Italian Spyware Company Execs Arrested After Company Employees Spied On Innocent Citizens

from the power-and-responsibility-once-again-decoupled dept

Any tool that gives people access to tons of personal data will be abused. Law enforcement databases are routinely misused by government employees. Ring -- law enforcement's favorite consumer home product -- collects tons of data about its customers and this data has been inappropriately accessed by Ring employees.

The perfect storm of illicit surveillance and snooping comes from companies that sell spy tools to law enforcement but retain control of the servers where the personal data and communications are stored. An Italian developer, Diego Fasano, followed up his successful medical records app with something far more troubling: law enforcement spyware deployed with the aid of service providers.

The concept behind the company’s product was simple: With the help of Italy’s telecom companies, suspects would be duped into downloading a harmless-seeming app, ostensibly to fix network errors on their phone. The app would also allow Fasano’s company, eSurv, to give law enforcement access to a device’s microphone, camera, stored files and encrypted messages.

Fasano christened the spyware “Exodus.”

The software was popular. Prosecutors all over Italy bought Fasano's product. So did Italy's NSA, L'Agenzia Informazioni e Sicurezza Esterna. There's no telling how much the government slurped from targets' phones over the years, but one prosecutor discovered the truth about eSurv's operations on accident. The information harvested by investigators wasn't walled off from the internet, only accessible by the prosecutor's office. It was accessible to anyone with the right credentials, stored thousands of miles away.

The Naples prosecutor began a more in-depth probe—and found that eSurv had been storing a vast amount of sensitive data, unencrypted, on an Amazon Web Services server in Oregon.

The data included thousands of photos, recordings of conversations, private messages and emails, videos, and other files gathered from hacked phones and computers. In total, there were about 80 terabytes of data on the server—the equivalent of roughly 40,000 hours of HD video.

This meant eSurv employees -- at least the "Black Team" running eSurv's "Exodus" project -- could also access these recordings. There's no evidence (yet) that they did or that this very valuable stash of law enforcement intel was ever exfiltrated by hackers. But the fact remains law enforcement agencies did not have control of their harvested surveillance.

This would have been a tempting stash of personal info for eSurv employees to dip into. But they didn't. They didn't have to because they were already deploying their malware to intercept communications and exfiltrate data from Italian citizens who had been tricked into installing eSurv's malicious, telco-miming apps.

In one instance, the Black Team hacked the phone of a 49-year-old woman from Crotone, a port city on the coast of Calabria, according to the prosecutor’s filings. The team collected the woman’s personal text messages to family and friends, and covertly recorded more than 3,800 audio clips using her mobile phone’s built-in microphone, chronicling the woman’s life and interactions as she went about her daily business, the filings say.

In all, the Black Team spied on more than 230 people who weren’t authorized surveillance targets, according to police documents. Some of the surveillance victims were listed in eSurv’s internal files as “The Volunteers,” suggesting they were unwitting guinea pigs.

A court has already stated the company's product was "designed and intended.. to operate with functions that are very distant from the canons of legality." That should be an indictment of the law enforcement agencies who purchased it as well, but somehow it isn't. The proper paperwork may have been filed and approved by judges, but the spyware relies on cell service providers deceiving customers so malware can be implanted through fake apps.

If the company has abused it tools, it's safe to say some of eSurv's customers have as well. For now, it's only eSurv's principals being investigated. But it does highlight the danger this malware poses, even when it's supposedly only being used for good.

Filed Under: diego fasano, employees, exodus, italy, spyware, surveillance
Companies: esurv

Open Source Makes Kodi Add-ons Proliferate -- And Hard To Eradicate

from the welcome-to-the-hydra-effect dept

As Techdirt noted a year ago, the entertainment industry has been trying to convince the authorities around the world that "fully-loaded" Kodi boxes, which allow the viewing of unauthorized video streams, are the devil's spawn, and must be eradicated. That obsession has led to efforts to stop even vanilla Kodi boxes being promoted and sold, despite the fact that the open source software they run is perfectly legal. TorrentFreak has a report about the latest salvo in this war on Kodi, and its interesting consequences.

It concerns a third-party Kodi add-on called "Exodus", which, like many others, allowed unauthorized streaming videos to be viewed with little effort. The excellent design and resulting popularity of Exodus meant that it was soon targeted by copyright companies. The pressure worked, and the development of the add-on was halted, leaving millions of happy users somewhat less happy. But Exodus had an important hidden feature: it was released under an open source license. That meant that anyone could pick up the code and continue its development independently of the original, without needing to ask permission from anyone. As TorrentFreak points out, that is precisely what has happened, and on a surprisingly large scale. The TVAddons site recently published an article that discusses 12 forks of Exodus, which is only part of the Exodus ecosystem: "Too many Exodus forks are out there to investigate them all."

This "hydra" effect -- chop off one head, and two grow in its place -- makes eliminating open-source add-ons for Kodi extremely difficult. Although individual developers may be persuaded to stop working on a particular fork, the code is still out there, and can easily be maintained and improved by others. Since the latter can be anywhere in the world, that makes shutting them down even harder. However, TorrentFreak rightly notes that this doesn't mean that the efforts of the copyright companies are entirely in vain:

the continued efforts from rightsholders to shut down these add-ons may have a more subtle effect. While hardcore pirates will always find a new fork, there's also a group of people who will get frustrated by the repeated shutdowns, and give up eventually.

That's certainly true, but it's not an insurmountable problem. For example, it would be straightforward for developers to create a common standard for key aspects of their add-ons that would allow simple switching between them. That way, once one add-on was shut down, non-technical users could migrate easily to new ones, perhaps even automatically. When the code is open source, there is no problem with proprietary rights being asserted over programming modules or configuration files -- another reason why developers may decide to adopt it when writing Kodi add-ons.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: add-ons, exodus, hydra, kodi, open source

Heavy Metal Lyrics Posted To Facebook Result In Arrest For Terrorist Threats

from the so,-unfriending-just-isn't-harsh-enough? dept

Maybe the time has come for Facebook to implement a [Not a Threat] tag to go with its new [Satire] tag. That way, precious law enforcement resources won't be expended hunting down and arresting someone who really isn't threatening anyone.

WFIE 14 News is reporting that 31-year-old James Evans of Muhlenberg County, Kentucky was arrested on terroristic threatening charges after he posted lyrics from a song by the heavy metal band Exodus on Facebook. On August 24, Evans posted the following quote from the song “Class Dismissed (A Hate Primer)”, “Student bodies lying dead in the halls, a blood splattered treatise of hate. Class dismissed is my hypothesis, gun fire ends [the] debate.” Shortly thereafter, he was taken into custody by authorities under the rationale that his posting constituted a threat “to kill students and or staff at school,” according to his arrest warrant.

Evans ended up spending 8 days in jail for exercising his First Amendment rights. Terroristic threat charges haven't been dropped but his case has been deferred for six months. He's also been ordered to undergo a mandatory mental health evaluation -- all for posting lyrics written by someone else.

According to Evans, even some of the officers he spoke to felt there was no reason he should have been arrested. But the statement made by (why?) the county's school resource officer seems to indicate this response was perfectly justified. Resource officer Mike Drake said "multiple agencies" received calls about Evan's post. When you have multiple complainants babbling about school shootings, you really can't just sit around the precinct doing nothing. What you can do, however, is get a little context before booking someone on criminal charges. Turning someone into a criminal simply because they showed a little lack of judgement isn't the appropriate response. Beyond that, there's the First Amendment -- which doesn't cover actual threats but definitely protects stuff a bunch of people mistakenly viewed as a threat.

Filed Under: exodus, first amendment, free speech, james evans, lyrics, social media