The Justice Department said Friday that Nghia Hoang Pho, 67, a 10-year veteran of the NSA’s Tailored Access Operations unit, which broke into computer systems, agreed to plead guilty to a single charge of removing and retaining top-secret documents from the agency.
He kept the material at his Ellicott City, Maryland home.
According to The New York Times, it was Vietnam-born Pho’s computer that apparent Russian hackers accessed via his use of Kaspersky software to steal files and programs the NSA developed for its own hacking operations.
The Justice Department said Pho had taken printed and digital copies of documents and writings labelled “secret,” and containing sensitive “national defense information,” and stored them in his home from 2010 until he was caught in 2015.
It gave no detail on why he did that, and did not say whether Pho had revealed or lost any of the information.
Pho faces up to 10 years in prison, though could negotiate a lighter punishment.
He was the third NSA employee charged in the past two years for taking home top-secret information.
The NSA declined to respond to questions on the case.
In October The Wall Street Journal reported that Russian hackers exploited anti-virus software made by Kaspersky Lab to steal top secret materials from an unnamed NSA employee.
The Journal said the 2015 hack led to the Russians obtaining information on how the NSA itself penetrates foreign computer networks and protects itself from cyberattacks.
The incident was a key reason why the US government earlier this year announced a ban on use of Kaspersky anti-virus software on government computers, warning that the Moscow-based company has suspect links to Russian intelligence.
Kaspersky denies any ties to the Russian government, but said its own forensic investigation did show that hackers made use of its software to break into the NSA worker’s home computer.
Kaspersky said what was stolen included essential source code for so-called Equation Group hacking software from the NSA.