Anti-secrecy group WikiLeaks on Tuesday said it had obtained a secret trove of hacking tools used by the CIA to break into or circumvent the security of phones, communication apps and other devices, and published confidential documents describing those programs.
Among the most noteworthy WikiLeaks claims are that the Central Intelligence Agency, in partnership with other U.S. and foreign agencies, has been able to bypass the encryption on popular messaging apps such as WhatsApp, Telegram and Signal, by hacking phones that use Google Inc’s Android platform to collect audio and message traffic before encryption is applied.
Reuters could not immediately verify the contents of the published documents, but several contractors and private cyber security experts said the materials, dated between 2013 and 2016, appeared to be legitimate.
The information in what WikiLeaks said were 7,818 web pages with 943 attachments appears to represent the latest in a string of breaches in recent years of classified material from U.S. intelligence agencies.
Experts differed over how much the disclosures will damage U.S. cyber espionage. Many said that, while harmful, they do not compare to former National Security Agency contractor Edward Snowden’s revelations in 2013 of intrusive NSA surveillance.
Stuart McClure, CEO of Cylance, an Irvine, California, cyber security firm, said that one of the most significant disclosures shows how CIA hackers cover their tracks by leaving trails suggesting they are from Russia, China and Iran rather than the United States.
Other revelations show how the CIA took advantage of vulnerabilities that are known, if not widely publicized.
In one case, the documents say, U.S. and British personnel, under a program known as Weeping Angel, developed ways to take over a Samsung smart television, making it appear it was off when in fact it was recording conversations in the room.
“You thought your technology was safe. It’s never been safe,” said James Lewis, cyber security expert at the Center for Strategic and International Studies think tank.
The CIA and White House declined comment. “We do not comment on the authenticity or content of purported intelligence documents,” CIA spokesman Jonathan Liu said in a statement.
Google declined to comment on the reported hacking of its Android platform, but said it was investigating the matter.
Snowden on Twitter said the files amount to the first public evidence that the U.S. government secretly buys software to exploit technology, referring to a table published by WikiLeaks that appeared to list various Apple iOS flaws purchased by the CIA and other intelligence agencies.
An Apple Inc spokesman could not immediately be reached for comment.
The documents refer to means for accessing phones directly in order to catch messages before they are protected by end-to-end encryption tools like Signal.
Signal inventor Moxie Marlinspike said he took that as “confirmation that what we’re doing is working.” Signal and the like are “pushing intelligence agencies from a world of undetectable mass surveillance to a world where they have to use expensive, high-risk, extremely targeted attacks.”
CIA CYBER PROGRAMS
The CIA in recent years underwent a restructuring to focus more on cyber warfare to keep pace with the increasing digital sophistication of foreign adversaries. The spy agency is prohibited by law from collecting intelligence that details domestic activities of Americans and is generally restricted in how it may gather any U.S. data for counterintelligence purposes.
The documents published Tuesday appeared to supply specific details to what has been long-known in the abstract: U.S. intelligence agencies, like their allies and adversaries, are constantly working to discover and exploit flaws in any manner of technology products.
Unlike the Snowden leaks, which revealed the NSA was secretly collecting details of telephone calls by ordinary Americans, the new WikiLeaks material did not appear to contain material that would fundamentally change what is publicly known about cyber espionage.
WikiLeaks, led by Julian Assange, said its publication of the documents on the hacking tools was the first in a series of releases drawing from a data set that includes several hundred million lines of code and includes the CIA’s “entire hacking capacity.”
The documents do not include actual computer code needed to conduct the cyber exploits they describe.
WikiLeaks said it published the CIA documents “while avoiding the distribution of ‘armed’ cyber weapons until a consensus emerges on the technical and political nature of the CIA’s program and how such ‘weapons’ should be analyzed, disarmed and published.”
U.S. intelligence agencies have said that Wikileaks has ties to Russia’s security services. During the 2016 U.S. presidential campaign, Wikileaks published internal emails of top Democratic Party officials, which the agencies said were hacked by Moscow as part of a coordinated influence campaign to help Donald Trump win the presidency.
WikiLeaks has denied ties to Russian spy agencies.
U.S. officials, speaking on condition of anonymity, said they did not know where WikiLeaks might have obtained the material.
In a press release, the group said, “The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.”
U.S. intelligence agencies have suffered a series of major security breaches, including Snowden’s.
In 2010, U.S. military intelligence analyst Chelsea Manning provided more than 700,000 documents, videos, diplomatic cables and battlefield accounts to Wikileaks. President Barack Obama shortened her prison sentence in January.
Last month, former NSA contractor Harold Thomas Martin was indicted on charges of taking highly sensitive government materials over a course of 20 years, storing the trove of secrets in his home.
A longtime intelligence contractor with expertise in U.S. hacking tools said that people in the CIA and the NSA were “furious” about the apparent new breach. “This is not a Snowden-type situation,” he said. “This was taken over a long term and handed over to WikiLeaks.”