Privacy International Files Criminal Complaint Against FinFisher Spyware Company

from the accessories-and-abettors dept

Techdirt has been reporting on the disturbing rise in the use of malware by governments around the world to spy on citizens. One name that keeps cropping up in this context is the FinFisher suite of spyware products from the British company Gamma. Its code was discovered masquerading as a Malay-language version of Mozilla Firefox, and is now at the center of a complaint filed in the UK:

Privacy International today has made a criminal complaint to the National Cyber Crime Unit of the National Crime Agency, urging the immediate investigation of the unlawful surveillance of three Bahraini activists living in the UK by Bahraini authorities using the intrusive malware FinFisher supplied by British company Gamma.

Here's why Privacy International is acting now:

While it's long been known that Gamma has provided surveillance capabilities to Bahrain, amongst other countries, the extent of Gamma's complicity in Bahrain's unlawful surveillance of individuals located abroad has only recently been confirmed. Two months ago, a number of internal Gamma documents were published revealing that Gamma is both aware of, and actively facilitating, the Bahraini regime's surveillance of targets located outside Bahrain through the provision of intrusion technology called FinFisher to the Bahraini authorities.

The analysis by Bahrain Watch clearly shows that, amongst the Gamma documents published online, those targeted by the Bahraini government with FinFisher technology were [the activists] Mohammed, Jaafar, and Saeed, along with prominent Bahraini opposition politicians, democracy activists and human rights lawyers.

Privacy International believes that this alleged surveillance of Bahraini activists while in the UK constitutes an unlawful interception of communications under the UK's Regulation of Investigatory Powers Act 2000 -- the infamous RIPA -- and further argues that Gamma is "liable as an accessory under the Accessories and Abettors Act 1861 and/or encouraged and assisted the offence under the Serious Crime Act 2007." If this reasoning is accepted, it could create an important precedent, at least in the UK.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: activists, bahrain, finfisher, human rights, privacy, surveillance
Companies: gamma, privacy international

Privacy International Lodges Legal Challenge To Official Secrecy Surrounding GCHQ Spying

from the blanket-exemption dept

Although the scale of the surveillance being carried out by the NSA and GCHQ is daunting, digital rights groups are starting to fight back using the various legal options available to them. That's particularly the case for the UK, where activists are trying to penetrate the obsessive secrecy that surrounds GCHQ's spying activities. Back in December, we wrote about three groups bringing an action against GCHQ in the European Court of Human Rights (ECHR), and how Amnesty International is using the UK's Investigatory Powers Tribunal (IPT) to challenge the spying.

Another organization that filed a complaint against the UK government at the IPT is Privacy International. But not content with that, it has now taken further legal action, this time in order to obtain information about GCHQ's role in the "Five Eyes" system, the global surveillance club made up of the US, UK, Canada, Australia and New Zealand:

In order to shed light on this secret intelligence-sharing agreement, which effectively binds the Five Eyes as one intelligence agency, Privacy International, represented by Leigh Day & Co solicitors, filed a legal challenge against the British Government in the European Court of Human Rights. Europe's highest human rights court is the most appropriate venue for such an international agreement, and has a strong history of ensuring intelligence agencies are compliant with human rights law.

This follows repeated unsuccessful attempts to obtain this information using traditional channels:

The challenge comes after Privacy International filed Freedom of Information requests in all Five Eyes countries compelling them to release the details of the agreement, which has a profound impact on the enjoyment and fulfilment of human rights around the world. Governments in the US, UK, Canada, Australia, and New Zealand denied to publish the secret agreement. In the United Kingdom, GCHQ invoked a blanket exemption that excuses it from any obligation to be transparent about its activities. The same exemption was also invoked by the agency when Privacy International asked for mundane information such as GCHQ's cafeteria menu.

Privacy International obviously hopes that the ECHR will issue a judgment that the UK government is wrong to withhold the information about how GCHQ operates within the Five Eyes system. The trouble is, even if the ECHR does rule in favor of Privacy International, it's extremely unlikely that the UK government will take much notice. But as a way of ensuring that the spotlight remains on the disproportionate and unconstrained way that GCHQ is spying on citizens in the UK and around the world, it's as good as any.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: five eyes, gchq, human rights, lawsuit, privacy, surveillance
Companies: privacy international

Do Personal Computers Come With NSA Surveillance Devices Built-In As Standard?

from the tinfoil-hat dept

As Techdirt reported last year, one of the most bizarre episodes in the unfolding story of the Snowden leaks was when two experts from the UK's GCHQ oversaw the destruction of the Guardian's computers that held material provided by Snowden. As everyone -- including the Guardian's editor Alan Rusbridger -- pointed out, this was a particularly pointless act since copies of the documents were held elsewhere, outside the UK. The only possible explanation seemed to be that the UK government was trying to put the frighteners on the Guardian, and engaged in this piece of theater to ram the point home. But a fascinating blog post from Privacy International raises the possibility that there is another far more disturbing explanation:

GCHQ were not just interested in hard drives nor did they destroy whole devices. An examination of the targeted hardware by Privacy International, with cooperation from the Guardian, has found the whole episode to be more troubling and puzzling than previously believed.

During our investigation, we were surprised to learn that a few very specific components on devices, such as the keyboard, trackpad and monitor, were targeted along with apparently trivial chips on the main boards of laptops and desktops. Initial consultation with members of the technology community supported our identification of the components and that the actions of GCHQ were worth analyzing further.

In other words, GCHQ weren't trying to destroy the data -- which they, like everyone else, knew was completely futile. There were interested in "apparently trivial chips on the main boards of laptops and desktops." Specifically, these were the keyboard controller chip, the trackpad controller chip and the inverting converter chip. Privacy International provides more details:

From our analysis, we believe the targeted component of the keyboard is the keyboard encoder responsible for communicating over the USB and interpreting key presses on its various I/O pins.

...

We believe the targeted [trackpad] component is a serial flash chip that may perform a similar function to the keyboard controller also targeted. It is noteworthy that the device in question uses the controller board on the trackpad to also connect the keyboard to the main device.

...

The final component is an inverting converter, again used on the Apple MacBook Air systems.

Just over a year ago, only the most paranoid would have worried about the fact that the GCHQ sent two people to destroy these seemingly trivial components. But in the wake of Snowden's revelations about the astonishing range of technologies that the NSA has developed in order to infiltrate hardware systems -- things like radio transmitters built into USB leads -- the GCHQ's actions immediately raise a troubling thought: that most or all mainstream computers routinely contain various components that can be used to spy on us. As Privacy International concludes:

We will continue to explore the rest of the chips destroyed by GCHQ. We welcome any thoughts from individuals who have an understanding of these components and what their storage capabilities are, and for what purposes. We hope to achieve some much needed transparency about what our devices do and how the unseen components on the inside might betray our privacy.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: alan rusbridger, computers, destruction, gchq, inverting controller chip, keyboard controller chip, surveillance, trackpad controller chip
Companies: privacy international

Privacy Rights Group Files Legal Challenge To GCHQ's Extensive Hacking Activities

from the one-of-the-better-uses-of-normally-useless-anti-hacking-laws dept

Indispensable organization Privacy International has filed a legal challenge against GCHQ's hacking of computers and devices, seeking to use the UK government's own Computer Misuse Act against its national security agency.

Much like the (frequently maligned) CFAA (Computer Fraud and Abuse Act) here in the US, the CMA prohibits unauthorized access of computers as well as knowingly impairing computers and devices with malicious software. Privacy International argues that GCHQ (in conjunction with the NSA in many cases) has done both -- multiple times.

The extent of GCHQ's capabilities was revealed by the Snowden documents, which detail how GCHQ and NSA are using malware to conduct surveillance that is potentially far more intrusive than any other current surveillance technique, including the interception of communications. GCHQ's hacking capabilities are so advanced that they are able to surreptitiously:

• take over a device's microphone and record conversations taking place near the device (NOSEY SMURF);
• take over a device's webcam and snap photographs (GUMFISH);
• record Internet browsing histories and collect login details and passwords used to access websites and email accounts (FOGGYBOTTOM);
• log keystrokes entered into a device (GROK);
• extract data from removable flash drives that connect to an infected computer (SALVAGERABBIT);
• identify the geographic whereabouts of the user (TRACKER SMURF); and
• retrieve any content from a phone, including text messages, e-mails, web history, call records, videos, photos, address books, notes, and calendars.

Because the leaks have made these programs public knowledge, there's very little GCHQ can do to deny the claims. Instead, it will most likely invoke its "legal authority" to perform these acts, granted to it (albeit not in those specific words) by the UK's Intelligence Services Act of 1994, as PI's Caroline Wilson explains.

Section 5(1) of the ISA provides: “No entry on or interference with property or with wireless telegraphy [by GCHQ] shall be unlawful if it is authorised by a warrant issued by the Secretary of State under this section." In other words, so long as GCHQ is acting under a warrant then its interference with computer and mobile devices may be authorised under Section 5, even if its otherwise against the law.

This assertion rests on the presumption that these acts are always carried out under a warrant. And even if not, the broad reading of the law has allowed GCHQ to declare its operations are completely legal. The CMA itself also provides another loophole for GCHQ, nullifying the stipulations of Section 1 of the act if performed under government authority.

This may not look all that promising for Privacy International, but the UK can't rely solely on its own laws to protect GCHQ from this legal action. It also has to answer to the European Union.

[T]he law authorizing GCHQ's hacking must at the least set out the nature of the offenses that might lead GCHQ to intrude on our personal devices, define that categories of people who might be affected, limit the duration and extent of any intrusion, set out the procedure for examining, using and storing any information obtained, prescribe how that information will be secured and shared with other parties, and define when the data collected will be erased or destroyed. The ISA's bare bones authorisation most certainly does not meet these basic requirements.

[GCHQ's] hacking is so intrusive, giving GCHQ unlimited control over any target device, that it is hard to imagine how it could made proportionate [...] This intrusion is only compounded when it is indiscriminately deployed to potentially millions of devices.

Privacy International argues that it is the breadth of GCHQ's activities that make it run afoul of both UK and EU law. Leaked documents have shown several programs instituted under the title of anti-terrorism that have failed to prohibit abusive use or even hold the agency to a reasonable definition of "relevant." Much like the NSA, the capabilities have outstripped the narrowly-defined goal, providing the agencies with unprecedented levels of intrusion.

Privacy International has filed its complaint with the UK's Investigatory Powers Tribune, the only body with the power to hear challenges of GCHQ's activities. The legal authority GCHQ claims gives it the permission to sabotage and infiltrate computers on a widespread basis is far from clear. Much of what's been granted to the agency has been done in complete secrecy and, as the leaks have been unleashed, its oversight has been exposed as completely worthless.

This legal battle (joining others filed by citizens and Amnesty International) will also likely end up being fought in the dark, obscured by cries of "national security." But at least one of the combatants will be making an effort to publicize every detail of the fight.

Filed Under: cma, computer misuse act, gchq, lawsuit, surveillance, uk
Companies: privacy international