CIA could listen through cellphones, smart TVs, WikiLeaks claims
Leaks suggest spies can bypass encryption of messaging apps such as WhatsApp, Signal and Telegram
WikiLeaks on Tuesday published thousands of documents purportedly taken from the Central Intelligence Agency's Center for Cyber Intelligence, a dramatic release that appears to provide an eye-opening look at the intimate details of America's cyberespionage toolkit.
The dump of more than 8,000 documents could not immediately be authenticated by The Associated Press and the CIA declined comment, but WikiLeaks has a long track record of releasing top secret government documents. Experts who've started to sift through the material said it appeared legitimate — and that the release was almost certain to shake the CIA.
- How WikiLeaks-fuelled conspiracy theory led to gunfire
- WikiLeaks target isn't who you think, Russia experts say
"There's no question that there's a fire drill going on right now," said Jake Williams, a security expert with Augusta, Ga.-based Rendition Infosec. "It wouldn't surprise me that there are people changing careers — and ending careers — as we speak."
Bob Ayers, a retired U.S. intelligence official currently working as a security analyst, agreed, saying that the release was "real bad" for the agency.
If it did prove legitimate, the dump would represent yet another catastrophic breach for the U.S. intelligence community at the hands of WikiLeaks and its allies, which have repeatedly humbled Washington with the mass release of classified material, including hundreds of thousands of documents from the State Department and the Pentagon.
If the CIA can discover such vulnerabilities so can others.— WikiLeaks
The documents claim, among other things, that the spy agency has developed malware that can turn iPhones, Android devices and Samsung smart TVs into covert listening devices.
The latter, known by the codename "Weeping Angel," was allegedly developed in co-operation with the U.K.'s MI-5. Infected TVs appear to be turned off while, in fact, they record conversations in the room and send them via the internet to the CIA, WikiLeaks said in a statement.
WikiLeaks also claims U.S. spies can bypass the encryption of apps including WhatsApp, Signal and Telegram, and that the U.S. consulate in Frankfurt, Germany is a "covert CIA hacker base" for personnel covering Europe, the Middle East and Africa.
It is also alleged that — contrary to an agreement struck during the Obama administration — the CIA did not disclose to U.S. companies such as Apple, Google and Microsoft vulnerabilities it has discovered in their products.
Left uncorrected, such flaws leave openings for cyber-criminals and hostile intelligence services, WikiLeaks said.
"If the CIA can discover such vulnerabilities so can others."
Cryptic hints
WikiLeaks, which had been dropping cryptic hints about the release for a month, said in a lengthy statement that the CIA had "recently" lost control of a massive arsenal of CIA hacking tools as well as associated documentation.
The radical transparency organization said that "the archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner" and that one of them "provided WikiLeaks with portions of the archive."
Jonathan Liu, a spokesman for the CIA, said: "We do not comment on the authenticity or content of purported intelligence documents."
Williams, who has experience dealing with government hackers, said that the voluminous files' extensive references to operation security meant they were almost certainly government-backed.
"I can't fathom anyone fabricated that amount of operational security concern," he said. "It rings true to me."
"The only people who are having that conversation are people who are engaging in nation-state-level hacking," he said.
Ayers noted that WikiLeaks has promised to release more CIA documents, saying Tuesday's publication was just "the first full part of the series."
"The damage right now is relatively high-level," he said. "[But] the potential for really detailed damage will come in the following releases."
With files from CBC News