WikiLeaks Publishes Massive Archive of CIA Hacking Tools

Julian Assange is back, this time purportedly exposing some of Langley’s most sensitive secrets.

WikiLeaks released a huge trove on Tuesday of hacking tools allegedly developed and used by the CIA, a release that — if authentic — would constitute one of the most significant breaches of classified information in the agency’s history.

According to the group led by Julian Assange, the dump includes tools to penetrate popular consumer electronics such as Apple iPhones, Android mobile devices, and smart TVs. The tools purportedly allow agency hackers to penetrate the devices and use them for surveillance and to steal data.

While the National Security Agency serves as the primary signals intelligence agency within the U.S. government and employs a cadre of elite hackers, the CIA has built a separate capability to operate clandestinely on the web and to break into computers around the world.

The authenticity of the documents and code released Tuesday remains unclear, and the CIA refused to comment on the dump. “We do not comment on the authenticity or content of purported intelligence documents,” said Heather Fritz Horniak, a CIA spokesperson.

American intelligence agencies have accused WikiLeaks of serving as a front for the Russian government by publishing documents stolen from American political organizations by hackers working on behalf of the Kremlin. The publication of those documents, including emails belonging to Hillary Clinton campaign chairman John Podesta, served a central role in Moscow’s campaign of interference on Donald Trump’s behalf in the 2016 election.

WikiLeaks’ publication of CIA hacking tools comes on the heels of a series of embarrassing disclosures for the U.S. intelligence community. Last year, a group calling itself the Shadow Brokers put NSA hacking tools up for sale online. Shortly thereafter, U.S. investigators arrested an NSA contractor for stockpiling classified information at his home, in what prosecutors have said may be the largest compromise of agency secrets in its history.

In announcing the publication of the CIA tools, WikiLeaks claimed that “the archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.”

WikiLeaks said its source had provided it with the data in order to examine “whether the CIA’s hacking capabilities exceed its mandated powers” and “to initiate a public debate about the security, creation, use, proliferation and democratic control of cyberweapons.”

The publication of tools that may jeopardize ongoing intelligence operations and undermine the CIA’s ability to snoop represents a black eye for the agency at a time when it is already questioned by President Trump, who has likened his own spies to Nazi Germany.

Trump has repeatedly cast doubt on the intelligence community’s conclusion that Russia waged an active operation to boost his electoral chances by hacking into the computers of his political opponents, spilling their contents online, and organizing a disinformation campaign.

Tuesday’s publication includes a variety of tools to break into digital devices and evade security measures, including methods to bypass common anti-virus software, turn computers and phones into remote microphones, and so-called “zero day” vulnerabilities, which are software and hardware flaws unknown to the manufacturer. Such vulnerabilities represent key tools to break into computers and can sell for upwards of six figures on the black market.

By hacking directly into Android and Apple phones, WikiLeaks says the CIA can bypass popular encrypted messaging applications such as Signal and WhatsApp. That technique does not imply that the CIA has discovered a flaw in those applications to decrypt messages. Hacking into phones in order to read messages before they are encrypted is a common technique to bypass sophisticated encrypted messaging tools.

Once such vulnerabilities have been exposed, manufacturers and security companies can plug those holes and render the CIA’s hacking tools ineffective. Publishing such code en masse can be described as the digital equivalent of rolling up a spy agency’s network of agents.