What Does the CIA Know About You?

Anyone who has listened to or read any news over the past week has heard something about the WikiLeaks release of leaked documents supposedly containing information on the U.S. intelligence community’s arsenal of cyber tools. WikiLeaks’ founder, Julian Assange has said that the acquisition of this information from the CIA is “a historic act of devastating incompetence to have created such an arsenal and stored it all in one place and not secured it.”

There is a lot of information available to the public now and no doubt more is forthcoming. The information leaked so far appears to be over 8,700 pages of detailed information on the CIA’s cyber weapons. These, according to some could be used for remote spying, to bypass encryption, or perhaps to penetrate smartphones and spy on or collect data of their users. Many of the tools include ways to exploit various vulnerabilities in the software code that may be used to perform such acts.

However, the flaws may actually have been discovered and even fixed already. One of these was a flaw in the Samsung Smart TV that could allow someone to spy on the owners even if the device was turned off. However, in 2015 one such flaw was already found and reported on. Issues with vehicle software was also discussed in the lead papers. However, flaws in Chrysler and Tesla vehicles have also previously been found and addressed by the manufacturers. Some allowed remote access to open and close the sunroof, windows, or apply the brakes, for example. The security issues with automobiles can be serious; could potentially even lead to death. Therefore, the manufacturers are working together and separately to address potential issues. Your children's toys may also be used to listen in.

Apple has been reviewing and testing the flaws in the leaked documents as well. It has stated that many of the ones listed were addressed long ago and others were fixed in its latest iOS release. It continues to review and test for others.

What this whole story does highlight is the balancing act between computer security and exploiting flaws in code for the purposes of spying and the value that provides to overall security of a population. The technology community and the U.S. government have agreed to work together in the past to find and fix vulnerabilities in products. In 2010, the government, as part of the Vulnerabilities Equity Process agreed to notify companies of flaws it found in code with the agreement that some of them may be used for intelligence gathering. There is also a community of “bug hunters” that find flaws and report them to the developers first to give them an opportunity to fix them before releasing them to the public.

Whatever happens in the near term, there are still several questions that could be asked. If these tools can be used for spying, how would the devices be accessed? Perhaps by physically accessing them and installing the malware? Possibly also from entry via unsecure wireless connections in homes. People often don’t change the default passwords that come with devices. They also often fail to update them after they are installed for the first time. This has led to home routers being used for man-in-the-middle attacks, as well as spying and other activities. These are not exclusive for use to any particular person or group.

However, more likely any abuse or attempt at spying or using flaws for illicit or legitimate purposes would likely occur via social engineering and phishing. Because these are how so much malware makes it onto systems and mobile devices.

The FBI is investigating the leak and there is no doubt this topic will not be put to bed any time soon. As reported by Brian Ross of ABC News, the agency has narrowed the identification of the leak to a database used only by American spies that exists on a secret network that requires special access.

Most likely this incident will, perhaps even in a positive manner, spark heated debates about the security and control of cyber weapons going forward. However, as long as the government continues to seek out and hire those with the skills and personality traits to develop such cyber weapons, it will have to also learn how to manage those who may not share or embrace its culture. After all, cultures in organizations are not homogenous. They each have their own and therefore one size does not fit all.