Home / Blogs

Wikileaks, the CIA, and the Press

As you’ve probably read, WikiLeaks has released a trove of purported CIA documents describing their hacking tools. There’s a lot more that will be learned, as people work their way through the documents. For now, though, I want to focus on something that’s being misreported, possibly because of deliberately misleading text by WikiLeaks itself.

Here’s the text from WikiLeaks:

These techniques permit the CIA to bypass the encryption of WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman by hacking the “smart” phones that they run on and collecting audio and message traffic before encryption is applied.

Here’s what the New York Times said:

“Among other disclosures that, if confirmed, would rock the technology world, the WikiLeaks release said that the C.I.A. and allied intelligence services had managed to bypass encryption on popular phone and messaging services such as Signal, WhatsApp and Telegram. According to the statement from WikiLeaks, government hackers can penetrate Android phones and collect ‘audio and message traffic before encryption is applied.’”

The Wall Street Journal was much the same:

“WikiLeaks said the documents show the CIA’s ability to bypass the encryption of popular messenger applications, including WhatsApp, Signal, Telegram and Confide by hacking the smartphones they run on and collecting audio and message traffic before the applications encrypt the user’s texts.”

Both uncritically accepted the premise: that there’s something wrong with these encryption apps. Nothing could be farther from the truth. Rather, the existence of these hacking tools is a testimonial to the strength of the encryption. It’s hard or impossible to break, so the CIA is resorting to expensive, targeted attacks.

The Washington Post got it right:

“In a statement, WikiLeaks said the files enable the agency to bypass popular encryption-enabled applications—including WhatsApp, Signal and Telegram—used by millions of people to safeguard their communications.

But experts said that rather than defeating the encryption of those applications, the CIA’s methods rely on exploiting vulnerabilities in the devices on which they are installed, a method referred to as ‘hacking the endpoint.’”

As far as is publicly known, the encryption is strong. Even if it is somewhat weak, modern cryptosystems don’t fall in an instant; it takes a fair amount of computation to crack each instance. The CIA is hacking because that’s what’s left.

Hacking the endpoints—something I and my colleagues have advocated for years—is the right way to get around encryption. It’s much better than putting in back doors, since those can lead to serious weaknesses. And it’s not going to stop. As I’ve previous observed, spying will stop some time after a sustained outbreak of world peace. Spies, in other words, will always do whatever they need to do to gather information.

(What is the real story here? The big news is that this trove of files has been taken from the CIA, only a few months after a large collection of NSA files was stolen. Some counterintelligence officers have a lot of 36 hour days ahead of them.)

By Steven Bellovin, Professor of Computer Science at Columbia University

Bellovin is the co-author of Firewalls and Internet Security: Repelling the Wily Hacker, and holds several patents on cryptographic and network protocols. He has served on many National Research Council study committees, including those on information systems trustworthiness, the privacy implications of authentication technologies, and cybersecurity research needs.

Visit Page

Filed Under


Bruce Schneier, “Applied Cryptology” 1996"Chapter 10Most of Charles Christopher  –  Mar 9, 2017 6:33 AM

Bruce Schneier, “Applied Cryptology” 1996

“Chapter 10

Most of those applications have used lousy cryptography, but successful attacks against them had nothing to do with cryptanalysis. They involved crooked employees, clever sting operations, stupid implementations, integration blunders, and random idiocies. (I strongly recommend Ross Anderson’s paper, “Why Cryptosytems Fail” [44]; it should be required reading for anyone involved in this field.)

Even the NSA has admitted that most security failures in its area of interest are due to failures in implementation, and not failures in algorithms or protocols [1119].

In these instances it didn’t matter how good the cryptography was; the successful attacks bypassed it completely.

And 20+ years later what has changed?

Nothing …. Other than we have vastly exposed our lives to such technology, under an illusion of “encryption = privacy”.

FBI Used Best Buy's Geek Squad To Increase Secret Public Surveillance Charles Christopher  –  Mar 11, 2017 1:30 AM


“Recently unsealed records reveal a much more extensive secret relationship than previously known between the FBI and Best Buy’s Geek Squad, including evidence the agency trained company technicians on law-enforcement operational tactics, shared lists of targeted citizens and, to covertly increase surveillance of the public, encouraged searches of computers even when unrelated to a customer’s request for repairs.”

“In 2016, the defense lawyer claimed the FBI made Best Buy an unofficial wing of the agency by incentivizing Geek Squad employees to dig through customers’ computers, paying $500 each time they found evidence that could launch criminal cases.”


“Law enforcement has a number of informants working for it and the companies that already pay their paychecks, like UPS, for example. It also has a number of government employees working for the TSA, keeping their eyes peeled for “suspicious” amounts of cash it can swoop in and seize.
Unsurprisingly, the FBI also has a number of paid informants. Some of these informants apparently work at Best Buy—Geek Squad by day, government informants by… well, also by day.”

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet



Threat Intelligence

Sponsored byWhoisXML API

Brand Protection

Sponsored byCSC

New TLDs

Sponsored byRadix


Sponsored byVerisign

Domain Names

Sponsored byVerisign

IPv4 Markets

Sponsored byIPv4.Global


Sponsored byDNIB.com