In court in January, a prosecutor, the assistant United States attorney Matthew J. Laroche, said that “the government immediately had enough evidence” to make Mr. Schulte a target of the investigation. He said that the investigation was continuing, and that it involved in part how Tor, software that allows anonymous communication on the internet, “was used in transmitting classified information.”

Image The prime suspect, Joshua A. Schulte, has not faced charges in the breach, though prosecutors have charged him in a separate child pornography case.

Mr. Schulte’s lawyers have repeatedly demanded that prosecutors make a decision on the Vault 7 leak charges. Prosecutors said in court last week that they planned to file a new indictment in the next 45 days, and Mr. Schulte’s lawyer Sabrina P. Shroff, of the federal public defender’s office, asked the court to impose a deadline on any charges that the government sought to bring under the Espionage Act for supplying the secret C.I.A. files to WikiLeaks.

“This case has been dragging since August 2017,” Ms. Shroff said in an interview. “The government should be required to indict so Mr. Schulte has the opportunity to defend himself. Otherwise he is just languishing.”

Spokesmen for the C.I.A. and the Justice Department declined to comment. When WikiLeaks began to post the stolen documents last year, the C.I.A. said in a statement, “The American public should be deeply troubled by any WikiLeaks disclosure designed to damage the Intelligence Community’s ability to protect America against terrorists and other adversaries.”

Family members, who have spent much of their savings on legal fees, say they believe that Mr. Schulte is a scapegoat for the C.I.A.’s inability to secure its most sensitive files. They say the child pornography charges, based on his actions nine years ago when he was 20, are a thin pretext for keeping him incarcerated.

“I am just scared to death,” said Roger Schulte, Mr. Schulte’s father, who lives in Lubbock, Tex. “I think he’s innocent of all these crimes, as far as everything I’ve seen.” The elder Mr. Schulte said that his son was in college when he built the server later found to contain child pornography, and that he “had so many people accessing it he didn’t care what people put on it.”

Far from leaking classified information, his father said, Mr. Schulte had actually complained about security vulnerabilities at the C.I.A., first to his superiors and later to the agency’s inspector general and to a House Intelligence Committee staff member. Family members shared with The Times evidence of those contacts, which predated the Vault 7 release.