Senator probes DOJ's safeguarding of hacking tools

hacker looking at screen

The ransomware attack on the city of Baltimore has reignited a long-running debate about whether the National Security Agency is doing enough to protect the hacking tools and exploits it develops. Now, a Democratic senator is sniffing around to see if the same concerns exist at other federal agencies.

In a June 5 letter, Sen. Ron Wyden (D-Ore.) asked Attorney General Bill Barr what the Department of Justice and its component agencies are doing to keep their tools from being leaked or stolen, as the NSA's were in 2016 when a mysterious group known as the Shadow Brokers published them on the open internet.

"Just as the American people expect the government to protect its nuclear, chemical and biological weapons, so too do Americans expect that the government will protect its cyber arsenal from theft by hackers and foreign spies," Wyden wrote.

The senator referenced a number of public reports documenting DOJ and component agencies' use of such tools, from purchasing communications monitoring software from an Italian surveillance company and exploiting security vulnerabilities in the Firefox web browser to install malware on at least 8,000 computers in 2015 to the FBI using third-party hacking tools to break into iPhones and other encrypted devices during criminal investigations.

Wyden asked Barr if any of DOJ's offensive cyber capabilities have "fall[en] into the wrong hands," have been discovered "in the wild" by security researchers or foreign governments or have later been used in attacks against U.S. entities.

He also asked if any of the capabilities were developed by foreign companies and if so, whether DOJ is taking steps to ensure they aren't surreptitiously communicating with foreign servers where they could potentially be stolen or seized by other nations.

The Washington Post first reported on Wyden's letter.

The concerns come at a time when policymakers are increasingly concerned about blowback and collateral damage from the government losing control of its cyber capabilities.

The NSA tools released by the Shadow Brokers were later repurposed by third parties and used in a number of high-profile cybersecurity incidents, such as the WannaCry and NotPetya attacks in 2017. More recently, the New York Times reported that EternalBlue, a SMB exploit that was among the U.S. government tools leaked, was present in the malware used to carry out a ransomware attack on Baltimore's IT systems.

The NSA has since disputed that allegation, while experts have debated whether the blame should fall more on the city for failing to take advantage of security patches released by Microsoft two years ago.

Since the 2016 leaks, the government has revamped what is known as the Vulnerabilities Equities Process, which pulls in representatives across the federal government to decide which zero-day vulnerabilities are disclosed to the general public and which are retained for intelligence or national security purposes.

Grant Schneider, federal chief information security officer and chairman of the VEP board, told reporters in April that while the government used to broadly search for and collect software vulnerabilities regardless of whether there was a clear use for them, that process has since become more targeted.

"We don't do that really anymore, we're focusing our resources now on: 'I'm trying to achieve a particular objective and … what vulnerabilities exist in order for me to achieve that objective,'" Schneider said. "So, it is far more narrowly focused than the broad-brush [approach]."

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at, or follow him on Twitter @derekdoestech.

Click here for previous articles by Johnson.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.