WikiLeaks dump does not say CIA compromised Signal or WhatsApp

The reports show that the CIA targets devices, and apps have not been compromised.

When WikiLeaks posted thousands of documents on Tuesday allegedly the Central Intelligence Agency, it came with a press release claiming the CIA could “bypass the encryption of WhatsApp, Signal, Telegram, Weibo, Confide and Cloackman [sic]” by hacking the iPhones and Androids the apps run on to collect the communications before encryption is applied and sent to the recipient.

This paragraph led to outlets like the New York Times to write confusing and misleading reports claiming that “the CIA. and allied intelligence services had managed to bypass encryption on popular phone and messaging services such as Signal, WhatsApp and Telegram.”

The outlet later said they deleted tweets that referenced the claim, but the story remains unchanged.

The truth, according to the latest WikiLeaks documents, is that the CIA’s Engineering Development Group builds tools to hack into iPhones and Android phones, among other devices, to gain control and full visibility. There is no indication that the apps themselves have been compromised, despite a growing confused tide of conversation on social media networks.

The takeaway here is merely a core tenet of information security: if your device has been hacked, the encryption protocols built into your apps won’t protect your information. If you’ve been targeted by the CIA, they can likely break into your device. Anything on your device is owned by them at that point. The apps are incidental because the information is collected before apps can possibly do anything for your security.

The mistake of claiming that the encryption apps are compromised — news that will “rock the tech world,” according to the Times — is spreading like wildfire. NBC News made a similar error in its early reporting and Twitter was full of alarmed secure app users early on Tuesday wondering what it all meant.

We’ve reached out to the messaging apps in question for comment.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure