Vault 7: The CIA Leak Published by WikiLeaks

Vault 7, the CIA leak published by WikiLeaks, is to date the largest known public disclosure of internal documents from the U.S. agency's Center for Cyber Intelligence. Published starting March 7, 2017, the series of documents — dubbed "Vault 7" by WikiLeaks itself — shook the American intelligence community and reopened a fundamental debate over how states manage knowledge of software vulnerabilities before they become public.

What the publication contained

WikiLeaks presented Vault 7 as the first of several planned releases from a documentary trove that, according to the organization, described the arsenal and capabilities of the CIA's cyber-intelligence branch for roughly the period between 2013 and 2016. The first batch, called "Year Zero," included thousands of pages and files cataloguing projects, tools and techniques used by the agency, along with references to potentially affected devices and systems — including mobile phones, personal computers and smart-TV systems. Notably, and unlike previous leaks, WikiLeaks initially stated it would redact or withhold the operational source code of the tools described in order to avoid proliferating attack capabilities, focusing the release on describing capabilities rather than on their direct technical implementation.

The CIA and U.S. government response

The CIA neither confirmed nor denied the authenticity of every individual document, but it did acknowledge the incident's severity. The agency described the leak as significant damage to its foreign intelligence-gathering capabilities and opened an internal investigation to identify the source of the breach. Then-CIA Director Mike Pompeo went so far as to publicly label WikiLeaks a "non-state hostile intelligence service," a characterization that drew controversy among press-freedom advocacy groups.

The source of the leak: the Joshua Schulte case

The FBI investigation identified Joshua Schulte, a former software engineer who had worked at the CIA's Center for Cyber Intelligence, as the person responsible. Schulte was arrested in 2017 and underwent a lengthy legal process marked by two jury trials that ended in partial verdicts or without unanimous agreement on the main espionage charges. Finally, in July 2022, a federal jury in New York found him guilty of the most serious charges, including espionage and obstruction of justice, for leaking the material to WikiLeaks. In February 2024, federal judge Jesse Furman sentenced him to 40 years in prison, one of the harshest sentences ever handed down in the United States for a case involving leaked classified information. Schulte was also separately convicted of possessing child sexual abuse material, a charge unrelated to the leak case but folded into his total sentence.

1. March 7, 2017: WikiLeaks publishes the first installment of Vault 7, called "Year Zero."
2. 2017: the CIA opens an internal investigation and the FBI identifies Joshua Schulte as the prime suspect.
3. August 2017: Schulte is formally arrested on charges related to the leak.
4. 2020-2021: two federal jury trials end without a unanimous verdict on the main charges.
5. July 2022: a third trial concludes with Schulte's conviction for espionage and obstruction of justice.
6. February 2024: final sentencing to 40 years in prison.

The debate over vulnerabilities and the VEP

Beyond the criminal case, Vault 7 reignited a preexisting technical and political debate: the role of the Vulnerabilities Equities Process (VEP), the internal U.S. government mechanism by which various agencies decide whether a discovered software vulnerability should be disclosed to the manufacturer for a fix or kept secret for intelligence or law-enforcement purposes. Critics of the system, including organizations such as the Electronic Frontier Foundation, argued that Vault 7 demonstrated the risks of intelligence agencies stockpiling knowledge of security flaws without disclosing them to affected companies, since that knowledge can be leaked or stolen, as happened in this case. The U.S. government, for its part, maintained that the VEP includes safeguards and that most vulnerabilities discovered by agencies are eventually disclosed to manufacturers after a limited window of use.

A precedent for state cyber intelligence

Vault 7 stands, alongside the leak of NSA tools attributed to the Shadow Brokers group in 2016 and 2017, as one of the episodes that has most shaped public discussion of state accumulation of offensive cyber capabilities. Both cases showed that not even the best-protected agencies are immune to the risk of internal leaks, and fed the argument that secrecy around software vulnerabilities carries a collective security cost that must be weighed against its intelligence value. Nearly a decade later, Vault 7 is still cited in academic and policy circles as a must-reference case for any debate on transparency, state cybersecurity and institutional accountability in handling sensitive information.