Vault 7

Background

The Central Intelligence Agency's Center for Cyber Intelligence (CCI), a component of the CIA's Directorate of Digital Innovation established in October 2015 (with predecessor structures dating to the 2000s), is the agency element responsible for the development and operational deployment of offensive cyber capabilities — including remote-access implants, code-injection frameworks, network-pivoting tools, and platform-specific exploitation toolkits — in support of the agency's foreign-intelligence-collection and covert-action missions. The CCI's Engineering Development Group (EDG) is the principal CCI element responsible for the engineering and software development of the toolset; the EDG operates from the CIA's Cyber Center at the agency's Liberty Crossing facility in McLean, Virginia.¹

Joshua Schulte was a software engineer at the CCI's Operations Support Branch (OSB) from 2010 through November 2016. Schulte's responsibilities at the OSB included the development and maintenance of CCI tooling and the administration of the CCI's classified development environment. Schulte left the CIA in November 2016 following a series of internal disputes including a documented argument with a colleague, internal personnel-security-related matters, and the revocation of his system administrator privileges in March 2016 — in connection with which he was, on the United States Government's subsequent prosecution case, the principal suspect for the unauthorised exfiltration of the CCI tool repository.²

The Operation

WikiLeaks announced the Vault 7 series on 7 March 2017 and began the same day with the publication of the "Year Zero" tranche — approximately 8,761 documents and files extracted from the CCI Confluence wiki and from related development-environment systems. The publication continued at intervals across March–November 2017 in twenty-four separately titled tranches, including "Dark Matter" (23 March 2017, on iOS and macOS implants), "Marble" (31 March 2017, on the Marble Framework code-obfuscation system), "Grasshopper" (7 April 2017, on a payload-construction framework), "HIVE" (14 April 2017, on the HIVE command-and-control infrastructure), "Weeping Angel" (21 April 2017, on a Samsung smart-TV implant), "Scribbles" (28 April 2017, on a document-watermarking system), "Archimedes" (5 May 2017, on a man-in-the-middle network tool), "AfterMidnight" and "Assassin" (12 May 2017, on Windows implant frameworks), "Athena" (19 May 2017), "Pandemic" (1 June 2017, on a Windows-fileserver implant), "Cherry Blossom" (15 June 2017, on a router and access-point implant framework), "Brutal Kangaroo" (22 June 2017, on a USB-pivot toolset for air-gapped networks), "Elsa" (28 June 2017, on a Wi-Fi-based geolocation tool), "OutlawCountry" (30 June 2017, on a Linux-router kernel module), "BothanSpy" (6 July 2017, on SSH-credential collection), "HighRise" (13 July 2017, on a Android SMS-redirection implant), "Raytheon" (19 July 2017, on a contractor-developed implant family), "Imperial" (27 July 2017), "Dumbo" (3 August 2017, on a webcam-and-microphone control tool), "CouchPotato" (10 August 2017, on RTSP video collection), "ExpressLane" (24 August 2017, on liaison-service backdoor implants), "Angelfire" (31 August 2017, on a Windows persistence framework), "Protego" (7 September 2017, on a missile-control system), and "Hive" (9 November 2017, on the source code of the HIVE infrastructure).³

The published material was substantially confined to documentation, build environments, internal wiki content, and in some cases source code; WikiLeaks publicly stated that it had withheld weaponised executables. The publications were not coordinated with the established media partners of earlier WikiLeaks publication series; WikiLeaks exercised editorial control over the staged release timing across the entire 2017 publication arc.⁴

Disclosure

Joshua Schulte was identified by FBI investigation in March 2017 as the principal suspect for the Vault 7 disclosures and was placed under surveillance. A search of his Manhattan apartment in March 2017 produced a quantity of child sexual-abuse material; Schulte was arrested in August 2017 on the resulting unrelated federal charges and indicted on 27 June 2018 on the Vault 7 charges, alleging unauthorised retention and disclosure of national-defence information under the Espionage Act of 1917 in connection with the WikiLeaks transmission.⁵

Schulte's first trial, before Judge Paul A. Crotty at the United States District Court for the Southern District of New York in February–March 2020, resulted in a hung jury on the principal Espionage Act counts and conviction on two unrelated charges (false statements and contempt of court). The retrial, before Judge Jesse M. Furman at the same court in July 2022, resulted in conviction on the Espionage Act counts. A separate proceeding on the child sexual-abuse material charges, before Judge Furman in September 2023, produced a further conviction. On 1 February 2024, Judge Furman sentenced Schulte to forty years' imprisonment on the combined charges. Schulte's appeal was pending as of late 2024.⁶

The CIA's institutional response was characterised by the agency's WikiLeaks Task Force in an internal report dated October 2017, WikiLeaks Task Force: Final Report, of which a redacted version was released in connection with the Schulte prosecution. The report concluded that the unauthorised disclosure was the largest in CIA history; that the disclosure was substantially attributable to inadequate compartmentation of CCI tooling, inadequate access-control over the development environment, and inadequate monitoring of personnel-security indicators on cleared CCI staff; and that the agency's internal reporting on the disclosure was itself substantially incomplete in the period before WikiLeaks publication.⁷

Legacy

Vault 7 is the largest single unauthorised disclosure of classified material in the operational history of the Central Intelligence Agency. The substantive content disclosed — the operational architecture of the CCI tool set, the technical detail of named cyber-implants, the agency's attribution-evasion tradecraft (the Marble Framework's deliberate inclusion of foreign-language strings to misdirect attribution analysis being a particularly noted feature), and the operational tempo of CCI development — gave to foreign intelligence services and to private-sector security firms an unprecedented public-record account of a major Western state's offensive-cyber capability. The CIA WikiLeaks Task Force report characterised the disclosure as having caused substantial damage to ongoing CCI operations and to the agency's offensive-cyber programme more broadly.⁸

The disclosure has functioned in subsequent academic and journalistic analysis as the canonical reference for the public-record account of state-level offensive-cyber tooling. The published material has been the subject of detailed reverse-engineering and academic analysis; multiple of the disclosed tools and techniques have been identified by private-sector reporting in subsequent intrusion sets, in some cases by other states' services adapting the disclosed CIA techniques. The Marble Framework's specific role in attribution analysis — the deliberate inclusion of foreign-language strings to mislead analysts — has been substantially incorporated into the threat-modelling work of major Western private-sector security firms.⁹

Vault 7 stands alongside the Snowden disclosures (2013) and the Manning–WikiLeaks Disclosures (2010) as the third major modern intermediated disclosure of United States Intelligence Community classified material — the disclosure series that, in combination, produced the substantial reorientation of the public-record account of post-2001 United States signals-intelligence and cyber-intelligence operations. The successful prosecution of Schulte under the Espionage Act, in contrast to the more contested prosecution outcomes in the Manning and Assange cases, established a clearer judicial precedent for prosecution under the statute in disclosure cases of this character.¹⁰

Related dossiers and agencies

This dossier sits in the modern post-2010 disclosure series alongside the Manning–WikiLeaks Disclosures (2010) and the Snowden disclosures (2013). The technical content of the disclosure — offensive-cyber tooling — connects forward to Stuxnet (the canonical Western state-level offensive-cyber operation) and to the federal-government-targeting cyber operations documented in the 2015 OPM Data Breach, SolarWinds (SUNBURST), and HAFNIUM (Microsoft Exchange). The agency-level entry most directly engaged is the Central Intelligence Agency; the country-level context is on the page for the United States.

Sources & Further Reading

1. CIA, public statements on the establishment of the Directorate of Digital Innovation, October 2015; Mark M. Lowenthal, Intelligence: From Secrets to Policy, 8th ed. (CQ Press, 2019), ch. 4 on US intelligence community structure.
2. United States v. Schulte, indictment of 27 June 2018, US District Court for the Southern District of New York; trial record, United States v. Schulte, 2020 and 2022 trials.
3. WikiLeaks publication archive, "Vault 7: CIA Hacking Tools Revealed," March–November 2017; release-by-release publication index; The New York Times, The Washington Post, and Der Spiegel contemporaneous reporting on each tranche.
4. WikiLeaks public statements on Vault 7 publication policy, 7 March 2017 onward; the parallel Vault 8 archive (released 9 November 2017) contains the source code and development logs of the HIVE command-and-control infrastructure described in Vault 7; James Risen, "WikiLeaks Releases Trove of C.I.A. Documents," The New York Times, 7 March 2017.
5. United States v. Schulte, indictment of 27 June 2018; FBI affidavit in support of Schulte arrest warrant, August 2017.
6. United States v. Schulte, trial verdicts of 9 March 2020 and 13 July 2022; sentencing memorandum and judgment of 1 February 2024.
7. CIA WikiLeaks Task Force, Final Report, October 2017, redacted version released in connection with the Schulte prosecution; sealed-record disclosures in United States v. Schulte.
8. CIA WikiLeaks Task Force, Final Report; Senate Select Committee on Intelligence statements on Vault 7, 2017 onward; David E. Sanger, The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age (Crown, 2018), ch. 11.
9. Symantec Threat Intelligence reporting on Longhorn / The Lamberts, 2017 onward; Kaspersky Lab reporting on the same; subsequent academic analysis of the Marble Framework, including James Lewis (CSIS) and the Atlantic Council Cyber Statecraft Initiative.
10. Sanger, The Perfect Weapon; David Pozen, "The Leaky Leviathan: Why the Government Condemns and Condones Unlawful Disclosures of Information," Harvard Law Review 127 (2013); commentary on the Schulte verdicts in Lawfare, Just Security, and the trade press.