Believed more significant than leaks from NSA contractor Edward Snowden, Wikileaks’ Vault 7 release of some 8,000 CIA documents detailing the extent of the agency’s hacking and surveillance toolbox has already dealt the planet a gut-check — making painfully clear no true privacy exists in 2017.
Officials have already launched an investigation in an attempt to determine who forked over such a sizable cache of markedly sensitive information — which, incidentally, represents merely 1 percent of the total number of documents, according to Wikileaks.
Beyond the near certain constitutional, legal, and ethical transgressions of the CIA evidenced in Vault 7, one thing became stunningly clear this week: whoever leaked the information — lone wolf or group, politically or morally motivated — is potentially even more damaging an Enemy Number One to the Central Intelligence Agency than Snowden has proven to be for the NSA.
“Mr. Snowden’s leaks revealed names of programs, companies that assist the NSA in surveillance and in some cases the targets of American spying. But the recent leak purports to contain highly technical details about how surveillance is carried out. That would make them far more revealing and useful to an adversary, one person said,” reported the Wall Street Journal this week.
“In one sense, Mr. Snowden provided a briefing book on U.S. surveillance, but the CIA leaks could provide the blueprints.”
Without transparency, government inevitably trims away privacy rights and other liberties. Greater than any need for adherence to authoritarian rule of law, blowing the whistle on corrupt, illegal, and unseemly practices of those in power constitutes an act of paramount importance — so integral to maintaining checks and balances, in fact, government propaganda to the contrary still has a large swath of the populace questioning Snowden instead of the National Security Agency and U.S. government.
Keep in mind that if you blame the messenger, you won’t focus attention on government wrongdoing. It’s unfortunately telling most Americans who could identify Edward Snowden — many, only vaguely as a ‘traitor’ — likely would not remember the names of any domestic surveillance programs he disclosed.
As the world waits with bated breath for the next dump from the pot-o-gold that is Vault 7, it’s imperative to examine five of the more insidious and dubious revelations this week — and how, if at all, they affect you.
We Got the Dankest Malware
In what seems to be a snide thumb of the nose at popular culture, the CIA named several of its collection and hacking tools after Hollywood movies — and agents aggrandized their exploits and electronic ‘weapons’ behind the scenes.
“The tools described in the documents carried bizarre names,” reports CBS News, “including Time Stomper, Fight Club, Jukebox, Bartender, Wild Turkey, Margarita and ‘RickyBobby,’ a racecar-driving character in the comedy film, ‘Talladega Nights’ — a tool to pillage and insert files on ‘newer versions of Microsoft Windows and Windows Server.’”
RickyBobby operated “as a lightweight implant for target computers” — introduced without triggering antivirus or security software — exploiting files included with Windows systems for over a decade.
But don’t think this goodie bag is withheld for use solely within the United States — or that the CIA doesn’t share the ‘wealth.’ According to CBS News, the “documents show broad exchanges of tools and information among the CIA, NSA and other U.S. intelligence agencies, as well as intelligence services of close allies Australia, Canada, New Zealand and the United Kingdom.”
Vault 7 included commentary from cocksure CIA agents — what would have to be considered a bit of comedic relief were it not for the underhanded topic-at-hand — including the telling:
“You know we got the dankest Trojans and collection tools.”
‘Reckless Beyond Words’
Documentation shows system vulnerabilities developed by the CIA — and shared with allied foreign governments — were then apparently left open for any hacker, anywhere in the world, to exploit for any purpose. Wikileaks stated,
“‘Year Zero’ introduces the scope and direction of the CIA’s global covert hacking program, its malware arsenal and dozens of ‘zero day’ weaponized exploits against a wide range of U.S. and European company products, include Apple’s iPhone, Google’s Android and Microsoft’s Windows and even Samsung TVs, which are turned into covert microphones.”
Further, the intelligence agency paid to retain the holes for future use. Snowden tweeted,
“If you’re writing about the [email protected] story, here’s the big deal: first public evidence USG secretly paying to keep US software unsafe.”
If you"re writing about the CIA/@Wikileaks story, here"s the big deal: first public evidence USG secretly paying to keep US software unsafe. pic.twitter.com/kYi0NC2mOp
— Edward Snowden (@Snowden) March 7, 2017
Essentially, the CIA put its covert forays into the systems of anyone it chooses to target — particularly journalists, human rights groups, and prominent activists — above privacy and security protections for the entire population.
Snowden affirmed in a series of tweets the authenticity of Vault 7 documents — and blasted the spy agency for inexcusable imprudence, stating,
“The CIA reports show the USG developing vulnerabilities in US products, then intentionally keeping the holes open. Reckless beyond words.”
The CIA reports show the USG developing vulnerabilities in US products, then intentionally keeping the holes open. Reckless beyond words.
— Edward Snowden (@Snowden) March 7, 2017
“Why is this dangerous? Because until closed, any hacker can use the security hole the CIA left open to break into any iPhone in the world.”
“Evidence mounts showing CIA & FBI knew about catastrophic weaknesses in the most-used smartphones in America, but kept them open — to spy.”
Evidence mounts showing CIA & FBI knew about catastrophic weaknesses in the most-used smartphones in America, but kept them open — to spy. https://t.co/mDyVred3H8
— Edward Snowden (@Snowden) March 7, 2017
Your Car Can Kill You — Particularly If the CIA Wants You Dead
That characterization in cable television shows and movies of the Central Intelligence Agency as the dark arm of the United States Government carrying out surreptitious operations — including targeted killings — isn’t, of course, a departure from the truth.
But how, exactly, the CIA executes such missions without being detected has been the subject of innumerable theories, but remained unsubstantiated conjecture — that is until Vault 7 revealed the agency can seize control of your vehicle remotely. In a lengthy press release, Wikileaks noted,
“As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks. The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations.”
READ MORE: Leaked Email Reveals Possible Evidence State Dept Never Intended to Charge Clinton
Upon this revelation, suspicion immediately trained on the odd circumstances surrounding the untimely death of government critic and award-winning journalist, Michael Hastings, in 2013.
Hastings garnered acclaim and won the George Polk award for his career-defining 2010 report for Rolling Stone, which portrayed General Stanley McChrystal, commander of NATO’s International Assistance Security Force in the Afghanistan War, in a negative light — ruffling feathers in the upper echelons of the government and ultimately costing the general his career in the process.
Shortly before his Mercedes inexplicably rocketed through a Los Angeles neighborhood and exploded into an intense fireball — (before or after directly striking a palm tree, according to authorities and witnesses, respectively) — Hastings disclosed he’d grown leery of being followed and surveilled by government actors, and appeared to fear for his life.
In fact, the 33-year-old journalist told a friend and neighbor he believed his car had been tampered with — just before it careened down the road, headlong into a tree, burning his body so badly, the coroner only secured identification through a match in the FBI’s database.
Hastings’ fatal crash — officially deemed accidental despite lingering questions — occurred on June 18, 2013. CIA documentation proves the agency sought improvements to technology allowing it to seize control of vehicle systems just one year later — putting a remotely-affected assassination within the realm of the plausible.
“There is reason to believe that intelligence agencies for major powers — including the United States — know how to remotely seize control of a car,” former U.S. National Coordinator for Security, Infrastructure Protection, and Counter-terrorism, Richard Clarke, told Huffington Post shortly after Hastings’ death.
“What has been revealed as a result of some research at universities is that it’s relatively easy to hack your way into the control system of a car, and to do such things as cause acceleration when the driver doesn’t want acceleration, to throw on the brakes when the driver doesn’t want the brakes on, to launch an air bag.
“You can do some really highly destructive things now, through hacking a car, and it’s not that hard.”
READ MORE: Stanford Researchers Warn U.S. -- Cops Already Using AI to Stop Crimes BEFORE They Happen
Smart Devices — Too Smart for Comfort
For years, cybersecurity and technology experts, as well as privacy and rights advocates, have admonished the public to beware the convenience proffered by devices linked to the Internet of Things — described by Jacob Morgan in Fortune as “the concept of basically connecting any device with an on and off switch to the Internet (and/or to each other). This includes everything from cellphones, coffee makers, washing machines, headphones, lamps, wearable devices and almost anything else you can think of. This also applies to components of machines, for example a jet engine of an airplane or the drill of an oil rig.”
Connecting devices — such as a cell phone, washing machine, smart TV, or home management system — might save time, but CIA documents reveal the same hardware of convenience offers ease of access for agents to install malware and use built-in microphones and cameras to spy whenever they see fit — even if the device is powered off. Wikileaks notes,
“The increasing sophistication of surveillance techniques has drawn comparisons with George Orwell’s 1984, but ‘Weeping Angel’, developed by the CIA’s Embedded Devices Branch (EDB), which infests smart TVs, transforming them into covert microphones, is surely its most emblematic realization.
“The attack against Samsung smart TVs was developed in cooperation with the United Kingdom’s MI5/BTSS. After infestation, Weeping Angel places the target TV in a ‘Fake-Off’ mode, so that the owner falsely believes the TV is off when it is on. In ‘Fake-Off’ mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server […]
“The CIA’s Mobile Devices Branch (MDB) developed numerous attacks to remotely hack and control popular smart phones. Infected phones can be instructed to send the CIA the user’s geolocation, audio and text communications as well as covertly activate the phone’s camera and microphone.”
Wired’s Matt Burgess elaborates that Weeping Angel “targeted the Samsung F8000 Smart TV. They say the TV could be turned into ‘covert listening devices’ by putting the TV into ‘fake-off’ mode. When the televisions appeared to be off, it was possible for conversations to be recorded. The CIA documents, which are from 2014, state ‘future work’ on the vulnerability could include capturing video from the televisions and being able to leave Wi-Fi turned on while ‘fake-off’ mode was enabled.”
While this is indeed ominous for obvious reasons, AsTech president Andrew McDonnell and other experts argue there’s no reason for panic, as he told Fortune,
“Many of the vulnerabilities cited in this tool set are well-known. ‘Smart’ TVs, old Android phones (like the President’s), unpatched routers, and a host of other devices have known vulnerabilities that are not exclusive to the CIA. These implementations may have been exclusive, but that doesn’t mean only the CIA had exploits. If genuine, there are likely some proprietary vulnerabilities or zero-days in there. Ultimately, secret backdoors in software — whether intentional or based on an exploit — make everyone less safe: there’s no way to control who uses them.”
Who Actually Hacked Who?
Perhaps the most debated and disputatious disclosure in the first batch of Vault 7 documents is the epiphany the CIA has collected a voluminous library of hacking techniques and code it can employ and customize as needed for certain exploits.
“The CIA’s Remote Devices Branch’s UMBRAGE group collects and maintains a substantial library of attack techniques ‘stolen’ from malware produced in other states including the Russian Federation,” Wikileaks reports.
“With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the ‘fingerprints’ of the groups that the attack techniques were stolen from.”
At first blush, such an operation seems to aptly explain limited evidence wrangled by U.S. officials from ostensive hacks of assorted government systems by supposed Russian state actors — Wikileaks even intimates as much.
However, upon review of the content of Vault 7 documents, some information technology experts disagree this tidbit evinces CIA complicity in framing Russia for hacking.
According to SearchSecurity, “There is no evidence these false flag attacks were planned or took place, and there appears to be no references in the CIA documents that indicate the agency planned to use these stolen attack techniques in such a manner.”
Indeed, pinning an attack on Russia this way, though feasible, would not necessarily be efficacious or guaranteed success — and while Wikileaks specifically mentions the Russian Federation in its Vault 7 statement, The Intercept points out nothing in the actual CIA documentation suggests these tools would or had been used in this manner. To wit, Russia isn’t mentioned at all, in conjunction with UMBRAGE or digital footprints.
But this is the CIA, after all, and considering its intricately-woven operations and intense cloak of secrecy, to say adamantly whether or not agents purposefully left Russian ‘fingerprints’ to lay blame on propaganda’s currently highlighted State enemy cannot be known with certainty.
*****
READ MORE: WATCH: Honest News Anchor Destroys CIA Russia Hack Claims in Under 5 Minutes
A final point worth noting, although these hacking tools and exploits show the CIA perfectly proficient in carrying out a massive surveillance effort, analysts claim the agency focuses on specific individuals for specific reasons — contrary to the NSA’s spying dragnet and collection practices — so the worst of the revelations don’t pertain to the average person.
But that doesn’t mean it hasn’t happened, either, as Wikileaks explained, documents show agents coordinate with technology staff to render customized exploits and data collection when necessary, and “the list of possible targets of the collection are ‘Asset’, ‘Liason Asset’, ‘System Administrator’, ‘Foreign Information Operations’, ‘Foreign Intelligence Agencies’ and ‘Foreign Government Entities’. Notably absent is any reference to extremists or transnational criminals.”
Poised to release the next treasure from Vault 7, Wikileaks continues to set Washington ablaze by forcing the government’s corrupt, unethical, greedy, and power-drunk officials to center stage under white-hot spotlights — where they must come to terms with the fact the American public stopped swallowing the excuse of security to give up liberty and privacy some time ago.
