WikiLeaks Rains on CIA — With Style
By Tom Temin | @tteminWFED
March 8, 2017 8:59 am
WikiLeaks’ descriptions of the CIA documents it has posted make compelling reading. The authors write clearly and employ useful analogies. Their clinical, yet casual, style stands in contrast to the shocking sensitivity of what they’ve exposed.
For example, we learn that the CIA mixes in with its internally-developed hacks those from Russian and other developers. WikiLeaks says the CIA stole them. Regardless, it does so to cover its tracks, because each hack developed has a “fingerprint” pointing the way to attribution. WikiLeaks says, “This is analogous to finding the same distinctive knife wound on multiple separate murder victims.
The unique wounding style creates suspicion that a single murderer is responsible. As soon as one murder in the set is solved then the other murders also find likely attribution.” An ARS Technica story analyzes the danger of too much sameness in technique.
Even if WikiLeaks wrote in pig Latin, the latest dump would be significant. But it’s important to ask the right questions.
What does a 10 percent budget cut look like for your agency?
Don’t tell me you’re surprised the CIA has software letting it hack smartphones and internet-connected TV sets. You might be surprised at the range and depth of its library, but not that the agency develops, collects and uses these capabilities.
The community of cyber experts is already deep into analysis of CIA capabilities, how the agency lost control, and what will happen now that the tools could be widely available.
Important questions:
Did the CIA have unique powers of infiltration and listening or intercepting messages, or just its own versions of capabilities others also have?
If the capabilities were unique, can CIA staff redevelop them and if so, how long will that take?
Eighty-seven hundred documents sounds like a lot. WikiLeaks implies it has more, and more detail.
What does this mean to the agency in relative terms?
Is it true, as WikiLeaks says, the CIA made unclassified large sections of so-called Vault-7? Is so, why? WikiLeaks says it’s because the CIA is legally prohibited from putting classified items on the internet, and the hacking tools communicated with headquarters that way.
Most intriguing, how did WikiLeaks get this stuff, and the material it promises to reveal? In its FAQ, the authors seem to smile and say, “Sources trust WikiLeaks to not reveal information that might help identify them.” The WikiLeaks crew, thrilled with the richness of this material, says it has withheld writing more stories “to encourage others to find them.” Then the question is: “Won’t other journalists find all the best stories before me?” They answer, “Unlikely. There are very considerably more stories than there are journalists or academics who are in a position to write them.”
The intelligence community and its reportedly contentious relationship with President Donald Trump has already set the government on edge. WikiLeaks says this latest exposé isn’t related to Trump’s call for a 30-day cybersecurity review. But it will certainly give the reviewers a lot to consider.
March 8, 2017 8:59 am
WikiLeaks’ descriptions of the CIA documents it has posted make compelling reading. The authors write clearly and employ useful analogies. Their clinical, yet casual, style stands in contrast to the shocking sensitivity of what they’ve exposed.
For example, we learn that the CIA mixes in with its internally-developed hacks those from Russian and other developers. WikiLeaks says the CIA stole them. Regardless, it does so to cover its tracks, because each hack developed has a “fingerprint” pointing the way to attribution. WikiLeaks says, “This is analogous to finding the same distinctive knife wound on multiple separate murder victims.
The unique wounding style creates suspicion that a single murderer is responsible. As soon as one murder in the set is solved then the other murders also find likely attribution.” An ARS Technica story analyzes the danger of too much sameness in technique.
Even if WikiLeaks wrote in pig Latin, the latest dump would be significant. But it’s important to ask the right questions.
What does a 10 percent budget cut look like for your agency?
Don’t tell me you’re surprised the CIA has software letting it hack smartphones and internet-connected TV sets. You might be surprised at the range and depth of its library, but not that the agency develops, collects and uses these capabilities.
The community of cyber experts is already deep into analysis of CIA capabilities, how the agency lost control, and what will happen now that the tools could be widely available.
Important questions:
Did the CIA have unique powers of infiltration and listening or intercepting messages, or just its own versions of capabilities others also have?
If the capabilities were unique, can CIA staff redevelop them and if so, how long will that take?
Eighty-seven hundred documents sounds like a lot. WikiLeaks implies it has more, and more detail.
What does this mean to the agency in relative terms?
Is it true, as WikiLeaks says, the CIA made unclassified large sections of so-called Vault-7? Is so, why? WikiLeaks says it’s because the CIA is legally prohibited from putting classified items on the internet, and the hacking tools communicated with headquarters that way.
Most intriguing, how did WikiLeaks get this stuff, and the material it promises to reveal? In its FAQ, the authors seem to smile and say, “Sources trust WikiLeaks to not reveal information that might help identify them.” The WikiLeaks crew, thrilled with the richness of this material, says it has withheld writing more stories “to encourage others to find them.” Then the question is: “Won’t other journalists find all the best stories before me?” They answer, “Unlikely. There are very considerably more stories than there are journalists or academics who are in a position to write them.”
The intelligence community and its reportedly contentious relationship with President Donald Trump has already set the government on edge. WikiLeaks says this latest exposé isn’t related to Trump’s call for a 30-day cybersecurity review. But it will certainly give the reviewers a lot to consider.
No comments:
Post a Comment