But in court documents, prosecutors did disclose that he worked from 2006 to 2016 for the N.S.A.’s “Tailored Access Operations.” The unit, whose name has now been changed to Computer Network Operations, is the N.S.A.’s fastest-growing component. Its hackers break into foreign computer networks to gather intelligence, often leaving behind software implants that continue to collect documents and other data and forward it to the agency for months or years.

Prosecutors said that from 2010 until March 2015, Mr. Pho began removing classified documents and writings. He kept those materials, some in digital form, at his home in Maryland, according to prosecutors.

It appears he was charged in March 2015.

Mr. Pho is one of three N.S.A. workers to be charged in the past two years with mishandling classified information, a dismal record for an agency that is responsible for some of the government’s most carefully guarded secrets.

The leaks have come to light as investigators scramble to trace the source of an even worse breach of N.S.A. security: the public release of the agency’s hacking tools by a still-unidentified group calling itself the Shadow Brokers. Some of those tools have been subsequently used for “ransomware” attacks that shut down or disrupted businesses, hospitals, railways and other enterprises around the world this year.

Government officials, who would speak of the classified details of the case only on condition of anonymity, said that Mr. Pho took the classified documents home to help him rewrite his resume. But he had installed on his home computer antivirus software made by Kaspersky Lab, a top Russian software company, and Russian hackers are believed to have exploited the software to steal the documents, the officials said.