Skip to main content

“Vault 7”: The CIA, hackers and the challenges ahead for document management

(Image credit: Image source: Shutterstock/alexskopje)

In recent weeks, Wikileaks struck again and decided to release more private, official documents into the world. In fact, it was the organisation’s most expansive collection of official documents yet. The group – known for operating outside the usual codes of the internet world – leaked around 9,000 documents from the CIA’s specialist digital team. These documents turned out to be a record of new and revolutionary hacking methods, developed in conjunction with British intelligence. According to the leak, CIA hackers have been targeting specific technologies: from smartphones to apps, no part of modern communicative devices were left untargeted. This hacking, supposedly, would be a way for both respective bodies involved to increase their monitoring capabilities.   

According to Wikileaks and the various reports that have followed, the documents detailed ways to break into phones and other electronic devices. Of particular interest was the “weeping angel” program, which was designed to spy on people through the medium of their televisions – even whilst they appeared to be switched off. If there were ever a time to reference George Orwell, it would be now. It seems that we really are being watched….  

However, our problems do not end with the prying eyes of “Big Brother”. A joint report from the National Crime Agency and the National Cyber Security Centre revealed that the rise of interconnected devices is creating a new, aggressive breed of hacker which targets individuals instead of entire systems. The report has predicted that “ransomware” is becoming commonplace: taking hold of people’s personal data like photos, emails and even their fitness trackers – threatening to reveal their personal details to the world unless a payment is received.     

Shocking and upsetting

The repercussions of these kind of attacks can be shocking and upsetting to most. We often see pictures of celebrities being released to the masses which they would rather have kept private. Even Hilary Clinton fell victim to the exposure of her personal emails during the presidential election. Alarmingly, the very apps we use can put us at risk: most recently a huge settlement came out of a company which had gathered and failed to protect information about its customer’s sexual habits. 

You can imagine, if these kinds of attacks started occurring to each of us on an individual level, we would most definitely pay whoever was controlling the ransomware to protect ourselves, our private information and our reputations. 

These developments and news stories may be alarming for many people outside of the cybersecurity world. This is only natural. As many people are becoming increasingly attached to their electronic devices and methods of document storage, the Wikileaks story becomes terrifying to them in two ways: How do we know if our digital data is safe, and how can we protect ourselves and our data from hackers who want to exploit it? 

From the perspective of a cybersecurity professional, however, these revelations should not be shocking to people at all. It is a widely known fact in our industry that anything which we keep connected to the Internet has the potential to be hacked or broken into, whether it’s a phone or even a driverless car. This is the very nature of the digital technologies we have worked so hard to create across the past few decades. Whether or not data is compromised simply boils down to two things: how much patience and time people have to break into something, and the level of resources they can put towards said hacks. Although we know in many cases it can take huge amounts of manpower and time to break into a system, we still have to recognise that it is always a possibility with enough effort and resources put in. 

How we define 'secure'

Members of the public must learn that the main reason something is secure is because of the length of time and effort it would take a hacker to break into it – not because the data itself is impossible to access. This can be reflected in the way we create strong encryptions: the length of the key and the amount of time it would take a brute-force attack to crack it is where the security comes from. Sadly, people may need to start getting real about all of these “leaks” and “hacks” by recognising that they will inevitably keep occurring after a certain length of time has passed and people have successfully broken codes. Obviously when it comes to public devices, keys are most often less sophisticated than the ones I am referring to: therefore, hacking of personal data will have to be accepted as an even more likely possibility.  

If anything, we can perhaps use these scandals and warnings and a learning point. The leaks and cyber threats that have been dominating the news agenda in the past week are a prime example of how we must have procedures in place to install security updates and patches: whether that is from the perspective of a business caring for its own protection, or businesses who have a responsibility to their clients to protect the data which passes through their apps or products. Individuals, too, must take it upon themselves to monitor their devices for signs that they have been breached: these combined approaches, which organisations and consumers alike must take together, should be a way to keep most people safe from unwanted attacks. 

Overall, as long as we look at our cybersecurity measures from the assumptive perspective that someone could be inside our network at any time, it will be difficult to create opportunities for hackers to slip through the cracks and gain access to data that should – and hopefully will – remain the private property of those who produced it in the first place. 

Phil Beckett, Managing Director, Alvarez & Marsal
Image source: Shutterstock/alexskopje

Phil Beckett
Phil Beckett is a Managing Director for Alvarez and Marsal. He works for their Disputes and Investigations team and is a cybersecurity expert and forensic investigation specialist.