Nicholas Weaver, a computer scientist at the University of California at Berkeley, says the documents don't seem to reveal significant news about the CIA's capabilities — "it's describing a hacking organization that's doing a reasonably good job," he says.
What is surprising is that the documents are being published.
In a statement accompanying the document release, WikiLeaks alleges that the CIA has recently "lost control of the majority of its hacking arsenal," and that an archive with "several hundred million lines of code" has been circulating among former government hackers. One former government hacker or contractor gave a portion of that code to WikiLeaks, according to the organization.
Weaver calls that story "implausible," and raises the possibility that someone from outside the U.S. government compromised the CIA's systems to acquire the documents. And that, he says, would be a big deal: "Spies gonna spy, that's dog bites man. Spy dumps data on Wikileaks, proving that they exfiltrated it from a top-secret system? That's man bites dog."
Regardless of how they were acquired, the documents in the "Year Zero" release do not include the code for any cyberespionage programs. In its press release, Wikileaks says it is "avoiding the distribution of "armed' cyberweapons until a consensus emerges" on how to analyze and disarm such weapons.
Instead, the purported CIA documents reference and describe agency tools designed to extract information from computers, monitor communications and control electronic devices.
WikiLeaks says the files came from the CIA's internal Confluence system — a platform for team collaboration. They include instructions on how to use programs, and guides describing how to reduce the risk of CIA involvement being detected in a program. Some pages have comments from users whose names have been redacted, but appear to be software developers.
The alleged CIA documents show techniques developed specifically for "embedded systems" — which the files describe, in nontechnical terms, as "the Things in the Internet of Things." Think devices that don't look like computers, but use the Internet to work. For instance, one program uses a Samsung TV as a listening device, turning the microphone on while the TV appears to be off.
The documents also appear to show techniques the CIA has used to compromise and control individual smartphones. Wikipedia notes that such tactics would allow the agency to read even encrypted communications — but Weaver says that's misleading.
"The real story on encryption is not, 'Oh my God, the CIA breaks encryption,' but that encryption is so good that the CIA has to risk $1.5 million assets to compromise a target's iPhone if they want to read his messages," he says, noting the high price of developing smartphone-infiltrating techniques.
There's another concern about the methods that the CIA used to compromise phones. Ben Wizner, director of the ACLU Speech, Privacy and Technology Project, says the documents suggest the CIA "deliberately maintained vulnerabilities" in widely used devices.
"Those vulnerabilities will be exploited not just by our security agencies, but by hackers and governments around the world," he said in a statement. (Security consultant Tom Ritter tells NPR that according to the documents, the CIA does seem to have been aware of security vulnerabilities and not informed companies that could have fixed them.)
The CIA has traditionally been responsible for human espionage — officially, the NSA gathers "signals intelligence" and the CIA analyzes it. But the CIA also carries out its own cyber operations.
In February 2016, then-CIA Director John Brennan spoke with NPR's Mary Louise Kelly about, in part, the agency's desire to expand its cybercapabilities.
"The technological changes are taking place at a warped speed," he said:
"So we here at CIA, we recently set up a fifth directorate for the first time in 50 years, a new directorate ... the directorate of digital innovation, so that we can understand all of the opportunities and challenges associated with that digital environment.
"I'm not a technological expert by any means, but I recognize that more and more human transactions and interactions take place in that cyber environment. And it profoundly affects all of our ways of life, and it affects the intelligence mission. So I want to make sure that for CIA to be able to fulfill its responsibilities in the years ahead, we understand what the pitfalls are, what the opportunities are, so that we are able to master that environment consistent with our authorities, so we can carry out our respective missions."
Mike Pompeo, the new head of the CIA under President Trump, said in a written questionnaire accompanying his confirmation hearing that he understood that the agency, "upon direction from the President and working in cooperation with other agencies when appropriate, has capabilities to perform a wide [array of] actions related to all forms of cybersecurity policies."
Copyright 2017 NPR. To see more, visit http://www.npr.org/.
9(MDAxOTAwOTE4MDEyMTkxMDAzNjczZDljZA004))
