A specialized CIA unit that developed hacking tools and cyber weapons didn’t do enough to protect its own operations and wasn't prepared to respond when its secrets were exposed, according to an internal report prepared after the worst data loss in the intelligence agency’s history.
"These shortcomings were emblematic of a culture that evolved over years that too often prioritized creativity and collaboration at the expense of security,” according to the report, which raises questions about cybersecurity practices inside U.S. intelligence agencies.
Sen. Ron Wyden, D-Ore., a senior member of the Senate Intelligence Committee, obtained the redacted report from the Justice Department after it was introduced as evidence in a court case this year involving stolen CIA hacking tools.
He released it on Tuesday along with a letter he wrote to new National Intelligence Director John Ratcliffe, asking him to explain what steps he’s taking to protect the nation’s secrets held by federal intelligence agencies.
The findings were first published by The Washington Post.
The 2017 report was produced one year after the theft of sensitive tools for hacking into adversaries' networks that were developed by the CIA's specialized Center for Cyber Intelligence. A former CIA employee was accused of stealing the information and providing it to WikiLeaks, but a jury deadlocked on those allegations.
The CIA report revealed lax cybersecurity measures by the specialized unit and the niche information technology systems that it relies upon, which is separate from the systems more broadly used by everyday agency employees. The security was so poor, according to the report, that if these hacking tools had “been stolen for the benefit of a state adversary and not published, we might still be unaware of the loss.”
CIA spokesman Tim Barrett would not comment on the report, but said the “CIA works to incorporate best-in-class technologies to keep ahead of and defend against ever-evolving threats.”
The leak occurred almost three years after Edward Snowden, a former contractor for the National Security Agency, confiscated classified information about the NSA’s surveillance operations, and publicly disclosed it.
“CIA has moved too slowly to put in place the safeguards that we knew were necessary given successive breaches to other U.S. Government agencies,” according to the report prepared in October 2017 by the CIA's WikiLeaks Task Force.
The report said sensitive cyber weapons were not compartmented, users shared systems and administrator-level passwords, there were no effective controls for thumb drives and users had indefinite access to historical data.
The disclosure of the hacking tools featured prominently in the trial this year of Joshua Schulte, a former CIA software engineer accused of stealing a large trove of the agency’s hacking tools and handing it to WikiLeaks. He was convicted in March of only minor charges after a jury deadlocked on more serious espionage counts against him, including the theft of the hacking tools.
Prosecutors argued during the trial that the data dump had serious consequences, revealing CIA efforts to hack Apple and Android smartphones and efforts to turn internet-connected televisions into listening devices.
“These leaks were devastating to national security,” Assistant U.S. Attorney Matthew Laroche told jurors. “The CIA’s cyber tools were gone in an instant. Intelligence gathering operations around the world stopped immediately.”
Prosecutors portrayed Schulte as a disgruntled software engineer who exploited a little-known back door in a CIA network to copy the hacking arsenal without raising suspicion.
It was only after the anti-secrecy group WikiLeaks published the so-called Vault 7 leak in 2017 — nearly a year after the theft — that the agency scrambled to determine how the information had been stolen. It identified Schulte, 31, originally from Lubbock, Texas, as the prime suspect. Schulte had left the agency after a falling-out with colleagues and supervisors.
Prosecutors described the leak as an act of revenge. Defense attorney Sabrina Shroff argued that investigators could not be sure who took the data because the CIA network in question “was the farthest thing from being secure” and could be accessed by hundreds of people.
PROVIDENCE, R.I. (AP) — Several days of investigations into the Brown University mass shooting and the slaying of a Massachusetts Institute of Technology professor ended when authorities discovered evidence they say indicates the killings were committed by the same man, who was then found dead from a self-inflicted gunshot wound.
The attacker at Brown killed two students and wounded nine others in an engineering building on Saturday. Some 50 miles (80 kilometers) away MIT professor Nuno F.G. Loureiro was killed Monday night in his home in the Boston suburb of Brookline. Police said the body of the shooter they believe is responsible for both crimes was found Thursday.
Here is what to know about the attacks and investigations:
Claudio Neves Valente, 48, a former Brown student and Portuguese national, was found dead in a New Hampshire storage facility after a six-day search that spanned several New England states.
Brown University President Christina Paxson said Neves Valente was enrolled at Brown from the fall of 2000 to the spring of 2001. He was admitted to the graduate school to study physics beginning in September 2000.
“He has no current affiliation with the university,” she said.
Neves Valente had studied at Brown on a student visa. He eventually obtained legal permanent residence status in September 2017. His last known residence was in Miami.
Portugal’s top diplomat said Friday that the government was taken aback that a Portuguese man is the main suspect in the mass shooting at Brown and the killing of an MIT professor who was of the same nationality. Police said they were contacted by U.S. authorities Thursday once Neves Valente was named.
Foreign Minister Paulo Rangel said Portugal has provided “very broad cooperation” in the case. He said in comments to the national news agency Lusa that “the investigation is far from over.”
Loureiro, 47, who was married, joined MIT in 2016 and was named last year to lead the school’s Plasma Science and Fusion Center, where he worked to advance clean energy technology and other research. The center, one of MIT’s largest labs, had more than 250 people working across seven buildings when he took the helm. He was a professor of physics and nuclear science and engineering.
Valente and Loureiro attended the same academic program at a university in Portugal between 1995 and 2000, Foley said. Loureiro graduated from the physics program at Instituto Superior Técnico, Portugal’s premier engineering school, in 2000, according to his MIT faculty page.
The same year, Neves Valente was let go from a position at the Lisbon university, according to an archive of a termination notice from the school’s then-president in February 2000.
Authorities released several security videos of a suspect for the Brown attack but their face is masked or turned away in all of them.
Police say a witness then gave investigators a key tip: he saw someone who looked like the person of interest with a Nissan sedan displaying Florida plates. That enabled Providence police officers to tap into a network of more than 70 street cameras operated around the city by surveillance company Flock Safety. Those cameras track license plates and other vehicle details.
After leaving Rhode Island for Massachusetts, Providence officials said the suspect stuck a Maine license plate over the rental car’s plate to help conceal his identity.
Video footage showed Neves Valente entering an apartment building near Loureiro’s. About an hour later, he was seen entering the New Hampshire storage facility where he was later found dead, Foley said.
The two students who were killed and the nine others wounded were studying for a final in a first-floor classroom in an older section of the engineering building when the shooter walked in and opened fire.
Those killed were 19-year-old sophomore Ella Cook and 18-year-old freshman MukhammadAziz Umurzokov. Cook, whose funeral is Monday, was active in her Alabama church and served as vice president of the Brown College Republicans. Umurzokov’s family immigrated to the U.S. from Uzbekistan when he was a child, and he aspired to be a doctor.
As for the wounded, six were in stable condition Thursday, officials said. The other three were discharged.
Neves Valiente gained permanent residency status through a green card lottery program, Homeland Security Secretary Kristi Noem said in a post on X.
She said President Donald Trump ordered her to pause the United States Citizenship and Immigration Services program.
The diversity visa program makes up to 50,000 green cards available each year by lottery to people from countries that are little represented in the United States, many of them in Africa. The lottery was created by Congress, and the move is almost certain to invite legal challenges.
This combo image made with photos provided by the FBI and the Providence, Rhode Island, Police Department shows a person of interest in the shooting that occurred at Brown University in Providence, R.I., Saturday, Dec. 13, 2025. (FBI/Providence Police Department via AP)
A memorial of flowers and signs lay outside the Barus and Holley engineering building at Brown University, on Hope Street in Providence, R.I., on Tuesday, Dec 16, 2025. (AP Photo/Matt OBrien)
A Brown University student leaves campus, Tuesday, Dec. 16, 2025, after all classes, exams and papers were canceled for the rest of the Fall 2025 semester following the school shooting, in Providence, R.I. (AP Photo/Robert F. Bukaty)
