(CN) – A former National Security Agency employee pleaded guilty Friday to removing classified information from the agency’s offices, the Justice Department announced.
Nghia Pho, of Maryland, was a developer for the agency’s Tailored Access Operations, otherwise informally known as its the hacking corps.
Prosecutors said investigators found found classified documents in Pho’s home, and that he took them over a five-year period beginning in 2010.
Published reports, most notably in the New York Times, have reported that Pho was involved in the incident in which a still-unidentified group calling itself the Shadow Brokers hacked NSA tools using Kaspersky Lab software.
In the aftermath of that breach the Trump administration banned the use of the software. But that did little to blunt the impact of the public release of the NSA’s hacking tools.
The Shadow Brokers were able to use the tools in a series of ransomware attacks that shut down or disrupted businesses, hospitals, railways and other enterprises around the world.
According to media reports, an investigation revealed the hackers were able to carry out their brazen plan because an unidentified agency employee placed classified hacking tools on a home computer that was also loaded with Kaspersky’s antivirus program.
Russian spies then purportedly used the antivirus program’s file scanning function to search for classified documents on the computer — and all computers — running the software.
For its part,Kaspersky has denied any deliberate involvement in espionage. The company claims the software performed as it was designed to — it just couldn’t differentiate run-of-the-mill malware from that designed by the government.
Pho is one of three NSA workers to be charged in the past two years with mishandling classified information.
In Aug. 2016, Harold Thomas Martin III, of Glen Burnie, Maryland, was arrested by the FBI after federal prosecutors said the former NSA contractor illegally removed highly classified information and stored the material in his home and car.
In June, Reality Winner, a former Air Force linguist who worked as an NSA contractor at a facility in Augusta, Georgia, was charged with copying a classified U.S. report and mailing it to a news organization.
The charges against Pho carry a maximum sentence of 10 years in prison, followed by three years of supervised release. He is scheduled to be sentenced on April 6.