A Police Gadget Tracks Phones? Shhh! It’s Secret

By MATT RICHTEL NYTIMES 
MARCH 15, 2015

A powerful new surveillance tool being adopted by police departments across the country comes with an unusual requirement: To buy it, law enforcement officials must sign a nondisclosure agreement preventing them from saying almost anything about the technology.

Any disclosure about the technology, which tracks cellphones and is often called StingRay, could allow criminals and terrorists to circumvent it, the F.B.I. has said in an affidavit. But the tool is adopted in such secrecy that communities are not always sure what they are buying or whether the technology could raise serious privacy concerns.

The confidentiality has elevated the stakes in a longstanding debate about the public disclosure of government practices versus law enforcement’s desire to keep its methods confidential. While companies routinely require nondisclosure agreements for technical products, legal experts say these agreements raise questions and are unusual given the privacy and even constitutional issues at stake.

“It might be a totally legitimate business interest, or maybe they’re trying to keep people from realizing there are bigger privacy problems,” said Orin S. Kerr, a privacy law expert at George Washington University. “What’s the secret that they’re trying to hide?”

The issue led to a public dispute three weeks ago in Silicon Valley, where a sheriff asked county officials to spend $502,000 on the technology. The Santa Clara County sheriff, Laurie Smith, said the technology allowed for locating cellphones — belonging to, say, terrorists or a missing person. But when asked for details, she offered no technical specifications and acknowledged she had not seen a product demonstration.

Buying the technology, she said, required the signing of a nondisclosure agreement.

“So, just to be clear,” Joe Simitian, a county supervisor, said, “we are being asked to spend $500,000 of taxpayers’ money and $42,000 a year thereafter for a product for the name brand which we are not sure of, a product we have not seen, a demonstration we don’t have, and we have a nondisclosure requirement as a precondition. You want us to vote and spend money,” he continued, but “you can’t tell us more about it.”

The technology goes by various names, including StingRay, KingFish or, generically, cell site simulator. It is a rectangular device, small enough to fit into a suitcase, that intercepts a cellphone signal by acting like a cellphone tower.

The technology can also capture texts, calls, emails and other data, and prosecutors have received court approval to use it for such purposes.

Cell site simulators are catching on while law enforcement officials are adding other digital tools, like video cameras, license-plate readers, drones, programs that scan billions of phone records and gunshot detection sensors. Some of those tools have invited resistance from municipalities and legislators on privacy grounds.

The nondisclosure agreements for the cell site simulators are overseen by the Federal Bureau of Investigation and typically involve the Harris Corporation, a multibillion-dollar defense contractor and a maker of the technology. What has opponents particularly concerned about StingRay is that the technology, unlike other phone surveillance methods, can also scan all the cellphones in the area where it is being used, not just the target phone.

“It’s scanning the area. What is the government doing with that information?” said Linda Lye, a lawyer for the American Civil Liberties Union of Northern California, which in 2013 sued the Justice Department to force it to disclose more about the technology. In November, in a response to the lawsuit, the government said it had asked the courts to allow the technology to capture content, not just identify subscriber location.

The nondisclosure agreements make it hard to know how widely the technology has been adopted. But news reports from around the country indicate use by local and state police agencies stretching from Los Angeles to Wisconsin to New York, where the state police use it. Some departments have used it for several years. Money for the devices comes from individual agencies and sometimes, as in the case of Santa Clara County, from the federal government through Homeland Security grants.

Christopher Allen, an F.B.I. spokesman, said “location information is a vital component” of law enforcement. The agency, he said, “does not keep repositories of cell tower data for any purpose other than in connection with a specific investigation.”

A fuller explanation of the F.B.I.’s position is provided in two publicly sworn affidavits about StingRay, including one filed in 2014 in Virginia. In the affidavit, a supervisory special agent, Bradley S. Morrison, said disclosure of the technology’s specifications would let criminals, including terrorists, “thwart the use of this technology.”

“Disclosure of even minor details” could harm law enforcement, he said, by letting “adversaries” put together the pieces of the technology like assembling a “jigsaw puzzle.” He said the F.B.I. had entered into the nondisclosure agreements with local authorities for those reasons. In addition, he said, the technology is related to homeland security and is therefore subject to federal control.

In a second affidavit, given in 2011, the same special agent acknowledged that the device could gather identifying information from phones of bystanders. Such data “from all wireless devices in the immediate area of the F.B.I. device that subscribe to a particular provider may be incidentally recorded, including those of innocent, nontarget devices.”

But, he added, that information is purged to ensure privacy rights.

In December, two senators, Patrick J. Leahy and Charles E. Grassley, sent a letter expressing concerns about the scope of the F.B.I.’s StingRay use to Eric H. Holder Jr., the attorney general, and Jeh Johnson, the secretary of Homeland Security.

The Harris Corporation declined to comment, according to Jim Burke, a company spokesman. Harris, based in Melbourne, Fla., has $5 billion in annual sales and specializes in communications technology, including battlefield radios.

Jon Michaels, a law professor at the University of California, Los Angeles, who studies government procurement, said Harris’s role with the nondisclosure agreements gave the company tremendous power over privacy policies in the public arena.

“This is like the privatization of a legal regime,” he said. Referring to Harris, he said: “They get to call the shots.”

For instance, in Tucson, a journalist asking the Police Department about its StingRay use was given a copy of a nondisclosure agreement. “The City of Tucson shall not discuss, publish, release or disclose any information pertaining to the product,” it read, and then noted: “Without the prior written consent of Harris.”

The secrecy appears to have unintended consequences. A recent article in The Washington Post detailed how a man in Florida who was accused of armed robbery was located using StingRay.

As the case proceeded, a defense lawyer asked the police to explain how the technology worked. The police and prosecutors declined to produce the machine and, rather than meet a judge’s order that they do so, the state gave the defendant a plea bargain for petty theft.

At the meeting in Santa Clara County last month, the county supervisors voted 4 to 1 to authorize the purchase, but they also voted to require the adoption of a privacy policy.

(Sheriff Smith argued to the supervisors that she had adequately explained the technology and said she resented that Mr. Simitian’s questioning seemed to “suggest we are not mindful of people’s rights and the Constitution.”)

A few days later, the county asked Harris for a demonstration open to county supervisors. The company refused, Mr. Simitian said, noting that “only people with badges” would be permitted. Further, he said, the company declined to provide a copy of the nondisclosure agreement — at least until after the demonstration.“Not only is there a nondisclosure agreement, for the time being, at least, we can’t even see the nondisclosure agreement,” Mr. Simitian said. “We may be able to see it later, I don’t know.”

Facebook's Future Plans for Data Collection Beyond Imagination

Facebook's dark plans for the future are given away in its patent applications.
December 4, 2013 | Alternet (via Counterpunch)

“No one knows who will live in this cage in the future, or whether at the end of this tremendous development, entirely new prophets will arise, or there will be a great rebirth of old ideas and ideals, or, if neither, mechanized petrification, embellished with a sort of convulsive self-importance. For of the fast stage of this cultural development, it might well be truly said: ‘Specialists without spirit, sensualists without heart; this nullity imagines that it has attained a level of civilization never before achieved.’”
—Max Weber, 1905

On November 12,  Facebook, Inc. filed its 178th patent application for a consumer profiling technique the company calls “inferring household income for users of a social networking system.”

“The amount of information gathered from users,” explain Facebook programmers Justin Voskuhl and Ramesh Vyaghrapuri in their patent application, “is staggering — information describing recent moves to a new city, graduations, births, engagements, marriages, and the like.” Facebook and other so-called tech companies have been warehousing all of this information since their respective inceptions. In Facebook’s case, its data vault includes information posted as early as 2004, when the site first went live. Now in a single month the amount of information forever recorded by Facebook —dinner plans, vacation destinations, emotional states, sexual activity, political views, etc.— far surpasses what was recorded during the company’s first several years of operation. And while no one outside of the company knows for certain, it is believed that Facebook has amassed one of the widest and deepest databases in history. Facebook has over 1,189,000,000 “monthly active users” around the world as of October 2013, providing considerable width of data. And Facebook has stored away trillions and trillions of missives and images, and logged other data about the lives of this billion plus statistical sample of humanity. Adjusting for bogus or duplicate accounts it all adds up to about 1/7th of humanity from which some kind of data has been recorded.

According to Facebook’s programmers like Voskuhl and Vyaghrapuri, of all the clever uses they have already applied this pile of data toward, Facebook has so far “lacked tools to synthesize this information about users for targeting advertisements based on their perceived income.” Now they have such a tool thanks to the retention and analysis of variable the company’s positivist specialists believe are correlated with income levels.

They’ll have many more tools within the next year to run similar predictions. Indeed, Facebook, Google, Yahoo, Twitter, and the hundreds of smaller tech lesser-known tech firms that now control the main portals of social, economic, and political life on the web (which is now to say everywhere as all economic and much social activity is made cyber) are only getting started. The Big Data analytics revolution has barely begun, and these firms are just beginning to tinker with rational-instrumental methods of predicting and manipulating human behavior.

There are few, if any, government regulations restricting their imaginations at this point. Indeed, the U.S. President himself is a true believer in Big Data; the brain of Obama’s election team was a now famous “cave” filled with young Ivy League men (and a few women) sucking up electioneering information and crunching demographic and consumer data to target individual voters with appeals timed to maximize the probability of a vote for the new Big Blue, not IBM, but the Democratic Party’s candidate of “Hope” and “Change.” The halls of power are enraptured by the potential of rational-instrumental methods paired with unprecedented access to data that describes the social lives of hundreds of millions.

Facebook’s intellectual property portfolio reads like cliff notes summarizing the aspirations of all corporations in capitalist modernity; to optimize efficiency in order to maximize profits and reduce or externalize risk. Unlike most other corporations, and unlike previous phases in the development of rational bureaucracies, Facebook and its tech peers have accumulated never before seen quantities of information about individuals and groups. Recent breakthroughs in networked computing make analysis of these gigantic data sets fast and cheap. Facebook’s patent holdings are just a taste of what’s arriving here and now.

The way you type, the rate, common mistakes, intervals between certain characters, is all unique, like your fingerprint, and there are already cyber robots that can identify you as you peck away at keys. Facebook has even patented methods of individual identification with obviously cybernetic overtones, where the machine becomes an appendage of the person. U.S. Patents 8,306,256, 8,472,662, and 8,503,718, all filed within the last year, allow Facebook’s web robots to identify a user based on the unique pixelation and other characteristics of their smartphone’s camera. Identification of the subject is the first step toward building a useful data set to file among the billion or so other user logs. Then comes analysis, then prediction, then efforts to influence a parting of money.

The way you type, the rate, common mistakes, intervals between certain characters, is all unique, like your fingerprint, and there are already cyber robots that can identify you as you peck away at keys.

Many Facebook patents pertain to advertising techniques that are designed and targeted, and continuously redesigned with ever-finer calibrations by robot programs, to be absorbed by the gazes of individuals as they scroll and swipe across their Facebook feeds, or on third party web sites.

Speaking of feeds, U.S. Patent 8,352,859, Facebook’s system for “Dynamically providing a feed of stories about a user of a social networking system” is used by the company to organize the constantly updated posts and activities inputted by a user’s “friends.” Of course embedded in this system are means of inserting advertisements. According to Facebook’s programmers, a user’s feeds are frequently injected with “a depiction of a product, a depiction of a logo, a display of a trademark, an inducement to buy a product, an inducement to buy a service, an inducement to invest, an offer for sale, a product description, trade promotion, a survey, a political message, an opinion, a public service announcement, news, a religious message, educational information, a coupon, entertainment, a file of data, an article, a book, a picture, travel information, and the like.” That’s a long list for sure, but what gets injected is more often than not whatever will boost revenues for Facebook.

The advantage here, according to Facebook, is that “rather than having to initiate calls or emails to learn news of another user, a user of a social networking website may passively receive alerts to new postings by other users.” The web robot knows best. Sit back and relax and let sociality wash over you, passively. This is merely one of Facebook’s many “systems for tailoring connections between various users” so that these connections ripple with ads uncannily resonant with desires and needs revealed in the quietly observed flow of e-mails, texts, images, and clicks captured forever in dark inaccessible servers of Facebook, Google and the like. These communications services are free in order to control the freedom of data that might otherwise crash about randomly, generating few opportunities for sales.

Where this fails Facebook ratchets up the probability of influencing the user to behave as a predictable consumer. “Targeted advertisements often fail to earn a user’s trust in the advertised product,” explain Facebook’s programmers in U.S. Patent 8,527,344, filed in September of this year. “For example, the user may be skeptical of the claims made by the advertisement. Thus, targeted advertisements may not be very effective in selling an advertised product.” Facebook’s computer programmers who now profess mastery over sociological forces add that even celebrity endorsements are viewed with skepticism by the savvy citizen of the modulated Internet. They’re probably right.

Facebook’s solution is to mobilize its users as trusted advertisers in their own right. “Unlike advertisements, most users seek and read content generated by their friends within the social networking system; thus,” concludes Facebook’s mathematicians of human inducement, “advertisements generated by a friend of the user are more likely to catch the attention of the user, increasing the effectiveness of the advertisement.” That Facebook’s current So-And-So-likes-BrandX ads are often so clumsy and ineffective does not negate the qualitative shift in this model of advertising and the possibilities of un-freedom it evokes.

Forget iPhones and applications, the tech industry’s core consumer product is now advertising. Their essential practice is mass surveillance conducted in real time through continuous and multiple sensors that pass, for most people, entirely unnoticed. The autonomy and unpredictability of the individual —in Facebook’s language the individual is the “user”— is their fundamental business problem. Reducing autonomy via surveillance and predictive algorithms that can placate existing desires, and even stimulate and mold new desires is the tech industry’s reason for being. Selling their capacious surveillance and consumer stimulus capabilities to the highest bidder is the ultimate end.

Sounds too dystopian? Perhaps, and this is by no means the world we live in, not yet. It is, however, a tendency rooted in the tech economy. The advent of mobile, hand-held, wirelessly networked computers, called “smartphones,” is still so new that the technology, and its services feel like a parallel universe, a new layer of existence added upon our existing social relationships, business activities, and political affiliations. In many ways it feels liberating and often playful. Our devices can map geographic routes, identify places and things, provide information about almost anything in real time, respond to our voices, and replace our wallets. Who hasn’t consulted “Dr. Google” to answer a pressing question? Everyone and everything is seemingly within reach and there is a kind of freedom to this utility.

Most of Facebook’s “users” have only been registered on the web site since 2010, and so the quintessential social network feels new and fun, and although perhaps fraught with some privacy concerns, it does not altogether feel like a threat to the autonomy of the individual. To say it is, is a cliche sci-fi nightmare narrative of tech-bureaucracy, and we all tell one another that the reality is more complex.

Privacy continues, however, too be too narrowly conceptualized as a liberal right against incursions of government, and while the tech companies have certainly been involved in a good deal of old-fashioned mass surveillance for the sake of our federal Big Brother, there’s another means of dissolving privacy that is more fundamental to the goals of the tech companies and more threatening to social creativity and political freedom.

Georgetown University law professor Julie Cohen notes that pervasive surveillance is inimical to the spaces of privacy that are required for liberal democracy, but she adds importantly, that the surveillance and advertising strategies of the tech industry goes further.

“A society that permits the unchecked ascendancy of surveillance infrastructures, which dampen and modulate behavioral variability, cannot hope to maintain a vibrant tradition of cultural and technical innovation,” writes Cohen in a forthcoming Harvard Law Review article:

“Modulation” is Cohen’s term for the tech industry’s practice of using algorithms and other logical machine operations to mine an individual’s data so as to continuously personalize information streams. Facebook’s patents are largely techniques of modulation, as are Google’s and the rest of the industry leaders. Facebook conducts meticulous surveillance on users, collects their data, tracks their movements on the web, and feeds the individual specific content that is determined to best resonate with their desires, behaviors, and predicted future movements. The point is to perfect the form and function of the rational-instrumental bureaucracy as defined by Max Weber: to constantly ratchet up efficiency, calculability, predictability, and control. If they succeed in their own terms, the tech companies stand to create a feedback loop made perfectly to fit each an every one of us, an increasingly closed systems of personal development in which the great algorithms in the cloud endlessly tailor the psychological and social inputs of humans who lose the gift of randomness and irrationality.

“It is modulation, not privacy, that poses the greater threat to innovative practice. Regimes of pervasively distributed surveillance and modulation seek to mold individual preferences and behavior in ways that reduce the serendipity and the freedom to tinker on which innovation thrives.” 

Cohen has pointed out the obvious irony here, not that it’s easy to miss; the tech industry is uncritically labeled America’s hothouse of innovation, but it may in fact be killing innovation by disenchanting the world and locking inspiration in an cage.

If there were limits to the reach of the tech industry’s surveillance and stimuli strategies it would indeed be less worrisome. Only parts of our lives would be subject to this modulation, and it could therefore benefit us. But the industry aspires to totalitarian visions in which universal data sets are constantly mobilized to transform an individual’s interface with society, family, the economy, and other institutions. The tech industry’s luminaries are clear in their desire to observe and log everything, and use every “data point” to establish optimum efficiency in life as the pursuit of consumer happiness. Consumer happiness is, in turn, a step toward the rational pursuit of maximum corporate profit. We are told that the “Internet of things” is arriving, that soon every object will have embedded within it a computer that is networked to the sublime cloud, and that the physical environment will be made “smart” through the same strategy of modulation so that we might be made free not just in cyberspace, but also in the meatspace.

Whereas the Internet of the late 1990s matured as an archipelago of innumerable disjointed and disconnected web sites and databases, today’s Internet is gripped by a handful of giant companies that observe much of the traffic and communications, and which deliver much of the information from an Android phone or laptop computer, to distant servers, and back. The future Internet being built by the tech giants —putting aside the Internet of things for the moment— is already well into its beta testing phase. It’s a seamlessly integrated quilt of web sites and apps that all absorb “user” data, everything from clicks and keywords to biometric voice identification and geolocation.

United States Patent 8,572,174, another of Facebook’s recent inventions, allows the company to personalize a web page outside of Facebook’s own system with content from Facebook’s databases. Facebook is selling what the company calls its “rich set of social information” to third party web sites in order to “provide personalized content for their users based on social information about those users that is maintained by, or otherwise accessible to, the social networking system.” Facebook’s users generated this rich social information, worth many billions of dollars as recent quarterly earnings of the company attest.

In this way the entire Internet becomes Facebook. The totalitarian ambition here is obvious, and it can be read in the securities filings, patent applications, and other non-sanitized business documents crafted by the tech industry for the financial analysts who supply the capital for further so-called innovation. Everywhere you go on the web, with your phone or tablet, you’re a “user,” and your social network data will be mined every second by every application, site, and service to “enhance your experience,” as Facebook and others say. The tech industry’s leaders aim to expand this into the physical world, creating modulated advertising and environmental experiences as cameras and sensors track our movements.

Facebook and the rest of the tech industry fear autonomy and unpredictability. The ultimate expression of these irrational variables that cannot be mined with algorithmic methods is absence from the networks of surveillance in which data is collected.

One of Facebook’s preventative measures is United States Patent 8,560,962, “promoting participation of low-activity users in social networking system.” This novel invention devised by programmers in Facebook’s Palo Alto and San Francisco offices involves a “process of inducing interactions,” that are meant to maximize the amount of “user-generated content” on Facebook by getting lapsed users to return, and stimulating all users to produce more and more data. User generated content is, after all, worth billions. Think twice before you hit “like” next time, or tap that conspicuously placed “share” button; a machine likely put that content and interaction before your eyes after a logical operation determined it to have the highest probability of tempting you to add to the data stream, thereby increasing corporate revenues.

Facebook’s patents on techniques of modulating “user” behavior are few compared to the real giants of the tech industry’s surveillance and influence agenda. Amazon, Microsoft, and of course Google hold some of the most fundamental patents using personal data to attempt to shape an individual’s behavior into predictable consumptive patterns. Smaller specialized firms like Choicestream and Gist Communications have filed dozens more applications for modulation techniques. The rate of this so-called innovation is rapidly telescoping.

Perhaps we do know who will live in the iron cage. It might very well be a cage made of our own user generated content, paradoxically ushering in a new era of possibilities in shopping convenience and the delivery of satisfactory experiences even while it eradicates many degrees of chance, and pain, and struggle (the motive forces of human progress) in a robot-powered quest to have us construct identities and relationships that yield to prediction and computer-generated suggestion. Defense of individual privacy and autonomy today is rightly motivated by the reach of an Orwellian security state (the NSA, FBI, CIA). This surveillance changes our behavior by chilling us, by telling us we are always being watched by authority. Authority thereby represses in us whatever might happen to be defined as “crime,” or any anti-social behavior at the moment. But what about the surveillance that does not seek to repress us, the watching computer eyes and ears that instead hope to stimulate a particular set of monetized behaviors in us with the intimate knowledge gained from our every online utterance, even our facial expressions and finger movements?

Internet S.O.S.

Saturday, September 14, 2013 by Media Citizen

by Tim Karr







Last week we learned that U.S. and British intelligence agencies have broken the back of digital encryption — the coded technology hundreds of millions of Internet users rely on to keep their communications private.

Is the Internet on life support?

Over the weekend, Der Spiegel reported that the NSA and its British counterpart are also hacking into smartphones to monitor our daily lives in ways that wouldn’t have been possible before the age of the iPhone.

This news, just the latest revelations from the files of Edward Snowden, only heighten our sense that we can no longer assume anything we say or do online is secure.

But that’s not all. In a case that was heard in a U.S. federal appeals court on Monday, telecommunications colossus Verizon is arguing that it has the First Amendment right to block and censor Internet users. (That’s right. Verizon is claiming that, as a corporation, it has the free speech right to silence the online expression of everybody else.)
It's come to this. Government and corporate forces have joined to chip away at two pillars of the open Internet: the control of our personal data and our right to connect and communicate without censorship or interference.

The Surveillance Industrial Complex

A series of reports coordinated among the Guardian, the New York Times and ProPublica revealed that the NSA and its British counterpart have secretly unlocked encryption technologies used by popular online services, including Google, Facebook and Microsoft.

Using National Security Letters and other secret court orders, intelligence agencies can wedge their way onto the large telecommunications networks that move most of the world’s Internet traffic. Getting access to the data is only half the challenge. To read and sort these communications, the NSA works with a lesser-known assortment of security vendors that filter through mountains of data, target references and patterns of interest and crack codes designed to safeguard user identity and content.

Many of the companies that ply this trade are only now being exposed through “Spyfiles,” collaboration among WikiLeaks, Corporate Watch and Privacy International designed to shed light on the multibillion-dollar industry. According to the latest documents provided by Edward Snowden, U.S. intelligence agencies alone spend $250 million each year to use these companies’ commercial security products for mass surveillance.

Without safeguards that protect users from surveillance and censorship, the Internet’s DNA will change in ways that no longer foster openness, free expression and innovation.It’s part of a sprawling complex of companies, lobbyists and government officials seeking to rewire the Internet in ways that wrest control over content away from Internet users.

While motivations may differ, the result is the same: a communications network that works against the Interests of many for the benefit of the few.

Tearing the Fabric

The Internet wasn’t meant to be like this. Bruce Schneier, an encryption fellow at Harvard's Berkman Center for Internet and Society, writes that the NSA and the companies it works with are “undermining the very fabric of the Internet.”

Telecommunications companies are doing their part by giving spy agencies access to our data. They’re also bankrolling a multimillion-dollar lobbying effort to destroy Net Neutrality — the one rule that prohibits Internet service providers from blocking or degrading our ability to connect to one another, share information and use the online services of our choosing.

If Verizon wins its case in Washington, ISPs will be able to prioritize certain online content while degrading user access to sites and services that the big companies don’t like.

It’s a business that puts at risk the most integral function of the World Wide Web. Sir Tim Berners-Lee, the Web’s pioneer, saw the network as a “blank canvas” — upon which anyone could contribute, communicate and innovate without permission.

Berners-Lee’s invention relied on an open protocol that gave everyday users power over the network. This networking principle has far-reaching political implications, favoring systems that are more decentralized and democratic.

Without safeguards that protect users from surveillance and censorship, the Internet’s DNA will change in ways that no longer foster openness, free expression and innovation.

Media Policy

If we’ve learned anything during the Summer of Snowden, it’s that corporations and governments alone can’t be trusted to be good stewards of the Internet. We need media policies that protect our privacy and promote access to open networks.

The fight for these policies is being led by a diverse and bipartisan alliance of civil liberties and communications-rights organizations, including the ACLU, EFF, Free Press and Public Knowledge.

We’re not alone. Millions joined the call for Net Neutrality in 2010; millions more stood up to defend the Internet against the PIPA and SOPA Web-censorship bills in 2012. The battle to protect users’ privacy has engaged new audiences as we've learned more about the extent of the NSA's mass surveillance.

In each of these arenas, we’re working to stop bad laws, amend others and implement new policies that put Internet users first.

A grassroots movement is fueling this fight. If you haven’t joined us yet, now’s the time to step up and save the Internet.

Spy Tech Companies & Their Authoritarian Customers, Part I: FinFisher And Amesys

FEBRUARY 16, 2012 | BY TREVOR TIMM - Electronic Frontier Foundation

Last week, EFF gave its recommendations to EU parliament on what steps to take to combat a growing and dangerous civil liberties concern: Western companies marketing and selling mass surveillance technology to authoritarian regimes. This technology has been linked to harassment, arrests, and even torture of journalists, human rights advocates, and democratic activists in many Middle East countries over the past year.

EFF recommended parliament approach the problem through a “know your customer” program whereby companies would investigate purchasers of surveillance technology and would refrain from doing business with a government or its agents if the sale would be used to assist in human rights abuses. This program would be voluntary for companies and encouraged via incentives but could, if necessary, become a formal requirement. As we’ve seen, transparency can be a powerful tool. The industry is notoriously secretive and a little sunlight can help spur protests and force companies to change their business practices.

Privacy International recently released a mapping of companies and countries that have attended the notorious I.S.S. World trade shows, where this technology is bought and sold. But their investigation is far from over and you can go here to help them file Freedom of Information requests, write to your representative, or dig though government spending reports.

In the first part of a new series, EFF will take a look at what we know about some of the worst offenders located in Europe and the United States. 

Part I will highlight two companies, United Kingdom based FinFisher and France based Amesys:

FinFisher, unit of Gamma International—based in the UK
Gamma International and its subsidiary FinFisher first made headlines after the fall of Hosni Mubarak in Egypt last year, when activists found the company’s records in an abandoned state security building, along with troves of surveillance files. The documents on Gamma and FinFisher showed how they provided Mubarak with a five-month trial of their sophisticated spying technology, most notably FinSpy, which can wiretap encrypted Skype phone calls and instant messages—a service once mistakenly trusted by activists for secure communications.

The Wall Street Journal has since reported about FinFisher’s techniques and its technology’s dangerous capabilities. It works much the same way online criminals steal banking and credit card information. Authorities can covertly install malicious malware on a user’s computer without their knowledge by tricking the user into downloading fake updates to programs like iTunes and Adobe Flash. Once installed, they can see everything the user can. The FinFisher products can even remotely turn on the user’s webcam or microphone in a cell phone without the user’s knowledge.

FinFisher doesn’t pretend to market their products for solely lawful use. In 2007, they bragged that they use and incorporate “black hat (illegal and malicious) hacking techniques to allow intelligence services to acquire information that would be very difficult to obtain legally,”according to a report by OWNI.

Gamma or FinFisher, of course, won’t comment on any of these facts that have come to light over the past year. They hid behind claims of client confidentiality, telling the Wall Street Journal that they “cannot otherwise comment upon its confidential business transactions or the nature of the products it offers." But of course you can’t use claims of confidentiality to hide illegal behavior in the US or the UK. Investigators, especially in the UK and wherever these companies have sufficient contacts to establish jurisdiction, should require them to come clean about their potentially illegal business practices and uphold human rights privacy standards in the tools they offer and the customers to whom they sell.

Amesys, unit of Bull SA—based in France
When trade restrictions on Libya were eased in the early 2000s, Libya’s leader, Muammar Qaddafi, began to capitalize on the change by bringing in Western technology companies to surveil Libya's citizens’ Internet use under the guise of stopping terrorism. Instead, and to no one’s surprise, the technology was “deployed against dissidents, human-rights campaigners, journalists or everyday enemies of the state,” as the Wall Street Journal documented after seeing Qaddafi’s abandoned Internet monitoring center in Tripoli.

The main company tasked assisting Libya with all its surveillance needs was a unit of the French company Bull SA, known as Amesys. With Amesys’ monitoring centers, Libyan authorities could read emails, get passwords, read instant message conversations, and map connections among criminals, or in many cases, journalists or dissidents. OWNI graphically mapped out just how massive the surveillance system was. Documents released by WikiLeaks in November revealed that Amesys gear was even allowing Libya to spy on dissidents and opposition figures living in the United Kingdom. And as AFP reported, Qaddafi’s “regime [had previously] been accused of sending agents to harass and even kill opposition figures in exile.”

Despite the ease in trade restrictions, it was no secret Libya had a long history of human rights abuses and Amesys should have known who they were helping. The head of Libyan intelligence, the notorious Abdullah Senussi, was convicted in absentia in France of the Lockerbie terrorist bombing in 1989 that killed 170 people. Yet the former head of Amesys and current CEO of Bull, Philippe Vannier, was seen in Tripoli meeting with the same Abdullah Senussi in 2007, according to the Wall Street Journal.

Abdullah Senussi has since been indicted by the International Criminal Court for crimes against humanity for his role in the violent crackdown against Libyan citizens this past year.

The Amesys case highlights a problem with many of these companies—they are doing business with human rights violators that may have relations with the US or EU. As Amesys rightly points out, Libya was an “ally” of the west when their contract was signed and boasted of warm relations with France until NATO decided to take sides with the rebel forces late last year. "All Amesys activities strictly adhere to the statutory and regulatory requirements of both European and French international conventions," a spokeswoman said in Amesys’ defense. But this doesn’t excuse their behavior. EFF's know your customer standards address this problem by creating a framework in which companies study non-partisan human rights reports and not just the legal restrictions against the West’s perceived enemies.

"We are fully prepared to answer any questions which the legal authorities may ask us," the spokesman for Amesys also said. Authorities should take them up on their offer. In France, human rights groups have filed court documents asking for an investigation into Amesys for “possible violations of export rules and complicity in torture.” EFF encourages the French authorities to conduct a full investigation.

But Gamma and Amesys are far from the only transgressors. There are dozens of companies in both the US and EU that have been supplying this gear to authoritarian regimes as well, and EFF will soon highlight more of these companies until Congress and the EU countries act to prevent more of this dangerous technology from falling into the wrong hands.