Wintry mix spreads across Minnesota

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

WikiLeaks is billing its latest document dump as the largest leak of CIA material in the history of the spy agency, and it describes cutting-edge ways to hack into phones, computers and even televisions connected to the Internet.

The thousands of documents, many of which are highly technical, are said to be internal CIA guides on how to create and use cyber-spying tools — from turning smart TVs into bugs to designing customized USB drives to extract information from computers. The CIA has refused to comment on their authenticity.

The full ramifications of the release are still not clear, but the case immediately calls to mind the 2013 episode when Edward Snowden, then an National Security Agency contractor, provided a trove of documents on that agency's surveillance programs.

But there are significant differences between the two revelations.

Here's a look at what we know so far about the CIA leaks, and how it compares with the NSA case four years ago.

The NSA collected American data; no evidence the CIA is doing so


The Edward Snowden leaks revealed the NSA was collecting bulk data on Americans' phone usage, which was 

The CIA spies abroad, and is barred by law from doing so domestically. Neither WikiLeaks nor anyone else is alleging that the CIA is using these methods inside the U.S.


"I can tell you that these tools would not be used against an American," Michael Hayden, the former director of both the CIA and the NSA, 

told CBS' The Late Show With Stephen Colbert.

"NSA develops tools, CIA develops tools that we can use. We just went through the drill about ... how you get a warrant, and you've got to go to a judge," Hayden added. "That protects you and me, all U.S. citizens, all the time. But there are people out there that you want us to spy on. You want us to have the ability to actually turn on that listening device inside the TV to learn that person's intentions."

Inside the U.S., the F.B.I. or another domestic law enforcement agency would typically go to court to get permission to tap the phone of a suspect.

WikiLeaks did not provide examples of how any of these CIA tools might have been used.

CIA spokeswoman Heather Fritz Horniak, without confirming the authenticity of the documents, tells NPR that the agency "is legally prohibited from conducting electronic surveillance targeting individuals here at home, including our fellow Americans, and CIA does not do so."

Cyber security experts says the agency is sure to be poring over the documents that were disclosed to see how it might affect its operations around the globe.

The NSA often worked in bulk; the CIA is targeting individuals



Snowden's leak revealed bulk collection of data — not just of American phone data, but conversations abroad, including all the calls in 

. It included surveillance on a massive scale, as well as efforts targeting individuals.


If the NSA's surveillance was often casting a broad net, the CIA's hackers are mostly spear-fishing, based on the alleged agency documents.


"A lot of these are endpoint attacks, like, 'Can we compromise your router? Your iOS device or your Android device?' " says Matthew Green, a 

"Those things don't scale — you don't do them to hundreds of thousands of people, you do them to one or two."

That's not just because of the amount of time and effort involved. It's also because many of the techniques rely on a loophole or flaw in a software system. The more you exploit that flaw, the more likely a manufacturer is to notice it — and fix it.

The NSA discussed creating vulnerabilities; the CIA exploits them 

The documents suggest the CIA has been exploiting vulnerabilities and not telling companies about them. That's controversial — if government agencies flagged such flaws, instead of taking advantage of them, millions of devices could be more secure.

, the Obama administration nodded to the importance of revealing such bugs — while reserving the right to stay mum on them if there's "an urgent and significant national security priority."



But while the CIA appears to have not disclosed vulnerabilities, the NSA leaks revealed something far more alarming, Green says.

 where the NSA was talking about introducing vulnerabilities into cryptostandards. And that's really serious ... because that's going well above finding vulnerabilities to making them," he says. "There's nothing like that, as far as I see, in these CIA documents."


Other leaks featured program overviews; these are developer notes

The NSA leak included revealing, easily comprehensible documents — memos about a program's goals and scope, slideshows about why and how a technology worked, details about where systems were being deployed and how many people were affected.

Basically, that leak included lots of documents designed to explain what the NSA was doing (albeit never meant for public consumption).

The U.S. diplomatic cables that WikiLeaks disclosed in 2010, meanwhile, were highly embarrassing for the U.S. government because they were filled with actual cases involving foreign individuals and leaders.


The alleged CIA documents, in contrast, are internal files used by developers — with lots of program specifications, but a dearth of details about how or why the technology was actually used. In some cases, it's not clear if the program 

"This is developer chat on how they build these tools," says Nicholas Weaver, a computer scientist at the University of California at Berkeley.

But the tools themselves are missing, at least for now. And, significantly, details about when, why and where the programs were used, and with what results, aren't included in this release.

Snowden, the NSA whistleblower, calls the CIA leaks 'a big deal'

Snowden, who has been in Russia since shortly after he fled the U.S. in 2013 at the time of his disclosures, has been tweeting about the latest WikiLeaks disclosure.

He's highly critical of the CIA and U.S. government, saying it's "reckless beyond words" to find vulnerabilities in the software of smartphones and other electronic devices, and then exploit them rather than inform the companies so they could patch them.


"Still working through the publication, but what 

 has here is genuinely a big deal. Looks authentic," he tweeted initially on Tuesday.


Snowden faces criminal charges in the U.S., but Russia recently said it would extend Snowden's asylum until 2020.

Like Russia, WikiLeaks is shaping up as a key actor in the early days of the Trump presidency.

Trump and his campaign team cheered on WikiLeaks as it dribbled out Democratic Party emails during the presidential race last year.


Now Trump will have to deal with the fallout of the latest WikiLeaks dump that reveals secrets of what is now 

The U.S. intelligence community concluded that Russia hacked the Democratic targets last year, and then gave the documents to WikiLeaks to disclose. WikiLeaks and Russia have denied any collusion.

Russia has not been linked to the latest WikiLeaks dump on the CIA.

The original version of this story incorrectly stated that Edward Snowden leaked NSA documents to WikiLeaks. He provided the documents to journalists.

Politics and Government News

Greg Myre

Author

WikiLeaks is billing its latest document dump as the largest leak of CIA material in the history of the spy agency, and it describes cutting-edge ways to hack into phones, computers and even televisions connected to the internet.

The CIA document dump isn't exactly Snowden 2.0. Here's why.

Go Deeper.

Like this?

News you can use in your inbox