“There is no such thing as absolute privacy in America,” the FBI director, James Comey, has declared after the disclosure of a range of hacking tools used by the CIA.
Comey was delivering prepared remarks at a cybersecurity conference in Boston, but his assessment has deepened privacy concerns already raised by the details of CIA tools to hack consumer electronics for espionage published by WikiLeaks on Tuesday.
“All of us have a reasonable expectation of privacy in our homes, in our cars, and in our devices. But it also means with good reason, in court, government, through law enforcement, can invade our private spaces,” Comey said at the conference on Wednesday. “Even our memories aren’t private. Any of us can be compelled to say what we saw … In appropriate circumstances, a judge can compel any of us to testify in court on those private communications.”
Fresh concerns over personal privacy arose after WikiLeaks published what it called the first tranche of a larger body of data about CIA hacking, which it says was provided to the organisation by a whistleblower seeking to trigger a debate on the issue.
The CIA said it would not comment on the authenticity of the WikiLeaks material but issued a statement pointing out it was legally prohibited from using such surveillance tools in the US.
“The CIA’s mission is to aggressively collect foreign intelligence overseas to protect America from terrorists, hostile nation states and other adversaries. It is CIA’s job to be innovative, cutting-edge, and the first line of defense in protecting this country from enemies abroad. America deserves nothing less,” the statement said.
“The American public should be deeply troubled by any Wikileaks disclosure designed to damage the Intelligence Community’s ability to protect America against terrorists and other adversaries. Such disclosures not only jeopardize US personnel and operations, but also equip our adversaries with tools and information to do us harm.”
There is anxiety in Washington that the WikiLeaks release of what it called its “Vault 7” trove of data would make the hacking tools available to criminal or terrorist organisations, or foreign governments.
The Democratic congressman Ted Lieu called for a congressional investigation into how the data came to be stolen and the wisdom of the intelligence agencies in withholding knowledge about vulnerabilities in consumer software from manufacturers.
“If these documents are true, it means the CIA arsenal of cyber weapons is now out there in the public domain, and who knows who now has access to some very intrusive hacking tools,” Lieu told the Guardian. “It is very disturbing to anyone who cares about privacy … It should also put to rest any argument about encryption back doors. You can’t just give encryption keys to the good guys and hope they don’t get to the bad guys. Our best protection is to have no security defects in the products we use.”
Security experts said that the “Vault 7” data released so far consisted mainly of summaries of the capabilities of some hacking tools rather than the tools themselves and the material appeared to have been edited so as not to give away hacking capabilities.
The CIA had no comment yesterday on the disclosures or any investigation into the leak, but cybersecurity analysts said it would not be hard to find out how the more than 500MB of data was stolen. The data covers the period from 2013 to February 2016. It was mostly secret, with a couple of top secret documents, indicating it had either been taken from a top secret server or that top secret documents had been carelessly left on a server with lower classification.
“By doing this dump in such detail, whoever has released this data has basically given the CIA a roadmap about how to find this data was taken in the first place because now they know where it was taken from and what time it was taken – probably the single day, if not hour, and that leads you to how it got taken and who took it,” said Nicholas Weaver, a senior staff researcher on cybersecurity at the International Computer Science Institute in Berkeley, California.
Malcolm Nance, a former naval cryptologist, said: “I don’t think this came from software. I think this came from screen grabs that were done on a non-secure computer – that’s why I think it was a low-level guy.”
Both Weaver and Nance questioned the role WikiLeaks played, in terms of the timing of the release and the analysis the organisation provided alongside the data.
“WikiLeaks came out with this 48 hours after Donald Trump was ranting about Barack Obama was wiretapping him,” Nance said, adding that it appeared timed to give Trump ammunition in his feud with the intelligence agencies who are investigating Russian intervention in the election in his favour.
“It appears to be a hit operation on the CIA by Julian Assange [the WikiLeaks founder]. Why would it come out in such a precision release? WikiLeaks have done many releases like this in Donald Trump’s favour during the election campaign,” said Nance, who is the author of a book on the Russian role in the campaign, The Plot to Hack America.
“I don’t believe they have anything to do with global transparency … [Assange] never seems to be able to get anything on the Russians, or the conservatives.”
Weaver said that the commentary provided by WikiLeaks to accompany the “Vault 7” documents was misleading, overstating the CIA’s capacities, suggesting, for example, that it could hack household smart TVs remotely to turn them into spying devices.
“How many stories were there that said: ‘Oh my God, the CIA is hacking my smart TV?’ How many of those mentioned that only works with physical access? How is this different from sticking a bug under the table?” he asked. “The real story is that WikiLeaks hacked the press.”
0 comments: