WASHINGTON: The disclosure this week of documents describing secret CIA hacking tools shows that intensified US government efforts to prevent leaks by intelligence agency employees and contractors have largely failed, cybersecurity professionals and intelligence officials say.
If the Central Intelligence Agency disclosures are confirmed to be the work of an intelligence agency contractor, as government investigators currently suspect, it would be at least the third public case in recent years in which special software and human resources programs intended to catch so-called insider threats have not worked.
WikiLeaks founder Julian Assange on Thursday accused the CIA of “devastating incompetence” for keeping hacking secrets in one place and said he would work with tech giants to develop fixes after he leaked them.
“This is a historic act of devastating incompetence, to have created such an arsenal and then stored it all in one place,” Assange told a press conference streamed live from Ecuador’s embassy in London, where he has been living as a fugitive from justice since 2012.
“It is impossible to keep effective control of cyber weapons... If you build them, eventually you will lose them,” Assange said.
He said his anti-secrecy website had “a lot more information” about the Central Intelligence Agency’s hacking operation but would hold off on publishing it until WikiLeaks had spoken to tech manufacturers about fixes.
“We have decided to work with them to give them some exclusive access to the additional technical details we have so fixes can be developed and then pushed out.
“Once this material is effectively disarmed by us we will publish additional details about what has been occurring,” he added.
Part of the problem in combating leaks is that the number of government employees and contractors with access to highly sensitive information has exploded in recent years, due in part to greater information-sharing across the government that was mandated in the wake of the Sept. 11, 2001, attacks.
Budget constraints that force agencies to rely on contractors rather than permanent staff have also contributed to the problem, intelligence officials say. Government estimates of how many people have been granted Top Secret clearances range from the high hundreds of thousands to more than a million across thousands of public agencies and private companies.
Government agencies estimate that there is one insider threat for every 6,000 to 8,000 employees, an intelligence agency contractor said, speaking on condition of anonymity for fear of upsetting his employer. The contractor said there is too much sharing of information internally, with many workers having access to material they do not need.
Two officials speaking on condition of anonymity said intelligence agencies have been aware since the end of last year of the breach, which led to WikiLeaks releasing thousands of pages of information on its website on Tuesday.
According to the documents, CIA hackers could get into Apple Inc. iPhones, devices running Google’s Android software and other gadgets in order to capture text and voice messages before they were encrypted with sophisticated software.
The White House said on Wednesday that President Donald Trump was “extremely concerned” about the CIA security breach that led to the WikiLeaks release.
“Anybody who leaks classified information will be held to the highest degree of law,” spokesman Sean Spicer said.
The two officials told Reuters they believed the published documents about CIA hacking techniques used between 2013 and 2016 were authentic.
One of the officials with knowledge of the investigation said companies that are contractors for the CIA have been checking to see which of their employees had access to the material that WikiLeaks published, and then going over their computer logs, e-mails and other communications for any evidence of who might be responsible.
On Tuesday in a press release, WikiLeaks itself said the CIA had “lost control” of an archive of hacking methods and it appeared to have been circulated “among former US government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.”
The agency said in a statement that its mission was to collect foreign intelligence abroad “to protect America from terrorists, hostile nation states and other adversaries” and to be “innovative, cutting-edge, and the first line of defense in protecting this country from enemies abroad.”
The CIA is legally prohibited from surveillance inside the US and “does not do so,” the statement added.
A US government source familiar with the matter said it would be normal for the Federal Bureau of Investigation (FBI) and the CIA both to open investigations into such leaks. US officials previously have confirmed that prosecutors in Alexandria, Virginia for years have been conducting a federal grand jury investigation of WikiLeaks and its personnel.
US Senator Dianne Feinstein of California and a Democrat on the intelligence committee, said the government needed to stop the breaches.
“I think we really need to take a look at the contractor portion of the employee workforce, because you have to be loyal to America to work for an intelligence agency, otherwise don’t do it,” Feinstein said.
Both US Senate and US House of Representatives intelligence committees have either opened or are expected to open inquiries into the CIA breach, congressional officials said.
If the Central Intelligence Agency disclosures are confirmed to be the work of an intelligence agency contractor, as government investigators currently suspect, it would be at least the third public case in recent years in which special software and human resources programs intended to catch so-called insider threats have not worked.
WikiLeaks founder Julian Assange on Thursday accused the CIA of “devastating incompetence” for keeping hacking secrets in one place and said he would work with tech giants to develop fixes after he leaked them.
“This is a historic act of devastating incompetence, to have created such an arsenal and then stored it all in one place,” Assange told a press conference streamed live from Ecuador’s embassy in London, where he has been living as a fugitive from justice since 2012.
“It is impossible to keep effective control of cyber weapons... If you build them, eventually you will lose them,” Assange said.
He said his anti-secrecy website had “a lot more information” about the Central Intelligence Agency’s hacking operation but would hold off on publishing it until WikiLeaks had spoken to tech manufacturers about fixes.
“We have decided to work with them to give them some exclusive access to the additional technical details we have so fixes can be developed and then pushed out.
“Once this material is effectively disarmed by us we will publish additional details about what has been occurring,” he added.
Part of the problem in combating leaks is that the number of government employees and contractors with access to highly sensitive information has exploded in recent years, due in part to greater information-sharing across the government that was mandated in the wake of the Sept. 11, 2001, attacks.
Budget constraints that force agencies to rely on contractors rather than permanent staff have also contributed to the problem, intelligence officials say. Government estimates of how many people have been granted Top Secret clearances range from the high hundreds of thousands to more than a million across thousands of public agencies and private companies.
Government agencies estimate that there is one insider threat for every 6,000 to 8,000 employees, an intelligence agency contractor said, speaking on condition of anonymity for fear of upsetting his employer. The contractor said there is too much sharing of information internally, with many workers having access to material they do not need.
Two officials speaking on condition of anonymity said intelligence agencies have been aware since the end of last year of the breach, which led to WikiLeaks releasing thousands of pages of information on its website on Tuesday.
According to the documents, CIA hackers could get into Apple Inc. iPhones, devices running Google’s Android software and other gadgets in order to capture text and voice messages before they were encrypted with sophisticated software.
The White House said on Wednesday that President Donald Trump was “extremely concerned” about the CIA security breach that led to the WikiLeaks release.
“Anybody who leaks classified information will be held to the highest degree of law,” spokesman Sean Spicer said.
The two officials told Reuters they believed the published documents about CIA hacking techniques used between 2013 and 2016 were authentic.
One of the officials with knowledge of the investigation said companies that are contractors for the CIA have been checking to see which of their employees had access to the material that WikiLeaks published, and then going over their computer logs, e-mails and other communications for any evidence of who might be responsible.
On Tuesday in a press release, WikiLeaks itself said the CIA had “lost control” of an archive of hacking methods and it appeared to have been circulated “among former US government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.”
The agency said in a statement that its mission was to collect foreign intelligence abroad “to protect America from terrorists, hostile nation states and other adversaries” and to be “innovative, cutting-edge, and the first line of defense in protecting this country from enemies abroad.”
The CIA is legally prohibited from surveillance inside the US and “does not do so,” the statement added.
A US government source familiar with the matter said it would be normal for the Federal Bureau of Investigation (FBI) and the CIA both to open investigations into such leaks. US officials previously have confirmed that prosecutors in Alexandria, Virginia for years have been conducting a federal grand jury investigation of WikiLeaks and its personnel.
US Senator Dianne Feinstein of California and a Democrat on the intelligence committee, said the government needed to stop the breaches.
“I think we really need to take a look at the contractor portion of the employee workforce, because you have to be loyal to America to work for an intelligence agency, otherwise don’t do it,” Feinstein said.
Both US Senate and US House of Representatives intelligence committees have either opened or are expected to open inquiries into the CIA breach, congressional officials said.
