CIA Vault 7 FAQ: What To Know About the Biggest Security Leak in History

Put simply, the CIA Vault 7 leaks are a big deal. Last week, the WikiLeaks released an explosive cache of documents apparently taken from the CIA. The “Vault 7” leaks allegedly show a concentrated effort on the part of the federal government to create hacking tools for smartphones and various internet-connected devices.

One of the most common examples being reported was a Samsung television, which the intelligence agency is purported to have cracked in a way that allows the device to record audio—even after the user has turned it off.

Naturally, the CIA Vault 7 leaks have created unease among consumers, electronics manufacturers, software developers, and IT professionals. In this article, we’ll try to answer some of the most common questions about the leaks as they relate to data loss and information security.

Are the CIA Vault 7 Leaks really notable?

Yes. While previous leaks have suggested that organizations like the National Security Administration (NSA) monitor communications to try to catch criminals, we’ve never had direct evidence that the CIA engages in an ongoing hacking program that would allow them to bypass security controls.

Put another way, the leaks show that the CIA is (apparently) attempting to develop methods of access for every electronic device imaginable, and the agency may even use malicious code to force hardware to act contrary to the wishes of the device’s owner.

The implications are practically endless; a person with access to the Vault 7 tools could eavesdrop on private conversations, stream live video of a target, or even turn off a functioning vehicle.

No, seriously. Here are private hackers doing that exact thing.

 

It stands to reason that the CIA has better resources, given that the institution is apparently pouring money into this program.

Should I be worried about the CIA hacking my device?

That depends on who you trust. Former officials of the CIA say that no American citizen has ever been targeted by their hacking program, and that the tools are purely intended as a counter-espionage measure.

Like any other technology publisher, we are not in a position to make any sort of judgment. The Vault 7 leaks do not include evidence that the tools were used against American citizens without due process.

Is there a chance that these leaks are fake?

There’s always a chance that leaks aren’t what they appear to be, but the New York Times and other organizations have independently assessed the evidence and affirmed that the documents seem legitimate.

The CIA, of course, refuses to comment, but all reliable sources are treating the Vault 7 leaks as actual disclosures of the CIA’s hacking technology.

Does WikiLeaks have access to the CIA’s hacking tools?

WikiLeaks claims to have those tools, although we don’t know if the software in question is the latest versions used by the CIA (assuming that the leaks are legitimate).

Julian Assange, founder of WikiLeaks, held a press conference at the Embassy of Ecuador in London.

“The Central Intelligence Agency lost control of its entire cyberweapons arsenal,” Assange said. “This is an historic act of devastating incompetence to have created such an arsenal and stored it all in one place and not secured it.”

Will WikiLeaks offer the CIA’s hacking tools to the general public?

Assange says that WikiLeaks will not release the tools to the general public; instead, he says that the organization will contact the electronics manufacturers and software developers, providing them with a chance to counter the CIA’s engineering.

But in his public statements, Assange has implied that WikiLeaks will eventually release the hacking tools.

What will happen if the CIA Vault 7 hacking tools become publicly available?

We can only guess, but our guess is “chaos.” Even if manufacturers have a chance to create security fixes, millions of devices won’t be protected from the tools, and enterprising hackers will be able to easily access them.

While we wouldn’t panic just yet, this story definitely deserves close attention. We’ll update this FAQ as we learn more.