Vault 7: 'Year Zero'

Year Zero was the first and largest Vault 7 publication: 8,761 documents and files which I said came from an isolated, high-security network inside the CIA's Center for Cyber Intelligence in Langley, Virginia. Most of the material is 7,818 pages from the centre's internal development wiki, with 943 attachments, covering the years 2013 to 2016.

The pages document the work of the CIA's Engineering Development Group and its branches, which built malware, exploits and implants targeting devices including iPhones, Android phones, Windows computers and Samsung smart televisions. They include 'Weeping Angel', a Samsung TV implant developed in workshops with Britain's MI5; 'Umbrage', which I described as a library of attack techniques taken from malware produced elsewhere; and guidance for CIA hackers working from the US consulate in Frankfurt under diplomatic cover.

I said we had not published the functional code of the tools and had redacted tens of thousands of IP addresses and other identifying details, including more than 22,000 within the United States.

I published Year Zero on 7 March 2017, having shared it in advance with Der Spiegel and La Repubblica (Guardian). I said the archive had circulated among former US government hackers and contractors 'in an unauthorized manner', one of whom had provided portions of it to me.

The US Department of Justice has stated, on the basis of evidence at trial, that Joshua Schulte, a software developer in the CIA's Center for Cyber Intelligence from 2012 to 2016, used a secret administrator session on 20 April 2016 to copy the centre's entire tool-development archives and then transmitted them to WikiLeaks. He was found guilty at trial on 9 March 2020 of contempt of court and making false statements, and on 13 July 2022 of eight counts including the illegal gathering and transmission of national defence information and unauthorised computer access; after a further conviction for child sexual abuse material offences on 13 September 2023, he was sentenced to 40 years in prison on 1 February 2024. The department described the theft as 'the largest data breach in CIA history' and counted 26 Vault 7 and Vault 8 disclosures between March and November 2017. The CIA itself declined to comment on the authenticity of the documents when they were published.