https://www.justice.gov/opa/pr/former-nsa-employee-sentenced-prison-willful-rete...

---

Nghia Hoang Pho, 68, of Ellicott City, Maryland, and a naturalized U.S. citizen originally of Vietnam, was sentenced today to 66 months in prison, to be followed by three years of supervised release, for willful retention of classified national defense information.  According to court documents, Pho removed massive troves of highly classified national defense information without authorization and kept it at his home.

The sentence was announced by Assistant Attorney General for National Security John C. Demers, U.S. Attorney for the District of Maryland Robert K. Hur, and Special Agent in Charge Gordon B. Johnson of the FBI’s Baltimore Field Office.  U.S. District Judge George L. Russell, III issued the sentence.

“Pho’s intentional, reckless and illegal retention of highly classified information over the course of almost five years placed at risk our intelligence community’s capabilities and methods, rendering some of them unusable,” said Assistant Attorney General Demers.  “Today’s sentence reaffirms the expectations that the government places on those who have sworn to safeguard our nation’s secrets.  I would like to thank the agents, analysts and prosecutors whose hard work brought this result.”

“Removing and retaining such highly classified material displays a total disregard of Pho’s oath and promise to protect our nation’s national security,” said U.S. Attorney Hur.  “As a result of his actions, Pho compromised some of our country’s most closely held types of intelligence, and forced NSA to abandon important initiatives to protect itself and its operational capabilities, at great economic and operational cost.”

“The privilege of working for the U.S. Intelligence Community requires strict adherence to laws governing the lawful secrecy of its work,” said Special Agent in Charge Johnson.  “We cannot have a functioning Intelligence Community without the protection of sources and methods, and taking classified information and placing it in a vulnerable setting has profound and often disastrous consequences.  This case is a clarion call to all security clearance holders to follow the law and policy regarding classified information storage.  The FBI will leave no stone unturned to investigate those who compromise or mishandle classified information.”

According to his plea agreement, beginning in April 2006, Pho was employed as a developer in Tailored Access Operations (TAO) at the National Security Agency (NSA).   NSA is a component of the U.S. intelligence community and the U.S. Department of Defense (DoD).  The NSA's TAO involved operations and intelligence collection from foreign automated information systems or networks, as well as actions taken to prevent, detect and respond to unauthorized activity within DoD information systems and computer networks, for the United States and its  allies.

Pho held various security clearances in connection with his employment, including Top Secret and Top Secret // Sensitive Compartmented Information (SCI).  Pho had access to national defense and classified information and worked on highly classified, specialized projects.   Over his years of holding a security clearance, Pho received training regarding the proper handling, marking, transportation and storage of classified information.  Pho was also told that unauthorized removal of classified materials, and the transportation and storage of those materials in unauthorized locations, risked disclosure of the materials and could endanger the national security of the United States.  Pho signed numerous non-disclosure agreements demonstrating that he understood the trust that the United States places in individuals who receive a security clearance.

According to the plea agreement, beginning in 2010 and continuing through March 2015, Pho removed and retained U.S. government property, including documents and writings that contained national defense information classified as Top Secret and SCI.  This material was in both hard copy and digital form, and was kept in a number of locations in Pho’s residence in Maryland.  Pho knew that he was not authorized to remove the material or store it at his home.

Assistant Attorney General Demers and U.S. Attorney Hur commended the FBI and the NSA for their work in the investigation.  This prosecution was handled by the District of Maryland, and the National Security Division’s Counterintelligence and Export Control Section.

https://www.washingtonpost.com/world/national-security/nsa-employee-who-worked-o...

By Ellen Nakashima December 1 at 7:05 PM

A National Security Agency employee who worked at home without authorization on sensitive hacking tools pleaded guilty Friday to violating the Espionage Act — a security breach that the agency was tipped off to by Israeli cyberspies.

Federal prosecutors said they will seek an eight-year sentence for Nghia Hoang Pho, 67, of Ellicott City, Md., for willful detention of national defense information.

Pho’s case is noteworthy not only because it is one of several significant breaches at the NSA but also because he was using anti-virus software from a Russian firm on his computer — software the agency never deployed on its computers for fear it could enable Russian government spying.

The U.S. government and Congress this year have moved to ban the use of Kaspersky Lab anti-virus products from federal government computers.

Pho, a naturalized citizen, worked as a developer in Tailored Access Operations (TAO), the agency’s elite hacking unit, which gathers intelligence by penetrating the computers of foreign governments and other targets overseas. The unit is now called Computer Network Operations.

He held various clearances, and former officials said he had no malicious intent in working on the tools at home. But the breach violated protocols and conditions for holding a security clearance. According to a court document, from 2010 to March 2015, Pho removed classified material in hard copy and digital form.

“The facts supporting this criminal charge and guilty plea display a total disregard of the defendant’s oath and promise to protect our nation’s national security,” said Stephen M. Schenning, acting U.S. attorney in Maryland. “Such conduct cannot and will not be tolerated.”

Anti-virus software detects malicious code on a system by scanning its contents and can serve as a platform for digital espionage. U.S. officials have said that Kaspersky Lab, by virtue of being located in Moscow, is subject to Russian surveillance.

In a remarkable spy-vs.-spy twist, Israeli government hackers who had compromised Kaspersky’s network detected hacking-tool signatures that they recognized as the NSA’s. They alerted the agency, which began an investigation code-named Red Magic.

The hunt quickly led to Pho, who was removed from his position in 2015.

In a November report on the incident, Kaspersky Lab said its software had “inadvertently” retrieved the NSA tools because they were contained in a larger file that had NSA code in it that the firm classifies as malicious.

“We deleted those files,” the report said, because they were not needed to improve customer security and because of concerns regarding the handling of potentially classified materials.

Last fall, the Justice Department charged another TAO employee, a contractor named Harold T. Martin III, who had taken classified tools and other material home over several years. Martin was indicted in February on charges of violating the Espionage Act. He has pleaded not guilty.

The breaches are compounded by the August 2016 release online of a cache of sensitive NSA hacking tools that are similar to those Martin took. The trove was published by a mysterious group calling itself the Shadow Brokers. Investigators suspect the Russian government is behind that release but have not obtained proof.

The agency’s loss of control over its sensitive hacking tools has caused great concern at its Fort Meade headquarters, at the Pentagon and in Congress.
The scope of harm in Pho’s case is “not theoretical,” said Gordon B. Johnson, special agent in charge of the FBI’s Baltimore field office. “It denotes another attack on the bedrock secrecy and discipline required” of those holding security clearances, he said. Pho is scheduled to be sentenced in April in U.S. district court in Baltimore.