Former US Intelligence Analysts Sued For Hacking A Saudi Activist's Phone On Behalf Of The United Arab Emirates

from the hacking-victim-getting-the-chance-to-inflict-some-misery-of-her-own dept

In early 2019, a whistleblower revealed some ugliness emanating from the United Arab Emirates: former NSA analysts working for a private company hired to perform counterterrorism work for the government were spying on journalists, activists, and the occasional American citizen on behalf of their royal benefactors.

Why these analysts were working for known human rights abusers was unclear. Why they decided this work should involve targeting people who weren't terrorists, but rather critics of the UAE government, was similarly left unexplained. The program was called Project Raven and former employee Lori Stroud was the only person involved willing to speak publicly about its activities. Everyone else -- from the NSA to the UAE government -- refused to comment.

More than two years later, the harms perpetrated by these former analysts were given a price tag. Three former US intelligence community analysts (two of which worked for the NSA) were fined $1.68 million for utilizing powerful hacking tools to target dissidents, activists, journalists, and the occasional American citizen for the UAE government. The tools used included "Karma," which was capable of remotely compromising targets' phones without any interaction from phone owners, allowing for wholesale collection of photos, emails, text messages and location information.

Over the years covered in the indictment (which resulted in the fines mentioned above), the analysts began with Project Raven, which migrated from Cyberpoint (a company associated with Italy's infamous Hacking Team), before finally ending up as a wholly-UAE-owned company called Darkmatter.

It's this company that's now being sued by one of its targets, a Saudi activist represented by the EFF.

The Electronic Frontier Foundation (EFF) filed a lawsuit today on behalf of prominent Saudi human rights activist Loujain AlHathloul against spying software maker DarkMatter Group and three of its former executives for illegally hacking her iPhone to secretly track her communications and whereabouts.

AlHathloul is among the victims of an illegal spying program created and run by former U.S. intelligence operatives, including the three defendants named in the lawsuit, who worked for a U.S. company hired by United Arab Emirates (UAE) in the wake of the Arab Spring protests to identify and monitor activists, journalists, rival foreign leaders, and perceived political enemies.

The defendants include Darkmatter, the UAE-owned company that acted on behalf of the Kingdom of Saudi Arabia. Also named are the three former US Intelligence Community analysts who were fined $1.68 million by the federal government in September 2021.

A lot of what's alleged mirrors what we've been seeing over the past several months emanating from Israel malware manufacturer, NSO Group: powerful phone hacking tools, authoritarian governments, and the targeting of government critics, political opponents, and journalists. We've heard plenty about who's been targeted. We don't often hear what happens to those targeted when the governments targeting them finally catch up to them. AlHathoul's lawsuit [PDF] details the end result of her targeting by former NSA analysts working for Project Raven and Darkmatter.

[AlHathloul's] phone was initially hacked in 2017, gaining access to her texts, email messages, and real-time location data. Later, AlHathloul was driving on the highway in Abu Dhabi when she was arrested by UAE security services, and forcibly taken by plane to the KSA, where she was imprisoned twice, including at a secret prison where she was subject to electric shocks, flogging, and threats of rape and death.

I'm sure the named analysts would prefer not to know the human misery their work for the UAE and KSA (Kingdom of Saudi Arabia) resulted in. It's always easier to think of targets in the abstract: an identifier devoid of personal agency, compromised and controlled by ones and zeroes similarly devoid of personality. This lawsuit will force them to confront what they enabled and, possibly, compensate this activist for the harms they enabled.

Filed Under: activism, hacking, karma, malware, nsa, spyware
Companies: darkmatter

Ex-NSA Personnel Spied On Americans And Journalists For The United Arab Emirates

from the all-the-'good-guys'-doing-all-the-bad-stuff dept

When former NSA employees and contractors decide to start working for a journalist-murdering authoritarian, they should feel sick. Instead, after targeting journalists, dissidents, and other people the United Arab Emirates government doesn't like, they felt exhilarated.

Working together with managers, Stroud helped create a policy for what to do when Raven swept up personal data belonging to Americans. The former NSA employees were instructed to mark that material for deletion. Other Raven operatives would also be notified so the American victims could be removed from future collection.

As time went on, Stroud noticed American data flagged for removal show up again and again in Raven’s NESA-controlled data stores.

Still, she found the work exhilarating. “It was incredible because there weren’t these limitations like there was at the NSA. There wasn’t that bullshit red tape,” she said. “I feel like we did a lot of good work on counterterrorism.”

That quote comes from a disturbing account of UAE "counterterrorism" work performed by a unit of Americans linked to the NSA published at Reuters. That "bullshit red tape" is, for the most part, known as the Constitution. The quote comes from Lori Stroud, who worked with a unit of hackers known as Project Raven, targeting whoever the UAE felt needed targeting. She is the only person from that unit willing to publicly-out her identity. Everyone else involved either spoke anonymously or refused to say anything at all. Here's the deafening silence that accompanied the Reuter's article:

An NSA spokesman declined to comment on Raven. An Apple spokeswoman declined to comment. A spokeswoman for UAE’s Ministry of Foreign Affairs declined to comment. The UAE’s Embassy in Washington and a spokesman for its National Media Council did not respond to requests for comment.

Lori Stroud's work with the NSA dates far enough back that it includes a stupendous irony: she recommended the NSA add Ed Snowden to her Booz Allen contracting team. A few months later, Snowden was gone, taking with him a pile of documents that Stroud's recommendation had helped him gain access to.

Hacking for the UAE meant hacking American targets and British journalists.

One of the program’s key targets in 2012 was Rori Donaghy, according to former Raven operatives and program documents. Donaghy, then 25, was a British journalist and activist who authored articles critical of the country’s human rights record. In 2012, he wrote an opinion piece for the Guardian criticizing the UAE government’s activist crackdown and warning that, if it continued, “those in power face an uncertain future.”

This is what counterterrorism looks like in UAE. This is what it can look like anywhere, once mission creep sets in and the government decides criticism is suspicious behavior. But this was done by US intelligence personnel who took better-paying offers to spy for a nation we somehow consider an ally, despite its stances on pretty much everything being antithetical to ours.

The quote opening this post was from the aftermath of an indiscriminate deployment of a virus that infected every visitor of a targeted Islamist forum. It swept up plenty of communications from Americans, but even with safeguards in place to remove inadvertent collections, it was clear UAE did not consider Americans' communications off-limits.

It should have. The UAE claims to be a partner in the War on Terror, citing its positive relationship with the United States as an intelligence partner. Even though Project Raven was run by the UAE using former US intel personnel, the NSA still was supposed to be notified before operation deployments or prior to presentations that might discuss classified techniques. What's published here shows either the NSA was cut out of the loop by UAE or that the NSA appears to have made no effort to keep tabs on operations run by its surveillance partner.

The UAE government took the project in-house, using a local tech contractor to create a company called DarkMatter that severed any ties the project might have with the US Intelligence Community. To their credit, at least eight former US intelligence analysts left when it became apparent targeting dissidents, journalists, and American citizens was going to be a large part of their work.

Lori Stroud eventually realized targeting Americans was a feature, not a bug.

When she questioned the apparent targeting of Americans, she received a rebuke from an Emirati colleague for accessing the targeting list, the emails show. The target requests she viewed were to be processed by “certain people. You are not one of them,” the Emirati officer wrote.

Days later, Stroud said she came upon three more American names on the hidden targeting queue.

Those names were in a category she hadn’t seen before: the “white category” — for Americans. This time, she said, the occupations were listed: journalist.

“I was sick to my stomach,” she said. “It kind of hit me at that macro level realizing there was a whole category for U.S. persons on this program.”

But sick or not, it was the UAE government that removed her from DarkMatter, terminating her employment when she kept objecting to the targeting of Americans. She was met by the FBI when she returned to the US. The entire operation is now under FBI investigation, but not necessarily for the illegal targeting of Americans. The FBI appears to be more concerned about possible leaks of classified surveillance techniques. It also wants to know if any US "systems" were targeted, suggesting it will be looking at attacks against US government entities and domestic corporations. It appears spying on journalists and Americans isn't worthy of an investigation.

Filed Under: journalists, lori stroud, mercenaries, nsa, project raven, surveillance, uae, united arab emirates
Companies: darkmatter