Who Actually Did Leak CIA Cyber Weapons Data?

The largest known data theft in CIA history happened because a cyber espionage unit had an employee who took advantage of weak security and gave secret hacking tools to WikiLeaks, according to a secet internal report just released. 

The breach was revealed in March 2017 when WikiLeaks published what it characterised as the largest-ever trove of acquired CIA documents, known as ‘Vault 7’. The hacking tools stolen in the breach, which occurred in 2016, came from its clandestine Center for Cyber Intelligence (CCI). The amount of data stolen is unknown, the memo said, but could be as much as 34 terabytes of data which is the equivalent of 2.2 billion pages of text. 

A former CIA employee, Joshua Schulte, has been accused of being behind the leak, altough a federal grand jury this year failed to reach a verdict on allegations of illegal gathering and transmission of national security information. The leaked material attracted controversy, showing that the CIA had the capability to perform widespread electronic surveillance, including compromising individuals’ smartphones, cars, computers and smart TVs.

Whistle-blower Edward Snowden criticised the CIA for intentionally maintaining vulnerabilities in US products. The theft was revealed around a year later, in March 2017, when WikiLeaks published what it claimed was the largest trove of CIA documents, dubbed "Vault 7," detailing some of the agency's sophisticated cyber weapons, this was reported by the Washington Post.

That incident prompted a review by the CIA WikiLeaks Task Force, which submitted its findings to then-Director Mike Pompeo and his deputy, who is now the director, Gina Haspel.  

While the CIA declined to comment on any specific report, agency spokesperson Timothy Barrett told CNN, "CIA works to incorporate best-in-class technologies to keep ahead of and defend against ever-evolving threats... The report is heavily redacted but clearly states that the breach came as a result of a series of security shortcomings ."

The task force memo was released by Democrat Senataor Ron Wyden,  who sits on the Senate Intelligence Committee, who obtained an incomplete, redacted version from the Justice Department. In a letter to the new Director of National Intelligence, Wyden asked for more information about "widespread cybersecurity problems across the intelligence community." 

The material published by WikiLeaks in 2017 suggested that the CIA had become the globe's pre-eminent hacking operation, breaking into high-tech phones and televisions to spy on people worldwide. 

Leaked information published by WikiLeaks as part of the "Vault 7" series contained notes about how the agency allegedly targeted individuals through malware and physical hacking on devices including phones, computers and TVs. 

To hide its operations, the CIA routinely adopted techniques that enabled its hackers to appear as if they were Russian, according to the documents published by WikiLeaks. 

The CIA's lax cybersecurity practices were also highlighted during the trial of Joshua Schulte, the ex-CIA employee who is accused of handing over reams of classified data to WikiLeaks in 2016. The October 2017 CIA report was introduced as evidence during the trial and Schulte's attorneys argued that the system's security was so poor that the information could have been accessed by a large number of employees. 

Following the failed prosection, it is still not officially known whether or nor Schulte actually did give the data to WikiLeaks. 

Wikileaks:     CNN:       New York Times:      US Senate:      Engineering Technology:     Politico:    Brian Krebs

Image: CIA 

You Might Also Read: 

Julian Assange Faces New Criminal Charges:

Snowden Accuses CIA Of 'A PR Fix':

 

« Coronvirus Phishing Campaign Targets Six Nations
Online Shoppers Have Lost Over £16m To Lockdown Fraud »

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 4,000+ specialist service providers.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

InfoSec Institute

InfoSec Institute

InfoSec Institute provides certification-based training courses for security professionals and enterprise-grade security awareness and phishing training for businesses.

Acunetix

Acunetix

Acunetix is a leading web vulnerability scanner, widely acclaimed to include the most advanced SQL injection and XSS black box scanning technology.

BackBox Software

BackBox Software

BackBox is a leading provider of solutions for automated backup and recovery software for security and network devices.

SAS Institute

SAS Institute

SAS is a leader in business analytics software and services providing solutions for a wide range of critical business areas including risk management, compliance and fraud prevention.

TruNarrative

TruNarrative

TruNarrative provides a unified solution for Identity Verification, Fraud Detection, eKYC, Risk Assessment, AML Compliance and Account Monitoring.

Wolfberry Cyber

Wolfberry Cyber

Wolfberry Cyber are a leading Cyber Security Consultancy with offices in London and Dubai. Services include penetration testing and security assessments.

CyCraft Technology Corp

CyCraft Technology Corp

CyCraft is an AI company that forges the future of cybersecurity resilience through autonomous systems and human-AI collaboration.

Cyber-Security Council Germany

Cyber-Security Council Germany

Cyber-Security Council Germany provides a wide range of services to inform and support its members against cybercrime with a focus on their operational and working requirements.

Deepwatch

Deepwatch

deepwatch’s cloud SecOps platform and relentless customer focus are redefining the managed security services industry.