It took a few months, but the Department of Justice has finally filed charges in the largest hack and leak of the CIA in its history. Prosecutors filed a superseding indictment yesterday against Joshua Schulte, a former computer engineer for the agency, who had previously faced charges relating to child pornography. The DoJ alleges that Schulte stole massive amounts of data relating to the CIA’s counter-cyberwarfare efforts and gave it to Wikileaks, which published it last year:

Joshua Schulte, 29, was charged in a new grand jury indictment with providing WikiLeaks with a massive trove of U.S. government hacking tools that the online publisher posted in March 2017, the Justice Department announced on Monday.

Schulte was previously facing child pornography charges in federal court in New York, but the indictment broadens the case to accuse him of illegally gathering classified information, damaging CIA computers, lying to investigators and numerous other offenses.

In January, attorneys involved in the child porn case revealed in court that Schulte was the target of a major investigation into WikiLeaks’ release of a CIA collection known as “Vault 7.”

Politico also has a copy of the new indictment, which replaces the previous indictment for Schulte over his alleged involvement in child pornography. That case raised some eyebrows as to prosecutor intent and Schulte’s actual involvement in the traffic over his servers. At the time, the suggestion was that the DoJ ginned up the child-porn charges as a way to keep Schulte detained while they built a case for espionage against him. If so, the DoJ isn’t backing down, as those charges remain in the new indictment.

The DoJ also has the indictment available as a link in their press release about the Schulte case, but the release has another interesting lacuna. It never mentions WikiLeaks at all, nor does the indictment, at least by name. Both make reference to “Organization-1,” even though everyone knows that it’s WikiLeaks. Perhaps that could indicate that the DoJ may not be interested in pursuing charges against the group for receiving and publishing the data — at least not for now. Or maybe they’re going to bide their time and see if they can get Julian Assange once the Ecuadorians get tired enough of him to give him the boot.

Interestingly, the DoJ’s chart of potential penalties on each count shows that Schulte’s still most at risk on the child-porn charges, two of which carry a potential 20-year prison sentence. The Espionage Act (18 USC 793) violations carry a maximum 10-year prison sentence. Assuming Schulte gets convicted on all of these counts, there is at least some possibility that a judge will combine the related charges into two groups, espionage and porn, and deliver concurrent sentences within the groups but combine the two groups for a consecutive sentence. That would put Schulte away for a very long time.