On 7 March 2017, WikiLeaks began publishing the Vault 7 archive, a collection of CIA documents dated from 2013 to 2016. The material described tools capable of targeting iOS and Android smartphones, Windows, macOS and Linux computers, web browsers, routers, and some smart televisions. The Weeping Angel program, reportedly developed with Britain’s MI5, could make suitable Samsung televisions appear switched off while using their microphones—and possibly cameras—to record nearby activity. HIVE provided covert command-and-control infrastructure for collecting data from compromised devices, while other projects described persistent malware, traffic redirection, USB-based attacks on air-gapped networks, and methods for evading antivirus software.
The disclosure revealed a serious security-governance failure inside the agency: a CIA internal audit found that 91 malware tools among more than 500 in use in 2016 had been compromised by the breach. WikiLeaks said the archive had circulated improperly among former government hackers and contractors; U.S. officials told Reuters in March 2017 that they had known of the breach since late 2016 and were examining contractors as a possible source. Former CIA software engineer Joshua Schulte was convicted in July 2022 of leaking the documents and sentenced in February 2024 to 40 years for espionage-related offenses, plus 80 months for child-pornography offenses. The CIA labeled WikiLeaks a “non-state hostile intelligence service,” while the leak intensified scrutiny of oversight, vulnerability disclosure, and the risks of stockpiling cyberweapons.
