Short-term intelligence wins will come at the expense of long-term securityby / March 10, 2017 / Leave a comment
Organisations like the CIA live or die by their ability to keep secrets. Today the CIA is in the intensive care room and is leaking secrets like a wet paper bag. On Tuesday, WikiLeaks published the biggest ever leak of CIA documents: 8,761 in total.
WikiLeaks claims that it has released only one per cent of the remarkable new CIA material it has available. The CIA had apparently “lost control” of an archive of hacking methods circulated among former US government hackers and contractors in an unauthorised manner, one of whom has provided WikiLeaks with all the details.
One of the reasons for this leak is the vicious competition between the CIA, the NSA, and FBI, and the exploitation of these internal feuds in the US intelligence community by Donald Trump’s administration. The US does not really have an intelligence community so much as an intelligence discontinuity—which means that many leaks are yet to come. The main casualty will be its alliances. In the summer of 2013, Edward Snowden’s leaks showed that Britain and America were spying on their NATO allies. Now this latest development shows that the leak-prone Americans cannot be trusted with the top secrets of others. Snowden spilled most of GCHQ’s biggest secrets and now the Americans have done something similar to MI5. The Director-General of MI5 must hate the CIA.
What exactly has been revealed? The answer is premier league hacking secrets. The first part of the WikiLeaks Vault 7 series of documents allegedly shows how the CIA’s Center for Cyber Intelligence (CCI) produced more than a thousand hacking systems, viruses, and other “weaponised” malware—that is, software which is specifically designed to disrupt, damage, or gain unauthorised access to a computer system. This arsenal can target iOS, Android, Windows—even Samsung TVs, which are allegedly turned into covert microphones. One CIA system, called “fine dining,” helps officers to select their spying tool of choice. “Hive” is a customised malware suite implant for Windows, Solaris and Microtik, used in internet routers and Linux platforms. It allows spies to infect computer systems while hiding behind “decoy” applications. No system, it seems, is safe.
For Washington, the worst problem is hypocrisy. This week’s leak nullifies the fact that US intelligence agencies formally accused Russia of intervening in its election to help Trump get elected, along with the country’s decision to be increasingly open about the scale of Chinese cyber-spying. The broad conclusion of world opinion will now be that “everyone is at it” and that no government or corporation is to be trusted. The only reliable and trustworthy American figure is the fictional FBI Agent Fox Mulder from The X-Files, who warns us: “Trust no-one!”
Trust is being destroyed at several levels. First, in the world of the electronic spy, no-one is sure who is who. The CIA allegedly maintains a library of stolen malware produced in other countries. This malware can be used to disguise and misdirect attribution of where attacks have originated from in “false flag” operations. Although the possibility of attribution for cyber-attacks is better than some believe, only a minority of countries can successfully see through these “false flags”—and they will not share their findings. The result is widespread paranoia. Have the US intelligence services engineered a dastardly operation only to point to Russia as the culprit of the meddling with the elections? Was the Trump administration in collaboration with WikiLeaks or Russia during the US elections? In this uncertain environment, bizarre claims abound.
Furthermore, many of the big corporations no longer trust the big governments. This revolves around the commitment of the US government to the Vulnerabilities Equities Process. Tech companies lobbied and won for the disclosure of all pervasive vulnerabilities after 2010. We now know, though, that the CIA kept knowledge of them to itself. The consequence of this approach is that tech companies do not fix them and systems are left open to hacking by other governments, non-state actors and cyber-criminals. Once again, as with the Snowden revelations, this means that many tech companies mistrust the US government, which seems to prioritise the race for the best hacking tools and aggressive intelligence gathering over stable platforms for global commerce and robust financial institutions. The tech giants were kept in the dark and were left exposed continuously. This is clear proof of a significant break with government.
What is most worrying for the tech giants is that organisations like the CIA and MI5 do not seem to be in total control of these weapons that they have created. Leaking means cyber proliferation. Many cyberweapons used by the CIA can now be exploited by third parties everywhere and anywhere. Hostile countries are watching and learning. So are the world’s terrorists and organised criminals.
One of the most intriguing questions is: who makes up the names for these new cyber spying techniques? MI5 is alleged to have devised “Weeping Angel,” which transforms a Samsung TV model F8000 into a listening device when it appears to be switched off, and then sends the recording to a server. It is hard to resist the conclusion that the codename for this new cyber-spying tool was stolen from Dr Who. The statue-like “Weeping Angels” have been persistently nominated as scariest Doctor Who monsters. The writer who created them, Steven Moffatt, has suggested that every statue might secretly be one in disguise. A suitable analogy indeed, since every TV might secretly be a node for surveillance for MI5. Should MI5 pay royalties to the BBC for the use of the name of its most emblematic Dr Who monster?
Ultimately, the real victim is the ordinary citizen. Instead of seeking to stabilise digital technology for the new global economy, the secret services have sought short-term intelligence wins at the expense of our long-term security. All this places individual citizens in world where privacy is a victim of predatory cyberwar tactics, with no accountability or oversight. It is time for the citizen to fight back.