Patrick Tucker | Defense One | March 7, 2017 | 0 Comments

CIA Silent as Wikileaks Claims to Publish Thousands of Agency Files

Gil C/

The CIA on Tuesday had no comment about Wikileaks’ claim to have revealed the existence and function of key hacking tools in a document dump that the group calls “the largest intelligence publication in history.”

In a Tuesday statement on its site, Wikileaks officials claimed to have obtained and posted  “8,761 documents and files from an isolated, high-security network situated inside the CIA’s Center for Cyber Intelligence in Langley, Virgina” [sic]. The organization said the trove revealed that the spy agency can read encrypted messages sent through popular apps such as Facebook-owned Whatsapp, popular in the Ukrainian military; Signal, a favorite of journalists, dissidents and some in the intelligence community; Telegram, used by jihadists and others; and Confide, popular among Trump administration leakers.

Some cybersecurity researchers immediately called the claims uncorroborated and misleading. It has long been the case that hackers who gain physical access to a phone, for example, may be able to read text written in various messaging apps. It’s hard to tell whether the tools described in the dump would allow a spy to enter your phone from anywhere.

They urged users to remain calm, and not to take the Wikileaks post as a reason to abandon the use of encrypted messaging apps.

Among other purported revelations, Wikileaks said, the documents show that the CIA and British intelligence outfit MI5 developed malware to listen in on the microphones in Samsung smart TVs; and that the U.S. consulate in Frankfurt, Germany, has become a hub for U.S. signals intelligence agents and engineers traveling under diplomatic passports.

In their post, the group said they had redacted some of the posted emails and communications to avoid “the ‘distribution of ‘armed’ cyberweapons until a consensus emerges on the technical and political nature of the CIA’s program and how such ‘weapons’ should analyzed, disarmed and published.”

The group also hinted that the documents were leaked by a source inside the agency. “The source wishes to initiate a public debate about the security, creation, use, proliferation and democratic control of cyberweapons,” they wrote. “The source details policy questions that they say urgently need to be debated in public, including whether the CIA’s hacking capabilities exceed its mandated powers and the problem of public oversight of the agency.”

Asked for comment, CIA spokesperson Jonathan Liu said, “We do not comment on the authenticity or content of purported intelligence documents.”

Defense One also reached out the office of the National Counterintelligence Executive, which is in charge of responding to releases or disclosures of U.S. intelligence assets, methods or products. They referred us back to CIA.

In September, we interviewed the the National Counterintelligence Executive himself, William Evanina, who described how hard it remains to thwart insiders who want to leak data.

“To no extent are we capable of stopping someone from doing damage who wants to. It’s not possible,” said Evanina. “The same way you can’t stop someone from starting a fire who wants to be an arsonist.”

Still, there is plenty of reason to be skeptical about documents published by Wikileaks — about their veracity, whether they might have been tampered with, who provided them, and so on. Independent research and the intelligence community have determined that Wikileaks has routinely published documents and data given to it by Kremlin-linked intelligence agencies.

If the new Wikileaks dump proves valid, and the source does turn out to be a mole inside the CIA, then it will be the second release of information about critical intelligence tools in a year by an insider. On Aug. 27, NSA contractor Harold Martin III was arrested for hoarding agency documents. He is suspected of offering NSA tools for sale.

The group claims that its revelations are just scratching the surface.

“Wikileaks has intentionally not written up hundreds of impactful stories to encourage others to find them and so create expertise in the area for subsequent parts in the series. They’re there. Look. Those who demonstrate journalistic excellence may be considered for early access to future parts,” they write.

To attribute the document drop to pure altruism on the part of Wikileaks would probably be a mistake. In fact, it seems to be setting the stage for an organized communications campaign to discredit the intelligence community assessment on the DNC hack. Both the intelligence community and private cyber security researchers have determined that Russian actors stole both the DNC and John Podesta emails published to Wikileaks. 

A portion of the Wikileaks statement released today reads: “The CIA’s Remote Devices Branch’s UMBRAGE group collects and maintains a substantial library of attack techniques ‘stolen’ from malware produced in other states including the Russian Federation…With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the “fingerprints” of the groups that the attack techniques were stolen from.”

Pro-Russian information sites and trolls were quick to notice the claim. 


Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.