CIA Vault 7 leak blamed on "woefully lax" attitude to cyber security

Internal report reveals CIA division was ‘so focused on cyber weapons’ it neglected the security basics

The CIA was embedded with a workplace culture in which elite hackers were so preoccupied with building cyber weapons they neglected to secure their own systems, an internal report has suggested.

The theft of documents revealing hacking tools in March 2017, infamously publicised by WikiLeaks, was in-part the result of an agency more concerned with reinforcing its arsenal than securing those tools.

Dubbed Vault 7, the 2017 leaks outlined how the CIA could pretty much hack into any device with a suite of tools designed to read and copy data from electronic devices. The stolen documents detailed how, for example, authorities found a way to bypass encryption in a host of secure messaging apps such as WhatsApp and Telegram,

Several months later, the CIA’s WikiLeaks Task Force produced a report, now seen by the Washington Post, that revealed “woefully lax” security procedures within the team that developed those tools were partially responsible for the disclosure.

The leaked tools were developed by the Center for Cyber Intelligence, where the most sophisticated operatives devised methods of infiltrating hard-to-penetrate networks. Their security procedures were so lackadaisical, however, that without the WikiLeaks disclosure, the CIA may never have known the tools had been stolen, according to the report.

This particular section of the CIA’s “mission systems” division is distinct and segregated from the agency’s “enterprise information technology system”, which makes up the vast majority of the agency’s computer networks.

“CIA has moved too slowly to put in place the safeguards that we knew were necessary given successive breaches to other US Government agencies,” the report said. 

Related Resource

How enterprises are embracing cyber security challenges

Enterprises across Europe, the Middle East and Africa are undergoing a significant transformation

Download now

The research also found that “most of our sensitive cyber weapons were not compartmented, users shared systems administrator-level passwords, there were no effective removable media controls, and historical data was available to users indefinitely”.

Prepared for the then director Mike Pompeo, and deputy Gina Haspel, who is now the CIA’s director, the report was introduced as evidence in the trial of Joshua Schulte. 

The former CIA operative is being accused of stealing the hacking tools on behalf of WikiLeaks. Schulte, however, has pled not guilty, with his lawyers arguing the security regime was so poor that hundreds of employees or contractors may have had access to the same information.

The task force reported that it could not determine the exact size of the breach because the hacking team did not demand the monitoring of who used its network. A rough estimate suggested that a CIA employee stole as much as 34TB of data.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

The Ritz suffers data breach after hackers pose as staff
data breaches

The Ritz suffers data breach after hackers pose as staff

17 Aug 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020

Most Popular

Windows XP source code allegedly leaked online
Microsoft Windows

Windows XP source code allegedly leaked online

25 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020