I am Maureen Cavanaugh it is Wednesday, March 8. Our top story on midday edition the latest on the documents from WikiLeaks contains information that sounds like the script of of spy thriller. The documents appear to outline how the CIA can watch and listen to smart type he's -- TVs caulk and hacking to smart phones and taken over control of smart cars. CIA has issued no response but the consensus from experts and cyber security seems to be the revelations are possible. Joining me is Darren Anderson he is a member of California's task force on cyber security chairman of cyber California founder and CEO of cyber security company. Welcome Darren. Thank you. The cyber security world was not really surprised by the information in this week was it? Not really we have seen some wiki leaks around CIA tactics and techniques come out with the Chelsea Manning documents but it wasn't too big of a surprise. You talk about that of scrubbing that area being somewhat of a revelation in this dump. What does that mean? I think my thought about the level at which you stroke -- scrub depends on the level at which you see a threat occurring. When a threat level goes up you may dig a little deeper into the data. What may have happened sort of triggered this will latest dump. The CIA is looking more actively and harder than ever because the threat level for the nation has increased. Is there anything in this that indicates that the CIA is using this technology to spy on Americans in the US. I think that what you have with this latest set of WikiLeaks is sort of the exposé of the CIA's cookbook for how they actually hack into accounts and what they do is have a series of tactics that they use to break into different kinds of accounts and breaking the smart phones they've been able to break into traditional laptops and servers as well as some new devices which we call the Internet of things. The wearables deliverables and drivable's. What is new about the information is there is definitely information being gathered on American citizens and how the information is used is sort of what is in question. Are the laws that prevent the government from snooping on average citizens? There are sort of nervous about that exist and I think historically Americans have had what I call an expectation of privacy. That is somewhat unique in the Western world. Europe tends to favor privacy and the sort of giveaway the privacy to test by clicking on it is checkbox to get the application. In the east there's not really an expectation of privacy. There are laws that protect citizens and the privacy rights. A lot of that comes through the FTC credit rating type agencies that have to lay out with their ability to work out what your information is. I have read that the hacks described in the dump are things that a lot of hackers might be able to do you would not need the CIA to come up with that. We see tactics and techniques here that are familiar to us and do not forget we are battling with foreign adversaries. Nationstates that are well-funded and extremely motivated to take our intellectual property and Steeler national security secrets and compromise our defense and so the CIA would and does rationalizes an activity as a kind of defensive or in some cases offense of response. Typically only the US government employs and deploys what I would call offensive cyber security tactics which is what a surprise -- described in this week. Typically we play a lot of defense in the West. I call it the hundred or problem. We are trying to defend 100 doors our adversaries be they nationstates or have to vest are trying to find that one open door that one way to exploit and find a way in. I think the offenses is to take the opposite of that where you are actually looking at your adversary systems and trying to break into their systems. It's like playing defense to protect plan offense to go on a more aggressive tech. As I said they have not responded at all to this information. How much credibility do they have in the cyber security world.? I think it is a love-hate relationship. I think that I may expose tactics and techniques that are pretty familiar to us in the business. We are aware of these capabilities. If you recall it was a private company that was an Israeli company that was brought in to break into the iPhone and the San Diego -- San Bernardino massacre. So the private world is very familiar with these techniques. What is novel here is that it is another sort of -- Computer systems and support. What can people do to protect themselves? I like to propose and suggest what I call good cyber hygiene. The simple things like changing your passwords regularly do not expose them to the Internet to your friends. Outrun the person that is hopefully behind you with the bear behind it. So you are what I call a hard target and others of the soft target. So if you outfit yourself by keeping your passwords updated by updating your software and making sure that any security holes are being patched you have a much better chance that the hackers will move on to somebody else that is more vulnerable. I have been speaking with cyber security expert Darren Anderson member of the California task is on cyber security. Thank you. Thank you for having me.
WikiLeaks has released thousands of files that it identifies as CIA documents related to the agency's cyber-espionage tools and programs.
The documents published on Tuesday include instruction manuals, support documents, notes and conversations about, among other things, efforts to exploit vulnerabilities in smartphones and turn smart TVs into listening devices.
A CIA spokesperson would not confirm whether the documents were genuine, telling NPR, "We do not comment on the authenticity or content of purported intelligence documents."
WikiLeaks has dubbed Tuesday's release "Year Zero," saying it is the first of a series of CIA-related leaks that the site is collectively calling "Vault 7."
In a statement accompanying the document release, WikiLeaks alleges that the CIA has recently "lost control of the majority of its hacking arsenal," and that an archive with "several hundred million lines of code" has been circling among former government hackers, giving them "the entire hacking capacity of the CIA."
One former government hacker or contractor gave a portion of that code to WikiLeaks, according to the organization. But the files included in WikiLeaks' "Year Zero" release do not include the code itself — in its press release, the site says it is "avoiding the distribution of 'armed' cyberweapons until a consensus emerges" on how to analyze and disarm such weapons.
Instead, the purported CIA documents reference and describe agency tools designed to extract information from computers, monitor communications and control electronic devices.
WikiLeaks says the files came from the CIA's internal Confluence system — a platform for team collaboration. They include guides describing how to reduce the risk of CIA involvement being detected in a program. Some pages have comments from users, whose names have been redacted.
The CIA has traditionally been responsible for human espionage — officially, the NSA gathers "signals intelligence" and the CIA analyzes it. But the CIA also carries out its own cyber operations.
In February 2016, then-CIA Director John Brennan spoke with NPR's Mary Louise Kelly about, in part, the agency's desire to expand its cybercapabilities.
"The technological changes are taking place at a warped speed," he said:
"So we here at CIA, we recently set up a fifth directorate for the first time in 50 years, a new directorate ... the directorate of digital innovation, so that we can understand all of the opportunities and challenges associated with that digital environment.
"I'm not a technological expert by any means, but I recognize that more and more human transactions and interactions take place in that cyber environment. And it profoundly affects all of our ways of life, and it affects the intelligence mission. So I want to make sure that for CIA to be able to fulfill its responsibilities in the years ahead, we understand what the pitfalls are, what the opportunities are, so that we are able to master that environment consistent with our authorities, so we can carry out our respective missions."
Copyright 2017 NPR. To see more, visit http://www.npr.org/.
