WikiLeaks vows to disclose CIA hacking tools; CIA to investigate

The CIA promised to investigate the leak and theft of cyberweapons, while WikiLeaks' founder, Julian Assange, said his outlet would help to "disarm" the CIA hacking tools that WikiLeaks released.

The CIA refused to comment on the authenticity of the Vault 7 documents released by WikiLeaks.

"CIA's mission is to aggressively collect foreign intelligence overseas to protect America from terrorists, hostile nation states and other adversaries. It is CIA's job to be innovative, cutting-edge, and the first line of defense in protecting this country from enemies abroad. America deserves nothing less," the CIA wrote in its statement. "The American public should be deeply troubled by any WikiLeaks disclosure designed to damage the Intelligence Community's ability to protect America against terrorists and other adversaries. Such disclosures not only jeopardize U.S. personnel and operations, but also equip our adversaries with tools and information to do us harm."

As part of the statement, the CIA flatly denied "conducting electronic surveillance targeting individuals here at home, including our fellow Americans," saying the agency does not do that and cannot do that because of oversight and laws prohibiting such activity.

Assange admitted during a press conference held on Facebook Live that there was no direct evidence found in Vault 7 proving the CIA had hacked anyone in the U.S. But Assange noted the CIA used the American consulate in Frankfurt, Germany, as a "base" for cyberattacks carried out in Europe, Africa, the Middle East and China.

Vishal Gupta, CEO of Seclore, based in Sunnyvale, Calif., said the CIA statement could "be taken as confirmation from the CIA that the leaked documents are legitimate." Gupta added, "If the CIA had any doubts about the authenticity of the WikiLeaks release, I believe they would be very vocal and direct about that."

Brian Vecci, technical evangelist at Varonis, based in New York, agreed with this reading of the statement.

"It's telling that the CIA has not flatly denied that this was leaked by an insider or pointed to an external attacker as the source," Vecci told SearchSecurity. "The leaked data and the method in which it was leaked suggests that this was done by someone who likely already had access to the information, whether that access was still needed or not."

Tim Prendergast, CEO of Evident.io in Pleasanton, Calif., said he had "no doubts the leaked data is real," and it is "likely only a fraction of what assets the governments of the world have."

"The CIA is one of many agencies in the world -- across world governments -- that have this kind of technology. The need for cyber advantages is real, and every country on the planet is investing in this kind of stockpiling," Prendergast told SearchSecurity. "This may be the trove that was leaked [most] recently, but many others have been purposefully or maliciously leaked in smaller portions over the past decade. Anticipating anything less than their existence, use and availability makes us naive as a population of this technology-forward planet."

Assange berated the CIA for not protecting its own cyberweapons, saying it had "lost control" of its arsenal and would not know or be able to prevent malicious insiders from using the CIA hacking tools themselves. He said the report that the CIA knew about the leak raises the specter of who knew about it. "[It] brings into question the entire concept of cyberwarfare, because it is our analysis, and stated also by many other experts, that it is impossible to keep effective control of cyberweapons. ... If you build them, eventually, you will lose them," Assange said. "They are just information. There's no barrier for them spreading across the world."

Vecci agreed and said the real issue "isn't whether [the CIA] should be developing tools to spy, it's why weren't they spying on their own data?"

"Having a clear and updated understanding of who could have accessed this data is critical, as is making sure that people who don't need to see it can't. The risk of unauthorized disclosure is significant, as the CIA says. And that means that critical data like this also needs to be monitored," Vecci said. "You can't catch what you can't see; if the CIA wasn't able to see how this data was being used and by who, and [it] wasn't alerted that the data was being accessed in abnormal ways, then that's a problem." 

While Gupta said "No one should be blaming the CIA for not disclosing these vulnerabilities," he agreed the CIA hacking tools should have been guarded better.

"No one should be surprised that one of the most advanced intelligence agencies in the world is stockpiling the means to carry out investigations in the digital age -- that's their job," Gupta said. "However, the CIA must be able to guarantee that incidents such as this one don't continue to occur. The CIA having access to sophisticated hacking techniques is one thing, but that information being accessible to anyone with an internet connection poses a huge risk to everyone's security."