A former National Security Agency software developer with its Tailored Access Operations (TAO) has been sentenced to 66 months in prison plus three years of supervised release for taking home classified information without authorization.

Nghia Hoang Pho, 68, of Ellicott City, Md., had pleaded guilty in December of 2017 for his actions that ultimately led to the theft of classified NSA hacking tools and other information from his personal computer by Russian state-sponsored actors. Pho’s machine was breached on Oct. 4, 2014, after he installed what appeared to be a pirated Office 2013 application, which was later detected by the Kaspersky Lab anti-malware software running on the computer. 

Kaspersky Lab in November 2017 conducted an internal investigation on Pho’s infected machine after the Moscow-based security company came under scrutiny and faced allegations that its software had assisted Russian nation-state actors in stealing the NSA hacking tools off the NSA employee’s home computer. The security company has denied those allegations.

Pho’s PC was infected with the Mokes backdoor, aka Smoke Bot and Smoke Loader, an information-stealing backdoor Trojan sold in Russian cybercrime underground forums, Kaspersky Lab found.

The former NSA employee took home classified information in both digital and paper form between 2010 and March 2015, and eventually, some of that information was exposed to Russian state-sponsored hackers.  

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio