April 20, 2016. A backup comes back from the dead.
Somewhere in the CIA’s cyber-espionage division, an old backup file was about to undo months of caution.
Joshua Schulte was a systems administrator on DevLAN, the CIA’s internal network for building cyber-espionage tools. Months before that date, the agency had stripped his administrator privileges, after friction with colleagues on his team. On April 20, 2016, prosecutors said, he restored a backup file that quietly reinstated the access the agency thought it had taken away, then used that window to copy the CIA’s hacking-tool archive. Afterward, according to the government, he went through the workstation’s activity logs and deleted the entries that would have shown what he’d done. (Every heist movie’s second act, minus the soundtrack.)
Nobody noticed. Not for a year. (The agency built to notice everything took twelve months to notice this.)
That archive surfaced a year later. Starting in March 2017, WikiLeaks began publishing it as “Vault 7,” what the Department of Justice later called the largest data breach in CIA history and one of the largest unauthorized disclosures of classified information in U.S. history.
Schulte denied it, flatly. His defense argued the forensic record actually helped him: no external drive was ever logged as connected to the workstation in question, and roughly 200 other people had access to the same DevLAN systems. The first trial, in early 2020, ended in a partial mistrial: the jury convicted him of contempt and lying to the FBI but hung on the core espionage and hacking counts. Federal prosecutors retried the case. In July 2022, a jury convicted him on all the remaining counts. In February 2024, a federal judge in Manhattan sentenced him to 40 years (the longest sentence to date for unauthorized disclosure of national defense information outside of traditional nation-state espionage) in a decision that also folded in an unrelated child-sexual-abuse-material conviction.
Two trials, two years apart. One question sat underneath both of them: does the digital trail actually place him at the theft?
The artifact: not the leak, the log
The Vault-7 archive is the headline. It is not the artifact a software expert actually works from.
Strip the headline away, and here’s what’s actually on the table: the DevLAN audit trail. The record of who had administrator rights and when, the restored backup that briefly returned Schulte’s stripped privileges, the workstation activity logs from the exfiltration window, and, just as important, the gap in that log where entries were allegedly deleted afterward.
A missing log entry is not neutral. It can mean someone covered their tracks. It can also mean the logging system failed, rotated, or was never configured to capture that action in the first place. Which explanation survives depends entirely on how the log was built, retained, and later reconstructed, not on how convincing either lawyer sounds in a closing argument.
Why a generalist misses it
A lawyer can read an incident summary and repeat “he restored a backup and deleted the logs.” A generalist engineer can explain, in the abstract, how Unix permissions and backup restores work. Neither of those answers what a jury actually has to weigh: does the log’s timestamp resolution place the restore at a specific minute, or only somewhere in a multi-hour window? Is the “deletion” a real erasure, or a gap explainable by log rotation, retention limits, or a system that was, as the defense argued, accessible to roughly 200 people? If administrator access briefly returned, does the log show who was logged in during that window, or only that the access existed?
A court-appointed software expert starts by naming the narrow technical question: not “was Schulte guilty,” but “does this specific log, given its structure and known limits, place a specific action at a specific account at a specific time.” Then the materials: the backup file, the access-control records, the workstation logs, the retention and rotation policy for that logging system. Then a repeatable method: how each artifact was extracted, what its actual precision is, and how it was tested against the others rather than read in isolation. Only then a conclusion: one that states plainly what the log can support and what it cannot.
That is what holds up under cross-examination. An expert who says “the log shows this, and here is exactly what it does not show” is credible. An expert who reads a headline conclusion into a gap in a log file is not, and a competent cross-examiner will find the seam.
Why Israeli counsel and tech GCs should care
Israeli tech companies run on internal access controls, admin backups, and activity logs: DevOps teams, cloud consoles, source-control systems, internal network shares. Every one of those systems keeps a log with real limits: retention windows, rotation policies, gaps where nothing was ever recorded. Companies rarely think about what that log can prove until an insider incident, a departing employee, or a leak investigation puts it in front of a court.
For litigators, the lesson from Vault 7 has nothing to do with espionage law and everything to do with evidence discipline: before anyone testifies about what an access log “shows,” someone independent needs to test what the log actually records, at what resolution, and where it can mislead. For company counsel, the same question runs earlier: know what your systems log, and what they don’t, before an incident forces you to find out in front of a judge.
The takeaway
Vault 7 will keep getting cited as an espionage case. Underneath the headline, it was always a case about whether a restored backup and a set of workstation logs could place one specific person at one specific act, at a resolution a court could trust. A generalist doesn’t read that off a server report. It takes a court-grade software expert: define the technical question narrowly, name the materials, apply a method that can be repeated, and say plainly where the evidence stops.
The above is general information only and does not constitute legal advice. Case facts are drawn from the sources cited.