UK Tribunal Says Spy Agencies Illegally Collected Communications Data In Bulk For More Than A Decade

from the 17-years-of-bulk-rogering dept

A big ruling has been handed down by the UK's Investigatory Powers Tribunal, stating that intelligence agencies' (GCHQ, MI5, MI6) bulk data collection has been illegal since its inception.

The ruling said the regime governing the collection of bulk communications data – the who, where, when and what of personal phone and web communications – failed to comply with article 8 protecting the right to privacy of the European convention of human rights (ECHR) between 1998, when it started, and 4 November 2015, when it was made public.

It said the holding of bulk personal datasets (BPD) – which might include medical and tax records, individual biographical details, commercial and financial activities, communications and travel data – also failed to comply with article 8 for the decade it was in operation until its public avowal in March 2015.

This ruling comes at a particularly opportune time -- just as the UK government is putting the finishing touches on another investigatory powers bill: the so-called Snooper's Charter. But not necessarily because this will deter GCHQ from further bulk data collections. In fact, the ruling may give pro-surveillance politicians a better idea of how to make future collections stand up to legal challenges.

On the other hand, the tribunal's examination of the case uncovered some interesting statements by agency insiders who rather presciently noted the press would have a field day if information about the programs were ever made public. (The statement also shows the agency was prepared to head off backlash by questioning the media's truthiness.)

The IPT ruling included the disclosure from an unpublished 2010 MI5 policy statement that the “bulk personal datasets” include material on the nation’s personal financial activities. “The fact that the service holds bulk financial, albeit anonymised, data is assessed to be a high corporate risk, since there is no public expectation that the service will hold or have access to this data in bulk. Were it to become widely known that the service held this data, the media response would most likely be unfavourable and probably inaccurate,” it says.

The ruling is the end result of Privacy International's multiple legal challenges to British spying powers. Even though this is a win for PI, the charity also notes that no ruling was made on how the illegally-obtained datasets should be disposed of… or if they even will be.

The UK government responded to the ruling showing it had "overseen" more than a decade's-worth of illegal data collection with a cheerily tone deaf, "Things are so much better now!"

"The powers available to the security and intelligence agencies play a vital role in protecting the UK and its citizens. We are therefore pleased the tribunal has confirmed the current lawfulness of the existing bulk communications data and bulk personal dataset regimes.

Through the investigatory powers bill, the government is committed to providing greater transparency and stronger safeguards for all of the bulk powers available to the agencies."

It's not the stuff that's gone on for years. That's apparently not important. No, UK citizens need to keep their eyes on the prize: the ten months or so of legal spying UK intelligence agencies have been engaged in, as well as the eventual codification of other possibly-illegal surveillance programs.

Filed Under: gchq, investigatory powers tribunal, mass surveillance, privacy, surveillance, uk

UK Government Says Smart Meters Can Definitely Be Trusted Because GCHQ Designed Their Security

from the oh,-that's-OK,-then dept

The idea behind smart meters -- that detailed information about how you consume electricity will allow you to use power more efficiently and thus cut your bills and your home's carbon emissions -- is a good one in theory. And yet smart meters are still not used very widely, even in countries like the UK, where the government has a strategy to install millions of them by 2020. Actually, the likely savings by users are small, but smart meters also promise to allow the electricity industry to lower salary costs by carrying out meter readings remotely, which is one reason why it is so keen on the idea. Another is because smart meters make it is easy to cut off someone's supply if they don't pay their bills.

The slow uptake of smart meters seems in part to be due to public concerns about security. People are worried that their smart meter will spy on them, sending back information to electricity companies that might be intercepted and used for targeted burglary when they are away. Similarly, there are fears that if the smart meter control system were compromised, domestic electricity supplies might be at risk on a large scale.

One of UK Parliament's most important committees, the one monitoring science and technology, has just published a report into the UK smart meter roll-out, offering recommendations for ways to speed it up. Security is an issue it discusses, and one of the committee's recommendations is as follows:

We recommend that the Government consider further how to communicate the level of thought that has gone into designing a secure system for smart metering

More about that "level of thought" is found in an appendix to the report, which contains the UK government's evidence on this topic, including the following statement:

The Department of Energy and Climate Change (DECC) has worked with GCHQ since the very early design stage of the rollout, when the programme was initiated. The engagement with GCHQ has been one of partnership, issue discussion and resolution.

Helpfully, GCHQ has written a long and interesting description of its work on smart meters, and how it has tried to make UK smart meters resistant to attack. The post concludes:

We hope that this article has explained the thinking behind the design of the Smart Metering System. DECC, with support from GCHQ (part of which will be become the National Cyber Security Centre) has security right at the top of the list of things it cares about. Of course, no system is completely secure, and nothing is invulnerable. However, we’re confident that the Smart Metering System strikes the best balance between security and business needs, whilst meeting broader policy and national security objectives.

It's interesting that the post mentions national security objectives. As Techdirt has reported, one of the worst features of the UK's Investigatory Powers Bill that is currently wending it way through Parliament is that it creates a legal framework to allow GCHQ and the other intelligence agencies to hack into any kind of equipment in order to carry out surveillance. Of course, that's really rather easy when you were the one who designed its security systems.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: gchq, security, smart meters, surveillance, trust, uk

UK's GCHQ Takes A Page From China, Plans To Build A Great British Firewall

from the well,-that's-just-dandy dept

Generally speaking, taking cues from China on things like best ways to censor the internet... probably isn't the best idea. Yet, it appears that's exactly what the UK's big surveillance agency, GCHQ is doing. The "Director-General of Cyber" (that's a thing? yikes!) at GCHQ, Ciaran Martin, gave a speech at a cybersecurity summit in DC recently and announced exciting plans to censor the UK internet at a DNS level. No, really.

Finally, we're exploring a flagship project on scaling up DNS filtering: what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses? Now it's crucial that all of these economy-wide initiatives are private sector led. The Government does not own or operate the Internet. Consumers must have a choice. Any DNS filtering would have to be opt out based. So addressing privacy concerns and citizen choice is hardwired into our programme.

Of course, while the reasoning and sentiment may sound good, we've pointed out time and time again how DNS filtering, in particular is a really bad idea that actually does more harm than good for internet security. The internet works under the expectation that when you put in an address, the DNS system returns with info from the proper server.

And, of course, once you start mucking with the DNS system for filtering out stuff that you consider to be "malware" or "bad addresses" you open it up to much worse. You also end up validating China's Great Firewall, since China just responds that their use of DNS filtering is also used to block "bad addresses." It's just that they have a different interpretation of what's "bad."

Filed Under: ciaran martin, dns, filter, firewall, gchq, great british firewall, great firewall, uk

Scottish Law Enforcement Also Apparently Hooked Up To NSA/GCHQ's Data Firehose

from the metadata-on-everyone...-for-everyone! dept

The fun thing about leaked documents is that they almost always reveal something more than just the focal point. The leaked reports that showed British intelligence agencies to be drowning in data also exposed a previously hidden part of the UK intelligence apparatus.

The documents confirm that a little-known policing body called the Scottish Recording Centre (SRC) was given access to information logs that includes millions of communications data including phone activity, internet histories, and social media behaviour on Facebook.

The confirmation that UK state spy agency GCHQ ran a specific programmed, called “MILKWHITE”, to share data with devolved policing and tax authorities is the first Snowden leak to directly implicate Scottish authorities in the controversial policy of ‘bulk data’ collection.

And just like that, the "obscure Scotland-based surveillance unit" is no longer obscure. It's safe to say most of Scotland's citizens were unaware of its existence until the latest revelations. While there's probably only been a small bump in general public awareness, it has mobilized activists and given them the ammo they need to question their representatives.

Richard Haley, chair of human rights group Scotland Against Criminalising Communities, has said that the SRC raises “very serious questions”.

Haley asked: “The Scottish Recording Centre might be unknown to most of us, but the Scottish Government must be familiar with it because of its role in legally authorised interception. Did the Scottish Government know of its involvement in MILKWHITE? If not, why not? And if they did, why didn't they sound the alarm? And for that matter, what is the Scottish Recording Centre? A real set of offices and computers, or just an organisational concept?”

Haley and others are seeking answers. They likely won't be getting them any time soon. The Police Service of Scotland -- which partakes of the SRC data haul -- says it won't discuss "intelligence matters." GCHQ added its own boilerplate in response, stating it also won't discuss "intelligence matters," and that everything it does is subject to multiple legal authorities and strict oversight: two claims leaked documents keep refuting.

Those claims are even refuted within this article about the leaked documents. Michael Gray of CommonSpace points out that the Police Service of Scotland previously spied on communications between journalists in violation of the law. The service has also been linked to targeting of political activists -- none of which sounds particularly "lawful," much less "authorised, necessary, and appropriate," to borrow a phrase from GCHQ's non-comment.

Filed Under: gchq, mass surveillance, nsa, scotland, surveillance

Communications Show GCHQ's 'Oversight' Talking Itself Out Of Performing Any Sort Of Oversight

from the so...-what-do-you-spies-think-we-should-do-about-all-this-spying? dept

New documents obtained by Privacy International as a result of its ongoing litigation over GCHQ bulk surveillance shows (yet again) there's really no such thing as "oversight" when it comes to spying. Owen Bowcott of The Guardian highlights conversations between GCHQ and its supposed oversight, in which the former talks the latter out of applying more restrictive guidelines from updated laws to its massive data intake. (Unfortunately, Bowcott discusses the documents but does not link to them, and I have been unable to locate these at Privacy International's website. Found 'em.)

The letters were sent by Home Office legal advisers, GCHQ and Sir Swinton Thomas, who was the interception of communications commissioner. The organisation is now called the Interception of Communications Commissioner’s Office (IOCCO).

In May 2004, a Home Office legal adviser wrote to Thomas backing an MI5 proposal that collecting bulk data from communication service providers for its “database project” be authorised under section 94 of the 1984 Telecommunications Act because, at that stage, there were no human rights implications or breach of privacy concerns. Using that act would not require a notice to be put before parliament because it could be used secretively on the grounds that “disclosure of the direction would be against the interests of national security”.

Thomas briefly tried to act as an overseer, suggesting the GCHQ would be on firmer legal footing if it applied a more-updated law to its collection practices: the Regulatory of Investigatory Powers Act of 2000. Because this newer law contained more procedural safeguards and additional transparency requirements, GCHQ was obviously uninterested in applying this to its bulk collections.

The UK Home Office got involved at this point, claiming the newer law was not really a law at all, but collated stack of suggestions.

The Home Office responded, saying that, although Ripa might be engaged, it did not think that meant it must be used. The letter continued: “The only practical difference between the two sets of provisions is if [Ripa] were used, a new notice would need to be issued every month … involving a fresh consideration of the necessity and proportionality issues. This would not be the case under section 94 [of the Telecommunications Act].”

Yeah, why bother periodically reassessing "necessity and proportionality" of orders when you can issue one order and have it apply indefinitely? GCHQ also expressed its concern about using the new law, saying it wanted to keep all of its collections in one big pile, even if that meant intermingling minimized and unminimized data.

Its oversight reluctantly agreed.

Thomas backed down, replying that, “on reconsideration”, use of Ripa was not mandatory. He added: “I am also impressed by the considerable and, if possible to be avoided, inconvenience in following the [Ripa] procedure in the database procedures.”

And, just like that, any protections UK citizens might have gained from the 2000 version of RIPA were waved away in the interest of bulk collection convenience. This conversation every appearance of someone raising an issue in hopes of being talked out of it and expressing relief when this was accomplished. For UK citizens, this meant that GCHQ could collect both minimized data (anonymized by stripping of identifying info) and unminimized data and mix it all together in its storage, thereby nullifying the protective minimization methods.

It is, as Privacy International states, a "total failure" of oversight. There's no evidence that the Home Office or the IOCCO ever acted in an adversarial fashion. Both appear to have cut GCHQ as much slack as it needed to avoid having to adhere to an updated law written explicitly to regulate investigatory powers. Instead, they both allowed GCHQ to avail itself of lower legal requirements by applying a 20-year-old law -- one that could not have possibly anticipated the exponential surveillance growth in the intervening years -- to its post-2001 bulk surveillance.

Filed Under: gchq, oversight, surveillance, uk

Spies In Denial: GCHQ Boss Says Snowden Didn't Kick Off Debate Over Surveillance

from the you-look-foolish dept

For all the idiotic things said about Ed Snowden, at least US bureaucrats appear to have come around to the idea that he helped kick off a necessary debate on surveillance powers and privacy. Just recently we had former Attorney General Eric Holder admit that Snowden "performed a public service by raising the debate." And regular surveillance apologist and former Defense Department lawyer Jack Goldsmith just said that "Snowden forced the intelligence community out of its suboptimal and unsustainable obsession with secrecy."

It appears that some of their counterparts in the UK are still in denial about all of this. GCHQ's boss Robert Hannigan, whose currently on a PR charm offensive (or should that be just offensive PR?) insists that Snowden has nothing to do with the ongoing debate, which he says was happening prior to Snowden leaking documents:

No, Edward Snowden had not sparked a global debate about privacy - that had been under way already - but terrorist targets GCHQ had been tracking had learned from his revelations with heavens knows what consequences, he said.

This is delusional, and calls into question whether or not the GCHQ has management that lives in reality or in a fantasy land. As someone who has followed this issue since well before the Snowden leaks, to argue that the debate was happening in any real way prior to them being splashed across the press is a flat out lie. You can disagree with what Snowden did -- as Hannigan clearly does. But to argue that the revelations did not spark the debate is clearly wrong.

As for the latter part of Hannigan's claim, that terrorists learned stuff from the Snowden documents that created "heaven knows what consequences," that's a load of bunk also. Actual studies showed basically no change in behavior by terrorists post-Snowden, as many already assumed that their basic communications were being tracked. And no one has yet to demonstrate any legitimate consequences from his revelations other than forcing people like Hannigan to have to answer questions about why the GCHQ and NSA seem to be spying on tons of people.

If this new PR campaign is about rebuilding trust in the GCHQ, Hannigan might want to recognize that spewing pure bullshit doesn't make people trust him more. It makes them trust him a lot less.

Filed Under: debate, ed snowden, gchq, robert hannigan, surveillance

Snowden Docs Show GCHQ, MI5 To Be All Haystack, No Needle

from the collections-so-bulky-they're-practically-immobile dept

"Collect it all," they said. "You can't find needles without haystacks," they proclaimed. "The more you know," they rainbowed. All well and good, except the NSA, GCHQ, et al. appear to have far more in common with the protagonists of "Hoarding: Buried Alive" than with effective, finely-tuned terrorism-fighting machines.

New documents from the Snowden stash show the UK's intelligence agencies love piling data on top of data, but seemingly have no idea how to utilize this massive haul.

MI5 “can currently collect (whether itself or through partners …) significantly more than it is able to exploit fully,” the report warned. “This creates a real risk of ‘intelligence failure’ i.e. from the Service being unable to access potentially life-saving intelligence from data that it has already collected.”

A followup report from a month later echoed these concerns:

“There is an imbalance between collection and exploitation capabilities, resulting in a failure to make effective use of some of the intelligence collected today,” the report noted. “With the exception of the highest priority investigations, a lack of staff and tools means that investigators are presented with raw and unfiltered DIGINT data. Frequently, this material is not fully assessed because of the significant time required to review it.”

This isn't just an MI5 problem. And it's not just a bulk surveillance problem. GCHQ uses the same "data broker" -- a program called PRESTON, run by the National Technical Assistance Center, which is supposed to act as a go-between for intelligence agencies in order to prevent the siloing of data. But it doesn't work. It has prevented agencies from walling each other off, but the info firehose is still too much for agencies to handle -- even with more-targeted surveillance.

Targeted collections fare little better than the bulk collections, in terms of needle location. The following chart shows how much data goes unutilized in cases where suspects are known and targeted with individualized warrants.

From the 2009 report detailing these problems:

[I]n one six-month period, the PRESTON program had intercepted more than 5 million communications. Remarkably, 97 percent of the calls, messages, and data it had collected were found to have been “not viewed” by the authorities.

Despite this failure to fully use the collections they already have, UK intelligence agencies are asking the government to give them more, supposedly to capture the "growing range of services available to internet users." But they've already shown they can't handle the data they already collect. Piling more hay on the stacks is only going to allow more "needles" to escape the attention of analysts. One solution would be to throw more people at the problem, but even this might cause its own issues, as every intelligence agency is increasingly wary of becoming the temporary home of the next Snowden. Vetting procedures have ramped up and security clearances have been scaled back.

More judicious collections are a better answer, but intelligence agencies -- just like many of the internet users they track -- apparently suffer from Fear of Missing Out. But an examination of their current collections/analysis shows they're "missing out" already, and expanded powers/collections would do nothing to better secure the nation. In fact, these reports show the more they collect, the less they know.

Filed Under: gchq, haystacks, information overload, mass surveillance, mi5, needles, surveillance

Investigation Shows GCHQ Using US Companies, NSA To Route Around Domestic Surveillance Restrictions

from the introducing-MS-Loophole-365! dept

Late last year, UK Parliament members held an "emergency debate" over the GCHQ's surveillance programs after learning that [gasp] their data and communications could be legally hoovered up as if they were mere commoners. Of course, were there any actual oversight of GCHQ's activities, this shock would have been blunted by years of foreknowledge. But the GCHQ, like other intelligence agencies, preferred to keep its overseers in the dark about its access to the NSA's PRISM firehose.

The mortified Parliament members claimed the GCHQ's decision to include them in its data haul violated a long-held "gentlemen's agreement" between the two entities -- one that had no legitimate legal basis. Supposedly, this "agreement" forbade GCHQ from targeting Parliament members for surveillance. (Any incidental collection was considered unavoidable.) A panel review found GCHQ's targeting of Parliament members to be completely legal, if a bit on the rude side.

Duncan Campbell and Bill Goodwin of Computer Weekly have performed their own examination of MP's communications, finding that both GCHQ and the NSA have access to intercepted emails sent to and from Parliament members, including communications with their constituents.

GCHQ wouldn't normally have access to these emails as it is not supposed to be collecting information about purely domestic communications. But thanks to the software Parliament uses and the location of data centers used to route the emails, it can comply with its surveillance restrictions while still collecting email data/communications sent from UK email addresses to other UK email addresses.

Part of the process involves Microsoft's willing assistance in past domestic spying efforts, which preceded both Snowden's document dumps and its current, more combative stance.

The controversial decision by Parliament to replace its internal email and desktop office software with Microsoft’s Office 365 service in 2014, means that parliamentary data and documents constantly pass in and out of the UK to Microsoft’s datacentres in Dublin and the Netherlands, across the backbone of the internet.

Computer Weekly performed forensic analysis of emails it had received from MPs, using header info to trace its path across the internet. It found that nearly two-thirds of "domestic" emails actually left the country on their way to local email addresses, allowing GCHQ -- through its "Tempora" program -- to intercept data and communications using its NSA-provided PRISM hookup.

Microsoft's above-and-beyond assistance makes its widely-used Office products a valuable contributor to the agencies' data haul.

The NSA’s Prism system offers access to all parliamentary documents and email through Microsoft Office 365 software, as a result of secret directives given to Microsoft under controversial US 2008 surveillance laws. The directives were implemented at the same time as Microsoft was selling its cloud system, Office 365, to the Houses of Parliament.

Post-Snowden, Microsoft is far more reluctant to continue acting as Little Brother. As Computer Weekly points out, leaked documents have led to the company's hasty erection of two UK data centers in order to protect its UK users from GCHQ's exploitation of normal communication routing techniques to bypass restrictions on domestic surveillance.

Microsoft isn't the only US company assisting the UK intelligence agency in its harvesting of domestic data/communications.

Computer Weekly’s investigation also confirmed that MPs’ incoming and outgoing emails are automatically scanned through a network run by MessageLabs, a subsidiary of another US corporation, Symantec, which has been contracted by Parliament to provide services including spam filtering and malware detection.

MessageLabs provides GCHQ with direct access to parliamentary emails, through a secret cyber security network called Haruspex, according to GCHQ’s “Cyber Defence Operations” legal policy instructions disclosed by Edward Snowden. The scanning system has been in operation for at least a decade.

MessageLabs scans for keywords to prevent the circulation of spam and malware. But it also can be configured to flag other terms and return those results to intelligence agencies.

Once again, officials are not amused their positions do not exclude them from GCHQ surveillance.

Labour deputy leader Tom Watson MP told Computer Weekly: “This will shock many of my parliamentary colleagues and provides a further illustration of why it is right for the government to give additional protections in law to MPs, lawyers and journalists. Theresa May has the opportunity to do this during the passage of the IP Bill in Parliament.”

There's a nice nod to a few other citizens not in elected positions contained in that statement, but there needs to be a solid, unified push from UK legislators during the debate over the Investigatory Powers Bill if this domestic surveillance loophole is going to be closed. As Computer Weekly notes, amendments have been made to the bill which prevent law enforcement agencies from accessing MPs' communications data, but that concession would not apply to GCHQ.

Filed Under: gchq, internet, nsa, parliament, surveillance, uk

Practical Applications For Massive Surveillance Databases: Timely Birthday Cards, Travel Diaries

from the the-ultimate-vanity-search-engine dept

If you want to get a feel for the gobsmacking amount of information being collected by UK surveillance agencies (MI5, M16, GCHQ), all you have to do is see how it's being misused. Privacy International, which has been steadily suing the UK government over domestic surveillance, has received another set of documents that show the banality of dragnet surveillance evil. The banality is not so much the dragnet itself (although that's not to say it isn't its own form of evil) as it is the uses it's put to.

Ryan Gallagher, writing for The Intercept, points out that spies are using surveillance collections as backup Day-Timers -- apparently with enough frequency they've had to be warned to knock it off.

The documents include internal guidance codes for spies who have access to the surveillance systems. One memo, dated June 2014, warns employees of MI6, the U.K.’s equivalent of the CIA, against performing a “self-search” for data on themselves, offering a bizarre example that serves to illustrate the scope of what some of the repositories contain.

“An example of an inappropriate ‘self search’ would be to use the database to remind yourself where you have traveled so you can update your records,” the memo says. “This is not a proportionate use of the system, as you could find this information by another means (i.e. check the stamps in your passport or keep a running record of your travel) that would avoid collateral intrusion into other people’s data.”

The information collected includes data that could reveal political preferences, sexual orientation, religious beliefs, memberships in associations or groups, mental/physical health along with biometric data and financial documents. With a little digging, the massive database could be used to uncover journalists' sources and privileged communications.

The wealth of information at the fingertips of British spies helps explain why they never seem to forget important dates.

“We’ve seen a few instances recently of individual users crossing the line with their database use, looking up addresses in order to send birthday cards, checking passport details to organise personal travel, checking details of family members for personal reasons…"

The world's greatest search engine isn't Google. It's GCHQ. Of course, the documents also point to various levels of oversight, none of which appear to have much of a deterrent effect. A monitoring system of some sort appears to be in place and it's likely what flagged agents' self-searches. But it's unlikely to catch other inappropriate searches involving someone other than the person performing the search. These, too, are forbidden, but it's likely these violations were part of a pattern of sustained abuse, rather than one-off searches -- which would likely have slipped under the radar as being just another intelligence-related search.

What's worse is access to these vast data stores apparently went oversight-free for several years, and it's not entirely clear from what's been released that comprehensive oversight is even in place at this point in time.

One 2010 policy paper from MI6 states there is “no external oversight” of it or its partners’ “bulk data operations,” though the paper adds that this was subject to review.

This may not seem completely terrible -- after all, six years government time is like 30 days real time -- until you realize the GCHQ has data sets dating back nearly 20 years (harvesting began in 1998) and MI5's bulk collection is more than a decade old at this point. And it continues onward, getting more massive by the moment. The GCHQ wants to collect 50 billion records every day, utilizing people's web browsing, phone calls, and email. While the agencies insist this is all for fighting terrorism and international crime, the cold reality is that it's just as useful for reconciling travel expenses and making sure Mom always gets her birthday card on time.

Filed Under: abuse, gchq, mi5, mi6, privacy, surveillance

Destroying Reputations And Hacking Elections For Fun And Profit

from the coming-to-a-presidential-candidate-near-you dept

Although rather forgotten now, one of the most troubling Snowden revelations appeared in 2014, and concerned GCHQ's "dirty tricks" group known as JTRIG -- the Joint Threat Research Intelligence Group. Put simply, its job is to "manipulate, deceive and destroy" reputations. Of course, it would be naïve to think that GCHQ is alone in using these techniques. We can safely assume all the major spy agencies engage in similar activities, but what about other players? To what extent might ambitious politicians, for example, be using these dirty tricks to slime their opponents -- and to win elections unfairly?

If a long and fascinating feature in Bloomberg is to be believed, the outcome of presidential elections in Nicaragua, Panama, Honduras, El Salvador, Colombia, Mexico, Costa Rica, Guatemala, and Venezuela were all influenced and possibly even determined by the work of one man, a certain Andrés Sepúlveda, using similar methods to those employed by JTRIG. It's a great story, and well-worth reading in full. What follows are some of the details that are likely to be of particular interest to Techdirt readers.

Sepúlveda began on a modest scale:

For $12,000 a month, a customer hired a crew that could hack smartphones, spoof and clone Web pages, and send mass e-mails and texts. The premium package, at $20,000 a month, also included a full range of digital interception, attack, decryption, and defense.

Eventually, he hit the big time. For $600,000 Sepúlveda is alleged to have helped elect Peña Nieto as the Mexican President in 2012:

He led a team of hackers that stole campaign strategies, manipulated social media to create false waves of enthusiasm and derision, and installed spyware in opposition offices, all to help Peña Nieto, a right-of-center candidate, eke out a victory.

His team varied from seven to 15 people, and came from all over Latin America:

Brazilians, in his view, develop the best malware. Venezuelans and Ecuadoreans are superb at scanning systems and software for vulnerabilities. Argentines are mobile intercept artists. Mexicans are masterly hackers in general but talk too much. Sepúlveda used them only in emergencies.

Money was no problem:

At one point, Sepúlveda spent $50,000 on high-end Russian software that made quick work of tapping Apple, BlackBerry, and Android phones. He also splurged on the very best fake Twitter profiles; they’d been maintained for at least a year, giving them a patina of believability.

But in many ways, Sepúlveda's most powerful tool was not digital technology, but his understanding of how digital technology had re-shaped the political landscape:

His insight was to understand that voters trusted what they thought were spontaneous expressions of real people on social media more than they did experts on television and in newspapers. He knew that accounts could be faked and social media trends fabricated, all relatively cheaply. He wrote a software program, now called Social Media Predator, to manage and direct a virtual army of fake Twitter accounts. The software let him quickly change names, profile pictures, and biographies to fit any need. Eventually, he discovered, he could manipulate the public debate as easily as moving pieces on a chessboard -- or, as he puts it, "When I realized that people believe what the Internet says more than reality, I discovered that I had the power to make people believe almost anything."

Of course, that's true not just for Latin America, but pretty much everywhere else too. Which inevitably raises the following:

On the question of whether the U.S. presidential campaign is being tampered with, he is unequivocal. "I’m 100 percent sure it is," he says.

Sepúlveda has no reason to lie. After all, he's not looking for work anymore:

He's serving 10 years in prison for charges including use of malicious software, conspiracy to commit crime, violation of personal data, and espionage, related to hacking during Colombia's 2014 presidential election.

So the issue is probaby not so much whether dirty tricks of the kind described above are being deployed against US presidential candidates, but rather: by whom, to what end, and with what effect?

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: colombia, costa rica, el salvador, gchq, guatemala, jtrig, mexico, venezuela