Guilty: NSA bloke who took home exploits at the heart of Kaspersky antivirus slurp row

Maryland man cops to making illegal copies of top-secret code

By Shaun Nichols in San Francisco


An NSA hacker has admitted taking home copies of classified software exploits – understood to be the cyber-weapons slurped from an agency worker's home Windows PC by Kaspersky Labs' antivirus.

Nghia Hoang Pho, 67, pleaded guilty in a US district court in Baltimore on Friday to one count of willful retention of national defense information. The Vietnam-born American citizen, who lives in Ellicott City, Maryland, faces roughly six to eight years in the clink, with sentencing set for April next year.

Pho is understood to be the Tailored Access Operations (TAO) programmer whose home computer was running Kaspersky Lab software that was allegedly used, one way or another, by Russian authorities to steal top-secret NSA documents and tools in 2015.

According to Kaspersky, its security package running on the PC detected Pho's copies of the NSA exploits as new malicious software, and uploaded the powerful spyware to its cloud for further analysis by its researchers. The biz deleted its copy of the archive as soon as it realized what it had discovered, it is claimed. It is further alleged by US government sources that Russian spies were able to get their hands on the top-secret code via the antivirus package, although Kaspersky denies any direct involvement.

Judging from his plea deal with prosectors, Pho broke federal law when, as a developer on the NSA's TAO hacking team, he took his work home with him multiple times and, in the process, exposed the classified information. Pho admitted that, over a five-year period starting in 2010, he copied information from NSA machines and took it all home with him.

"Beginning in 2010 and continuing through March 2015, Pho removed and retained U.S. government documents and writings that contained national defense information, including information classified as Top Secret and Sensitive Compartmented Information," the US Department of Justice said in disclosing Friday's guilty plea.

"This material was in both hard-copy and digital form, and was retained in Pho’s residence in Maryland."

No other charges were filed, and there is no mention of any efforts by Pho to sell or pass off any of the data.

Kaspersky Lab has denied any wrongdoing in the matter or illicit ties to Russian intelligence. The security vendor also pointed out Pho's machine was infected with loads of malware, meaning any miscreant could have stolen Uncle Sam's cyber-weapons.

Regardless, the Moscow-based biz is fighting a ban on the use of its products on American government networks. Meanwhile, British spies at surveillance nerve center GCHQ today warned Brits to be wary of cloud-based antivirus toolkits. Kaspersky isn't named specifically, but reading between the lines, Blighty's snoops are saying: don't Pho-k it up like the NSA did. ®

Sign up to our NewsletterGet IT in your inbox daily


More from The Register

Hua-no-wei! NSA, FBI, CIA bosses put Chinese mobe makers on blast

No probs, says Huawei: It's a big world, we don't need America

WikiLeaks drama alert: CIA forged digital certs imitating Kaspersky Lab

Vault 8 release says spooks used disguise to siphon off data

Spotted: Miscreants use pilfered NSA hacking tools to pwn boxes in nuke, aerospace worlds

High-value servers targeted by cyber-weapons dumped online by Shadow Brokers

30 spies dead after Iran cracked CIA comms network with, er, Google search – new claim

Uncle Sam's snoops got sloppy with online chat, it seems

Spies do spying, part 97: The CIA has a tool to track targets via Wi-Fi

Thanks, WackyLeaks

Ex-CIA man fingered as prime suspect in Vault 7 spy tool manuals leak

Report claims former intel worker believed to be behind data dump

Kaspersky: Clumsy NSA leak snoop's PC was packed with malware

Lab suspects Chinese spyware was on home computer

Google Play Store spews malware onto 9 million 'Droids

How did these get through the net?

NSA dev in the clink for 5.5 years after letting Kaspersky, allegedly Russia slurp US exploits

Bloke sent down after spilling Uncle Sam's cyber-weapons

Learn client-server C programming – with this free tutorial from the CIA

Available now via everyone's favorite publisher, WikiLeaks – Отличная работа, Джулиан!