Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Trump Media auditor charged by SEC with ‘massive fraud’

Google’s empire is massive. A judge will soon rule if it’s a monopoly.

Five tech products we actually like

Confident of victory over Ukraine, Russia exhibits Western war trophies

Two women are seeking Mexico’s presidency. But the race is about a man.

Hamas in Cairo for hostage talks as Israel briefs aid agencies on Rafah

Biden confronts campus protests; Trump hedges on accepting election results

Kristi Noem just won’t stop talking about killing her dog

Noem’s dog-killing isn’t popular, though Trump supporters are divided

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

Ask Amy: My boyfriend just confessed he’s almost $20,000 in debt

Miss Manners: Is it inappropriate to reach out to old girlfriends?

Carolyn Hax: Longtime friend won’t forgive being last-minute canceled for a guy

The New York Times, alone in its outrage over access to Biden

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

Stephen A. Smith would like even more of your attention

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

Adaptive equipment is making national parks more inclusive

In photos: At least 39 dead as historic flooding hits southern Brazil

Sea level rise brings new era of dangerous flooding

Michael Cohen keeps broadcasting despite being a witness

In a pinch, the Nationals finally find some offense

Is Pastis as good as our food critic thought? He sent spies to find out.

The Capitals, a team in transition, know what they want this offseason

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

On Press Freedom Day, little to celebrate for Hong Kong’s journalists

Young Georgians want to be part of Europe. Their government is in the way.

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Dalton Bennett

Greg Miller

The latest revelations about the <a href="https://www.washingtonpost.com/world/national-security/wikileaks-says-it-has-obtained-trove-of-cia-hacking-tools/2017/03/07/c8c50c5c-0345-11e7-b1e9-a05d3c21f7cf_story.html?utm_term=.5419a7f7c6ae">U.S. government’s powerful hacking tools</a> potentially takes surveillance right into the homes and hip pockets of billions of users worldwide, showing how a remarkable variety of everyday devices can be turned to spy on their owners.

Televisions, smartphones and even anti-virus software are all vulnerable to CIA hacking, according to the WikiLeaks documents released Tuesday. The capabilities described include recording the sounds, images and the private text messages of users, even when they resort to encrypted apps to communicate.

[<a href="https://www.washingtonpost.com/world/national-security/wikileaks-says-it-has-obtained-trove-of-cia-hacking-tools/2017/03/07/c8c50c5c-0345-11e7-b1e9-a05d3c21f7cf_story.html?utm_term=.5419a7f7c6ae">WikiLeaks says it has obtained trove of CIA hacking tools</a>]

While many of the attack technologies had been previously discussed at cybersecurity conferences, experts were startled to see evidence that the CIA had turned so many theoretical vulnerabilities into functioning attack tools against staples of modern life. These include widely used Internet routers, smartphones, and Mac and Windows computers.

In the case of a tool called “Weeping Angel” for attacking Samsung SmartTVs, WikiLeaks wrote, “After infestation, Weeping Angel places the target TV in a ‘Fake-Off’ mode, so that the owner falsely believes the TV is off when it is on, In ‘Fake-Off’ mode the TV operates as a bug, recording conversations in the room and sending them over the Internet to a covert CIA server.”

The CIA reportedly also has studied whether it could infect vehicle control systems for cars and trucks, which WikiLeaks alleged could be used to conduct “nearly undetectable assassinations.”

And a specialized CIA unit called the Mobile Devices Branch produced malware to control and steal information from iPhones, which according to WikiLeaks were a particular focus because of the smartphone’s popularity “among social, political diplomatic and business elites.” The agency also targeted popular phones running Google’s Android, the world’s leading mobile operating system.

Wikileaks said it redacted lists of CIA surveillance targets, though it said they included targets and machines in Latin America, Europe and the United States. The anti-secrecy group also said that by developing such intrusive technology — rather than helping tech companies patch flaws in their products — the CIA was undermining efforts to protect the cybersecurity of Americans.

“The argument that there is some terrorist using a Samsung TV somewhere — as a reason to not disclose that vulnerability to the company, when it puts thousands of Americans at risk — I fundamentally disagree with it, “ said Alex Rice, chief technology officer for Hacker One, a start-up that enlists hackers to report security gaps to companies and organizations in exchange for cash.

[<a href="https://www.washingtonpost.com/news/the-fix/wp/2017/03/07/the-trump-white-house-is-changing-its-tune-on-wire-tapping-and-hoping-you-dont-notice/?utm_term=.352cc34b9522">The Trump White House is totally changing its tune on wiretapping and hoping you don’t notice</a>]

The trove released Tuesday, which The Washington Post could not independently verify and the CIA has declined to confirm, included 8,761 documents that were the first batch of a series of releases that WikiLeaks plans, it said.

This first group, at least, shows important differences from the 2013 revelations by the National Security Agency’s former contractor Edward Snowden. His trove of documents largely described mass surveillance of Internet-based communications systems, while the WikiLeaks release more often describes attacks on individual devices.

By targeting devices, the CIA reportedly gains access to even well-encrypted communications, on such popular apps as Signal and WhatsApp, without having to crack the encryption itself. The WikiLeaks reports acknowledged that difference by saying the CIA had found ways to “bypass,” as opposed to defeat, encryption technologies.

“The idea that the CIA and NSA can hack into devices is kind of old news,” said Johns Hopkins cryptography expert Matthew D. Green. “Anyone who thought they couldn’t was living in a fantasy world.”

Snowden’s revelations and the backlash made strong encryption a major, well-funded cause for both privacy advocates and, perhaps more importantly, technology companies that had the engineering expertise and budgets to protect data as it flowed across the world.

Google, Microsoft, Facebook, Yahoo and many other companies announced major new initiatives, in part to protect their brands against accusations by some users that they had made it too easy for the NSA to collect information from their systems. Many websites, meanwhile, began encrypting their data flows to users to prevent snooping. Encryption tools such as Tor were strengthened.

Encrypting apps for private messaging, such as Signal, Telegram and WhatsApp exploded in popularity, especially among users around the world who were fearful of government intrusion. In the days following the U.S. presidential election, Signal was among the most downloaded in Apple’s app store, and downloads grew by more than 300 percent.

Open Whispers Systems, which developed Signal, released a statement Tuesday, saying, “The CIA/WikiLeaks story today is about getting malware onto phones, none of the exploits are in Signal or break Signal Protocol encryption.”

WhatsApp declined to comment, and Telegram did not respond to requests for comment. Google declined to comment, while Samsung did not respond to requests for comment.

“While our initial analysis indicates that many of the issues leaked today were already patched in the latest iOS, we will continue work to rapidly address any identified vulnerabilities. We always urge customers to download the latest iOS to make sure they have the most recent security updates,” Apple spokesman Fred Sainz said in a statement Tuesday.

[<a href="https://www.washingtonpost.com/investigations/understanding-cyberspace-is-key-to-defending-againstdigital-attacks/2013/06/03/d46860f8-ad58-11e4-9c91-e9d2f9fde644_story.html?utm_term=.b8d0cab14123">Understanding cyberspace is key to defending against digital attacks</a>]

U.S. government authorities complained loudly that the post-Snowden wave of encryption was undermining their ability to investigate serious crimes, such as terrorism and child pornography. The FBI in 2016 sued Apple in hopes of forcing it to unlock an iPhone used by the San Bernadino killers before announcing it had other ways to crack the device amid heavy public criticism.

Against that backdrop, many privacy advocates argued that devices — often called “endpoints” for their place on chains of communications that can crisscross continents — were the best available targets left in a world with widespread online encryption. The WikiLeaks documents suggests that the CIA may have reached the same conclusion.

“It would certainly be consistent with the hypothesis that we’ve made real progress in the encryption we’ve been introducing,” said Peter Eckersley, technology projects director for the Electronic Frontier Foundation, a San Francisco-based civil liberties group. “It’s impossible to be 100 percent certain, but reading the tea leaves, it’s plausible.”

The WikiLeaks revelations also will serve as a reminder that, for whatever the political backlash to revelations about digital spying, it is not going away and probably will continue to grow.

Aside from the United States, many other advanced nations such as China, Russia, Britain and Israel have extremely sophisticated tools for digital spying. Less advanced nations have gained access to powerful online spying technology through a robust and lightly regulated industry of surveillance contractors based throughout the world.

On Tuesday, resignation and frustration rippled through Silicon Valley as technologists grappled with revelations of yet another U.S. government attempt to exploit their systems. And cybersecurity experts reacted with alarm.

“This is explosive,” said Jake Williams, founder of Rendition Infosec, a cybersecurity firm. The material highlights specific anti-virus products that can be defeated, going further than a release of NSA hacking tools last year, he said.

The WikiLeaks release revealed that the CIA has sophisticated “stealth” capabilities that enable hackers not only to infiltrate systems, but evade detection, as well as abilities to move inside a system freely as if they owned it.

Nicholas Weaver, a computer security researcher at the University of California at Berkeley said the dates in the WikiLeaks files suggest the documents were taken in February or March 2016. At least two of them are marked Top Secret, “which suggests that somebody in early 2016 managed to compromise a Top Secret CIA development system and is willing to say that they did.”

One internal CIA document listed a set of Apple iPhone “exploits” — or tools that can be used to compromise the device by taking advantage of software flaws. Some of the tools are based on “zero-days,” which are software vulnerabilities that have not been shared with the manufacturer. So “some of these descriptions will allow Apple to fix the vulnerabilities,” Weaver said. “But at the same time, they’re out in the public and whoever stole this data could use them against U.S. interests.”

How the CIA deceives its own workforce about operations

NSA contractor charged with stealing top secret data

How hard is it to get an intelligence wiretap? Pretty hard.

This pretty blond doll could be spying on your family

Connecticut College

Craig Timberg is a deputy managing editor for The Washington Post. Since joining The Post in 1998, he has been a reporter, editor and foreign correspondent, and he contributed to The Post’s Pulitzer Prize-winning coverage of the National Security Agency and the Jan. 6, 2021, attack on the U.S. Capitol.

Craig Timberg

Winner of the 2017 Overseas Press Club Bob Considine Award for "Behind the Firewall" Series on Silicon Valley China

 2010 Finalist, Livingston Award for Young Journalists

 2009 Finalist, Livingston Award for Young Journalists 

Columbia University, BA. 

Columbia Graduate School of Journalism, MS.

Lizza joined The Washington Post as Silicon Valley correspondent in 2016, becoming the paper's eyes and ears in the region. She focuses on social media and the power of the tech industry in a democratic society. Before that, she was the Wall Street Journal's first full-time beat reporter covering AI and the impact of algorithms on people's lives. 

Elizabeth Dwoskin

Pulitzer Prize for Public Service, 2014

Gerald Loeb Award 2014, NSA stories

Society of American Business Editors and Writers enterprise award 2009, for the story "Banking Regulator Played Advocate over Enforcer"

Daily Californian Alumni Association Alumna of the Year, 2017

Pulitzer Prize for reporting on Russian interference in the 2016 presidential election, 2018

Pulitzer Prize for Public Service in 2022 for an investigation of the Jan. 6 assault on the U.S. Capitol

The Prince of Tennessee

City University, London, MA in international journalism

University of California at Berkeley, BA in humanities

Ellen Nakashima is a national security reporter with The Washington Post. She was a member of three Pulitzer Prize-winning teams, in 2022 for an investigation of the Jan. 6 assault on the U.S. Capitol, in 2018 for coverage of Russia's interference in the 2016 election, and in 2014 and for reporting on the hidden scope of government surveillance. 

