Is There A Positive Aspect To CIA Spying?

The latest release from WikiLeaks detailing how the CIA has allegedly stockpiled a plethora of tools to hack a variety of everyday devices, from phones, to televisions to cars, is a stark reminder about the fragile state of Internet security. 

The US government has amassed extraordinary hacking powers largely in secret, and this leak might just force us to grapple with whether we are comfortable with that.

The most widely reported aspect of the purported leak is the allegation that the CIA has myriad ways to hack popular smartphones like iPhone and Android devices, and that the agency could be allowing its hackers to take control of internet connected televisions and covertly listen in on conversations in people’s living rooms. 

This type of attack has been the worry of many privacy advocates for years, as more and more televisions and other household devices, collectively known as the Internet of Things, are increasingly connected to the Internet while always “listening”.

There was never a doubt that the US and other government around the world would quickly move to leverage the ability to exploit these features, as more and more consumer electronics companies have made them standard in all sorts of household items. 

The former Director of National Intelligence James Clapper even made clear in testimony to Congress last year. But just how often governments have exploited this type of technology is still largely unknown.

While many of the headlines accompanying these documents will send a shiver down the spine of readers, there is some good news in the WikiLeaks documents. 

Contrary to some early reports suggesting that the CIA can “defeat” popular end-to-end encrypted messaging apps like Signal and WhatsApp, the WikiLeaks release is further evidence that encryption does work to protect people’s privacy.

The documents do purport to show is that the CIA has a host of exploits to attack the operating systems of popular mobile devices like iPhones and Androids, a deeply worrying prospect, to be sure, but to “defeat” secure messaging apps, government hackers essentially have to gain access to your phone itself before they can read your messages. 

So if you’re using an app like Signal, the content of those communications are at least still likely protected from their vast surveillance nets that otherwise indiscriminately capture billions text messages and emails per day.

This is encouraging news. The Snowden revelations were so offensive to so many people because the government was secretly using mass surveillance to spy on hundreds of millions of people at once, the vast majority of them innocent. 

With countless users switching over to end-to-end communications in recent years, it means intelligence agencies like the CIA must target individuals one by one, which, in turn, means the cost for each surveillance target goes up, and forces them to prioritise a much smaller number of people.

Still, the amount of smartphone vulnerabilities and exploits detailed in these documents was shocking even to experts. “It certainly seems that in the CIA toolkit there were more zero-day exploits”, an exploitable vulnerability in software not known to the manufacturer, “than we’d estimated,” Jason Healey, a director at the Atlantic Council think tank, told Wired Magazine. He added: “If the CIA has this many, we would expect the NSA to have several times more.”

As Edward Snowden himself tweeted recently: “Why is this dangerous? Because until closed, any hacker can use the security hole the CIA left open to break into any iPhone in the world.” He called it “reckless beyond words.”

For years, civil society groups have been calling on US intelligence agencies to disclose these vulnerabilities to tech companies instead of hoarding them in secret. Intelligence agencies should help make the everyday devices we rely on safer, rather than less secure. 

The government has claimed that they run the vulnerabilities they know about through an interagency “equity process” to determine whether they should disclose and help fix them. But the surprising amounts of exploits in the WikiLeaks release suggests this process is either woefully inadequate or largely only exists on paper.

Undoubtedly, there will be a heated debate over WikiLeaks and the value of having these documents in the public record for the days and weeks to come, as any publication by WikiLeaks inevitably does. 

But whether Trump administration officials like it or not, the hacking powers of our government is a vital topic that needs much more public debate, and this latest release may end up fueling it.

But in the mean-time, perhaps you might download Signal.

Guardian:

 Assange Says CIA Lost Control Of Its Cyber Weapon Documents:

CIA leak 'absolutely' an 'inside job':           Signal: The Snowden-Approved Crypto App Comes to Android: