With surveillance-security software on the rise, the fight against the use of espionage malware on citizens is gathering steam.
Tom Brewster, The Guardian, 18.06.2014 In March, the world’s biggest surveillance-technology providers gathered in the pristine corridors of the JW Marriot Hotel in Dubai. The occasion was the three-day ISS World conference, the middle east’s largest “lawful interception” event. Rooms there cost just under £200 a night, small change to those business leaders earning significant sums by providing the code used to spy on internet denizens. The following month, fusty halls in Farnborough were filled with many of the same companies at Security & Policing, a Home Office-sponsored event. These firms believe they are supplying tools to the defenders of the free world. Yet the Guardian has been handed evidence their technology and vast numbers of other espionage tools are increasingly being used in countries with questionable human rights records, where activists and media organisations, among others, are under attack. Software for monitoring and accessing victims’ computers Hacking Team was one of the companies expected to attend both events. This Italian outfit has been accused of selling its malicious software to the UAE and Morocco, where an activist and a media organisation were targeted. Its Galileo tool can monitor Skype calls, emails, keystrokes and webcams while allowing remote control over victims’ machines. Research released in February indicates the company’s surreptitious software has been operational in a significant number of nations that civil rights organisations deem repressive. Citizen Lab, a group based out of the University of Toronto consisting of security researchers keen to expose malware used by repressive regimes, details in its Spy Another Day report (previous studies have been given Bond-themed names) several months of internet-mapping efforts. The researchers discovered servers running the malware in as many as 22 countries, including Mexico, Colombia, Azerbaijan, Kazakhstan, Uzbekistan, Oman, Sudan, Malaysia, Ethiopia and Saudi Arabia. Of particular concern is Ethiopia. In the second half of last year, Ethiopian Satellite Television (ESAT), a politically focused media outlet, was targeted by Hacking Team malware. Claudio Guarnieri, a security researcher who contributed to the Citizen Lab report, suspects the Ethiopian government adopted Hacking Team technology to replace a suite of tools known as FinFisher, created by British company Gamma International, which is now exporting tools out of Switzerland. “My assumption is Hacking Team is getting a lot of customers FinFisher lost,” Guarnieri says. Documents seen by the Guardian show that an ESAT contributor found FinFisher malware on their computer in mid-2013. They claimed a subsequent investigation detected FinFisher had been activated on their PC in mid-2012. Hacking Team and Gamma are just two of many European and US companies that make up the $5bn digital surveillance industry. Gamma’s pricey FinFisher tools, costing as much as €255,000 (£215,000) for use of the FinSpy tool with support, were previously found by Citizen Lab in use in a wide range of countries, including Bahrain, Egypt, Ethiopia, Nigeria, Pakistan, Turkmenistan and Vietnam. Human rights activists aren’t impressed. “What is worrying is that much of this offensive digital capability is being sold as lawful intercept software in countries where rule of law is not robust,” says Citizen Lab researcher Morgan Marquis-Boire. Gamma has not responded to a request for comment. But legal counsel for Hacking Team, Eric Rabe, says over email that the company stops supplying its services when they are used for “gross human rights abuses”. Nor does it “sell products to governments or to countries blacklisted by the US, EU, UN, Nato or Asean”. Yet when asked what blacklists Hacking Team uses, Rabe does not respond, nor does he reply to questions about the additional customers identified by Citizen Lab. Hacking Team has previously told the Guardian that “Hacking Team complies, in all its dealings, with all relevant UK legislation and regulation”. Smoking out RATs Governments also have many of their own bespoke capabilities, creating highly sophisticated offensive software. The Stuxnet malware, uncovered in 2010, is the most infamous. Believed to have been the work of US and Israeli agents, it disrupted centrifuges at an Iranian nuclear plant. Few similar examples been uncovered since. But other government attacks have not been so well hidden, especially those using commonly available remote access Trojans, less sophisticated versions of Hacking Team-type technology. The Guardian has learned of many such attacks ostensibly launched by repressive regimes in the past two years. In the UAE, activists were repeatedly targeted by the SpyNet RAT in 2013, according to Bill Marczak, another member of the Citizen Lab team, who is based out of the University of California, Berkeley. They were sent a video of a fake protest via email. Once clicked on, the videos played, but the RATs were silently downloaded on to victims’ PCs. The video even mentioned Ahmed Mansoor, the UAE activist targeted by Hacking Team malware in 2012. Marczak believes the UAE administration has moved away from using costly Hacking Team kit to this “off-the-shelf” software. Among recent victims was the wife of a political detainee in the country, Marczak says. Eva Galperin, security expert from the Electronic Frontier Foundation, was recently targeted by similar malware, along with an Associated Press journalist and a Vietnamese pro-democracy blogger. She is convinced the Trojan sent to her via email, purporting to come from charity Oxfam, actually came from Vietnamese government hackers. Tibetans continue to be battered by such attacks too. Security firm AlienVault’s own research has been used as a lure to convince email recipients into clicking on links that lead to infection, says the company’s research director, Jaime Blasco. Previously undocumented attacks stemming from 2012 hit a range of targets, including the Tibetan government in exile, the Tibetan People’s Mass Movement and the Bureau du Tibet in Brussels. The same hackers went after Voice of America, the official broadcaster of the US government, according to Blasco. Elsewhere, the Guardian has learned that in in January, a number of Ukrainian websites disseminating information on the protests against former President Viktor Yanukovych’s regime were taken down with distributed denial of service (DDoS) attacks, which use infected machines, known as bots, to flood web servers with traffic to force them offline. Access to botnets is sold on underground forums, or they can be created by infecting large numbers of machines, which are tied together with attackers’ command and control systems. Fighting digital arms Governments’ arsenals are replete with hacking tools then, some sophisticated, others blunt. And they are regularly used the world over, often by repressive regimes. But the fight against the use of digital arms on citizens is gathering steam. While Citizen Lab and the EFF are shining a light on the wide-scale use of government-controlled malware, others are taking action at both technical and political levels. In Europe, MEP Marietje Schaake has launched the Stop Digital Arms Trade initiative, supported by UK-based non-profit Privacy International. She is lobbying hard on acquiring legally binding agreements across member states to enforce export controls on the likes of Hacking Team and Gamma. Currently, “they are doing very little” to address the issues, Schaake notes. “We have to preserve and defend our values and that’s why it’s even more surprising is that there is basically no regulation on the production or export of what I call digital arms. Often people do not realise the EU is not seeking to curb this trade,” she says. There has been one notable political success in the fight against this software. Thanks to recommendations from the UK and French governments, the Wassenaar Arrangement, a multilateral export regime controlling weapons, accepted two new categories. One covered “advanced persistent threat software” and offensive cyber tools”, the other “IP network surveillance systems”. It remains to be seen which signatories adopt export controls, but activists are upbeat. Privacy International is taking the fight to Gamma too. Following official complaints about the export of the technology, the Organisation for Economic Cooperation and Development is currently deciding whether or not its rules have been broken by Gamma’s exports. The German National Contact Point for the OECD decided not to investigate, but the UK side is continuing to look into the matter. For technical assistance, Netherlands-based Digital Defenders, founded in 2012 by international development organisation Hivos, offers recourse to those under attack from governments. It stepped in to help those Ukrainian sites hit by DDoS attacks, which wished to remain anonymous. A Digital Defenders consultant acted as a middle man to help bring in Google’s new Shield offering, part of the internet giant’s altruistic efforts to protect activists, to prevent future DDoS strikes. Founder Fieke Jansen says the organisation, which has secured financial support from the US, Dutch, Estonian, Latvian, Czech and Swiss governments, now has its own DDoS-mitigation service, which can be used for free. Over in the US, a crew of security professionals are establishing a “peace corps for hackers”, as one of the founders, Josh Corman, describes it. Currently called I Am The Cavalry, it will look at helping citizens on a range of security issues, focusing on public safety and making it more difficult for any kind of attack to take place, especially ones that have a physical impact. Corman believes the rush to connect everything to the internet, from medical devices to cars, is leaving people vulnerable and no one, especially not government, is coming to save them. Finding common ground Though these groups agree citizens need greater protection from the myriad threats facing them, they do not agree on how to secure it. Any kind of regulation is likely to be met with scepticism from the security community, largely because governments are the biggest buyers of legally accepted offensive tools. An outright ban of exploit code might have negative consequences. It could hamper the work of security researchers investigating those tools, according to Galperin. “I am unable to come up with a legislative framework that would make it illegal to do this that would not also have tremendous impact on free speech and on the work of perfectly legitimate security researchers.” One option outside of enforcing a ban could be to implement a strict licence regime, whereby certain technologies would be classed as potentially detrimental to human rights. Manufacturers of those tools would have to be granted a licence by a public authority for exporting goods, Schaake suggests. Despite its disparate views, the anti-surveillance movement, in part inspired by the Edward Snowden leaks, is in an ebullient mood, confident of some kind of consensus on slowing the rise of the offensive digital surveillance industry. “I’m confident sooner or later we will turn this ship around,” Schaake adds.