Vault 7: 'Weeping Angel' (Samsung smart TV implant)

Weeping Angel was an implant for Samsung F-series smart televisions designed to record audio through the set's built-in microphone and either store the recordings or send them out. I first described it in Year Zero on 7 March 2017, saying it placed the television in a 'Fake-Off' mode in which the owner believed it was switched off while it continued to record.

On 21 April 2017 I published the tool's user guide, titled 'Extending'. I said the guide's classification markings indicated that it had been written by MI5 (which the documents call MI5/BTSS) and later shared with the CIA, and that the two agencies developed the malware further in joint workshops. A CIA page in Year Zero, reported by the Guardian, recorded 'Accomplishments during joint workshop with MI5/BTSS (British Security Service) (week of June 16, 2014)'.

According to SecurityWeek's reading of the guide, which is dated February 2014, the implant was installed by connecting a USB device to the television, and recordings could be retrieved by USB or through a Wi-Fi hotspot.

Weeping Angel was first disclosed in our Year Zero release of 7 March 2017; the user guide followed on 21 April 2017.

The US Department of Justice has stated, on the basis of evidence at trial, that Joshua Schulte, a software developer in the CIA's Center for Cyber Intelligence from 2012 to 2016, used a secret administrator session on 20 April 2016 to copy the centre's entire tool-development archives and then transmitted them to WikiLeaks. He was found guilty at trial on 9 March 2020 of contempt of court and making false statements, and on 13 July 2022 of eight counts including the illegal gathering and transmission of national defence information and unauthorised computer access; after a further conviction for child sexual abuse material offences on 13 September 2023, he was sentenced to 40 years in prison on 1 February 2024. The department described the theft as 'the largest data breach in CIA history' and counted 26 Vault 7 and Vault 8 disclosures between March and November 2017. The CIA itself declined to comment on the authenticity of the documents when they were published.