Cyber ​​weapons stolen in historical breach for ‘easy security’, an internal report said

The theft was discovered about a year later, in March 2017, when WikiLeaks announced that it claimed to be the largest wealth of CIA documents, called “Vault 7”, detailing some of the agency’s sophisticated cyber weapons, which is first reported Author of the Washington Post.

That incident prompted an audit of the CIA’s WikiLeaks working group, which submitted its findings to October 2017 report to then-director Mike Pompeo and his deputy – who is now director – Gina Haspel.

While the CIA declined to comment on any particular report, agency spokesman Timothy Barrett told CNN: “The CIA is working to introduce best-in-class technology to stay ahead and defend against ongoing threats.”

The report released on Tuesday was severely redacted, but clearly states that the violation came as a result of a series of security flaws, “over the years that too often favored creativity and cooperation to the detriment of security.”

“In the press to meet the mission’s growing and critical needs, the CCI has prioritized cyber weapons to the detriment of securing its own systems. Everyday security practices have become terribly loose,” the report said.

The Labor Notes were released Tuesday by Sen. Ron Wyden, a Democrat from Oregon on the Senate Intelligence Committee, who received an incomplete, redacted version from the Department of Justice. In a letter to the new director of National Intelligence, John Ratcliffe, Wyden asked for more information on “widespread cybersecurity issues in the intelligence community.”

A CIA report released by Wyden points out that the Agency did not know the full extent of the damage because the CCI system – unlike other parts of the Agency’s IT system – “did not require monitoring of user activities or other safeguards …”

“Most of our sensitive cyber weapons were not shared, users shared passwords at the system administrator level, there was no effective portable media control, and historical data was available to users indefinitely,” the report said.

“Furthermore, the CCI focused on making cyber weapons and also neglected to prepare mitigation packages if those tools were exposed,” it adds.

A material released by WikiLeaks in 2017 suggested that the CIA had become the world’s most respected hacking operation, infiltrating high-tech phones and televisions to spy on people around the world.

Leaked information released by WikiLeaks as part of the “Vault 7” series contained notes on how the agency allegedly targeted individuals through malware and physical hacking of devices, including phones, computers and televisions.

To hide its operations, the CIA routinely adopted techniques that allowed hackers to appear as if they were Russians, according to documents released by WikiLeaks.

U.S. officials who previously spoke to CNN about the incident stressed that any intelligence gathering using the types of operations described in the documents is legal. against overseas targets. Officials also warned that part of the material describes programs that the intelligence community has still developed.

At the time, WikiLeaks claimed that almost all of the CIA’s privacy-violating arsenal had been stolen, and the tool was potentially in the hands of criminals and foreign spies.

Although the CIA working group responsible for the 2017 report has made several recommendations to address these security vulnerabilities, some lawmakers remain concerned that the intelligence community remains vulnerable to security breaches of this nature.

“The loose cybersecurity practice documented in the CIA report by the WikiLeaks working group does not appear to be limited to just one section of the intelligence community,” Wyden wrote, adding that it violated what he called a “wake-up call” that provided “an opportunity for proper long-term imbalances and shortcomings. ”

“Three years after the report was filed, the intelligence community is still lagging behind and has failed to adopt even the most basic cybersecurity technologies in widespread use elsewhere in the federal government,” he said.

Wyden has asked Ratcliffe to provide him with unclassified answers to a number of questions related to the application of cybersecurity practices in the intelligence community by July 17, 2020.

The CIA’s easy cybersecurity practice was also highlighted in federal court earlier this year during the trial of Joshua Schulte, a former CIA employee accused of leaking copies of classified information to WikiLeaks in 2016.

The CIA report from October 2017 was presented as evidence during the trial, and Schulte’s lawyers argued that the security of the system was so poor that information could be accessed by a large number of employees.

In March, a grand federal jury in New York City failed to rule on whether Schulte provided data to WikiLeaks.

Prosecutors have said they intend to try Schulte again this year, according to the Washington Post.