Sources: WikiLeaks asks tech firms to agree to conditions before receiving details of CIA zero-days
Last week, WikiLeaks promised it would share the technical details and code of the hacking tools that the CIA has allegedly developed against Google, Apple, Microsoft and other tech companies.
Context & Ripple Effects
After promising to hand the CIA's alleged hacking tools to the companies they target, WikiLeaks is now attaching strings: sources say firms must agree to conditions before receiving the technical details and code affecting Google, Apple and Microsoft. That follows reporting that Microsoft and Google hadn't actually been contacted by Assange two days after the pledge was made, so the conditions arrive before any outreach has even happened.
The week that followed tested how much substance sat behind the offer — subsequent drops were mostly decade-old documents on EFI and UEFI firmware techniques against Macs and iOS, suggesting the vault-release cadence matters as much as the material itself.
First-order effects
- Apple, Google and Microsoft face a take-it-or-leave-it choice: accept WikiLeaks' undisclosed conditions to learn about zero-days aimed at their own platforms, or refuse and stay dependent on their own internal discovery for fixes.
Second-order effects
- By gating disclosure behind conditions, WikiLeaks keeps control of timing and framing — the firmware-document releases show it can sustain attention with older material while the promised code stays held back.
Third-order effects
- If conditioned, leaker-brokered disclosure becomes the norm for state exploit caches, vendors' patch pipelines end up hostage to a third party's terms rather than coordinated vulnerability disclosure norms set by companies and regulators.
The trend: Disclosure of government hacking tools is shifting from vendor-led coordinated disclosure toward staged, condition-laden releases controlled by the leaking organization itself.