British spies joined forces with the United States to develop cyberweapons for hacking mobile phones, smart TVs and personal computers, WikiLeaks claimed yesterday as it posted nearly 9,000 classified CIA files online.
The document dump — the worst security breach for western intelligence since the Edward Snowden leaks in 2013 — reveals how the CIA has built up a 5,000-strong cyberforce over the past four years. Some 8,761 documents, said to represent a portion of a bigger archive to be released in stages by WikiLeaks, also show close British involvement with CIA programmes and include references to GCHQ and MI5.
WikiLeaks, whose editor Julian Assange is a fugitive living at the Ecuadorean embassy in London, said that the CIA had “lost control of the majority of its hacking arsenal”. A former British official with links to the intelligence services said that the leaked documents appeared authentic and amounted to a “how-to manual for the aspiring cyberterrorist” and a trove of material that would be “a boost to all hackers”.
The files reveal that MI5 helped to exploit a back door in Samsung’s voice recognition system to turn smart TVs into covert listening devices. The project was named Weeping Angel, a reference to a Doctor Who character.
GCHQ and MI5 are referred to in discussions about a programme codenamed Anger Management, designed to hack into the Android system used by millions of mobile phones. A technique for gaining remote access to Google Chrome is said to have been developed by GCHQ with the US National Security Agency.
The leak comes amid clashes between Donald Trump and his intelligence chiefs, including claims that Russian hackers helped to swing the US election for Mr Trump. Yesterday WikiLeaks sought to inflame the dispute by saying that Umbrage, a CIA file holding a library of hacking techniques, enabled American spies to carry out cyberattacks. They could then leave false “fingerprints” behind to frame others. One file discussed “flexible and easy to use obfuscation”, and WikiLeaks said that the cache included techniques invented in Russia.
German security services believe that WikiLeaks is a conduit for Russian spy agencies and are braced for material aimed at undermining Angela Merkel in September’s election. MI5 warned last year that Russia was using a “whole range” of techniques against the West.
Mr Assange said that the leak, labelled Vault 7, was “exceptional from a political, legal and forensic perspective”. Snowden, based in Moscow, said the leaks showed that the CIA had found weaknesses in Apple and Android systems before leaving them open.
British agencies declared the use of hacking in the run-up to the debate over the Investigatory Powers Act last year. Intelligence officials said that they hacked devices because sophisticated encryption on communications apps made it harder to eavesdrop on terrorists. A Whitehall source said: “The agencies have had to find different ways to achieve the same end. This is not about spying on the general public.”
A former British official said: “The CIA will be trying to work out whether someone downloaded it on to a memory stick. Is it a member of staff, is it a contractor? Is it Snowden all over again?” The CIA said: “We do not comment on the authenticity or content of purported intelligence documents.”
Snowden said in a series of posts on Twitter that the documents released online seemed genuine and that it showed the “first public evidence USG [US government] secretly paying to keep US software unsafe”.
Another tweet read: “The CIA reports show the USG developing vulnerabilities in US products, then intentionally keeping the holes open. Reckless beyond words.”
The leaks are from the CIA’s Center for Cyber Intelligence, based at its headquarters in Virginia. It has a second, covert base in the US consulate in Frankfurt that covers Europe, the Middle East and Africa, the documents reveal.
