“I’m not following you, I’m looking for you. There’s a big difference.” Francis Ford Coppola’s The Conversation (1974)
If you thought that projects such as the Prism project of the U.S. National Security Agency (NSA), and its Indian cousin, the Central Monitoring System (CMS), was all there is to a full-spectrum surveillance system, think again. While the explosive and still ongoing revelations made by whistleblower Edward Snowden have focused attention on giant data trawlers such as the Prism system, little is known about the thousands of fishing boats deployed by national surveillance agencies, without which the trawlers would be stranded.
Surveillance is all about filtering and targeting. Internet surveillance is not just Big Data — whether meta data or otherwise — because a lot of data is meaningless junk that is swirling around what intelligence is actually looking for, says Masashi Crete-Nishihata, Research Manager at the Citizen Lab, Munk School of Foreign Affairs, University of Toronto. But to find the nuggets of gold, you need tools that filter, track and target mobile phones or Internet users, says Mr. Nishihata, who has worked on a number of reports prepared by Citizen Lab over the last decade.
Tools and methods
“Behind the outrageously innocuous notion of ‘lawful interception’ by State surveillance agencies lurk the many tools, which makes this possible,” he says. Indeed, he terms the broad swathe of tools and methods of surveillance as “information control systems”. These methods adopted by States seek to “deny, disrupt, manipulate or monitor information for political ends,” he argues. A May 2013 report, ‘For their eyes only: the commercialisation of digital spying’, in which Citizen Lab was a participant, observed that “as the world’s communications moved from telephone and fax to email, chat and VOIP, we witnessed the rise of massive intercept technology and its ubiquitous integration into modern network architecture”.
The sharp increase in the use of “dual use” technologies, those that are typically justified in the name of fighting terror or waging a war on drugs, but which are also increasingly deployed by States to monitor “dissidence” by their own citizens, is a major worry, says Mr. Nishihata.
For instance, commercial “intrusion and monitoring tools” are available in the international market, he says. Mr. Nishihata pointed out that studies conducted by the Citizen Lab, based on forensic analysis of surveillance tools, showed the widespread use of such tools.
FinFisher Suite
For instance, FinFisher Suite is a tool that is available off the shelf. It shot into the limelight in December 2011 when WikiLeaks posted the company’s brochures as part of its release of a tranche of documents titled The Spy Files.
According to the report cited earlier, forensic analysis revealed the use of FinSpy to deliver malware to activists in Bahrain in May 2012. Interestingly, the system was “socially engineered” to deliver malware that would appear credible to the targeted activists. In one case, an email appearing to come from a correspondent of the Al-Jazeera’s English service to an activist, contained a reference to a “detailed report” of the torture of an pro-democracy activist. In fact, it was an executable file designed to unleash “a multi-featured trojan on the victim’s computer”. “The malware provides the attacker with clandestine remote access to the victim’s machine as well as comprehensive data harvesting and exfiltration capabilities,” the report observed. But the spy tool does even more: it adopts a “granular solution” to the antivirus programme that may be on the victim’s computer, modulating its response to what it encounters on a particular machine.
Stealthy connection
After harvesting a wide array of data from the computer and mobile devices, the malware is stored locally in a hidden directory. Even more sinister was the discovery that the FinSpy toolkit had a stealthy connection to “command and control servers,” which the study said numbered nearly 40 across the world, including in India.
Another study of Silicon Valley-based Blue Coat Systems by Citizen Lab (January 2012) showed that at least three Indian telecom operators used the company’s PacketShaper device to “filter” content.
These issues go far behind the issue of ‘privacy’, especially in India in the context of the exposure about the nature, breadth and scope of the Indian CMS (see The Hindu , June 21, 2013)
The increasingly ‘social’ nature of networks is what makes them vulnerable. Thus, any kind of dissidence, especially of the organised kind, which, by definition, means it’s ‘socially’ connected, is vulnerable to not only snooping but also attack. Surely, this is not merely about the state of hearing and seeing what we do in our homes or with friends, but about how we participate in the affairs of a democracy.
