GCHQ and UK Mass Surveillance Chapter 2 2 Invasive collection: active signals development 2.1 Introduction In the previous section, we looked at how we all generate data by using the Internet, phones, apps and even wearable technology, and how the NSA and GCHQ collect anything that passes through wires or the ether. But the agencies gather even more information through a range of intrusive techniques to extract data from machines that the agencies call Active Signals Intelligence. Interference with equipment is not new. GCHQ has always carried out clandestine operations. During the 1950s and 60s it was routine to try to plant listening devices in foreign embassies and other targets as part of the Cold War.i UK legislation allows agencies to obtain authorisation to carry out this kind of “equipment interference”. Most people will broadly understand operations targeting clear military, diplomatic or security objectives; for example, hacking into a terrorist phone, possibly even the tapping of a cable feeding the part of the city where a foreign embassy is located. But the Snowden documents show that in recent times these activities have evolved into something else. For a start, the capability to carry out some such attacks in the digital age will rely on softening the infrastructure of the Internet, by weakening widely used security systems, which can have consequences for all of our online safety. In addition, there is now evidence that the agencies develop hugely complex operations that target a very broad range of organisations and individuals, including innocent civilians, in order to get to their target. Finally, the scale of the potential activities has grown excessively. The NSA and GCHQ are able to target millions of computers. Termed Computer Network Exploitation, the agencies are building a global machine capable of hacking on an industrial scale. In the previous section we saw how passive state surveillance has become massive and nowadays affects not just terrorists, diplomats and high tech companies, but everyone who uses modern communications. Here we explain how the active and more invasive aspects have also expanded to potentially affect every one of us. It is hard to imagine that the programmes are under effective control. 1 of 21 GCHQ and UK Mass Surveillance 2.2 Documented examples of attacks 2.2.1 Belgacom and German satellite businesses The Belgian telecommunications company, Belgacom, was targeted by GCHQ from 2010 in order to gain access to important international telecommunications infrastructure.ii This is the first documented government-sponsored cyberattack of one EU member state on another.iii Belgacom operates an important mobile phone roaming exchange that enables travellers to use their handsets in other countries. This was the main objective of the attack, but GCHQ also planned to access the company's international cables. Thanks to this attack, GCHQ had potential access to the communications of all European institutions based in Brussels, although there is no documented evidence that these were targeted in this wayiv. Operation Socialist, as GCHQ codenamed it, began by creating fake LinkedIn webpages in order to infect the computers of individual Belgacom engineers with malicious software. The software infections eventually reached the core of the company's internal network, and even now it is unclear whether their systems have been completely cleaned. The malicious software (malware) used in the attack has been identified as a very sophisticated programme called Regin, also found on European Union computers targeted by the NSA.v The software has been compared to the infamous Stuxnet virus, used against the 2 of 21 GCHQ and UK Mass Surveillance Iranian nuclear programme, which was called by Wired magazine “the world's first digital weapon”vi. There is currently a criminal investigation in Belgium into the attack, but both the Belgian Government and the company itself seem keen to hush up such an embarrassing diplomatic incident. 2.2.2 Gemalto SIM Card In another well documented case, GCHQ attacked the Dutch company Gemalto, a major manufacturer of SIM cards used in mobile phones worldwide. The aim of the hacking operation was to steal encryption keys for mobile phones.vii Encryption keys are only needed to intercept mobile traffic between the handset and the station, as that is the only moment when it is encrypted. Once the conversation enters the main telephony system it travels without encryption and could be harvested through one of many corporate partnerships. This indicates that the objective was targeted interception.viii The documents also state that the agencies targeted other SIM card providers, and were unsuccessful that the time. But it is not know whether those were infiltrated at a later date. 3 of 21 GCHQ and UK Mass Surveillance 2.2.3 Telecommunications companies GCHQ has also attacked German providers of satellite data services: IABG, Cetex and Stellar.ix The joint NSA-GCHQ operation targeted exchange points linking satellites with the broader Internet, and identified ‘important’ customers of the German providers. According to leaked documents, in 2013 the NSA had obtained legal authorisation under the FISA court system to monitor “Germany”. It is unclear what the legal basis is for the British participation in the attacks. The NSA and GCHQ also infiltrated several global telecom companies including German providers in order to gain access to the data flowing over their networks.x The aim was to produce intelligence on the architecture of the Internet in order to prepare other interventions. The attacks involved targeting individual employees of the companies. 2.2.4 TOR GCHQ has a programme called EGOTISTICAL GIRAFFE that targets the TOR anonymous communications network.xi TOR “The Onion Router” is instrumental in enabling hundreds of thousands of political dissidents to access the Internet anonymously, and thus communicate without fear of repercussions in places like Iran and China. It is also increasingly used by regular Internet users in Western countries wishing to avoid snooping by commercial Internet companies. The development of TOR has been substantially financed by the US government.xii TOR has recently come to prominence because its capacity to provide security and anonymity has also been used by criminals, including child abusers, and has enabled an underground market in illicit goods such as drugs. The current debates about TOR are reminiscent of the early days of the Internet, when it was perceived as an unregulated “electronic frontier”. Most advocates of freedom of information agree that on balance TOR is a force for good, despite the potential for abuse by unscrupulous criminals – much like the Internet as a whole. According to the NSA’s own documentsxiii GCHQ and NSA staff expressed their dislike for this tool in a presentation slide set called “TOR Stinks”.xiv Despite their best efforts the agencies acknowledged they have not been able to fully crack the TOR network to de- anonymise the users. 4 of 21 GCHQ and UK Mass Surveillance Leaked source code from the XKEYSCORE systemxv shows that operatives use it to systematically track TOR activity and potential users. 2.3 From equipment interference to industrial scale hacking The NSA and GCHQ run a very complex global infrastructure that allows them to hack into millions of computers worldwide. This, in their own terms, “industrial scale exploitation”xvi allows the agencies to obtain information from these machines. However they are also able to remotely control the computers, including those of innocent people that are used as accessories to other covert operations. Many attacks target infrastructure such as routers.xvii In their documents, the agencies call these activities Computer Network Exploitation, and the term is also used in a recent public consultation by the Home Office on equipment interferencexviii. Traditional interception attacks on individuals required either direct physical access to plant bugs, or targeted techniques that required considerable effort. But recently the US, the UK, 5 of 21 GCHQ and UK Mass Surveillance and other Five Eyes countries, have developed the capacity to automate remote hacking attacks, allowing mass computer infection on an industrial scale. The UK is heavily involved in the development and implementation of these mass hacking systems. Leaked US budgetary details show that the use of such techniques has exploded in the last decade. In 2004 the NSA had some 100 to 150 active “implants”.xix By 2014 the US had infected tens of thousands of machines with malicious software,xx with up to 100,000 computers being controlled at any time in order to act as platforms for hacking attacksxxi on third parties. We do not know how many computers are directly infected and controlled by GCHQ. It is generally accepted that spy agencies must have some properly regulated targeted hacking capabilities, but it is concerning that the NSA and GCHQ are building systems capable of targeting millions of people. The legal basis for this is very unclear. The top level components of this system have been extensively described in leaked documents. These programmes for mass hackingxxii involve many interconnected subsystems. The following is a very superficial description based on the available informationxxiii and analyses put together by security experts. The source leaked documents are highly technical and it may be challenging to fully understand the operations. Given that new revelations continue to appear it is likely that this information will become quickly outdated. The scale of operations is staggering, and in many cases there is a blurring between mass surveillance and hacking, with access being used to plant malware in network infrastructure that is then used to enable new channels for bulk collection. 2.3.1 The NSA hacking budget: GENIE The NSA GENIE programme appears to be a massive umbrella for a very broad range of activities and programmesxxiv for the exploitation of equipment.