# The CIA secretly built an arsenal of hacking tools to turn phones, smart TVs, and cars into covert surveillance devices

**Verdict: Proven.** The core is documented and, unusually, confirmed by the government's own criminal case. Beginning on 7 March 2017, WikiLeaks published Vault 7, thousands of files from the CIA's Center for Cyber Intelligence describing a real toolkit of malware and zero-day exploits for iPhones, Android phones, Windows, routers, and smart TVs, including a Samsung TV implant, Weeping Angel, that could turn a set into a covert microphone. A former CIA software engineer, Joshua Schulte, was later convicted of the leak and sentenced to 40 years, which settles that the material was authentic. What the record does not support is the maximal spin: these were targeted espionage tools, several needing physical access, not a system for passively watching everyone through their living-room television. The arsenal is real; the always-on all-seeing version is not what the documents show.

Category: Government & Intelligence · Era: 2010s · First circulated: March 2017, when WikiLeaks began publishing the Vault 7 files · Believed by: A broad audience of privacy advocates, security researchers, journalists, and the general public, with a maximal 'they watch everyone through your devices' version circulating widely on social media
URL: https://theconspiratory.com/theory/cia-vault-7

## Summary
On 7 March 2017, WikiLeaks began releasing Vault 7, the largest leak of internal CIA documents in the agency's history: thousands of pages describing hacking tools built by its Center for Cyber Intelligence. The files detailed malware and zero-day exploits to compromise iPhones, Android phones, Windows and Linux machines, routers, web browsers, and internet-connected televisions, along with an implant called Weeping Angel that could make a Samsung smart TV record audio while appearing to be off. The CIA declined to confirm the authenticity of specific documents but treated the breach as real and serious, and a jury later convicted CIA software engineer Joshua Schulte of the leak. This case file keeps two things apart: the documented capabilities, which are substantiated, and the overreaching claim that the tools amounted to mass, passive surveillance of the public, which the record does not support.

## The claim
That the Central Intelligence Agency secretly developed a large arsenal of cyber weapons, malware, viruses, and zero-day exploits, capable of breaking into smartphones, computers, routers, cars, and smart televisions, and using them as covert listening and tracking devices, and that these capabilities were built and used outside meaningful public oversight until the Vault 7 leak exposed them.

## Origin and timeline
- 2013–2016: The internal documents later published as Vault 7 are created and circulated inside the CIA's Center for Cyber Intelligence (CCI) in Langley, Virginia. They catalog the agency's cyber tools: malware, exploits, and technique write-ups for compromising a wide range of consumer and commercial devices.
- 2016: The Weeping Angel implant, a joint CIA and British Security Service (MI5) project targeting certain Samsung smart TVs, is documented in a user guide. It uses a 'Fake Off' mode so a set appears powered down while its built-in microphone keeps recording.
- 2016 (approx.): According to a later internal CIA assessment, the material that would become Vault 7 is copied from a high-security CCI network. A subsequent audit found that 91 of more than 500 of the agency's malware tools had been compromised by the breach.
- 2017-03-07: WikiLeaks publishes the first Vault 7 batch, 'Year Zero': roughly 7,800 web pages and more than 900 attachments. WikiLeaks says the archive came from an isolated, high-security network inside the CCI, and calls it the largest leak of intelligence documents in history.
- 2017-03 to 2017-11: WikiLeaks releases a run of further installments (Dark Matter, Marble, Grasshopper, Weeping Angel, and others), 26 disclosures in total that it labels Vault 7 and Vault 8, each documenting specific tools, frameworks, or techniques.
- 2017-03: The CIA responds without confirming the authenticity of specific documents, warning that such disclosures damage national security and endanger personnel, while defending its mission to collect foreign intelligence. Security researchers stress that the files show the CIA compromising devices, not breaking the encryption of apps like Signal or WhatsApp.
- 2018-06: Federal prosecutors charge Joshua Adam Schulte, a former CIA software engineer who had worked in the CCI, with unlawfully transmitting the Vault 7 material to WikiLeaks, among other counts.
- 2022-07-13: After an earlier trial ended without a verdict on the central counts, a jury convicts Schulte of espionage and computer-hacking charges tied to the leak. He is separately convicted in 2023 on child sexual abuse material charges.
- 2024-02-01: U.S. District Judge Jesse Furman sentences Schulte to 40 years in prison. The Justice Department describes his theft as the largest data breach in CIA history and one of the largest unauthorized disclosures of classified information the United States has ever seen.

## The evidence, claim by claim
- Claim: The CIA built a large secret arsenal of hacking tools, malware, and zero-day exploits to break into everyday devices.
  Evidence: Proven, and confirmed twice over. The Vault 7 files themselves describe the tools in operational detail, and the government's own criminal case treated the archive as authentic classified material, securing a conviction and a 40-year sentence for the engineer who leaked it. The documents cover exploits for Apple's iOS, Google's Android, Microsoft Windows, Linux, routers, and major web browsers. A CIA internal audit reportedly found that 91 of more than 500 of its malware tools had been exposed. This is not a rumor about capabilities; it is the government prosecuting someone for revealing them.
- Claim: One of the tools could turn a smart TV into a hidden microphone that keeps listening after you switch it off.
  Evidence: True in the specific, and worth stating precisely. Weeping Angel, developed with Britain's MI5, targeted certain Samsung smart TVs and used a 'Fake Off' mode so the set appeared powered down while its microphone recorded. But the documented method required an operative to install the implant, in the leaked guide, via physical access and a USB stick, and a later firmware update reportedly closed that USB route. It was a targeted espionage implant for a specific model under specific conditions, not a switch flipped remotely on every television at once.
- Claim: The CIA had cracked encrypted messengers like Signal and WhatsApp and could read anyone's private chats.
  Evidence: This is where early coverage overreached and security experts pushed back. The Vault 7 files do not show the CIA breaking the cryptography behind Signal or WhatsApp. They show the agency compromising the phone itself, so that once a device is fully hacked, its owner's messages can be read before they are encrypted or after they are decrypted, along with everything else on the handset. As one researcher put it, that no more breaks Signal than reading a message over someone's shoulder does. The encryption held; the endpoint was the target.
- Claim: Vault 7 proves the government is passively watching everyone, all the time, through their phones and TVs.
  Evidence: This is the overreach the documents do not support. The tools cataloged in Vault 7 are instruments of targeted intelligence operations: many require specific access, specific device models, or specific conditions, and several (like the TV implant) needed hands-on installation. There is no document showing a program that mass-compromised consumer devices across the public, or that quietly turned every phone and television into an always-on feed. A capability that can be aimed at a chosen target is a serious thing; it is not the same as continuous surveillance of everyone, and conflating the two is where the accurate story tips into the false one.
- Claim: The whole thing could be a fabrication or a foreign forgery, so none of it can be trusted.
  Evidence: The authenticity question is effectively closed. The CIA never denied the archive's provenance and treated the breach as a genuine, damaging loss from the moment it broke. More decisively, the United States tried a former CIA engineer for stealing and disclosing the material, and a jury convicted him; you cannot convict someone of leaking documents that do not exist. The dispute was never whether the files were real. It was how far their significance should be stretched.

## Why people believe it
- The kernel is not speculation but documented fact, published in bulk and later validated by a federal prosecution, so the leap from 'the CIA built spy malware' to 'the CIA can watch me' feels short even though a lot of engineering sits in that gap.
- The Weeping Angel TV implant is a genuinely unsettling image, a device in your living room recording while it looks switched off, and a true, vivid detail like that does more to shape belief than any amount of careful qualification about USB sticks and target models.
- Edward Snowden's 2013 NSA disclosures had already established that a U.S. intelligence agency would build sweeping electronic surveillance capabilities, so Vault 7 landed on primed ground where the maximal reading felt less like a leap than a confirmation.
- Modern homes are full of internet-connected microphones and cameras, phones, TVs, speakers, doorbells, and cars, and once you know an agency has hacked some of them, it is psychologically easy and not entirely unreasonable to assume it can reach all of them, all the time.
- Early news coverage itself overstated parts of the story, especially around encrypted messaging, so the exaggerated version carried the authority of mainstream headlines before the corrections caught up.

## Open questions
- How widely and against whom the Vault 7 tools were actually deployed is not public. The leak documents capabilities in detail, but the operational record of their use, targets, authorizations, and oversight, remains classified, so the line between what the CIA could do and what it did do is not fully drawn.
- How the archive was exfiltrated from a high-security CCI network, and what that says about the agency's own internal security, was aired in court but never fully resolved in public. The CIA's WikiLeaks Task Force reportedly found lax security, and the broader lesson about safeguarding cyber weapons is still being argued.
- What happened to the exploits after publication is a live security concern in its own right. Once zero-day vulnerabilities and techniques are exposed, they can in principle be studied or repurposed by others, and the full downstream effect of releasing an intelligence agency's toolkit is hard to measure.
- Whether intelligence agencies should stockpile undisclosed zero-day vulnerabilities at all, rather than reporting them so manufacturers can patch, is a genuine unresolved policy debate that Vault 7 sharpened but did not settle.

## Sources
- Vault 7: CIA Hacking Tools Revealed (release page), WikiLeaks (2017): https://wikileaks.org/ciav7p1/
- Former CIA Officer Joshua Adam Schulte Sentenced to 40 Years in Prison for Espionage and Child Pornography Crimes, U.S. Department of Justice, U.S. Attorney's Office, Southern District of New York (2024): https://www.justice.gov/usao-sdny/pr/former-cia-officer-joshua-adam-schulte-sentenced-40-years-prison-espionage-and-child
- WikiLeaks Releases What It Calls CIA Trove of Cyber-Espionage Documents, NPR (2017): https://www.npr.org/sections/thetwo-way/2017/03/07/519010317/wikileaks-releases-what-it-calls-cia-trove-of-cyberespionage-documents
- The CIA Didn't Break Signal or WhatsApp, Despite What You've Heard, The Intercept (2017): https://theintercept.com/2017/03/07/the-cia-didnt-break-signal-or-whatsapp-despite-what-youve-heard/
- WikiLeaks Says CIA Hacked Samsung Smart TVs, CBS News (2017): https://www.cbsnews.com/news/cia-hacked-samsung-smart-tvs-wikileaks-vault-7/
- WikiLeaks and the CIA: What's in Vault 7?, Council on Foreign Relations (2017): https://www.cfr.org/articles/wikileaks-and-cia-whats-vault7
- A Record Sentence in the 'Vault 7' Leak Case, Reporters Committee for Freedom of the Press (2024): https://www.rcfp.org/schulte-vault-7-leak-sentence/
- Former CIA Engineer Gets 40 Years for Giving Agency's Hacking Secrets to WikiLeaks, NPR (2024): https://www.npr.org/2024/02/01/1228493323/former-cia-engineer-sentenced-40-years-wikileaks

Rated by The Conspiratory, a neutral, sourced encyclopedia of conspiracy theories. Full page: https://theconspiratory.com/theory/cia-vault-7