WikiLeaks founder Julian Assange said he would contact technology companies and privately supply technical details of the CIA’s collection of bugs in some of the world’s most commonly used smartphone software. Assange made the announcement in a live-streamed press conference on Thursday, two days after WikiLeaks published the cache of classified documents containing the bugs.
Assange cast WikiLeaks as a rare trustworthy actor in a world of shadowy interests, describing his operation as “a neutral, digital Switzerland
” on the heels of harsh criticism from the CIA and renewed accusations of involvement by Russian
intelligence with the organization’s information-gathering apparatus.
Assange denied the involvement of Russian intelligence in WikiLeaks’ acquisition of its latest documents, which it calls “Vault 7”, and made a point of impugning the motivations of news organizations that questioned him along those lines. “There are many question that might be asked by CNN; one that defends the interests of the CIA might be a bit problematic to ask,” Assange said when asked by CNN whether the release simply hampered the unsurprising operations of one country’s intelligence service.
A source told NBC News on Wednesday that Russian intelligence was among the suspects in the latest round of leaks. Russian state operators were said to be “one step” removed from the emails published by WikiLeaks during Donald Trump’s presidential campaign, according to a US
intelligence official who spoke to the Washington Post.
The press conference was broadcast from the Ecuadorian
embassy in west London
, where Assange is effectively confined. Nigel Farage visited the embassy shortly before the press conference began, according to BuzzFeed, and refused to tell reporters why he was there. The White House
press secretary, Sean Spicer, was also pressed by reporters on Friday on whether Farage was there at Trump’s behest. Spicer called the question “silly”. “I generally don’t worry about what’s going on across the pond,” he said.
The WikiLeaks founder pointed to events revealed in a three-part report last year in the Guardian as evidence that the CIA acted outside its jurisdiction on American soil. “The CIA has a habit of behaving badly in the United States as well,” he said.
“CIA was denounced by the US Senate intelligence committee because it had hacked their investigation in Congress into the CIA torture program and had used its hackers to retrieve documents,” Assange said. A domestic unit called Cyber Blue Team, essentially a white-hat group within the CIA intended to test for vulnerabilities in government networks, was asked by the CIA to break into the Senate’s own networks, according to a Freedom of Information Act (Foia) request by Vice News reporter Jason Leopold.
The CIA strongly criticized WikiLeaks in a statement issued on the agency’s website on Wednesday, saying that “CIA is legally prohibited from conducting electronic surveillance targeting individuals here at home, including our fellow Americans, and CIA does not do so.”
“The American public should be deeply troubled by any WikiLeaks disclosure designed to damage the intelligence community’s ability to protect America against terrorists and other adversaries,” the agency’s spokespeople wrote. “Such disclosures not only jeopardize US personnel and operations, but also equip our adversaries with tools and information to do us harm.”
The WikiLeaks disclosures were an extraordinary coup for a group that has already rocked American diplomacy with the release of 250,000 state department cables and embarrassed the Democratic party with political back-channel chatter and the US military with hundreds of thousands of logs from Iraq
The documents, classified “secret” and “top secret”, describe clandestine methods for bypassing or defeating encryption, antivirus tools and other protective security features for computers, mobile phones and even some Samsung smart TVs. Contrary to WikiLeaks’ assertions – the company said the information dump represented all of the CIA’s hacking capabilities – intelligence experts have said the released documents contain a set of tools available to many different contractors and are classified at comparatively low levels.
The bugs, or “zero-day” exploits, so named because manufacturers have zero days to fix them, published by WikiLeaks provide workarounds for hackers seeking to break into Apple’s iOS and Google’s Android operating systems. Apple said it would “rapidly address” any security holes revealed by the list of iOS bugs in the CIA documents. The documents are said to be genuine, though the list of bugs stops well short of the current iOS release.
There are far more variations on the Android operating system and thus a much higher likelihood that some of those exploits still work. Google said in an emailed statement to the Guardian that it was confident that “security updates and protections in both Chrome and Android already shield users from many of these alleged vulnerabilities” and that it would continue to investigate.
WikiLeaks has not released the actual hacking tools themselves, some of which were developed by government hackers while others were purchased from outsiders. However, the group is now saying that it will once it has passed the code itself on to the affected firms.
Security experts said WikiLeaks was obligated to work privately with technology companies to disclose previously unknown software flaws, known as zero-day vulnerabilities because consumers would have no time to discover how to defend themselves against their use, and with companies that design protection software. WikiLeaks has said the latest files apparently have been circulating among former US government hackers and contractors.
“The clear move is to notify vendors,” said Chris Wysopal, co-founder and chief technology officer of Veracode Inc. “If WikiLeaks has this data then it’s likely others have this data, too. The binaries and source code that contain zero days should be shared with people who build detection and signatures for a living.”
One clear risk is that WikiLeaks revealed enough details to give foreign governments better opportunities to trace any of the sophisticated hacking tools they might discover back to the CIA, damaging the ability to disguise a US government hacker’s involvement. “That’s a huge problem,” said Adriel T Desautels, the chief executive at Netragard LLC, which formerly sold zero-day exploits to governments and companies. “Our capabilities are now diminished.”