 2017. The disclosure burned the entire CIA cyber-operations toolkit and forced the agency to rebuild from scratch — the largest data loss in CIA history.
Schulte was arrested in 2017 on possession-of-child-sexual-abuse-material charges discovered when the FBI searched his home in connection with the Vault 7 investigation, and indicted on the leak charges in 2018. His first trial (2020) hung on the leak counts. He was convicted at retrial in 2022 of nine counts: illegal gathering and transmission of national-defense information, theft of government property, computer-intrusion offenses, contempt of court, false statements to the FBI, and the child-abuse-material counts. He represented himself in significant portions of the proceedings.
Where this sits in the leak-prosecution lineage
The pattern is unmistakable. Daniel Ellsberg, the Pentagon Papers leaker, faced 115 years in 1973; charges were dismissed over Nixon-administration misconduct. Thomas Drake, NSA, 2010: charges dropped to a misdemeanor; no prison. Chelsea Manning, 2013: 35 years, commuted to 7 by President Obama. Edward Snowden: in exile in Russia since 2013, no trial. Jeffrey Sterling, 2015: 42 months. John Kiriakou, CIA, 2013: 30 months. Reality Winner, 2018: 63 months. Daniel Hale, drone whistleblower, 2021: 45 months. Then, in 2024: Joshua Schulte, 40 years.
The fact-pattern that distinguishes Schulte from his predecessors — the CIA's strongest motivation for an exemplary sentence — is the operational severity of the disclosure: he gave WikiLeaks the agency's cyber-weapons themselves, not merely documents describing them. But the gradient is also unmistakable on its face: the U.S. government is escalating, sharply and steadily, the federal-prison cost of disclosing classified material. Schulte's 40 years is the marker for the next prosecution.
What is not in dispute
Schulte's case carries complications other leak cases do not. The child-abuse-material conviction is separate and substantial, and is part of why some movement civil-liberties groups have been more cautious in claiming him as a political prisoner. What is in dispute among press-freedom and surveillance-state critics is not whether his conduct in that respect should be punished but whether the leak component of the sentence — most of the 40 years — is calibrated to the offense or calibrated to deter the next leaker. The federal government has answered that question with the largest leak-related sentence in U.S. history.
