MI5 carried out secret mass surveillance for a decade | Ars Technica

GCHQ denies doing it, claims that “Alan Turing started it, so it must be okay.”

Source: MI5 carried out secret mass surveillance for a decade | Ars Technica

NSA Planned to Hijack Google App Store to Hack Smartphones

The National Security Agency and its closest allies planned to hijack data links to Google and Samsung app stores to infect smartphones with spyware, a top-secret document reveals.

The surveillance project was launched by a joint electronic eavesdropping unit called the Network Tradecraft Advancement Team, which includes spies from each of the countries in the “Five Eyes” alliance — the United States, Canada, the United Kingdom, New Zealand and Australia.

The top-secret document, obtained from NSA whistleblower Edward Snowden, was published Wednesday by CBC News in collaboration with The Intercept. The document outlines a series of tactics that the NSA and its counterparts in the Five Eyes were working on during workshops held in Australia and Canada between November 2011 and February 2012.

The main purpose of the workshops was to find new ways to exploit smartphone technology for surveillance. The agencies used the Internet spying system XKEYSCORE to identify smartphone traffic flowing across Internet cables and then to track down smartphone connections to app marketplace servers operated by Samsung and Google. (Google declined to comment for this story. Samsung said it would not be commenting “at this time.”)

As part of a pilot project codenamed IRRITANT HORN, the agencies were developing a method to hack and hijack phone users’ connections to app stores so that they would be able to send malicious “implants” to targeted devices. The implants could then be used to collect data from the phones without their users noticing.

Previous disclosures from the Snowden files have shown agencies in the Five Eyes alliance designed spyware for iPhones and Android smartphones, enabling them to infect targeted phones and grab emails, texts, web history, call records, videos, photos and other files stored on them. But methods used by the agencies to get the spyware onto phones in the first place have remained unclear.

The newly published document shows how the agencies wanted to “exploit” app store servers — using them to launch so-called “man-in-the-middle” attacks to infect phones with the implants. A man-in-the-middle attack is a technique in which hackers place themselves between computers as they are communicating with each other; it is a tactic sometimes used by criminal hackers to defraud people. In this instance, the method would have allowed the surveillance agencies to modify the content of data packets passing between targeted smartphones and the app servers while an app was being downloaded or updated, inserting spyware that would be covertly sent to the phones.

Link (The Intercept)

Inquiry Launched into New Zealand Mass Surveillance

New Zealand’s spy agency watchdog is launching an investigation into the scope of the country’s secret surveillance operations following a series of reports from The Intercept and its partners.

On Thursday, Cheryl Gwyn, New Zealand’s inspector-general of intelligence and security, announced that she would be opening an inquiry after receiving complaints about spying being conducted in the South Pacific by eavesdropping agency Government Communications Security Bureau, or GCSB.

In a press release, Gwyn’s office said: “The complaints follow recent public allegations about GCSB activities. The complaints, and these public allegations, raise wider questions regarding the collection, retention and sharing of communications data.”

This month, The Intercept has shined a light on the GCSB’s surveillance with investigative reports produced in partnership with the New Zealand Herald, Herald on Sunday, and Sunday-Star-Times.

The reports, based on information from National Security Agency whistleblower Edward Snowden and other sources, have revealed how the GCSB has been intercepting communications in bulk across a variety of neighboring South Pacific islands, raising concerns that New Zealand citizens’ emails and phone calls are being swept up in the dragnet.

The reports have also shown how the GCSB is funneling data into the NSA’s XKEYSCORE internet surveillance system from a surveillance base in the Waihopai Valley and is spying on about 20 countries across the world, predominantly in the Asia-Pacific region, including major trading partners such as Japan, Vietnam and China. The most recent stories have revealed that GCSB used XKEYSCORE to spy on emails about candidates vying to be the director general of the World Trade Organization and target top government officials and an anti-corruption campaigner in the Solomon Islands.

Following the disclosures, several of New Zealand’s opposition political leaders have criticized the surveillance and filed complaints with Gwyn, the inspector-general of intelligence and security.

In her statement on Thursday announcing the initiation of an inquiry, Gwyn said she would be conducting “a focused review of a particular area of GCSB or New Zealand Security Intelligence Service practice.”

She added: “I have today notified the acting director of the GCSB of my inquiry and of my intention in this inquiry to provide as much information to the public on my findings as I can, withholding only that information that cannot be disclosed without endangering national security. The director has assured me of the Bureau’s full co-operation.”

John Key, New Zealand’s prime minister, last year claimed that “there has never been any mass surveillance and New Zealand has not gathered mass information and provided it to international agencies.”

However, after The Intercept’s recent reports, former GCSB chief Bruce Ferguson admitted that the agency had been engaged in “mass collection” of data and said it was “mission impossible” to eliminate New Zealand citizens’ communications from being vacuumed up.

Responding to the news about the inspector general’s inquiry on Thursday, Prime Minister Key told the media he was “not fearful in the slightest” about its findings.

“That’s the reason we beefed up the inspector-general and, in fact, we’ve been talking to her,” Key said. “We’ve got absolutely no concerns about it.”

Link (The Intercept)

New Zealand Spied on WTO Director Candidates

New Zealand launched a covert surveillance operation targeting candidates vying to be director general of the World Trade Organization, a top-secret document reveals.

In the period leading up to the May 2013 appointment, the country’s electronic eavesdropping agency programmed an Internet spying system to intercept emails about a list of high-profile candidates from Brazil, Costa Rica, Ghana, Indonesia, Jordan, Kenya, Mexico, and South Korea.

New Zealand’s trade minister Tim Groser was one of nine candidates in contention for the position at the WTO, a powerful international organization based in Geneva, Switzerland that negotiates trade agreements between nations. The surveillance operation, carried out by Government Communications Security Bureau, or GCSB, appears to have been part of a secret effort to help Groser win the job.

Groser ultimately failed to get the position.

A top-secret document obtained by The Intercept and the New Zealand Herald reveals how GCSB used the XKEYSCORE Internet surveillance system to collect communications about the WTO director general candidates.

XKEYSCORE is run by the National Security Agency and is used to analyze billions of emails, Internet browsing sessions and online chats that are vacuumed up from about 150 different locations worldwide. GCSB has gained access to XKEYSCORE because New Zealand is a member of the Five Eyes surveillance alliance alongside the United States, the United Kingdom, Canada and Australia.

Link (The Intercept)

New Zealand Used NSA System to Target Officials, Anti-Corruption Campaigner

New Zealand’s eavesdropping agency used an Internet mass surveillance system to target government officials and an anti-corruption campaigner on a neighboring Pacific island, according to a top-secret document.

Analysts from Government Communications Security Bureau, or GCSB, programmed the Internet spy system XKEYSCORE to intercept documents authored by the closest aides and confidants of the prime minister on the tiny Solomon Islands. The agency also entered keywords into the system so that it would intercept documents containing references to the Solomons’ leading anti-corruption activist, who is known for publishing government leaks on his website.

XKEYSCORE is run by the National Security Agency, and is used to analyze billions of emails, Internet browsing sessions and online chats that are collected from some 150 different locations worldwide. GCSB has gained access to XKEYSCORE because New Zealand is a member of the Five Eyes surveillance alliance alongside the United States, the United Kingdom, Canada and Australia.

A number of GCSB’s XKEYSCORE targets are disclosed in a top-secret document that was obtained by The Intercept and New Zealand newspaper the Herald on Sunday. The document raises questions about the scope of the surveillance and offers an unprecedented insight into specific people monitored by New Zealand’s most secretive agency.

The targets list, dated from January 2013, was authored by a GCSB analyst. It is contained in a so-called “fingerprint,” a combination of keywords used to extract particular information from the vast quantities of intercepted data swept up by XKEYSCORE. None of the individuals named on the list appear to have any association with terrorism.

Most of the targets, in fact, had a prominent role in the Solomon Islands government. Their roles around the time of January 2013 suggest GCSB was interested in collecting information sent among the prime minister’s inner circle. The targets included: Barnabas Anga, the permanent secretary of the Ministry of Foreign Affairs and External Trade; Robert Iroga, chief of staff to the prime minister; Dr Philip Tagini, special secretary to the prime minister; Fiona Indu, senior foreign affairs official; James Remobatu, cabinet secretary; and Rose Qurusu, a Solomon Islands public servant.

The seventh person caught up in the GCSB’s surveillance sweep is the leading anti-corruption campaigner in the Solomon Islands, Benjamin Afuga. For several years he has run a popular Facebook group that exposes corruption, often publishing leaked information and documents from government whistleblowers. His organization, Forum Solomon Islands International, has an office next door to Transparency International in Honiara, the capital city of the Solomon Islands. GCSB analysts programmed XKEYSCORE so that it would intercept documents sent over the Internet containing the words “Forum Solomon Islands,” “FSII,” and “Benjamin Afuga.”

Link (The Intercept)

New Zealand Prime Minister Retracts Vow To Resign if Mass Surveillance Is Shown

In August, 2013, as evidence emerged of the active participation by New Zealand in the “Five Eyes” mass surveillance program exposed by Edward Snowden, the country’s conservative Prime Minister, John Key, vehemently denied that his government engages in such spying. He went beyond mere denials, expressly vowing to resign if it were ever proven that his government engages in mass surveillance of New Zealanders. He issued that denial, and the accompanying resignation vow, in order to re-assure the country over fears provoked by a new bill he advocated to increase the surveillance powers of that country’s spying agency, Government Communications Security Bureau (GCSB) – a bill that passed by one vote thanks to the Prime Minister’s guarantees that the new law would not permit mass surveillance.

Since then, a mountain of evidence has been presented that indisputably proves that New Zealand does exactly that which Prime Minister Key vehemently denied – exactly that which he said he would resign if it were proven was done. Last September, we reported on a secret program of mass surveillance at least partially implemented by the Key government that was designed to exploit the very law that Key was publicly insisting did not permit mass surveillance. At the time, Snowden, citing that report as well as his own personal knowledge of GCSB’s participation in the mass surveillance tool XKEYSCORE, wrote in an article for the Intercept:

Let me be clear: any statement that mass surveillance is not performed in New Zealand, or that the internet communications are not comprehensively intercepted and monitored, or that this is not intentionally and actively abetted by the GCSB, is categorically false. . . . The prime minister’s claimto the public, that “there is no and there never has been any mass surveillance” is false. The GCSB, whose operations he is responsible for, is directly involved in the untargeted, bulk interception and algorithmic analysis of private communications sent via internet, satellite, radio, and phone networks.

Link (The Intercept)

Snowden Docs: New Zealand Spying On Friendly Neighboring Countries For The NSA

More Snowden docs have been released, covering the extent of GCSB’s (New Zealand’s intelligence agency) spying on supposedly “friendly” island nations. As is par for the course for intelligence programs, the documents show massive bulk collections of data and communications — all of which are immediately shared with the other members of the “Five Eyes” club.

Since 2009, the Government Communications Security Bureau intelligence base at Waihopai has moved to “full-take collection”, indiscriminately intercepting Asia-Pacific communications and providing them en masse to the NSA through the controversial NSA intelligence system XKeyscore, which is used to monitor emails and internet browsing habits.

This sort of spying — while apparently “normal,” in light of previously-released documents — indicates many governments enjoy spying for spying’s sake, rather than for the justifications they often offer in defense of untargeted surveillance.

The documents, provided by US whistleblower whistleblower Edward Snowden, reveal that most of the targets are not security threats to New Zealand, as has been suggested by the Government.

Instead, the GCSB directs its spying against a surprising array of New Zealand’s friends, trading partners and close Pacific neighbours. These countries’ communications are supplied directly to the NSA and other Five Eyes agencies with little New Zealand oversight or decision-making, as a contribution to US worldwide surveillance.

Link (Techdirt)