24 ms·
In what is surely one of the most astounding intelligence own goals in living memory, the CIA structured its classification regime such that for the most market
by apo 10y ago
In what is surely one of the most astounding intelligence own goals in living memory, the CIA structured its classification regime such that for the most market valuable part of "Vault 7" — the CIA's weaponized malware (implants + zero days), Listening Posts (LP), and Command and Control (C2) systems — the agency has little legal recourse.
The CIA made these systems unclassified.
Why the CIA chose to make its cyberarsenal unclassified reveals how concepts developed for military use do not easily crossover to the 'battlefield' of cyber 'war'.
To attack its targets, the CIA usually requires that its implants communicate with their control programs over the internet. If CIA implants, Command & Control and Listening Post software were classified, then CIA officers could be prosecuted or dismissed for violating rules that prohibit placing classified information onto the Internet. Consequently the CIA has secretly made most of its cyber spying/war code unclassified. The U.S. government is not able to assert copyright either, due to restrictions in the U.S. Constitution. This means that cyber 'arms' manufactures and computer hackers can freely "pirate" these 'weapons' if they are obtained. The CIA has primarily had to rely on obfuscation to protect its malware secrets.
One of the more interesting passages. The arsenal must not be classified to protect those who deploy it from legal action. This cyberwarfare kit, which can just as easily be used to destroy the US as one of its enemies, is public domain software created and released at US taxpayer expense.
- pjc50 10y ago> Command & Control and Listening Post software were classified, then CIA officers could be prosecuted or dismissed for violating rules that prohibit placing classified information onto the Internet. Consequently the CIA has secretly made most of its cyber spying/war code unclassified. This is almost hilarious. Not that being classified would make any difference: cyber-"weapons" have something in common with biological weapons in that they're prone to leaking and blowing upwind, but also once used it's possible for the enemy to vaccinate against them.
- djsumdog 10y agoThe US chemical weapons program is downright frightening. Unlike these exploits which you can just leave in an office and never use (and which con subsequently go stale as people find and patch exploits), chemical weapons were stored in massive US facilities and many of them have started leaking over the years: https://www.youtube.com/watch?v=FjA0EQPeUGM https://www.youtube.com/watch?v=FjA0EQPeUGM
- tempVariable 10y agoThat is one of the saddest 30 minutes of video I have seen up to date.
- DashRattlesnake 10y ago> The US chemical weapons program is downright frightening. Was: they committed to destroying those weapons, and have been doing so for 24 years. They were 89.75% complete in 2012. The video you linked was from 1973. https://en.wikipedia.org/wiki/United_States_chemical_weapons_program#Decommissioning_and_destruction https://en.wikipedia.org/wiki/United_States_chemical_weapons...
- cloakandswagger 10y agoJust like they committed to revealing exploits to the tech industry instead of hoarding them?
- ruleabidinguser 10y agoIt sounds like you're just saying this without doing any kind of real comparison between the probably very different scenarios.
- DashRattlesnake 10y ago> Just like they committed to revealing exploits to the tech industry instead of hoarding them? I think you're letting your cynicism get in the way of truth and understanding. The US has signed and ratified a treaty committing to destroy all chemical weapons and never produce them again [1], and it has built the infrastructure to do so [2] [3]. It's conspiracy-nut territory to think the US is simultaneously stockpiling chemical weapons in some super-secret program without good evidence for it. [1] https://en.wikipedia.org/wiki/Chemical_Weapons_Convention https://en.wikipedia.org/wiki/Chemical_Weapons_Convention [2] https://www.youtube.com/watch?v=7u-ACe1CBfA https://www.youtube.com/watch?v=7u-ACe1CBfA [3] https://www.youtube.com/watch?v=wftLydix0Nw https://www.youtube.com/watch?v=wftLydix0Nw
- pimlottc 10y agoObviously there's a difference between cyber and conventional weapons, but imagine if the same rationale were extended to physical munitions: "We can't drop this bomb on the enemy, it contains classified technology"
- pjc50 10y agoWhile the weapon too secret to use sounds very Dr Strangelove, there have been slightly similar things with real weapons. The one I remember is when radar-triggered proximity shells were invented at the end of WW2 they were only issued for use on ships, so that undetonated shells would fall into the sea, so couldn't be recovered and investigated by the enemy.
- graycat 10y agoIIRC there was a claim that the shells with the proximity fuses were also used, likely by Patton's forces, in the Battle of the Bulge. Supposedly having the shells explode at a carefully determined distance above the ground made the shells especially effective against German ground troops. IIRC the proximity fuses were developed at the Johns Hopkins University Applied Physics Laboratory (JHU/APL); that is the story I got when I worked there. IIRC, the shells were also especially effective as anti-aircraft artillery.
- throwanem 10y ago> having the shells explode at a carefully determined distance above the ground made the shells especially effective against German ground troops It does. WWII tanks' armor is mostly concentrated to the front and sides, because those tanks are designed to force enemy lines against ground-bursting shells, field pieces, and other tanks, all of which fire mostly on low trajectories; what's on top is much thinner, because no one expects to need to withstand a lot of damage there. Bursting a shell above ground level throws a lot of fragments at that weak armor, where a ground burst mostly wastes them against armor designed to withstand direct hits from much more powerful weapons. For infantry, it's even worse; the whole point of a trench or a foxhole is to put a thick layer of earth between you and all the metal that's flying around at ground level. When an airburst can send fragments right down into the hole with you, that earth doesn't help one bit. Fun fact: "daisy cutter" bombs work the same way. Up until Vietnam at least, their proximity fuse was on the end of a rod protruding a few feet from the nose of the bomb. Low-tech compared to a radar proximity fuse, but fearsomely effective; probably the only reason you wouldn't find it on a shell is that, unlike an air-dropped bomb, a shell has to withstand the force of being fired from a gun, and I doubt any such expedient could. (That's also why bombs tend to be so much more effective than shells, even when no more accurate. When the strongest force involved is 1g, you can spend a lot less mass on structure, and a lot more on explosive.)
- samstave 10y ago>once used it's possible for the enemy to vaccinate against them. So think long term... Is this an innoculation game >10 years out????
- sandworm101 10y agoLol like anyone in this field cares about copyrights. It is like suggesting that North Korea cannot build nuclear bombs because doing so would infringe US patents. Some things are above IP rules.
- compuguy 10y agoThink about it. Having the code copyrighted, would leave a paper trail.
- Freak_NL 10y agoNot really; copyright is mostly implicit. If US law made all code developed for the purposes of the CIA automatically copyrighted, the code would be copyrighted. Right now the law says it isn't, so it isn't. Having code be copyrighted does not require any explicit registration.
- sandworm101 10y agoYes and no. The law says that works of federal government employees arent to be protected. But it is unclear whether this only applies within the US or whether the US governmemt can assert those copyrights against non-us entities. It's a constitutional question never clearly addressed. Also, these tools could easily be the work of contractors rather than government employees. The fed can own/purchase/assert copyrights in such works. We do not have enough facts to say they are surely public domain.
- thatcat 10y agoPerhaps what parent meant was that exclusive use of the code by agency would lead to easy post attack origin analysis, so by leaking the code in obfuscated form a few other people inevitably stumble on it and use it which generates a form of cover traffic for the original agents.
- dkersten 10y agoAnd "pirating" copyrighted code doesn't either, so they'd have no way of knowing anyway. Basically, anyone who would use this would likely wouldn't care if its classified or not and copyrighted or not.
- dopamean 10y ago> This means that cyber 'arms' manufactures and computer hackers can freely "pirate" these 'weapons' if they are obtained. Does the author really think that if the tools were exposed then people who wanted to use these tools actually wouldn't simply because they were labelled "classified" somewhere?
- omouse 10y agoThe bigger issue I think is when the prosecution of the CIA leakers happens. If the material is unclassified, they're just distributing materials that are public domain and definitely in the interest of the public. If it's classified, it's a breach and they should be punished in some way.
- waifufucker 10y agoShirley your joking, you think they give a shit
- simion314 10y agoFrom the article it says that the files were circulating in the wild, so if this was not leaked to Wikileaks then "the bad guys" would continue using this and the public would not know.
- code_duck 10y agoI think that's referring to people who want to sell them, like the people who supply cracking tools to questionable governments.
- Yhippa 10y ago> The CIA has primarily had to rely on obfuscation to protect its malware secrets. Ugh.
- marcoperaza 10y agoClassified or not, works of the federal government are all in the public domain. And classification is not legally relevant to anyone except to those entrusted with protecting classified data.
- yk 10y agoThat is the fun part, attacking with a virus is basically the same as releasing the code (modulo IDA pro). So a US government official can not use a classified virus, while everybody else can.
- imcoconut 10y agois this why we hear about "state-sponsored actors" and the distinction between them and the state itself?
- huffmsa 10y agoThis is often overlooked, but very correct. "Classification" only pertains to how the material should be treated within the government. Once its out, the only penalty can fall on the person who let it out into the wild.
- Bedon292 10y agoA person with a clearance can get in trouble for knowingly accessing or spreading the data, even after it is already released in the wild. The data is still considered classified, even after the leak. So those who are entrusted with a clearance still have to fulfill their duties to protect it. But, yes a random citizen has no responsibility or rules they most follow.
- vanattab 10y agoI would be careful also if you think you might need to get a clearance in the future. I was in college during the initial Wikileaks Manning dump and I remember getting a email from the DoD forwarded through the Physics department that viewing or sharing classified wikileaks info could prevent us from getting a clearance in the future even of we did not have a clearance at the time.
- compuguy 10y agoI honestly think this makes sense, based on how government bureaucracy is. Obviously everything else about it, is classified.
- guelo 10y agoThat passage is just dumb. Copyright would not stop hackers from using the tool once it is leaked.
- brodie78382 10y agoI think what it's trying to convey is that there's absolutely no legal recourse in any capacity for the CIA at this point to try and do any sort of damage control.
- Sunset 10y agoI am bemused by the naivete that they would care about legal recourse and not just blackbag you and Gitmo2.0 your posteriors if they felt like it.
- SolarNet 10y agoThat's difficult when a large company like Google or Microsoft use the tools as part of their development process to make their software more secure. These are organizations with a very large megaphone if the CIA did that to their employees.
- Sunset 10y agoWhat exactly can Google or Microsoft do to a state actor like CIA that's decided their employees are fair game. Not much.
- kevin_thibedeau 10y agoSo then there would be no justifiable reason to reject a FOIA request for the source code.
- bertil 10y agoI’m going to assume that the response would be that there are no such thing as Vault 7, a digital capability or even the CIA.
- mulmen 10y agoNo, it will be the Glomar defense or nothing at all.
- bertil 10y agoI’m going to assume that the response would be that there are no such thing as Vault 7, a digital capability or even the CIA.
- tedunangst 10y ago"classified" is not the only reason FOIA requests are denied.
- marmot777 10y agoWhy do they make such monumentally short-sighted, clearly bad decisions? Is it weak technical leadership (weak political or just old fashioned weak)? What is the internal logic these people use to justify pure folly that's probably done more harm than good even to their own interests and goals? Baffling.
- pillowkusis 10y agoNobody makes "decisions" like this in an organization with the level of complexity and bureaucracy that the CIA has. A lot of these decisions can be seen more as emergent behavior, subject to politics, short-term immediate incentives, and the pragmatic observation that any attempt to make significant changes (i.e. "change the laws around classification of documents") has such a high time horizon that it's better to bypass the law than try to fix it.
- marmot777 10y agoI think you're right as if you look at behaviors as the result of a rational decision-making process, it seems the sort of "decision" only an insanely self-destructive person or organization would make
- marmot777 10y agoAll of this makes more sense when I imagine smaller groups within the bureaucracy with narrow objectives and severe myopia trying to "solve" immediate problems to achieve short-term objectives. It makes my skin crawl to contemplate but the truth is that human beings do this sort of thing all the time.