On 7 March 2017, WikiLeaks published the first Vault 7 tranche, “Year Zero,” containing 7,818 web pages and 943 attachments dated from 2013 to 2016. The documents described CIA capabilities intended to compromise smartphones, computers, web browsers, routers, and some smart televisions. The “Weeping Angel” material, reportedly developed with Britain’s MI5, described using certain Samsung smart TVs’ microphones—and potentially cameras—to record while the devices appeared to be switched off. Other releases detailed persistent Windows malware, traffic redirection, credential theft, USB-based attacks against air-gapped networks, and infrastructure for covert command and control. The leaked documentation established the existence and design of these programs, but did not prove that every capability was deployed against particular individuals or that tools such as Athena were operationally used.
The breach also exposed a major internal security failure: a CIA audit reportedly found that 91 malware tools had been compromised out of more than 500 in use in 2016. U.S. officials told Reuters in March 2017 that investigators had identified the breach by late 2016 and focused on contractors. Former CIA software engineer Joshua Schulte was convicted in July 2022 of leaking the material to WikiLeaks and sentenced in February 2024 to 40 years on espionage counts, plus 80 months for child-pornography offenses. CIA Director Mike Pompeo labeled WikiLeaks a “hostile intelligence service” on 13 April 2017; the disclosures intensified scrutiny of government zero-day stockpiling, oversight, vendor notification, and the risks of concentrating offensive cyberweapons inside intelligence agencies.
