Former CIA intelligence officer Joshua Schulte is suspected of being the source who gave WikiLeaks top secret documents and source code of some CIA’s hacking tools. If that’s true, public statements he's made about the secret-spilling organization and its sources directly contradict what he allegedly did a few years later.
In 2010, when WikiLeaks published diplomatic cables, war logs, and documents about the Iraq and Afghanistan wars provided to it by Chelsea Manning, Schulte was working for the CIA, according to his LinkedIn account. At the same time, he was also following—and commenting—on the news on a pseudonymous Twitter account, where he lashed out at Manning.
“Kill the prick,” he tweeted commenting on a story about a rally in support of Manning.
Schulte is currently being held in a Manhattan jail awaiting trial for possessing child pornography, though the Department of Justice said in court filings that Schulte remains a prime suspect in an investigation into who leaked CIA hacking tools to WikiLeaks. The Daily Beast reported Wednesday that that Schulte had posted snippets of CIA code on his GitHub account in 2013, years before the code was posted on WikiLeaks.
In another tweet from 2010, when he shared a link to a Fox News story on former Rep. Mike Rogers calling for Manning to be executed, Schulte wrote: “This is even being questioned? Of course he should be executed."
In reaction to current national security advisor John Bolton’s assertion that Manning should be charged with treason, Schulte wrote: “At last! Someone who shares my thoughts… Off with his head!”
On Tuesday, The Washington Post and The New York Times revealed that the US government is investigating Schulte, and believe he is the person behind the leak of the CIA documents and code, which WikiLeaks codenamed Vault 7.
Schulte, who worked at the NSA first and then at the CIA for six years, has a sizable online footprint. According to the criminal complaint filed against him, Schulte ran a filesharing server called “The Crypt,” which was hosted at Cryptm.org.
The server is a treasure trove of data, and provides clues to Schulte’s online personas. For example, there’s a screenshot of Schulte’s Gmail inbox, which shows he used the handle “pedbsktbll” on a dating site, and as a username for several online games.
Got a tip? You can contact this reporter securely on Signal at +1 917 257 1382, OTR chat at firstname.lastname@example.org, or email email@example.com
Schulte appears to have used that same handle on Twitter, OKCupid, and other online services. On a chess website, pedbsktbll is registered to a Josh Schulte. Also, the @pedbsktbll Twitter account follows accounts that appear to belong to Schulte’s brothers (the names and online accounts of some of his family members were confirmed with information uploaded directly to Schulte’s personal page on The Crypt, and public records.)
The handle was first linked to Schulte on Wednesday, when The Daily Beast reported that Schulte had posted snippets of CIA code on his GitHub account in 2013, years before the code was posted on WikiLeaks. That account’s handle is also pedbsktbll.
Schulte’s lawyer Sabrina Shroff told the Associated Press on Tuesday that her client "has spent years working to ensure the safety of his country and is deeply saddened to hear that he could face charges of espionage."
Hoff did not did not immediately respond to a request for comment.
The CIA declined to comment. And Manning, who’s now running for the Senate in Maryland, also declined to comment through a spokesperson.
Get six of our favorite Motherboard stories every day by signing up for our newsletter.