A record sentence in the ‘Vault 7’ leak case

If you like this post, sign up to get The Nuance newsletter delivered straight to your inbox every Sunday night!

On Feb. 1, a federal judge sentenced former CIA programmer Joshua Schulte to 40 years in prison, the longest sentence to date for the unauthorized disclosure of national defense information, or NDI, outside of traditional nation-state spying. Schulte had been found guilty at trial of disclosing to WikiLeaks material related to classified CIA cyber tools — the so-called “Vault 7” cache — and child pornography offenses.

The sentence is notable on a few fronts, but to understand why, it’s helpful to get into the weeds of the specific charges.

Schulte was convicted at three separate trials. He was found guilty in March 2020 of contempt of court and making false statements, but the jury failed to reach a verdict on the remaining counts under the Espionage Act and Computer Fraud and Abuse Act. In July 2022, the government prevailed on those counts at a second trial, four counts of espionage and four counts under the CFAA. And, finally, in September 2023, he was convicted on three child pornography counts.

The 40-year sentence, which covers all 13 counts, breaks down like this:

• Ten years for counts one through three of the third superseding indictment. These are all under the Espionage Act, and include one count of illegal gathering of NDI under 18 U.S.C. 793(b) and two counts of illegally transmitting NDI under 793(e). As the government noted in its sentencing memorandum, Schulte is the first “leaker” to be charged under section 793(b) of the Espionage Act (more on that below).
• Ten years for counts four and five of the third superseding indictment. Count four is one count under 793(e) of attempted transmission of NDI. Count five is one count under the CFAA’s “mini-Espionage Act,” 18 U.S.C. 1030(a)(1), which criminalizes unauthorized access of a computer to obtain classified information.
• Ten years for counts seven and eight of the third superseding indictment, both of which cover the transmission of a harmful computer program causing damage to a government computer in violation of the CFAA, 18 U.S.C. 1030(a)(5)(A).
• More than three years for count six of the third superseding indictment, for unauthorized access to a computer to obtain information from the United States, in violation of the CFAA, 18 U.S.C. 1030(a)(2)(B), and for the contempt and false statement counts he was convicted of in 2020.
• And more than six years for the child pornography counts (counts 12, 13, and 14 of the second superseding indictment).

The main takeaway? That is … a lot of time. Putting aside Chelsea Manning, who was sentenced in military court to 35 years in the 2010 WikiLeaks case (commuted to about seven by President Barack Obama), the now second-longest sentence in a leak case is Reality Winner at 63 months, or about five years. That’s an eighth of the Schulte sentence, or slightly less than a sixth if you subtract the child pornography counts. Compared to the other leak case where prosecutors also brought child pornography charges against the defendant — the Donald Sachtleben prosecution — it’s still long. Sachtleben was sentenced in 2013 to 97 months on the child pornography charges and 43 months for two counts of violating the Espionage Act, to be served concurrently. That’s less than a third of the Schulte sentence.

To be sure, there are differences between Schulte and other leak cases that could account, at least in part, for the disparity. For one, Schulte went to trial — three times — whereas virtually all journalistic source cases end in pleas. Schulte was also a combative defendant and Judge Jesse Furman, who sentenced him, cited a “complete lack of remorse.” And the prosecution also emphasized throughout the trials that Schulte appeared to be driven by personal spite over personnel conflicts at the CIA, as opposed to any perceived public interest in the material disclosed (which isn’t technically relevant as a legal matter but could be an optical point one could make).

The court also added a “terrorism enhancement” to count five and possibly counts seven and eight. The 2001 USA Patriot Act included two CFAA provisions in the list of statutes qualifying for that enhancement: the “mini-Espionage Act” and using malware to harm government computers. (We don’t have the transcript or sentencing form, so we’re not 100 percent sure which charge received the enhancement; reports are that it was just the 1030(a)(1) count.)

But what’s really interesting is how the government framed the offense as akin to the kind of spying that results in a lifetime trip to ADX Florence. Typically, the U.S. Justice Department will argue that cases involving leaks to the media or public shouldn’t be treated differently from other violations of the Espionage Act. Prosecutors have argued, for instance, that public disclosure can arguably be more damaging to the U.S. because secrets go to the world, as opposed to just a foreign adversary. Here, however, they argued explicitly that the Schulte case is more akin to Robert Hanssen, Aldrich Ames, Arthur James Walker, and Andrew Daulton Lee — all Soviet or Russian spies — and should be expressly distinguished at sentencing from journalistic source cases.

And the way prosecutors make that argument is even more interesting. They note that Schulte is the only leak case charged under section 793(b) of the Espionage Act. That section has a slightly higher intent requirement than the typical media leak case, which usually involves section 793(e) or, less often, 793(d). A defendant under 793(b) must intend, or have reason to believe, that the NDI at issue “is to be used to the injury of the United States, or to the advantage of any foreign nation” as opposed to “could be used” in 793(d) or (e).

The sentencing memorandum goes on to note that all other 793(b) charges have historically been coupled with counts under the traditional espionage statute, 18 U.S.C. 794, which carries the same intent language but requires that the information be handed over to a foreign power. The government didn’t do that here because Schulte was charged with giving it to WikiLeaks. “But,” the memorandum concludes, “Schulte’s intent to harm the United States, the scope of his theft and disclosure, and the consequences of his conduct, more closely parallels cases prosecuted under [section] 794 than so-called ‘leak’ cases in which comparatively small amounts of information are shared with media organizations with a misguided sense of the public interest.” Judge Furman didn’t give Schulte the government’s desired life term, but that reasoning appears to have played into the 40-year sentence.

Time will tell what, if any, precedential impact the Schulte case has in the wider body of “leak law.” There are many elements of his case that could serve to distinguish it from future prosecutions of journalistic sources imbued with a “misguided sense of the public interest.”

But the theory the government advances under section 793(b) is pretty elastic. And, to the extent the court credited the precise reasoning in the sentencing filing, prosecutors managed to gloss the case as traditional espionage, even without formally bringing charges under section 794. (Not for nothing, section 794 is a capital offense and, “in time of war,” carries the death penalty for anyone who “publishes” government secrets with the intent they be communicated to the enemy.) Schulte did himself no favors in the course of his prosecution, but his case very well may have future emanations that extend beyond its facts.

The Technology and Press Freedom Project at the Reporters Committee for Freedom of the Press uses integrated advocacy — combining the law, policy analysis, and public education — to defend and promote press rights on issues at the intersection of technology and press freedom, such as reporter-source confidentiality protections, electronic surveillance law and policy, and content regulation online and in other media. TPFP is directed by Reporters Committee attorney Gabe Rottman. He works with RCFP Staff Attorney Grayson Clary and Technology and Press Freedom Project Fellow Emily Hockett.