That incident is believed to be among the reasons the Trump administration banned the use of Kaspersky software.
Pho is at least the third NSA employee or contractor to be charged within the past two years on counts of improperly taking classified information from the agency, breaches that have prompted criticism of the secretive NSA.
The court documents don't reveal Pho's motive or anything he may have done or meant to do with the documents.
"The facts supporting this criminal charge and guilty plea display a total disregard of the defendant's oath and promise to protect our nation's national security", said Stephen Schenning, acting USA attorney in Maryland.
Anti-virus software detects malicious code on a system by scanning its contents and can serve as a platform for digital espionage. The chief executive of Russia's Kaspersky Lab, Eugene Kaspersky, says he's ready to have his company's source code examined by USA government officials to help dispel long-lingering suspicions about his company's ties to the Kremlin.
Pho, 67, was removed from his position in 2015 as a result of this.More news: Did Trump Admit To Obstruction Of Justice In Latest Michael Flynn Tweet?
An NSA hacker has admitted taking home copies of classified software exploits - understood to be the cyber-weapons slurped from an agency worker's home Windows PC by Kaspersky Labs' antivirus.
Kaspersky admits that the files were automatically uploaded to its servers for further analysis, a standard procedure for antivirus vendors, but they were later deleted when the company realized they were classified material.
Last fall, the Justice Department charged another TAO employee, a contractor named Harold Martin III, who had taken classified tools and other material home over several years. She pleaded not guilty. Now he's pleading guilty to a federal crime.
A federal grand jury indicted former NSA contractor Harold Martin in February on charges alleging he spent up to 20 years stealing up to 50 terabytes of highly sensitive government material from the USA intelligence community, which were hoarded at his home. The trove was published by a mysterious group calling itself the Shadow Brokers. Investigators suspect the Russian government is behind that release, though they have no proof to substantiate the claim.
The NSA, whose main mission is gathering and analyzing foreign communications for potential security threats, is based at Fort Meade, Maryland. "It denotes another attack on the bedrock secrecy and discipline required" of those holding security clearances, he said. Pho remains free while he awaits sentencing, which has been scheduled by US District Judge George L. Russell for April 6, 2018.