NSA Employee Pleads Guilty To Stealing Classified Information

A former National Security Agency employee admitted on Friday 1st December, that he had illegally taken from the agency classified documents believed to have subsequently been stolen from his home computer by hackers working for Russian intelligence.

Nghia Pho, 67, has pleaded guilty to one count of willful retention of national defense information, an offense that carries a possible 10-year sentence. Prosecutors agreed not to seek more than eight years, however, and Mr. Pho’s attorney, Robert C. Bonsib, will be free to ask for a more lenient sentence. He remains free while awaiting sentencing on April 6.

Mr. Pho had been charged in secret, though some news reports had given a limited description of the case. Officials unsealed the charges on Friday, resolving the long-running mystery of the defendant’s identity.

Although the documents don't make it clear exactly what specific classified data and records were taken, beyond hard copy and digital files stored in Pho's residence, several earlier reports have pointed to hacking tools developed for offensive operations launched by the NSA, such as targeting foreign networks and systems for conducting surveillance.

Mr. Pho, who worked as a software developer for the NSA, was born in Vietnam but is a naturalised United States citizen. Prosecutors withheld from the public many details of his government work and of the criminal case against him, which is linked to a continuing investigation of Russian hacking. But in court documents, prosecutors did disclose that he worked from 2006 to 2016 for the NSA’s “Tailored Access Operations.” The unit, whose name has now been changed to Computer Network Operations, is the NSA’s fastest-growing component. 

Its hackers break into foreign computer networks to gather intelligence, often leaving behind software implants that continue to collect documents and other data and forward it to the agency for months or years.

Prosecutors said that from 2010 until March 2015, Mr. Pho began removing classified documents and writings. He kept those materials, some in digital form, at his home in Maryland, according to prosecutors. It appears he was charged in March 2015.

Mr. Pho is one of three NSA workers to be charged in the past two years with mishandling classified information, a dismal record for an agency that is responsible for some of the government’s most carefully guarded secrets.

The leaks have come to light as investigators scramble to trace the source of an even worse breach of NSA security: the public release of the agency’s hacking tools by a still-unidentified group calling itself the Shadow Brokers. Some of those tools have been subsequently used for “ransomware” attacks that shut down or disrupted businesses, hospitals, railways and other enterprises around the world this year.

Government officials, who would speak of the classified details of the case only on condition of anonymity, said that Mr. Pho took the classified documents home to help him rewrite his resume. 

But he had installed on his home computer antivirus software made by Kaspersky Lab, a top Russian software company, and Russian hackers are believed to have exploited the software to steal the documents, the officials said. It is not clear whether anyone at Kaspersky Lab was aware of the document theft. The company has acknowledged finding NSA hacking software on a customer’s computer and removing it, but says the material was subsequently destroyed. It has denied that it works with Russian intelligence.

The sensitivity of the case was evident on Friday, when one courtroom official described the charges against Mr. Pho as “super-sealed” before the hearing. The aggressive hacking of American targets by the Russian government, including the Democratic National Committee during last year’s election campaign, is a high-priority concern for the United States, and forensic information from Mr. Pho’s computer might provide useful clues.

In addition to Mr. Pho, an NSA contractor, Harold T. Martin III, was arrested last year after FBI agents found some 50 terabytes of data and documents that he had taken from the NSA and other agencies over 20 years. The material was stuffed into a garden shed and car, among other places, and investigators have considered the possibility that the Shadow Brokers might have obtained the hacking tools from Mr. Martin, who had also worked at one point for agency’s Tailored Access Operations.

A contract linguist who worked for the NSA in Georgia, Reality Winner, was arrested in June and charged with providing a single NSA document to the online publication The Intercept. Both Mr. Martin and Ms. Winner are being held awaiting trial.

New York Times:     ZDNet

You Might Also Read:

The US National Security Agency Is On The Ropes:

Russian Spies Used Kaspersky Anti-V To Hack NSA:

UK National Cyber Security Centre Has Not Certified Kaspersky:

We Are In A New Era Of Espionage:

Cyberspies: The Secret History of Surveillance, Hacking And Digital Espionage:

 


 

 

« Paying For The UK’s Cyber War With Russia
British Police Lose Phone & Web Search Powers »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

RioRey

RioRey

The DDoS mitigation specialist, from single server to Enterprise wide carrier level networks the RioRey Solution provides effective immediate and easy to manage protection.

National Institute of Information and Communications Technology (NICT) - Japan

National Institute of Information and Communications Technology (NICT) - Japan

NICT is Japan’s sole National Research and Development Agency specializing in the field of information and communications technology.

Averon

Averon

Averon's technology is the new gold standard for digital identity - the easiest, fastest and most secure verification solution for users on both WiFi and LTE.

OneVisage

OneVisage

Our award-winning 3DAuth digital identity platform turns any consumer mobile device into a real-time 3D facial scanner that securely authenticates the user in seconds.

SAASPASS

SAASPASS

SAASPASS is a full-stack identity and access management solution, a single product which allows you to manage all your digital and physical access needs securely and conveniently.

Lexsynergy

Lexsynergy

Lexsynergy is a global domain name management and online brand protection company.

Cybil

Cybil

Cybil is a publicly-available portal where members of the international cyber capacity building community can find and share information to support the design and delivery of programs and projects.

Schillings

Schillings

Shillings defends your rights to privacy, reuptation and security. We fight passionately against breaches of your privacy, attacks on your reputation and threats to your security.

Ignite Cyber

Ignite Cyber

IGNITE Cyber is focused on enabling secure technology adoption through intelligent business decisions. We are focused on providing a secure and stable business environment for everyone.

Code First Girls

Code First Girls

Code First Girls are on a mission to close the gender gap in the tech industry by providing employment through free education.

Cyberlocke

Cyberlocke

Cyberlocke is dedicated to finding inventive solutions to meet the distinct IT obstacles of each organization we support.

PureSoftware

PureSoftware

PureSoftware is a global software products and digital services company that is driving transformation for the world’s top organizations across various industry verticals.

PureID

PureID

Protect your enterprise with PureAUTH #IAMFirewall, Resilient SSO platform, purpose built to provide Passwordless Authentication & Zero Trust Access, by default.

Neeve

Neeve

Neeve is an edge cloud platform transforming smart buildings and spaces, making them more secure, smarter, and more sustainable.

Digital & Intelligence Service (DIS)

Digital & Intelligence Service (DIS)

DIS is the fourth Service of the SAF, here to defend and dominate in the digital domain, and achieve peace and security for our land.

OryxAlign

OryxAlign

OryxAlign offer managed IT and cyber security, cloud and digital transformation, and tailored professional and consulting services.