State of Surveillance

A German tech company is selling the ability to track "political opponents." An Italian company promises to remotely seize control of smartphones and photograph their owners. A U.S. company allows security services to "see what they [the targets]see." A South African company can store recordings of billions of phone calls, forever.

Welcome to the new covert world of surveillance contractors. Shining a light on this $5 billion (and growing) industry, Wikileaks today released "Spy Files": hundreds of secret sales brochures. The companies involved hand this  promotional material only to key contacts -- often government agencies and police forces -- at trade shows that are closed to the public and the press.

"The tools revealed in these brochures demonstrate the previously unfathomable power of mass surveillance. It makes phone-hacking look like a schoolboy's game," says Eric King of Privacy International. "Some of the most tyrannical regimes in the world are buying the power to monitor the behavior and communications of every single citizen -- and the technology is so effective that they are able to accomplish this with minimal manpower."

An analysis by the Bureau of Investigative Journalism and Privacy International of the brochures shows that at least 160 companies in 25 countries from Brazil to Switzerland are selling an array of technologies so sophisticated that they often seem to have come of a Hollywood studio.

But what the "Spy Files" reveal is real. The documents add weight to campaigners' claim that these proliferating technology companies constitute a new, unregulated arms industry. "What we are seeing is the militarization of cyber-space. It's like having a tank in your front garden," says Julian Assange, the founder of Wikileaks.

The industry brochures state that they only sell "lawful interception" gear to official authorities: the police, the military and intelligence agencies.

But the sales brochures also boast of vast powers of covert observation using off-the-shelf gear that, activists worry, repressive security forces and corrupt officials can easily abuse.

"Why sample, when you can monitor all network traffic inexpensively?" trumpets a brochure from Endace, a New Zealand-based company. "Total monitoring of all operators to plug any intelligence leakage is critical for government agencies," offers Indian-based ClearTrail.

China Top Communications, in Beijing, claims to be able to crack passwords of more than 30 email service providers, including Gmail, "in real time by a PASSIVE WAY [sic]." In the obfuscating language of the surveillance industry, "passive" is a euphemism for intercepting data without the targets' knowledge.

The surveillance technology being offered for sale falls into four broad categories: tracking real-time locations of mobile phones and vehicles, hacking into electronic devices such as computers and phones to monitor every keystroke, recording and storing data traffic of an entire telecommunications network, and analyzing vast streams of data to track individual users.

In recent months, news has filtered out on how repressive governments are using these technologies to crack down on dissent. In October, for example, the Bureau of Investigative Journalism and Privacy International revealed that Syria, despite US export ban, is deploying web filtering equipment from California-based Blue Coat Systems to censor internet traffic. The company later explained the equipment had been diverted from an importer based in the United Arab Emirates.

The Italian company, Area SPA, also aided Syrian government's repressive policies by installing a surveillance system, an investigation by Bloomberg recently uncovered. The news emerged as Syria was convulsed by mass protests that have left 3,500 dead at the hands of state security forces. Area's lawyers announced last Monday that the company had cancelled the project.

The speed at which this technology is advancing, and the way it is being used raise serious concerns. As technological capacity expands, "the dominant use of surveillance technologies is increasingly the wholesale spying on entire populations, rather than targeted monitoring of a few individuals," says Dr. Steven Murdoch, professor of security engineering at Cambridge University. "As communication becomes ever more critical to civil society, the abuse of surveillance is a rapidly increasing, and already substantial, threat to democracy, freedom of expression, and human rights in general."

Phone Tracking

One popular mobile-phone tracking technology is an IMSI catcher. This highly portable device poses as a mini mobile phone tower that can capture all the mobile phones signals in an area, effectively identifying all phone users in a particular place. Today, dozens of companies sell IMSI catchers. Some can fit into a briefcase; others are as small as a mobile phone.

Once up, the IMSI catcher tricks phones into wirelessly sending it data. By setting up several IMSI catchers and measuring the speed of the responses or 'pings' from a  phone, the surveiller can follow on a computer screen the location and movement of anyone with turned-on mobile, anywhere within the parameters of the IMSI catchers -- even when they are not using their phones.

Companies that offer this equipment include Ability in Israel, Rohde & Schwarz in Germany, and Harris Corporation in the US.

The Federal Bureau of Investigation (FBI), which uses these devices to track suspects, claims it can do so without a court order. Many police forces around the world have also bought, or are considering buying, IMSI catchers.

Other companies offer passive surveillance devices that can be installed at phone exchanges, or even stand-alone equipment that can covertly vacuum up all the mobile phone signals in an area.

Specialized gadgets attached to a vehicle can track where it goes. While logistics and trucking companies have long used these devices to ensure on-time delivery of goods, UK-based Cobham sells Orion Guardian covert devices that can be secretly attached to the bottom of a car. Hidden Technology, another British company, sells similar devices.

"For years, there has been a gentleman's agreement on how these technologies are used," says Chris Soghoian, a Washington DC-based fellow at the Center for Applied Cybersecurity Research. "The US and the UK know that the Chinese and the Russians are using IMSI catchers -- but so are we. Each government believes that the benefit of being able to use it abroad outweighs the risk to their own citizens.

"But today, anyone -- a stalker or a private company- - can show up in Chelsea or Tottenham Court Road [London] and listen to everyone else," adds Soghoian. "It is time to switch to more encrypted systems that keep everyone safe."

Hacking

Several companies offer "Trojan" software and phone "malware" that allow the user to take control of a target's computer or phone.

The software can be installed from a USB drive, or delivered remotely by disguising itself as an email attachment or software update. Once in place, a surveiller can riffle through a target's files, log every keystroke, and even remotely turn on phone and computer microphones and cameras to spy on the target in real-time.

Hacking Team of Italy, Vupen Security in France, Gamma Group in the UK, and SS8 in the US, each offer such products, which they variously claim can hack the Apple iPhone, BlackBerry, Skype, and the Microsoft operating system.

Hacking Team is probably the most public of these companies, advertising on a public website that its "Remote Control System" can "monitor a hundred thousand targets."

SS8 of Milpitas, California, claims that its Intellego product allows security forces to "see what they [the targets] see, in real time" including a "draft-only emails, attached files, pictures and videos."

These technologies often rely on software vulnerabilities. While major software manufacturers claim to fix these flaws as soon as they are discovered, at least one company, Vupen, boasts dedicated researchers in its "Offensive Solutions" division who are constantly looking to exploit new security holes in popular software.

Hacking systems have recently surfaced in countries with repressive governments. In March when Egyptian democracy activists raided the intelligence headquarters of Hosni Mubarak's regime, they uncovered contract documents for a hacking program called FinFisher that is marketed by Gamma Group, a UK company. Governments can use this product to "identify an individual's location, their associates and members of a group, such as political opponents," according to a brochure from Elaman, a German company with close links to Gamma which also sells FinFisher.

Massive Surveillance

While hacking software targets individuals, other technologies on the market can monitor and censor an entire data or telecommunications network. Massive surveillance works by capturing everyone's activities -- whether they are a suspect or not -- and then sifting it for valuable information. For example, US companies Blue Coat Systems and Cisco Systems offer corporate and government buyers technology that can filter web access based on commercial, political, religious or cultural criteria.

Businesses routinely these web-filtering products to catch employees surfing the web when they should be working. But the same technologies can also be used to block social networking websites such as Facebook, multimedia services including Flickr and YouTube, and internet phone services like Skype in countries ranging from China to the United Arab Emirates.

An extension of this technology, "deep packet inspection," allows the user to scan web and email traffic, and to read through huge volumes of web searches and emails searching for keywords:

--Companies including ipoque in Germany and Qosmos in France offer the ability to peer inside email traffic and block specific users such as dissidents.

--Datakom, a German company, sells a product called Poseidon that can "'search and reconstruct... web, mail, instant messaging etc." The company also claims Poseidon "collects, records and analyses VoIP calls," such as Skype conversations.

--Datakom, which offers "monitoring of a complete country," says it has sold two "large IP monitoring'" systems to unnamed buyers in the Middle East and North Africa region.

--South African VASTech sells Zebra, a product that gives governments the ability to compress and store billions of hours of phone calls and petabytes (a billion megabytes) of information for future analysis. In August, the Wall Street Journal reported that VASTech devices had been installed at the country's international phone exchanges.

Data Analysis

Needless to say, the sheer volume of data form internet traffic, the locations of individuals and their phone conversations could overwhelm. But a parallel analytical technology is providing intelligence agencies, the military, and the police with sophisticated tools that compile and sift information for use in criminal investigations and even in the battlefield.

For example, Speech Technology Center, based in Russia, offers a product called STC Grid ID that it claims provides "reliable identification [of a] nation-wide database of speakers."

Czech Republic-based Phonexia, with the help of the Czech military, claims to have developed a similar voice-recognition program. Italian-based Loquendo uses 'voice-prints' -- the unique signature of the human voice -- to identify targets and flag up their calls in real-time. And yet another company, Massachusetts-based Intelligent Integration Systems (IISi), sells Geospatial Toolkit, a "location-based analytics' program."

But legal documents filed in the US show that these technologies do not always work as promised.

Another Massachusetts company, Netezza, allegedly bought a copy of Geospatial Toolkit, reverse-engineered the code, and then sold a hacked version to the CIA for use in remotely piloted drone aircraft. IISi, which says that the software could be wrong by a distance of up to 40 feet, sued Netezza to prevent the use of this software. Company founder Rich Zimmerman stated in court that his "reaction was one of stunned amazement that they (CIA) want to kill people with my software that doesn't work."

The two companies settled out of court in November 2010. The CIA has refused to comment.

Digital Past, Dystopian Future

Wikileaks warns that the surveillance contractors revealed in the Spy Files are selling the ability to irrevocably alter our lives with their ability to delve into the digital past.

"We all aware of traditional spy stories of intelligence agencies like MI5 bugging the phone of one or two people," says Julian Assange. "In the last ten years, something else has happened. We now see mass surveillance, where computer systems of an entire country are infected by surveillance programs, where the entire phone calls of a nation can be and are recorded by a company."

"Previously we had all thought, why would the government be interested in me, my brother? My business is not interesting, I am not a criminal," Assange told the Bureau earlier this week. "Now these companies sell to state intelligence agencies the ability to spy on the entire population at once and keep that information permanently. In five or six years' time, if your brother or someone becomes of interest to that company or the government, they can go back in time and look to see what you said or what you emailed."

• 116 Human Rights