Hey CIA, You Held On To Security Flaw Information -- But Now It's Out. That's Not How It Should Work (eff.org)

Cindy Cohn, writing for EFF: The dark side of this story is that the documents confirm that the CIA holds on to security vulnerabilities in software and devices -- including Android phones, iPhones, and Samsung televisions -- that millions of people around the world rely on. The agency appears to have failed to accurately assess the risk of not disclosing vulnerabilities to responsible vendors and failed to follow even the limited Vulnerabilities Equities Process. As these leaks show, we're all made less safe by the CIA's decision to keep -- rather than ensure the patching of -- vulnerabilities. Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

Comments

Who's Responsibility?

[ISoldat53]

Is it the CIA's responsibility to point these out? How many "flaws" are intentional?

Re:Who's Responsibility?

[Anonymous Coward]

Did you not read the summary?

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

It's their job.

Re: Who's Responsibility?

[Anonymous Coward]

Social contracts, social responsibilities are applicable on the land populated by 10,000 unicorns.

Re:Who's Responsibility?

[phayes]

Says who?

Re:Who's Responsibility?

[goombah99]

It's like how when the CIA discovers a Russian General has a secret to hide they never black mail him but immediately notify the Russian Authorities of their vulnerability.

Re:Who's Responsibility?

[rmdingler]

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

Security yes... abroad. Privacy: not so much.

The CIA has been historically responsible for international operations, including spying in and on foreign nations. The FBI is supposed to do those things inside the country.

Re:Who's Responsibility?

[Anonymous Coward]

Three parts to that I can see - government, companies (ie economy) and citizens. All of which could suffer from those unpatched flaws being exploited.

Re:Who's Responsibility?

[nomadic]

Pretty much. This story makes zero sense. The CIA didn't just happen to find security flaws, they intentionally looked for them so they could exploit them.

Re:Who's Responsibility?

[ThomasBHardy]

While I find the abusive techniques being reported as abhorrent as the next fellow, I would challenge the assertion that it's their job to disclose security issues.

I'm not saying that they morally are not obligated. They are morally obligated to do so, in my personal opinion, to maintain the general fabric of security for the country.

But I'm not so sure that they have a legal obligation to do so.

There are some pretty convincing cases where they could argue that an obscure exploit can be disclosed and upgrade the digital security of the nation by 0.01% or they could hold onto it and use it to help prevent specific bad actors with big plans.

So yes, while I'd like to think we're all above board and working towards a bright shiny future with full disclosure, I'm not sure that the charter for agencies running covert ops lists vulnerability disclosure as their operational mandate.

Re:Who's Responsibility?

[thegarbz]

Says the CIA on their about page under responsibilities of the director.

Correlating and evaluating intelligence related to the national security and providing appropriate dissemination of such intelligence;

Re:Who's Responsibility?

[Opportunist]

It's the CIAs job to protect Americans and keep them safe. Its job also includes protecting the US' trade secrets and commercial interests. And that by definition entails making sure that enemies of the US, be it military or economic, cannot abuse security problems that may affect US interests.

In other words, yes, pointing those security flaws out to manufacturers and making sure that these flaws cannot be abused by enemies of the US and its assets is pretty much the definition of the CIA mandate.

Re:Who's Responsibility?

[Archtech]

It's like how when the CIA discovers a Russian General has a secret to hide they never black mail him but immediately notify the Russian Authorities of their vulnerability.

That's logical, because Russia - like the USA - is the CIA's enemy.

Re:Who's Responsibility?

[Opportunist]

As long as commercial interests and hence the national security interests and hinge to no small part on the economic stability and power of the US use the same tools that private citizens use, protecting our privacy is basically collateral damage of protecting the US national security.

Re: Who's Responsibility?

[Anonymous Coward]

George? Is that you?

Re: Who's Responsibility?

[chasm22]

And, in your mind, there will never be any problem deciding what is appropriate?

It seems to me to be a typical document meant to cast an 'appropriate' image of an agency whose very nature makes it impossible to easily explain its actions.

I find this action by Wikileaks to be disturbing by its timing. The contents shouldn't be a total surprise.

There's been plenty of hints going back years. In 2003 we had OnStar versus the FBI. A couple of years ago Verizon tried to patent an invention that made your TV both a display and a video cam.

Re:Who's Responsibility?

[gnick]

Correlating and evaluating intelligence related to the national security and providing appropriate dissemination of such intelligence;

The definition of the word "appropriate" makes all the difference in that statement. Is it "appropriate" to sacrifice capabilities in the name of improving the public's general digital security?

Re: Who's Responsibility?

[Anonymous Coward]

"Correlating and evaluating intelligence related to the national security.."

Bobs hacked Samsung TV is not a national security issue. Its not the CIA's job to worry about the fact that someone could possibly compromise your smart phone revealing all your most sensitive dick picks. The CIA holds on to vulnerabilities like these to do little insignificant things like hacking the NK nuclear missile programs stalling a potential international conflict, hacking Iranian nuke programs, thwarting terrorist bombings by interception of communications, destabilizing foreign nations that are apposed to your existence, etc.. But I'm sure your dick pics should be their top priority.

Re:Who's Responsibility?

[Stephan Schulz]

I cannot resist. "In Soviet Russia, TV watches you." More seriously, it looks like 1984 was a documentary...

Re: Who's Responsibility?

[Anonymous Coward]

Says themselves really. The TLAs are all still working on the old warfare espionage mentality. It's a wire, it must be tapped, and tapping procedures are classified. But the world has changed since then. Its so massive a situation now that no single government agency that was constitutional could ever hope to truly keep the situation under control. They will need the system administrators of the world's help.

The best first defense against it is awareness of the security issues in the tools we use. So that we the system administrators can do our jobs of ascertaining the severity of the flaw and how to mitigate it, thus reducing the total number of active vulnerable software versions running. Anything less is playing with fire.

And to those whom I know are just foaming at the mouth with we must protect ourselves from the evil of the world and this is justified, I say bullshit. Its becoming obvious that more devices will be online than ever before in the next 5 years or so and each one would be a new attack surface to bug, and not everyone is going to be a thorough, methodic and meticulous system administrator, just like people let their automobiles fall into disrepair because they didn't do routine maintenance. Social engineering would've far more effective than tap the wires these days

Re: Who's Responsibility?

[Impy the Impiuos Imp]

Thb they would probably argue they are protecting the safety of US citizens by maintaining a spy capability. That is their job, not turning over those same vulnerabilities.

Re:Who's Responsibility?

[T.E.D.]

Correlating and evaluating intelligence related to the national security and providing appropriate dissemination of such intelligence;

"intelligence" is government-speak for information they took from someone. If your desk safe has a factory combination that always works, that isn't "intelligence". The contents of what they found inside your safe when they used that combo is intelligence.

So no, its not their job to warn US citizens if they are vulnerable domestically. That's called "domestic counter-intelligence", and is explicitly the FBI's job.

Sure, it would be nice if the CIA did it anyway. But if that burns a method they are finding useful themselves to do things that ARE their job, I wouldn't hold my breath.

Re: Who's Responsibility?

[Anonymous Coward]

The problem with not having this released by Wikileaks is that until now, the people who claimed this capability existed were labeled as paranoid conspiracy theorists. Same thing with Snowden's leaks. I saw a column in the USA Today just now that said Americans don't need to worry because the CIA doesn't spy on Americans. Utter crap. They give the tools to European agencies to spy on us in the USA and we spy on their citizens for them.
National security does not justify whatever they want to do. They no longer fear prosecution because no one faced consequences after the Snowden leaks.
Basically, if nothing happens now except a manhunt for the whistleblower, we are all freaking doomed.

Re: Who's Responsibility?

[jafiwam]

"Correlating and evaluating intelligence related to the national security.."

Bobs hacked Samsung TV is not a national security issue. Its not the CIA's job to worry about the fact that someone could possibly compromise your smart phone revealing all your most sensitive dick picks. The CIA holds on to vulnerabilities like these to do little insignificant things like hacking the NK nuclear missile programs stalling a potential international conflict, hacking Iranian nuke programs, thwarting terrorist bombings by interception of communications, destabilizing foreign nations that are apposed to your existence, etc.. But I'm sure your dick pics should be their top priority.

You forgot "Spy on opposition candidates"

Re:Who's Responsibility?

[AmiMoJo]

They knew that Samsung TVs could be used to spy on people via their cameras and microphones. Samsung TVs are quite popular. It's likely that they are in sensitive places, like meeting rooms of US corporations, hospitals, newsrooms etc. And in all likelihood, the Russians and the Chinese and the Iranians and the North Koreans and GCHQ and many other intelligence agencies know all this too. I wouldn't be at all surprised if for-hire black hats knew as well.

So the CIA has a choice. Sit on this information and use it to gather intel themselves, but leaving the US at severe risk, or publish and give up their capability but also deny it to their adversaries. They must have either decided that the intel was more valuable than the loss to US citizens and corporations, or more likely never even had this discussion.

Re:Who's Responsibility?

[jbolden]

National security not personal security. Not the same thing.

Re: Who's Responsibility?

[Anonymous Coward]

You forgot "Spy on Russian ambassadors, along with anyone retarded enough to meet or call said ambassadors and then flip their shit when they've been seen by Several Dozens Of Eyes."

Just because you're a narcissist doesn't mean everyone is out to listen to your phone calls personally.

Re:Who's Responsibility?

[jbolden]

The FBI (and more the department of commerce) not the CIA is responsible for protecting corporate interests. The CIA can freely endanger American corporate interests.

Re:Who's Responsibility?

[bobbied]

Did you not read the summary?

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

It's their job.

I hate to disagree, but isn't that the FBI's job domestically? At least it's going to be part of Homeland Security or something...The CIA is specifically limited to gathering forgiven intelligence isn't it?

Re: Who's Responsibility?

[hesiod]

National security does not justify whatever they want to do.

But 9/11! We need to be protected!

Re:Who's Responsibility?

[Anonymous Coward]

There are some pretty convincing cases where they could argue that an obscure exploit can be disclosed and upgrade the digital security of the nation by 0.01% or they could hold onto it and use it to help prevent specific bad actors with big plans.

The fundamental issue is that (1) it has been repeatedly shown in leaks that "obscure" exploits tend to not be near as obscure as TLAs tend to believe, so "specific bad actors" will often have the same or near identical exploits at their own disposal; (2) digital security is rarely of the "0.01%" variety but of the "100% of the people who use this device, of which there's several 'important' 'good' actors*" which due to the fallacy of (1) are now potentially being exploited by "bad actors with big plans"; and (3) if they really want to monitor "specific bad actors with big plans" they should spend "specific" resources to bug their house/work, search their house/work, etc instead of leaving very widespread "obscure" exploits that effect a lot more than a very few "specific" bad actors. It's this last point, where the CIA and other TLAs seem more interested in having the power of a General Warrant in practice even though a specific Search Warrant or equivalent** is not only generally legally required by obviously desired morally precisely because otherwise TLAs have way too much independent power at their disposal.

* Unless they're going around and informing every Governor, Congressman, Diplomat, etc to avoid 99.99% of commercial devices, which they themselves have targeted and know are vulnerable.

** Obviously the CIA doesn't per se need a warrant, but it certainly does need some level of specific Congressional oversight and even Presidential oversight so it doesn't just operate as its own independent clearing house for the violation of everyone's private lives (and worse).

Re: Who's Responsibility?

[unixisc]

George who?

Re:Who's Responsibility?

[Anonymous Coward]

I do believe that Wikileaks has the responsibility now to release the software so the industry can get these vulnerabilities fixed.

Re:Who's Responsibility?

[mandark1967]

There's nothing in that italicized statement that states it's their responsibility to ensure your right to privacy.

There's nothing in that statement that states it's their responsibility to disclose vulnerability information to the holes can be patched

Re:Who's Responsibility?

[unixisc]

Actually, 1984 was an Oracle or Nostradamus prediction - only thing - happened to be off by 32 years

Re:Who's Responsibility?

[reddi-phreddi]

On the other hand, these flaws are probably exploited in common by all of the other spy agencies, so the disclosure is a plus.

Re: Who's Responsibility?

[TheRaven64]

Bobs hacked Samsung TV is not a national security issue

It is when Bob is the son of a general and the television is used to eavesdrop on conversations of classified material in his house.

Re:Who's Responsibility?

[TheRaven64]

Samsung TVs are quite popular. It's likely that they are in sensitive places, like meeting rooms of US corporations, hospitals, newsrooms etc.

It's worse than that. These TVs don't just end up there, they're actively marketed at these places because they can install various video conferencing apps and avoid the need to have a separate computer to control the video conferencing system.

Re:Who's Responsibility?

[TheRaven64]

Apple released the G5 iMac - a wall-mountable computer embedded in a display with a camera and network interface built in - on the 20th anniversary of their 1984 superbowl commercial, which ran with the tagline 'why 1984 won't be like 1984'. Apparently the reason was that it will take 20 years to get it into production.

Re: Who's Responsibility?

[MSG]

The CIA doesn't have a responsibility to Russia. If their officials have personal vulnerabilities, those vulnerabilities are exclusively Russian. Software vulnerabilities aren't exclusively Russian. These vulnerabilities affect American citizens. They affect American troops and officials. They affect American government agencies. The risk is not simply that the vulnerabilities will be discovered by foreign intelligence, but that any one of thousands of employees and contractors could sell the entire archive, instantly giving the buyer capabilities equal to or greater than the CIA itself.

Re: Who's Responsibility?

[Anonymous Coward]

He's the one that tells about the rabbits.

Re:Who's Responsibility?

[spire3661]

All this says is that you are ok with the CIA operating on its own agenda.

Re:Who's Responsibility?

[Anonymous Coward]

national security != the security and privacy of Americans

Re:Who's Responsibility?

[Anonymous Coward]

I would challenge the assertion that it's their job to disclose security issues.

You can challenge it all you like, but once the semantic bullshit is out of the we all know it's plain as day... seeking out and hording exploits en mass is not a legal or moral grey area for a government intelligence agency who exists ultimately to protect it's citizens who are all affected deeply by those exploits.

Re:Who's Responsibility?

[Anonymous Coward]

To create exploits that they then use to crash cars, down airplanes, and plant evidence that russians were attacking the DNC. All with 0 oversight. Yea keep dreaming its thier job.

Re:Who's Responsibility?

[Anonymous Coward]

No, that's not intelligence. What intelligence is is what the end results of the analysis point to after all the pieces of information are put together.

Re: Who's Responsibility?

[Anonymous Coward]

There are people who voted in the last election too young to remember 9/11. Since 9/11, 10 times as many soldiers and 50 times as many civilians have died in Iraq & Afghanistan as the death toll at the twin towers, and more than 130 times as many people in the USA have since died in car crashes. Get over it already.

Re:Who's Responsibility?

[fonske]

Suicidal Tendencies was already making songs like "flashing pictures on my screen, shown too quickly to be seen, does not register in my conscious mind, propaganda of another kind - they're fucking with me subliminally"

Re:Who's Responsibility?

[hairyfeet]

Uhhh you might want to look up the history of the CIA, the amount of murders of politicians and political leaders that didn't kiss the corporate ring of some multi-national? Is just staggering, nearly every action they did that resulted in "regime change" was to benefit some corp that was exploiting the people or the resources of some weaker country. They follow the "war is a racket" playbook and make sure that greedyco doesn't have to worry about any pesky peasants actually wanting to be treated right or using their own resources.

Re:Who's Responsibility?

[Anonymous Coward]

He is kinda correct, in that they are indeed doing their job, does not mean i have to like, or agree with it.

Those are opinions, and we are all entitled to ares, as are they to theirs.

Re: Who's Responsibility?

[Anonymous Coward]

Not to mention the concept that the orthodox Left will speak no ill of this, since an attack on any part of the government is an attack on all of government, and we certainly can't be casting aspersions on the omniscient and beneficent government.

Re:Who's Responsibility?

[jbolden]

Sure. If the USA decides a particular corporate activity is in the national interest then the CIA can freely back it. We had a lot more crony capitalism 1930s-1970s and it showed across all areas of government, including the first 3 decades of the CIA. My point is that this is not a blanket guarantee. They can also act against corporate interests freely when they deem it appropriate.

Re:Who's Responsibility?

[thegarbz]

Is it "appropriate" to sacrifice capabilities in the name of improving the public's general digital security?

That depends on what is more important. Protecting yourself or protecting the people. Lets face it, it hasn't been the latter for a long time.

Re: Who's Responsibility?

[Anonymous Coward]

I think you're very confused about the concerns of the left, and consequently the right, as well.

Re: Who's Responsibility?

[cellocgw]

Bobs hacked Samsung TV is not a national security issue

It is when Bob is the son of a general and the television is used to eavesdrop on conversations of classified material in his house.

SRSLY? If some jackass general is discussing classified info outside of an approved secure area, that's the national security issue. He should be court-martialed. That said, catching him in the act in his own home should be preceded with issuance of a valid warrant.

Re: Who's Responsibility?

[Anonymous Coward]

If Bob is discussing classified material in an unsecured environment then Bob is not correctly protecting classified material and should probably be charged with a federal felony.

Re: Who's Responsibility?

[leftCoaster]

Suppose the general is abusing his son. Suppose he is discussing something with his mistress. Suppose the general is dressing up in his daughter's clothes. Knowing any of that could make him vulnerable to coercion. This leverage could be used to influence the general in subtle ways.

One reason people objected to the collection of meta-data was that with sufficient, seemingly innocent, data it is possible to discern guilty behavior.

Re:Who's Responsibility?

[lgw]

nearly every action they did that resulted in "regime change" was to benefit some corp that was exploiting the people or the resources of some weaker country

That's not really useful evidence is the thing. Any regime change that didn't install a communist was going to benefit some corp in the region (and if the old guy wasn't a commie, then it would screw whatever corp he was in bed with).

Since the primary mission of the CIA for years was to overthrow small communist-leaning governments, usually for some tyrant who ended up working against us, the result would tend to be pro-corporate just as a side-effect of their blind anti-Red agenda.

Re:Who's Responsibility?

[Anonymous Coward]

All this says is that you are ok with the CIA operating on its own agenda.

a.k.a doing its job.

Re:Who's Responsibility?

[Talderas]

It's a plus depending on who you're talking about.

Foreign Spy Agencies: Positive
Domestic Companies: Positive
CIA: Negative
Domestic Spy Agencies (Excluding CIA): Probably Negative

Consider the following scenarios where two spy agencies both use an exploit to spy on the other team.

1. Neither agency is aware the other agency has the tool.
2. Both agencies are aware the other agency has the tool.
3. One agency is aware the other agency has the tool but not the inverse.

3 is the ideal situation for your team because you can employ honeypots and misinformation so you want to be on the upper hand where you know the other side has the tool. There's no telling how many of these exploits fall into category three. It means that other intelligence agencies will be rummaging through this list of exploits to identify weaknesses and information that they didn't think the CIA knew as well as identifying any information collected with these exploits as they need to be put back under consideration on whether they are true or not.

Re: Who's Responsibility?

[Anonymous Coward]

If an exploit is used, it should be classified and not released (exceptions apply, of course).

When things like heart bleed come out in public, good sys admins will go back through logs and other captured data to go back and determine if they were being exploited. This discovery can also implicate the IT guy who installed it and get himself outed as a spy.

Once they know that others are actively exploiting them should they report it, in my opinion. Then you can always point to some boogy man.

Re:Who's Responsibility?

[Tharkkun]

Samsung TVs are quite popular. It's likely that they are in sensitive places, like meeting rooms of US corporations, hospitals, newsrooms etc.

It's worse than that. These TVs don't just end up there, they're actively marketed at these places because they can install various video conferencing apps and avoid the need to have a separate computer to control the video conferencing system.

So let me get this straight. The CIA works with Samsung to market TV to specific people and corporations and then also interferes by back dooring these specific tv's before shipping them out? Because it's already been proven the TV's can't be accessed remotely without first having physical access (usb port) and modifying them.

Re: Who's Responsibility?

[Anonymous Coward]

I just wanted a Pepsi.

Re:Who's Responsibility?

[phayes]

They "correlate and evaluate" to the State department and other entities of the USG.

The "Disseminating information" part of their mission does not mean that they must (or should) inform corporate entities of their bugs.

Re:Who's Responsibility?

[phayes]

Some parts of the USG have the mission to protect us: CERT for example.

Some parts have the mission to get evaluate and distribute information to the State dept and the rest of the executive branch. CIA/NSA/...

Anyone who claims that both are not needed and the USG should only "Protect us" are either lying or idealistic fools. Which are you?

Re: Who's Responsibility?

[Anonymous Coward]

The same has been true since there was an online. There will be more devices online then there was the previous year. This will likely be true for many years to come. Saying that there will be more devices than ever, to come online in the next five years, is just stupid and obvious to anyone who isn't functionally retarded.

Re:Who's Responsibility?

[phayes]

When the CIA/NSA/... is following the constitutional laws and directives of the executive branch they are performing the mission that they were created to do.

That mission does not include serving as Apples/Googles/Microsofts/ZTEs/Huaweis/Samsungs vulnerability assessment division.

Re: Who's Responsibility?

[Anonymous Coward]

Two things.

One, no such thing was proven and you can't prove a negative.

Two, you're an idiot.

Re: Who's Responsibility?

[Anonymous Coward]

No, because the CIA has many other assets that are not just the exploits. Please, try to not be dumb. Thanks.

Re: Who's Responsibility?

[Anonymous Coward]

Yeah, workman-IT help Bob installed that Samsung TV on the wall in the Pentagon or White House or in some senators home or some corporate headquarters conference room ...

Re:Who's Responsibility?

[Namarrgon]

Except all the US generals have the exact same secret, and are equally vulnerable to blackmail. As do their politicians, corporations, citizens, and allies.

So by not notifying anyone, they're leaving their own country wide open to the Russians, Chinese, Mossad, other nations, organised crime etc, who they are hoping desperately haven't and won't ever notice the same secret themselves. They can't even tell if it's already happened. It's pure security through obscurity, and we've just seen that it didn't work.

Apparently they're supposed to disclose them, but clearly they're not.

Re:Who's Responsibility?

[Anonymous Coward]

Did you not read the summary?

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

It's their job.

uhhh, no.
There is nothing in the CIA's mandate that even vaguely hints that the CIA is responsible for Americans' privacy

Re: Who's Responsibility?

[Anonymous Coward]

No. It and all of these vulnerabilities will become a major issue in a few years. When they become script kiddie shit floating around the net. A lot of these things have been talked about for years. Just because you bought a vuln doesn't mean somebody else won't stumble upon it in their own.

Re: Who's Responsibility?

[Anonymous Coward]

Actually, the vulnerabilities that are exploited, and the tools that run on ant unclassified system have to be explicitly declassified... you can't run classified software or use classified information on unclassified systems.

Re: Who's Responsibility?

[Anonymous Coward]

The tool runs on their own hardware to remotely exploit the target. Even if it didn't, have you ever worked with classified info?

I don't know how the fuck you think spies operate.

Re: Who's Responsibility?

[Anonymous Coward]

The left can't and won't lift a finger for anything else except to assign blame.

Cyber security is a double edged sword to these 3-letter agencies. I'm not agreeing with what they've done, but I can understand their reasons for doing so.

Re:Who's Responsibility?

[Xest]

Actually I suspect the real problem is that they've been tasked to focus on terrorism for so long now that counter-intelligence has been largely neglected, which is why they're suffering all these leaks in the first place.

I suspect the question was a lot less, "Do we gather foreign information at the risk of US information?", and more, "Information is small fry compared to stopping the next 9/11". The reality is they're probably always going to prioritise intelligence gathering to avert physical attacks over counter-intelligence right now because it has been their assigned priority since the war on terror began.

I presume with all the leaks they may be beginning to wake up to the reality that there's a cost to taking your eye off the ball of counter-intelligence and focussing almost entirely on terrorism now however.

Re: Who's Responsibility?

[Anonymous Coward]

Better word is "whose."
Crazy language.

Re:Who's Responsibility?

[Anonymous Coward]

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

It's their job.

No. It really is not their job to do so.

CIA's primary mission is to collect, analyze, evaluate, and disseminate foreign intelligence to assist the President and senior US government policymakers in making decisions relating to national security.

https://www.cia.gov/about-cia/todays-cia/what-we-do

You may feel that it should be their job to do so, but it is not.

Re:Who's Responsibility?

[Anonymous Coward]

Why are people acting like the CIA has some secret hack? This is old news.
ANYONE that's been paying attention knows about the smart TV vulnerabilities.

Slashdot, from 2012:
https://tech.slashdot.org/story/12/12/12/168202/zero-day-hole-in-samsung-smart-tvs-could-have-tv-watching-you
https://yro.slashdot.org/story/12/03/31/2027225/samsung-says-their-tvs-arent-really-spying-on-you
https://it.slashdot.org/story/12/04/24/1642230/samsung-tvs-can-be-hacked-into-endless-restart-loop

Another warning from 2016.
https://tech.slashdot.org/story/16/02/14/1742240/samsung-warns-customers-to-think-twice-about-what-they-say-near-smart-tvs

Re:Who's Responsibility?

[Anonymous Coward]

Did you not read the summary?

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

It's their job.

You are so wrong...

https://www.cia.gov/about-cia/cia-vision-mission-values

Vision
CIA’s information, insights, and actions consistently provide tactical and strategic advantage for the United States.

Mission
Preempt threats and further US national security objectives by collecting intelligence that matters, producing objective all-source analysis, conducting effective covert action as directed by the President, and safeguarding the secrets that help keep our Nation safe.

Re: Who's Responsibility?

[EmptyHead]

They are an intelligence group. Their job is to find ways to exploit just about anything. Now, if they are breaking the law this dump will likely save Congress time to discover that. However, whoever did this is just creating anarchy and I hope they bring back treason when it happens. You are always aiding the enemy when you dump this kind of information that you have signed legal agreements and sworn duties to protect.

Re:Who's Responsibility?

[EmptyHead]

Mod parent up. A lot of this info that was released is rather old. The smart phone stuff has been around for quite a while too. There have been theories about smart card exploits as well.

https://it.slashdot.org/story/...
https://tech.slashdot.org/stor...
...etc.

Re:Who's Responsibility?

[Anonymous Coward]

...smart car exploits, not smart card. *face palm*

I don't agree

[Anonymous Coward]

The NSA is supposed to help and disclose vulnerabilities to the US at the evry least, rather than exploit them. The CIA on the other hand has no such goal, and the sole reason to search vulnerabilities is to exploit them onto every other countries.

Re:I don't agree

[SharpFang]

"Let the USA burn to ashes, as long as we manage to destroy Russia in the process"?

Re:I don't agree

[phayes]

So the NSA/CIA/... are now the publicly financed bug tracking unit of Apple/Google/Microsoft/ZTE/Huawei/Samsung/etc ?!?

Saying otherwise is "Let the USA burn to ashes, as long as we manage to destroy Russia in the process"?!?!

Re:I don't agree

[Fire_Wraith]

You are incorrect. The NSA does have an explicit Information Assurance mission, but it also has an intelligence collection mission. Also, while the CIA does not have an explicit IA mission, its ultimate goal is the defense of the nation, which does not preclude issuing warnings about uncovered vulnerabilities.

The problem is that they both have two conflicting goals when it comes to a discovered vulnerability, which can be used both by others to attack us, but also can be used by those agencies to gather intelligence. The term for it in the Intelligence Community is the "Equities Problem." This wasn't an issue in the past, because in the days of the Cold War for instance, the systems/codes/etc the Soviets were using were entirely different from American ones. Discovering a vulnerability in a Soviet cryptography system was only useful for intelligence gathering, whereas patching a vulnerability in an American cryptography system would not imperil our foreign intelligence collection activities.

In today's world however, everyone basically uses the same systems. This presents a quandary for the three-letter-agency folks. Do we patch everything and shut off our ability to gain information, possibly missing key information about a future attack? Do we keep the vulnerabilities secret to enable more collection, knowing that one of those vulnerabilities will someday be used to attack us and that we could have prevented it? Do we somehow try and muddle through, knowing that we may wind up with the worst of both?

Re:I don't agree

[SharpFang]

They are also meant to be an external department of DEA, by arresting drug smugglers instead of taking their money to fund own operations.

They are also meant to be the American-funded police of Mexico, and customs agency, in order not to aid smuggling weapons to Mexican mafia.

Oh, and they are meant to be bodyguards of democratically elected politicians in South America, in order not to aid the local dictators in assassinating them.

And they definitely should open public-funded hospitals to aid people, so that they can't test illegal drugs on them.

Re:I don't agree

[tinkerton]

Seems there is another problem. Suppose you start from agencies with well defined responsibilities with their matching checks to control them(well, hypothetically, let's say 'better defined') The FBI is domestic but has its constraints. The NSA does hacking but has its constraints . The CIA does spying.
Then if the CIA expands into the domestic front and into the hacking front without the constraints, (and the foreign intervention front as well, it could be said), you have a problem with unchecked power. The common response though is 'the CIA is defending us they don't need to be constrained.' Yeah right. The whole security apparatus has gotten completely out of hand.

Re:I don't agree

[Fire_Wraith]

That is another problem area, and partly why we've seen the push for more things that could potentially be abused. Back in the day (so to speak), if you were spying on a radio broadcast from within the USSR, it was pretty clear that's what it was. You'd have to put your listening post somewhere close(r) to Russia. It wouldn't be in the middle of Kansas. Geography would make for a pretty clear definition. If you tapped phone calls in the USSR, you were pretty likely to get Soviets and not Americans, because Americans' domestic calls or even international calls weren't being routed through the USSR unless they were calling someone there.

Fast forward to today, where the internet is global, and traffic from Country A to Country B probably runs through the USA at some point, using all the same protocols as purely domestic activity. If the CIA wants to be able to hack computers belonging to bad guys from the Evil League of Evil, those very same tools can just as easily be used to hack anyone in the USA, because they're all using the same hardware and software we do. It's not even a matter of geographic separation anymore, either, as a US government hacker sitting at CIA HQ can just as easily make a connection over the internet to anywhere in America as to the rest of the world.

Now, I've worked with people in the Intelligence Community before, and I have a good opinion of them, but there definitely needs to be stronger oversight on a number of these things, because the potential for abuse is just so much higher than it used to be. Safeguards dating from the 1970s badly need updating to take into account the new reality.

Re:I don't agree

[bobbied]

"National Security" is not the same as "Personal Security". While they are related at times please do not conflate the two.

One is about the defense of the nation as a whole and is clearly a government responsibility, the other is only a government responsibility in as far as law enforcement and regulations are concerned.

Re:I don't agree

[phayes]

You need to tell whoever it is that is feeding you these "meant to" lines to knock off the psychotropics. None of that has anything to do with the missions of the CIA/NSA.

Re:I don't agree

[SharpFang]

Same goes to you, with the bug tracking mission.

Their primary mission is to protect safety of USA citizens. If they find something that threatens that safety, they should stop that thing by most prudent ways available. Not copy it and keep using themselves! Yeah, that thing might make them more efficient at spying. But it makes them way less efficient at protecting the USA.

Re:I don't agree

[phayes]

The mission of the CIA/NSA is NOT the "protect safety of USA citizens" [sic], that's just you making things up. Their mission statements are online. I suggest you read them to cure your ignorance

Re:I don't agree

[tinkerton]

I fully agree that the mere fact by itself that globalisation has made the categories more fuzzy, much less separate would require a major update of the rules. Only I think what's been going on in the last 15 years is of a different order. It's more in the neoliberal category of 'do whatever you want and take whatever money you need'. Now I've become a strong believer in checks and balances over time and I consider the current situation very unhealthy in that respect. The security apparatus simply has too much power now.

Re:I don't agree

[SharpFang]

Funny. I just reread it. None of the entries states anything of actual benefit to the country, or anyone for that matter. The entirety of existence of CIA is fulfilling a pointless and baseless whim of the president - deliver intelligence. With absolutely zero rationale given. Zero authority for doing anything else.

Yep, looks exactly like your typical runaway optimizer AI, the paper-cliper. Unable to determine conditions at point X for an intelligence report? Nuke it, then report "conditions:nuclear crater" with full authority. Given presidential candidate might limit the agency's ability to collect intelligence? Lead another candidate to win. Given intelligence collection project needs funds? Smuggle drugs.

Re:I don't agree

[phayes]

I congratulate you on taking the first steps of enlightenment. The next step will be to accept that just because you do not understand something that it does not automatically mean that it is without value. A common indicator of this failure on your part is when you disagree with everyone around you but finding another self deluded fool doesn't make you right either.

The CIA exists to gather evaluate and deliver intelligence following the directives of the Executive branch while remaining within the bounds and budged defined by Congress & the Courts & would not exist were they all to find it as useless as your unlearned self does.

Re:I don't agree

[SharpFang]

Apparently they don't really care about the bounds as defined by the Courts that much. Never mind, while I never claimed what they produce is worthless, they produce it at a certain cost - and not just budgetary, but a cost to the society as a whole: privacy, liberties, justice, public order, stability, respect to the government, public health and safety. And at times these costs outweigh benefits by far - but since they are "hidden", never directly compared against the benefits - CIA can incur any costs it wishes, as long as the purely financial budget isn't exceeded and the violations aren't too obvious, it can do this with impunity.

Iran-Contras might have provided USA with certain benefits - but you'd be hard-pressed to argue they were well worth the costs it incurred.

Re:I don't agree

[phayes]

_You_ are in no position to judge, hell, until so very recently you didn't even know what the CIA's missions were and were just repeating the stupidities that others with no better comprehension fed you. I doubt you even know who controls their financing and decides whether or not they are performing their assigned missions as expected or not.

You're ignorant but still think that your opinion merits consideration. In short, you're a troll. Bye...

Re:I don't agree

[SharpFang]

Okay, so I'm clueless. Care to enlighten me: detail how MKUltra was the right thing to do? What don't I know about it that I can't judge CIA by it?

CIA is a spy agency that breaks the law.

[Anonymous Coward]

The CIA doesn't have the interest of the American public. They're used to committing illegal acts to get things done. Look up Iran Contra.

Re: CIA is a spy agency that breaks the law.

[Kkloe]

It is called doing their job like any * dum dum dum * spy agency should do, maybe you have heard of such terms. If you have problems with how they do their job complain to their boss(es).

Re:CIA is a spy agency that breaks the law.

[Archtech]

Is there an equivalent of Godwin's Law for Israel and the Jews? Because there ought to be.

Re:CIA is a spy agency that breaks the law.

[Anonymous Coward]

I thought the Russians thru the kommi-UN created Israel, there being so many Trotsky-sympathetic Jews that infiltration and adsorption was considered easy. Would have happened exactly that way ... but the Israel-Jewish data-merchants wanted too much money for their services - - what Jew doesn't - - and Unkil Sammy gave them THEBOMB ... so benevolent nation-building Russia kinda got screwed.

Re: CIA is a spy agency that breaks the law.

[Anonymous Coward]

"The CIA doesn't have the interest of the American public."

OK bud let me know how well the cold war would have ended for the American public without the CIA or other agencies like it. All your talk about illegal activities doesn't mean shit when you are burned to ash. I got news for you little snowflake: other nations don't care about you, your laws, and your "human rights".

Re: CIA is a spy agency that breaks the law.

[Anonymous Coward]

Since the president's boss is the CIA then who would that be? The Illuminati? The CFR? The campaign donors and lobbyists?

Re:CIA is a spy agency that breaks the law.

[torqer]

Congratulations: it's the Archtech Law.

Now go get a wikipedia page and it's official.

Re: CIA is a spy agency that breaks the law.

[Anonymous Coward]

They should be protecting the American people and not spying on them.

Re:CIA is a spy agency that breaks the law.

[unixisc]

The CIA doesn't have the interest of the American public. They're used to committing illegal acts to get things done. Look up Iran Contra.

Iran Contra was not a CIA operation: it was an NSC operation - Ollie North was an NSC guy.

Anyway, right now, the various intel agencies are more dedicated to running a background government of their own, complete w/ their own foreign and defense policies. Which is why they're doing their utmost to undermine the president. Having tasted blood in the form of Lt Gen Flynn, they're now targeting Sessions and anyone else they perceive as a threat, so that they can get their own swamp nominees in.

Re: CIA is a spy agency that breaks the law.

[ACE209]

other nations don't care about you, your laws, and your "human rights".

The question is more: are there some nations who don't care or are it all nations?

And what kind of nation do you want to be?

In too deep

[Anonymous Coward]

The problem is there are those in the CIA that have gotten "in too deep". It's as if, we are all now pawns on the board, ready to be sacrificed for the greater good.

That's not how it "should" work

[phayes]

Right, so when the CIA/NSA/whatever, uses a vulnerability that gives them access to information -- that it is their reason for existing, they should immediately turn the vulnerability over to the device manufacturer so that they will patch it.

Because these agencies exist and are financed to perform vulnerability testing for Apple/Google/Microsoft/HP/Dell/ZTE/Huawei/etc!?!?

Methinks that anyone that can say "that's not how it should work" with a straight face can only be a lawyer, habituated to defining truth as "whatever best serves me/my client".

We cannot be appalled by the lies of people like Trump and at the same time accept it when people who are say that they are defending us from his and other deceptions are also lying to us.

EFF, this does not help as it only gives Trump et all more ammunition.

Re:That's not how it "should" work

[moeinvt]

Do they really "exist" to gather information, or is gathering information just one tactic that they use as part of a larger mission? I'd argue that the only reason for their existence, or the existence of government in general, is to serve The People. Don't they repeatedly justify their activities by the claim that they're doing us a service?

Suggesting that the intelligence agencies exist purely for information gathering is the same as saying that the military exists purely to blow things up and kill people. They're good at doing that, but they do it in pursuit of a particular mission. "Invade and Occupy Iraq and find all the WMDs" for example.

If the mission of the intelligence agencies is to serve The People who pay the taxes and from whom the government derives its just power, they are doing us a disservice because we're not only vulnerable to THEIR information gathering, but vulnerable to anyone else in the world who figures out how to exploit same vulnerabilities.

Re:That's not how it "should" work

[jbolden]

Determining resolution of sources and methods is the job of the Senate and House intelligence committees. If they wanted the CIA to be in the vulnerability patching business they would have instructed them to do so.

Re:That's not how it "should" work

[chispito]

TLDR: If they were not permitted to hold onto vulnerabilities, they would stop finding vulnerabilities.

Re:That's not how it "should" work

[phayes]

After following the appropriate laws and the directives of the Executive branch, yes.

Re:That's not how it "should" work

[Xest]

The problem with your argument is that you're working on some misguided assumption that only you get to define how the people are best served.

Unfortunately, you need to understand that how you think you're best served, and how you're actually best served may well actually be two different things.

Furthermore, even if they're not two different things, and even if you're right, you still have the fundamental problem of living in a democracy where it's not you, and only you that gets to dictate priorities and what's classed as serving the people. So whilst you may feel you're best served by having your device vulnerabilities patched, there may be a number of other people who see that as far less of a priority than not becoming the next Boston marathon bombing victim as a greater priority - whether that's objectively right or not doesn't really matter in a democracy. The CIA's priorities and definition of what is serving the people will be set by the elected leadership.

So what you actually just did was gave your opinion on the internet and implied it's the only one true objective truth. Sorry to break it to you, but it's still just your opinion and not necessarily therefore correct, regardless of what you declare. There's every possibility that they are actually already serving the people the best way they can, whether you like that or not is ultimately irrelevant beyond your ability to influence it at the ballot box.

Re:That's not how it "should" work

[Anonymous Coward]

No, to them The People are The Enemy. Well, an enemy anyway. The only people who are not enemies are them and their brothers and sisters in other spy agencies. That's it. It's just like what law enforcement has devolved into in the US--it's us vs them. They don't serve us, they want to control us. The only cure is to replace them with people who are kept under proper supervision and control. But wait, you say, a nation has to have stuff like this. Yeah, unfortunately, but in a properly functioning republic with actual government transparency, such things ought to be relatively small and totally unheard of because they're also utterly rare--completely unlike today of course.

But wait, other countries want to steal our technology and advances and stuff. True, they do. You know what else is true? In the US, capitalism has long since stopped being an economic system and has become an unquestioned idol to be worshipped, and $diety help you if you don't profess loudly and publicly that capitalism is the solution to any and all problems. The government does more R&D than conservative idiots give it credit for, but the truth is that a good lot of the things that foreign nations want are in the hands of private companies. So the CIA et al try to stop things like that, allegedly. That means that our tax money is going to provide intelligence and information gathering and protection at the behest of private corporations (aka, rich people) who aren't paying for it, much like the primary purpose of our military these days is to protect overseas corporate assets. That is, our military is being used as a private security force to protect other peoples' stuff and you're paying for it. When our government steals stuff from overseas they often give it to their favored corporations to develop and then sell back to the government at obscene markups. That means that your tax money is being used to do the dirty work that increases corporate profits, again without your knowledge and consent.

The bottom line is that the CIA, NSA, etc. exist to keep the rich richer and the powerful in power and that's their entire purpose. They're not about protecting you, and the sooner you realize that the better.

Protest all you want.

[Anonymous Coward]

Just so long as you keep writing those tax checks to fund them, anyways.

The CIA is doing its job

[Anonymous Coward]

Doesn't it defeat the entire purpose of intelligence gathering operations to inform targets of your means & methods so... they can... stop you?

Re:The CIA is doing its job

[nomadic]

This is the EFF. Their minds dance forever in utopian fields of wildflowers.

Re:The CIA is doing its job

[Dissenter]

Saddly I have to agree. While in those fields of wildflowers, the ideal humanity has nothing but love and respect for its fellow human, but as long as that ideal exists, countries will continue to need security organizations like the CIA to keep an eye on those that dno not share those ideals. Until the entire world unilaterally accepts one another and the common good, there is a need for a defensive stance and that stance cannot support the altruistic ideas that most of us would love to adopt.

All of that said, the EFF does an outstanding job working to hold non-defense organizations accountable to their conumers and the self imposed privacy rules that they claim to hold so near and dear. I just wish that they would pick their battles a bit better rather than trying to fight everyone at once.

Intelligence agencies vs threats–us in the m

[asjk]

nt

Your worship of the State is the problem

[Anonymous Coward]

If you think that coming up with ways to assassinate people is worthy work, then your mind is warped.

Re:Your worship of the State is the problem

[Anonymous Coward]

If you don't think there are people that indisputably need to die then YOUR mind is the one that is warped.

God outsourced his job responsibilities to the CIA in order to give him more time to watch you masturbate.

Now the CIA has it all on camera and not even god dares fuck with them.

You know what the "C" stands for in CIA? That's right: Chuck Norris.

God bless America!

Re:Your worship of the State is the problem

[ACE209]

God outsourced his job responsibilities to the CIA in order to give him more time to watch you masturbate.

I think watching people masturbate was outsourced to DHS and FBI at some point.

I wonder what god does now, with so much free time on his hands.

Re:Your worship of the State is the problem

[lgw]

If you think that coming up with ways to assassinate people is worthy work, then your mind is warped.

Oh, so you wouldn't have assassinated Hitler, given the chance? We could have saved a lot of grief had it been possible to assassinate Saddam Hussein rather than drive in there and drag him out of his spider hole in person.

Considering....

[Zurkeyon3733]

That some of the exploits they decided to hang onto, were actually malware code samples that would allow them to attribute attacks to foreign governments. When in fact they had nothing do to with said attack. In addition to this, they appear to have held onto exploits for vehicle control systems, that would allow them to ASSASSINATE people without detection. This is CERTAINLY NOT what they were hired to do. Not by any of the US citizens/agents that I know anyway. These are EXPOSED Black Ops Projects, by any other definition. Its time that someone unbiased investigated the CIA/NSA... They clearly are into some things they shouldn't be. Things that are CLEARLY ILLEGAL...

Re:Considering....

[Anonymous Coward]

And now think, why Austrian nationalist politician Jörg Haiders car collided "mysteriously" with a tree, and he was killed on site.

Re:Considering....

[Tharkkun]

That some of the exploits they decided to hang onto, were actually malware code samples that would allow them to attribute attacks to foreign governments. When in fact they had nothing do to with said attack. In addition to this, they appear to have held onto exploits for vehicle control systems, that would allow them to ASSASSINATE people without detection. This is CERTAINLY NOT what they were hired to do. Not by any of the US citizens/agents that I know anyway. These are EXPOSED Black Ops Projects, by any other definition. Its time that someone unbiased investigated the CIA/NSA... They clearly are into some things they shouldn't be. Things that are CLEARLY ILLEGAL...

The CIA protects our country abroad. If these black ops missions saved millions of lives (which we know they have before) then one idiot like you being upset is worth it.

Allow me to help you understand

[Anonymous Coward]

You know that reason they have for existing? Yeah. People are trying to say that it's a trashy reason for existing. Get it yet?

Re:Allow me to help you understand

[Anonymous Coward]

What should intel groups do then. Hand out flyers with a friendly message. Pound sand, child. BTW, your European friends are just as aggressive with their gathering attempts, but not as competent. What sucks here is that we can't trust our own people to keep their mouths shut. Some public executions might help remind them what their security clearances are for.

Their job?

[Anonymous Coward]

Their job is to stop Mohammed from blowing up your children. If they have to refrain from disclosing a few security vulns they didn't even create in order to do that, so be it.

Re:Their job?

[Archtech]

Their job is to stop Mohammed from blowing up your children.

It's a bit late for that, unless they also have time machines. The best way to prevent "Mohammed from blowing up your children" (and when did that last happen in the USA?) would have been to refrain from blowing up his children. And his wife, and his aunts and uncles and his parents and his friends. And his dog.

Unfortunately that carrier task force sailed decades ago.

Re:Their job?

[Zurkeyon3733]

Try about 1400 years ago... A Few Questions for you... when was the last Cure invented by Muslims? The Last Surgical Procedure? The Last Great Piece of Technology? The Last Great Scientific Discovery? Then was the last time they lead a Humanitarian mission, to say, anywhere? When was the last time Israel, Iraq, Iran, Syria, Pakistan, or Afghanistan took in Refugees? When was the last Vaccine they invented? The last Nobel Prize? The Last Accomplishment in Space Travel? The Last Accomplishment in Women's Rights? Their Last Peace Accord? Their Last PUBLIC Admonishment Of The Muslim Brotherhood, Hamas, ISIS, the Taliban, the Rapes in Cologne, or ANY of the Recent Attrocities attributed to their people? Typically, I see them making excuses for Terrorists. nothing more. Show me their VALUE to society... I would TRULY like to see it. They invented Algebra about 2000 years ago. So that does NOT count. Show me what good they have done for the world LATELY. Last 1400 years or so. List their accomplishments. Lets hear it. :-)

Re:Their job?

[Anonymous Coward]

Try about 1400 years ago... A Few Questions for you... when was the last Cure invented by Muslims? The Last Surgical Procedure? The Last Great Piece of Technology? The Last Great Scientific Discovery? Then was the last time they lead a Humanitarian mission, to say, anywhere? When was the last time Israel, Iraq, Iran, Syria, Pakistan, or Afghanistan took in Refugees? When was the last Vaccine they invented? The last Nobel Prize? The Last Accomplishment in Space Travel? The Last Accomplishment in Women's Rights? Their Last Peace Accord? Their Last PUBLIC Admonishment Of The Muslim Brotherhood, Hamas, ISIS, the Taliban, the Rapes in Cologne, or ANY of the Recent Attrocities attributed to their people? Typically, I see them making excuses for Terrorists. nothing more. Show me their VALUE to society... I would TRULY like to see it. They invented Algebra about 2000 years ago. So that does NOT count. Show me what good they have done for the world LATELY. Last 1400 years or so. List their accomplishments. Lets hear it. :-)

Last Nobel Peace Prize? 2014. Literature? 2006. Chemistry? 2015.

Re:Their job?

[godrik]

Challenge accepted. In the last 10 years:
-Malala Yousafzai is a nobel peace prize winner and she is from pakistan. https://www.nobelprize.org/nob...
-Aziz Sancar was born and educated in turkey (difficult to tell whether he is of muslim faith or not, but he was probably at least raised in that culture) and is a chemistry nobel prize recipient.
-Maryam Mirzakhani was born and educated (up to bachelor) in Iran and received a Fields medal.

Re:Their job?

[Anonymous Coward]

"Peace price" is utterly political. Given even to war bloke like Obama, so it is utterly worthless.

Aziz Sancar is Turk. And he does not speak arabic. (When asked as to whether he is "a Turk or half-Arab" by the BBC, Aziz Sancar responded: "I told them that I neither speak Arabic nor Kurdish and that I was a Turk," he said. "I'm a Turk, that's it.")

Re:Their job?

[Archtech]

Er, how does any of that justify blowing them up?

Re:Their job?

[Archtech]

Challenge accepted.

And you therefore lose. You have accepted a challenge to debate an irrelevant, orthogonal issue. Whether it is right to kill Muslims wholesale does not depend on how many gadgets they invent or how many Nobel Prizes they win.

Best not feed the trolls.

Re: Their job?

[Anonymous Coward]

To be fair, when they are left to their own devices they collectively are rather abhorrent. It's really a bit of a pickle, isn't it?

Re:Their job?

[Anonymous Coward]

Last 1400 years or so. List their accomplishments. Lets hear it. :-)

https://en.wikipedia.org/wiki/History_of_Islam#Timeline

Despite concerns about reliability of early sources, most historians believe that Islam originated in Mecca and Medina at the start of the 7th century

the last 1400 years or so of Islam contain pretty much ALL of it.

Re:Their job?

[Trogre]

Three. The first of which is worthless.

Was that the best you could do?

Re:Their job?

[Zurkeyon3733]

2.... in 1400 years. Do you actually consider this a societal accomplishment? LOLOLOL

Old stuff

[clovis]

It looks to me like the list of CIA hacking tools is a list of vulnerabilities that we already knew about and have been discusssing since forever, and it's hardly just the CIA that's been taking advantage of the environment.

And it also looks like a list of vulnerabilities that the vendors all know about and we've all been complaining about.
Soooo why exactly should the CIA tell Apple "we have an evil app that intercepts messages before encryption" when Apple and everyone else who's been paying attention already knows about these apps. Should the CIA have meetings with every half-assed IOT vendor to tell them that their device is a POS and hiw the CIA takes advantage when we and they all know this already?

Really?

[Anonymous Coward]

"Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans." It is? News to me. Please cite the applicable Federal Legislation and Regulations. Or is this just some silly juvenile opinion of someone who doesn't know what the CIA does nor understand why they do it? See, life is full of compromises, and there's these things called "priorities". Last I heard physical threats rank somewhat above privacy threats in that list. Only juveniles believe as if we can have it all.

Re:Really?

[bobbied]

You are right. The CIA is NOT responsible for ones personal security. They are involved in NATIONAL security, which is related to personal security, but the two concepts are NOT the same thing.

Re:Really?

[Anonymous Coward]

Ah no, CIA is tasked with corporate and deep state security. The "national security" part is only a little white front for ordinary people.

Did CIA kill Mike Hastings by controlling his car?

[schwit1]

Journalist Michael Hastings Was Investigating CIA Director John Brennan Before He Was Killed in Fiery Car Crash

http://www.news.com.au/finance...

This is why people fear Artificial Intelligence

[SharpFang]

So obsessed with the letter of the mission statement, that you forget its spirit. Subjects you were meant to serve become means, and disposable resources in achieving goals that no longer serve their purpose, as the cost outweighs benefits by way too much.

CIA was created to protect safety of USA citizens. It got specific goals and means by which it would serve in that mission, and focused on them so much the mission went entirely out of focus. Collateral damage is no longer considered an issue. No matter how much CIA hurts and weakens the USA, it considers the actions a success if the "enemy" (actual or potential) is weakened in the process.

It's silly to expect a spy agency to obey the law and play always fair. But whatever it does, no matter how nefarious and slimy, it should always put the good of its citizens first. And it's ridiculous to expect whatever they might have gained through holding to these exploits outweighs the losses of the public caused by the non-disclosure. CIA no longer serves USA. CIA just serves goals of CIA, and if means to these goals conflict with the good of USA, so be it, USA be damned.

Re:This is why people fear Artificial Intelligence

[JustAnotherOldGuy]

It's silly to expect a spy agency to obey the law and play always fair.

Exactly, and I laugh at the naive simpletons who don't understand this.

The only time you should believe this is when you're still in pre-school or a head-injury ward.

Re:This is why people fear Artificial Intelligence

[Anonymous Coward]

If you learn to manipulate people without nationalism you will get the same result: people are largely the same and nations are all that define us, if you can see someone as lowly enough to take advantage of for intelligence or tactical gains you will see everyone like that. The only logical solution is to change the CIA's culture to one of deep nationalism as opposed to to a bunch of abstract goals which tend to serve foreign actors.

Re:This is why people fear Artificial Intelligence

[SharpFang]

That serves furthering the position of CIA. The victorious candidate is likely to favor them, grant them better funding, which will allow them to pursue their goals more efficiently. Damage to the country be damned.

Not their job

[jbrown.za]

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

The CIA's website says "CIA’s primary mission is to collect, analyze, evaluate, and disseminate foreign intelligence to the President and senior US government policymakers in making decisions relating to national security".

It seems pretty clear that they are focused on gathering information relating to US national security... it says nothing about protecting private individuals information. I can guess that they will claim to have weighed up the threat to private individuals vs the intelligence gathering advantages of not disclosing these vulnerabilities. I'm not saying I agree with this sentiment, but I don't think this exposes the CIA to the extent that the article suggests.

Re: Not their job

[Zero__Kelvin]

Who said anything about private individuals? Maybe you didn't know that all the Federal agencies use these same vulnerable systems? By leaving the hole they leave federal systems vulnerable too.

Re:Not their job

[Anonymous Coward]

Mr. President - we recognize that a number of defense contractors and private industries that are too big to fail use the following technology: Android phones, cars with advanced information systems, and Samsung TVs. All of these have critical vulnerabilities. We ADVISE you that foreign intelligence services using this can gain access to our financial institutions and markets. In the event that FIS gains access to these environments, it will cause irreparable harm to our economic interests and cripple our financial infrastructure. But hey, this will have NO IMPACT to our national security, so don't worry about it.

I call Bullshit

[mandark1967]

...Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

Section 202 of the National Security Act of 1947 established the CIA, and nowhere in the charter does it state it's their responsibility to protect the privacy of Americans.

Re:I call Bullshit

[Anonymous Coward]

It is established by the US government, hence must act within the overall legal parameters any government agency is bound by, including hierarchies of priorities. Specifically, failure to uphold the constitutional rights of citizens, such as the right to privacy, is probably - at least in legal theory - unacceptable.

Re:I call Bullshit

[mandark1967]

1 - Posted as AC? If you can't put your name next to your statements, STFU, coward.
2 - The CIA's job is to spy. Evidently, they use vulnerabilities discovered in software to do that.
3 - After re-reading your response, I can see why you'd post as AC. If you were any more dense you'd achieve spontaneous fission. That drivel isn't something I'd want my name next to, either.
4 - Again, it's not the CIA's responsibility to uphold the privacy rights of citizens and, until you post links to or the directive(s)/regulation(s) themselves stating it "is" their responsibility, refer to #1 & #2 above.
5 - Stop releasing shitty code full of holes.

Re:I call Bullshit

[ooloorie]

Specifically, failure to uphold the constitutional rights of citizens, such as the right to privacy, is probably - at least in legal theory - unacceptable.

I think it's rather a stretch to go from a prohibition on unreasonable searches and seizures to "the CIA must disclose any and all bugs in anybody's computer software that could be used to gain unauthorized access to those computers".

Re:I call Bullshit

[Anonymous Coward]

I checked the white pages. Funny, I couldn't find a listing for mandark1967.

Somehow I am getting the impression that it is not your real name.

So what's your excuse for being such a fucking coward?

Re:I call Bullshit

[mandark1967]

until you post links to or the directive(s)/regulation(s) themselves stating it "is" their responsibility, refer to #1 & #2 above

Re:I call Bullshit

[Anonymous Coward]

Being that I am not the OP, go fuck yourself, hypocrite. You're just as much of a coward for hiding behind a pseudonym.

Re:I call Bullshit

[mandark1967]

See #1 and #2

Re:I call Bullshit

[Sabriel]

The charter is subordinate to the Constitution, as as every CIA employee who took the oath of office and signed the affidavit affirming same should know:

“I, [name], do solemnly swear (or affirm) that I will support and defend the Constitution of the United States against all enemies, foreign and domestic; that I will bear true faith and allegiance to the same; that I take this obligation freely, without any mental reservation or purpose of evasion; and that I will well and faithfully discharge the duties of the office on which I am about to enter. So help me God.” Schooled CIA employees know that the Constitution also defines the role of federal employees: "To establish justice, insure domestic tranquility, provide for the common defense, promote the general welfare and secure the blessings of liberty."

  - work.chron.com/cia-oath-say-23447.html

Re:I call Bullshit

[Anonymous Coward]

#2 has nothing to do with my comment, dipshit. I already told you I am not the OP.

As far as #1, why are you not heeding your own advice? Why don't you put your name next to your statements? Why are you hiding behind a pseudonym, coward?

Sincerely,
Frank H. Cioppa

Re:I call Bullshit

[Anonymous Coward]

Actually if you remove the word "privacy" from your sentence you might actually find that the CIA is responsible for protecting Americans. You are subtly playing on words. Do you work for the CIA?

Re:I call Bullshit

[EmptyHead]

Cry me a river. I love the outrage about the govt gathering information, but no worries whatsoever about the likes of sociopathic corporations doing it for fun and profit. The folks with the gov have sworn an oath to uphold the constitution. Corporations only worship the dollar. Now contractors having access to some of this does concern me - they haven't been as brought into the fold and have less to lose.

yeah, be responsible, CIA!

[Anonymous Coward]

The CIA should definitely make sure every security hole is filled so they cant spy anymore.
That's why England called Hitler and told him we broke the engima code thing... you know, see he could patch it.

Re:yeah, be responsible, CIA!

[bobbied]

Yea, in the addled minds of some posters They think the following statement is true: National security == Personal security

Sorry folks, that evaluates to false...

The CIA is charged with protecting National Security by gathering intelligence on foreign targets. They are NOT charged with protecting individual's personal security though their protection of the nation does protect the individual in some ways.

Right on!

[tekrat]

.... And if the CIA has to run a false flag operation that blows up your children, then at least know that they died to weaken your enemy that wants to blow up your children... that are already blown up.

Re:Right on!

[laxguy]

If its a false flag then no children were harmed.

"Come w/ me if you wanna live..."

[Anonymous Coward]

"I'm here to help you - I'm Reese Sgt. TechCom DN38416 assigned to protect you" via APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ "you've been TARGETTED for TERMINATION!"

Shields vs. threats & gains speed (others slow you). Does more 4 less vs. illogical "Bolt on 'MoAr' so-called exploitable 'security solutions'" using more doing less (dns/antivirus/addons)

"That terminator is out there: It can't be bargained with. It can't be reasoned with. It doesn't feel pity, remorse, or fear & it absolutely will not stop EVER (until U R DEAD)"

Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/

P.S.=> "It's a HYPER-ALLOY Combat Chassis - Microprocessor controlled: FULLY armored, VERY tough!"

VIRUSPROOF (every function checks vs. alteration)... apk

I disagree

[Weaselmancer]

It is the job of the CIA to collect intelligence. Central Intelligence Agency, right there in the name. It's not their job to post software patches.

I think what Cindy Cohn meant was "it would sure be nice if the CIA had let us know about the problems rather than keep them secret", and I agree that would have been awfully nice of them - but wanting the CIA to reveal tactical information that helps it do its job is silly.

They're a spy agency, folks. This is what spies do.

Re:I disagree

[edtice1559]

I thought CIA stood for confidentiality, integrity, and availability and that was the mission of this agency!

Re: I disagree

[Zero__Kelvin]

Well you got it half right, conveniently leaving out the part that makes your argument obviously paper thin. Their mission is to collect and desseminate information. You seem to have left out that big word beginning with D.

Re:I disagree

[Anonymous Coward]

Ah, that argument which switches the brain off.

It was the job of the SS to kill jews. So it was ok?

Re: I disagree

[gnick]

Their mission is to collect and desseminate information. You seem to have left out that big word beginning with D.

Their purpose certainly isn't to disseminate everything they collect. That would be stupid and entirely counter-productive. Somebody quoted them up above:

Correlating and evaluating intelligence related to the national security and providing appropriate dissemination of such intelligence;

By asking them to disclose vulnerabilities that they're able to exploit, you're asking them to diminish their capabilities. Patching the world isn't their job - Spying on it is.

Re: I disagree

[Zero__Kelvin]

How, prey tell us, do you leave all the computers in the government and major industries that drive our nation like power plants and airlines vulnerable and still protect the national interest? That's quite a trick!

Re: I disagree

[Anonymous Coward]

These aren't national vulnerabilities, they're global vulnerabilities. Is it the CIA's job to patch every piece of software on the planet that they find a vulnerability for? If they disclose every vulnerability they find, then finding vulnerabilities buys them nothing and they will simply have no reason to do it. The CIA's only reason to search for vulnerabilities is to find attack vectors - Why find and then immediately eliminate them? You are a fucking idiot.

Re: I disagree

[Talderas]

Prior to these leaks no one knew that the CIA knew about these exploits. Now everyone knows the CIA knows about these exploits. This provides two clear problems for intelligence gathering for the CIA.

1. Other individuals and organizations will address these exploits making the exploits useless for government actors.
2. Other individuals and organizations will cease using these exploits for intelligence gathering as they're aware that the CIA knows about them. This does not mean that they don't have other exploits that can be used.

In order to effectively gather intelligence the enemy cannot know that you know what they know. This means the CIA can no longer use their knowledge of these exploits to create honeypots. Enemy actors will know and have just cause to suspect any information they gain via these exploits or avoid them to prevent any surveillance on their activities that could indicate what they're interested in.

Re: I disagree

[Anonymous Coward]

Shhh ... Go back to sleep little boy. You have been dreaming that you have a clue again!

Re: I disagree

[Zero__Kelvin]

You are confusing the word information when you mean capability. The capability to break in is not the commodity information. You are basically saying that now that I know that they MIGHT be able to get at my information that I'll stop communicating.

Re: I disagree

[gnick]

...do you leave all the computers in the government and major industries that drive our nation like power plants and airlines vulnerable...

Yes, you leave them vulnerable. They will always be vulnerable - The CIA has only discovered a subset of the global population of software vulnerabilities. Securing the planet is not the CIA's job; it should not be; and searching for vulnerabilities only to disclose them to the world would be a misuse of tax dollars. There are other, preferable, ways of finding, reporting, and patching bugs that do not waste the time of our intelligence agencies.

Re: I disagree

[Anonymous Coward]

Wow ... Just fucking wow. You truly are a clueless idiot.

Re: I disagree

[Anonymous Coward]

Well you got it half right, conveniently leaving out the part that makes your argument obviously paper thin. Their mission is to collect and desseminate information. You seem to have left out that big word beginning with D.

It looks like that big D word gave you some trouble too. When you see that red line under the "word" you're using, try right-clicking on it. Moron.

Re: I disagree

[Anonymous Coward]

Posting from a phone that didn't catch it either (And unlike me it's a computer!) but great job making a typical idiots assumption. -ZK

Re:Intel CPU backdoor

[Anonymous Coward]

Fine, let me see what I can do
I think there are new videos on this as well

Re:Intel CPU backdoor

[Anonymous Coward]

I've been seeing this code pop up all over, the last few weeks. It's Alliance, and it's high military.

Newsflash

[Anonymous Coward]

Every government intelligence agency holds on to flaws and exploits.

Spin the globe put your finger on a random country and ask their intelligence agency to divulge their trove of security flaws and exploits. See how far that gets you.

Seriously?

[JustAnotherOldGuy]

"The dark side of this story is that the documents confirm that the CIA holds on to security vulnerabilities in software and devices -- including Android phones, iPhones, and Samsung televisions -- that millions of people around the world rely on."

This is EXACTLY what I would expect of them. This is how they gain their advantage.

No sane person would ever expect the CIA/NSA/FBI to announce that they found a security vulnerability. It would be like a burglar announcing to a home owner that he found an unlocked door.

VEP doesn't mandate disclsoure

[Registered Coward v2]

The Vulnerabilities Equities Process doesn't have a mandate to disclosure, merely to determine if they should disclose or keep it for use. The EFF explains it:

EFF filed a lawsuit under the Freedom of Information Act in 2014 to get access to the government's "Vulnerability Equities Process" (VEP), the policy it uses to decide whether to disclose information about security vulnerabilities or instead withhold this information for its own purposes, including law enforcement, intelligence collection, and "offensive" exploitation.

EFF v. NSA, ODNI - Vulnerabilities FOIA"

The EFF has a heavily redacted copy of the policy the key statement in there is "When a decision is made to disseminate..."

Everyone knows it... apk

[Anonymous Coward]

See subject: There's a war for your mind employing std. psyop mechanics & marketing "jump on the bandwagon" psych tactics - that said?

THE "POWERS THAT BE" ARE USING YOUR OWN MIND AGAINST YOU... people feel safer in 'groups' being on the 'winning team' so they have to make it appear they have 'more people' & 'you are outnumbered & surrounded' via the creation of the ILLUSION of "mass consensus" (happens all the time on forums like /. - sockpuppets & FAKE NAME (multiple accounts) for FAKE LIVES users (like you BOY)).

They KNOW they don't have the military (the ultimate enforcer of law, using violence & GUNS they won't let YOU have or don't want you to rather) so the IMF/CFR/Trilateral Commission swine ran to DAVOS switzerland (home of their banks or a major hub) to TRY get 'muscle' via the Chinese (who are intelligent, trust me, & see RIGHT thru their asses & WILL play them in the end).

They keep getting caught in lies etc. in MainStreamMedia FAKE NEWS too - they're losing & couldn't even win a rigged election (they're bs'ing themselves & DESPERATE).

APK

P.S.=> See subject - they THINK people are stupid cattle - talk "social disconnect" bullshitting themselves (rather their dupes/cronies/sycophants/bootlickers who THINK "the master will protect a 'good dog' like me", bs, SOROS sold his OWN JEW PEOPLE into death as a counter-example proof of what REALLY happens - why? DIRTY birds of a feather - they know their "own kind" that would slice the balls off the masters to BE the masters)... apk

"we're all made less safe by the CIA's decision"

[Anonymous Coward]

No, we're not - not in any meaningful way. Unless the CIA begins giving or selling these exploits to someone else they are, for all intents and purposes, exploits which do not exist in the wild. We are almost exactly as safe as if the exploits had never been found.

I say "almost" because there is a chance that such knowledge is made public, such as by Wikileaks, which makes us temporarily unsafe until the holes are patched. There is also a chance that an operator might discover the exploit code and reverse-engineer it to determine the exploit. The chance of the latter is likely as high as finding the exploit from scratch, so there's no real net change in safety. Essentially, someone like wikileaks is actually the most dangerous condition in this chain, as a mole who releases information to the public [illegally] creates a zero-day event.

Re:Intel CPU backdoor

[Anonymous Coward]

Jesus y Maria! They just handed you a plethora of valuable information and you still find time to bitch about about. Fucking bozo.

CIA responsibility

[jbolden]

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

Why is that? They aren't a law enforcement agency. There are all sorts of crimes the CIA becomes aware of they are indifferent too.

We're made less safe

[Anonymous Coward]

...by the asshat leaking classified documents.

Red Team vs. Blue Team

[Anonymous Coward]

Blue team discloses all of their discovered vulnerabilities; red team hangs on to their discovered vulnerabilities. Guess who wins? Red team. There's a negative incentive at work here.

CIA doesnt own these Vulnerabilities.

[Anonymous Coward]

CIA is leasing them.

It is the same wink and nod that fouls poor Theo de Radt until he found where one of his co-developers contracted a vulnerability. I'm aware of one security firm that sells exploits top-dollar to agencies of government around the world and his personal team were at the forefront of DefCON wowing entrants:

lookup Gary Storer around either Redondo or Hermosa.

Re:Intel CPU backdoor

[Anonymous Coward]

That sequence of characters activates a backdoor so that Russian Intelligence can install a rootkit on your computer. HTH.

Re: Intel CPU backdoor

[Zero__Kelvin]

Dude, that's HORRIBLE! Somebody should invent UEFI so there would be a way to disable it in a UEFI configuration!

"That's Not How It Should Work"

[Anonymous Coward]

It is how it works when you consider the CIA as a state-sponsored criminal group.

Re:Did CIA kill Mike Hastings by controlling his c

[Anonymous Coward]

Journalist Michael Hastings Was Investigating CIA Director John Brennan Before He Was Killed in Fiery Car Crash

http://www.news.com.au/finance...

Some of us have been saying that for a long time. I work in security in the auto industry. The vehicle Michael Hastings was driving has throttle-by-wire. The Mercedes C-class has a feature called ADAPTIVE BRAKE which sounds like it needs brake-by-wire. If you've got by-wire control of throttle and break, a sophisticated attacker (like the CIA or NSA) could mostly likely cause a crash like the Michael Hastings crash.

Re:Intel CPU backdoor

[Bob the Super Hamste]

Looks like APK is off his meds again, or the institution let him on the internet. again.

no, they don't

[ooloorie]

Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.

It is the responsibility of US spy agencies not to violate the security and privacy of Americans; it is not their responsibility to fix security and privacy problems domestically.

You're probably confused because sometimes spy agencies say "in our operations, we protect the security and privacy of Americans", but that's in the same sense of "when we ship glass, we protect it from breaking", not "we protect all American glass from breaking ever".

Re:Did CIA kill Mike Hastings by controlling his c

[Anonymous Coward]

You'd have to physically modify the car to kill someone in anything other than a sudden lane switch into an oncoming car.

Every other scenario in a pure software hack setting is defeated by putting the car into neutral and pulling the parking brake. The electronic systems control neither of those things.

That is nice. Now what?

[houghi]

So they are guilty. The NSA are guilty. The FBI are guilty. The whole government is guilty. And all I see is a lot of people discussing it and no action taken.

If I as a kid stole a cookie and my mom told me of and I stole another one and still nothing happened, why would I stop stealing the cookies? They are great tasting cookies.

As long as there are no consequences, except for some whining, why would they NOT do it? You can discuss it among yourselves, but they do not care.

Re:That is nice. Now what?

[Anonymous Coward]

The cookie monster in charge also likes cookies though... (except when they're used against him)

Re:That is nice. Now what?

[Anonymous Coward]

I'm with you. We should be doing something. ...is it possible the people who care most are afraid to oppose it? Don't protest the NSA because you'll just end up on a watchlist kind of thing?

If so then that's the end of democracy.

Why doesn't WikiLeaks publish Russian or Chinese..

[footNipple]

...intelligence documents? Just asking.

I have no problem

[ckatko]

I have no problem with our intelligence agencies keeping tools and means to hack.

I DO HAVE a problem when they're used against American citizens and even used to murder them without a trial.

Our government should be doing everything it can to PROTECT us against China, Russia, etc. It should not be treating >us like antagonists to be targeted and crushed. It's time we stop treating our citizens like "criminals in the making".

LOL nope

[Anonymous Coward]

the CIA's "responsibility" is doing whatever is asked for by Our Government (tm) against foreign threats. Unfortunately some time ago that became doing whatever "needs to be done" even against Americans at home.

its mandate was never supposed to be doing anything *internal* at all, that's why we have the FBI and Secret Service. But now everyone's got interests in everyone else's area of responsibility, and that's bad for everyone.

To quote a relevant Sneakers movie quote in regard to CIA's responsibility to "keep Americans safe" from bugged software: "We are the United States Government! We don't do that sort of thing."

Neither does anyone else's intelligence network.

Re:Why doesn't WikiLeaks publish Russian or Chines

[Anonymous Coward]

1. Wikileaks is an anti-U.S. organization.

2. Think about what would have happened to someone like Manning in Russia or China. He and his entire family would have been gruesomely executed.

nothing new

[liquid_schwartz]

The agency appears to have failed to accurately assess the risk of not disclosing vulnerabilities to responsible vendors and failed to follow even the limited Vulnerabilities Equities Process.

This is the same group of idiots that are largely responsible for polio still being around (citation below). Failing to accurately assess risk and shortsighted thinking are nothing new to these folks.

Citation:

https://www.scientificamerican...

Are you on drugs?

[ackkamoto]

Seriously does anyone take EFF seriously ? Put on your big boy pants and learn how the real world works, no one in government is in computer security for altruistic reasons and gives 2 shits about making other people more secure, they just want information to give them more power.

Re:Come say that to my face motherfucker... apk

[Bob the Super Hamste]

And yet you seem to be able to prove my point time and time again with your delusions, non-sequiturs, circular arguments, incoherent ravings, and general paranoia. Although I should have know it wasn't you who made that post even though the author does a pretty good job of copying your /. style as you do claim credit for your mad ravings. It is also rather entertaining to bait you and then just stop responding once the rise has been gotten like I am going to do now.

oversight missing

[Anonymous Coward]

The problem is not that a CIA is spying, or keeping secrets. The problem is that with great power comes great responsibility.

For every institute that is allowed to do things regular people may not, there is an oversight system by the people granting this special power. What happened here, is that such oversight is in place for the NSA (but clearly not enough), the congressional oversight on the CIA is much more limited and does no longer match the powers they granted themselves.
Unfortunately most of the responses lack this fundamental issue, and focus on childish points of view like 'gubment is full of spying bastards!!' or the other extreme 'spying is what they are for in the first place, let them do their job, no oversight needed'.

Yes they do.

[Anonymous Coward]

Their remit isn't to attack vulnerabilities of systems of foreigners, but to ensure that US citizens are protected from being likewise attacked by foreign aggressors. And by leaving these systems vulnerable when they knew there was a vulnerability they ensure that the people in the USA using these items are insecure from foreign agents.

Given that these items are not US government products they cannot be fixed without disclosing the vulnerability to the private company (quite possibly foreign) that the vulnerability exists to fix.

Being able to use them to attack foreigners is only a replacement for their ACTUAL remit when in times of declared war.

They do. When there is such stuff.

[Anonymous Coward]

But slashdot being infested by merkins mostly describes the problems of the USA from a USA centric perspective. Go to WL and look up the document releases. And you will find one for Russia or China quite easily. Ergo, the answer to your petulant whinge is "They do, you just never bother to remember"

Re:Did CIA kill Mike Hastings by controlling his c

[Anonymous Coward]

You'd have to physically modify the car to kill someone in anything other than a sudden lane switch into an oncoming car.

What evidence do you have that physical access would be required?

This is a The Mercedes C-class with a cellular modem built into it with full access to the CAN bus and by-wire system.

That's like claiming an Internet connected server absolutely requires physical access to break into, a claim that has been proven false time and time again.

Every other scenario in a pure software hack setting is defeated by putting the car into neutral and pulling the parking brake. The electronic systems control neither of those things.

The electronic control system absolutely has control over the breaks. It must, since the peddle is nothing but a switch and the breaks are controlled electronically. It would be impossible to apply the breaks and stop without the electronic control system.

The same is true for the accelerator, and the transmission controller.

Being physically in the car it would be impossible to put the transmission in neutral once the computer was instructed to ignore the input channel from the gear shift switches, and it would be impossible to break once the computer was instructed to ignore the input channel for the break peddle.

Even steering can be by-wire. I don't personally know if the C-class uses that or not, but there is no reason to make any assumptions either way.
By-wire and physical shaft steering are both things that exist and that Mercedes can choose which to avail themselves of.

Re:Come say that to my face motherfucker... apk

[lgw]

See my subject Bob the Super WEASEL behind a FAKE NAME online for your FAKE LIFE sockpuppet that you are w/ no balls:

I'm pretty sure we all knew "Bob the Super Hamster" wasn't actually his real name. Just sayin'

Re: Eat your WORDS, SUPER WEASEL BITCH

[Anonymous Coward]

Is this the 15th century? You think calling someone a fatherless bastard has him crying?

I do get worried that you are not supervised. Or, if you are, they are doing an absolute shit job.

Re:"we're all made less safe by the CIA's decision

[Anonymous Coward]

Recently, the CIA lost control of the majority of its hacking arsenal including malware, viruses, trojans, weaponized "zero day" exploits, malware remote control systems and associated documentation. This extraordinary collection, which amounts to more than several hundred million lines of code, gives its possessor the entire hacking capacity of the CIA. The archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner, one of whom has provided WikiLeaks with portions of the archive.

"Year Zero" introduces the scope and direction of the CIA's global covert hacking program, its malware arsenal and dozens of "zero day" weaponized exploits against a wide range of U.S. and European company products, include Apple's iPhone, Google's Android and Microsoft's Windows and even Samsung TVs, which are turned into covert microphones.

Since 2001 the CIA has gained political and budgetary preeminence over the U.S. National Security Agency (NSA). The CIA found itself building not just its now infamous drone fleet, but a very different type of covert, globe-spanning force — its own substantial fleet of hackers. The agency's hacking division freed it from having to disclose its often controversial operations to the NSA (its primary bureaucratic rival) in order to draw on the NSA's hacking capacities.

https://wikileaks.org/ciav7p1/

Re: Come say that to my face motherfucker... apk

[Anonymous Coward]

APK is not known for intelligence or insight.

Re: "we're all made less safe by the CIA's decisio

[Anonymous Coward]

First you say majority of and then you say entire. Dishonest people can be safely ignored.

Re: Come say that to my face motherfucker... apk

[Anonymous Coward]

Then Bob the super hamster must be retarded because apk made bob eat his words https://it.slashdot.org/commen...

Dont you mean Georgia?

[Anonymous Coward]

There is more ocean-front property on Georgia than Arizona.

Re:Dont you mean Georgia?

[unixisc]

Whoosh!!!

Where the hello is the Tor Browser fix?

[Anonymous Coward]

I take it the CIA and FBI aren't friends.

Does Anyone Else Notice?

[Anonymous Coward]

They want security backdoors. They can't even keep the Zero Day exploits they have on file secret. Yet they absolutely, positively, pinky-swear that they will keep those built-in security backdoors secret!

I don't think they can even keep the secret of the CIA Director's executive bathroom. You know, the one with the gold-plated sinks, the ivory faucet handles (made with 100% illegal elephant tusk ivory!), the tiger skin rug on the floor, and the convex mirrored ceiling so the Director can look up and declare their mastery of the Universe. Everything looks bigger in a convex mirror.

Personal security is also national security

[Anonymous Coward]

But it's a chicken-and-egg question in many ways.

The CIA is in possession of exploits that they use to gather intelligence from legitimate targets, such as enemy/rival states and actors (Russia, PRC, etc). Gathering intelligence from the enemy is very much a legitimate course of action.

Yet by holding off on publishing data on, or notifying software vendors of those same exploits, the CIA (in this case) has left the common citizen and their devices vulnerable from being exploited by their enemy (enemies), by the rogue actors in the intelligence community, and all the rogue actors in other agencies that the CIA is sharing their exploit data with—think CBP and ICE who do not care about the privacy of anyone.

In this case, Apple appears to be the most forthright about its response, while Google and Android phone makers are the laziest in updating their software. Perhaps now with the exception of Nokia.

So what...

[billybiro]

Dear The Hoi Polloi,

We'll do what we want. What are you going to do about it?

Yours (up the a$$),
The CIA.

Re: Unidentifiable anonymous now Bob? LMAO!

[Anonymous Coward]

Dude, you are delusional. The link you provided embarrasses you for being incorrect and then going off the rails. You are not properly informed because you think you're the hosts file saviour of the world and don't know fuck all about the rest of the world.

Samsung and everyone else

[Anonymous Coward]

I don't know why you isolate Samsung for particular attention.
Any electronics, with any operating system, especially those with "normal" OTA updates, is vulnerable.
And always has been.
So was the case with many analog technologies too, the authorities could listen into a hard phone line without it ringing.
The fucking panic because people suddenly realise what nerds have always known.
Surveillance is pervasive, and you CAN NOT TURN THE FUCKING STUFF OFF.
Larry was right: you have no privacy - get over it.

Trying to downmod hide Bob = wrong quoted?

[Anonymous Coward]

"APK doesn't seem to know much about securing systems because if he did he would understand the defense in depth philosophy" - by Bob the Super Hamste ( 1152367 ) on Monday January 30, 2017 @08:44AM (#53765191)

Bob is quoted & WRONG - I've done layered security/defense in depth for DECADES which guides on it I wrote GOT ME PAID for it & CIS Tool (highly esteemed) took fixes from me for https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Google+Search&gbv=1/

* EAT YOUR WORDS you lying loser!

APK

P.S.=> Of course I know it's YOU Bob the Super Hamster (weasel is more like it) LYING & posting unidentifiably + trying to "downmod hide" where I prove you wrong quoting you = weak too per my subject https://yro.slashdot.org/comments.pl?sid=10339099&cid=54006365/... apk