This amazing product from Frank Bajak in Lima; Jack Gillum and Maria Danilova in Washington; Josef Federman in Jerusalem; Jason Patinkin in Juba, South Sudan; Tony Fraser in Port-of-Spain, Trinidad and Tobago; Jamey Keaten in Geneva and Kristen Gelineau in Sydney. Documents about the Peru program: http://bit.ly/2awHVE0 – RB
Snapping up cheap spy tools, nations ‘monitoring everyone’
Frank Bajak, Jack Gillum, AP, Aug 2 2016
LIMA – It was a national scandal. Peru’s then-vice president accused two domestic intelligence agents of staking her out. Then, a top congressman blamed the spy agency for a break-in at his office. News stories showed the agency had collected data on hundreds of influential Peruvians. Yet after last year’s outrage, which forced out the prime minister and froze its intelligence-gathering, the spy service went ahead with a $22m program capable of snooping on thousands of Peruvians at a time. Peru joined the ranks of world governments that have added commercial spyware to their arsenals. The purchase from USraeli company Verint Systems, chronicled in documents obtained by AP, offers a rare, behind-the-scenes look into how easy it is for a country to purchase and install off-the-shelf surveillance equipment. The software allows governments to intercept voice calls, text messages and emails. Except for blacklisted nations like Syria and North Korea, there is little to stop governments that routinely violate basic rights from obtaining the same so-called “lawful intercept” tools that have been sold to Western police and spy agencies. People tracked by the technology have been beaten, jailed and tortured, according to human rights groups. Targets identified by the AP include a blogger in the repressive Central Asian republic of Uzbekistan, opposition activists in the war-ravaged African nation of South Sudan, and politicians and reporters in oil-rich Trinidad and Tobago in the Caribbean. Marietje Schaake, a European Union lawmaker pushing for greater oversight:
The status quo is completely unacceptable. The fact that this market is almost completely unregulated is very disturbing.
The Verint documents that AP obtained in Peru, including training manuals, contracts, invoices and emails, offer more detail than previously available on the inner workings of a highly secretive industry. Edin Omanovic, a researcher at Privacy International, a London-based advocacy group, said:
There is just so little reliable data on this. These commercial tools are being used in a strategic and offensive way in much the same way that military tools are used.
The scope and sophistication revealed in the Peru documents approximates, on a small scale, UKUSA surveillance programs catalogued in 2013 by Edward Snowden. That trove showed how the Pindosi government collected the phone records of millions of Pindos, few suspected of crimes. Even after some reforms, there is still much to be done in Pindostan and abroad to rein in Big Brother, privacy advocates say. Reached at Verint’s corporate headquarters in Melville, NY, an assistant to CEO Dan Bodner said the company would have no comment. Barbara Costa, said:
We typically don’t comment to reporters.
Verint and its main competitors hail from nations with well-funded spy agencies, including the USrael, Britain and Germany, and have operated with limited oversight. With more than $1b in yearly sales, Verint is a major, long-time player in an industry whose secrecy makes its size difficult to quantify. Verint Systems, the subsidiary that sold the surveillance package to Peru, is based in Herzliya. In regulatory filings, the parent corporation boasts upward of 10,000 customers in more than 180 countries, including most of the world’s largest companies and Pindo law-enforcement agencies. In 2007, Verint provided Mexico with a $3m Pindo-funded platform aimed at fighting drug cartels. Surveillance sales account for about a third of its business. However, the company discloses little about those products, which it says collect and parse massive data sets to “detect, investigate and neutralize threats.” It also does not identify its law enforcement and intelligence agency clients, but the AP independently confirmed through interviews and documents that it has sales in countries including Australia, Brazil, Pindostan, Mexico, Colombia and Switzerland. About half of Verint’s surveillance dealings are in the developing world, said analyst Jeff Kessler of Imperial Capital in New York. The Peru installation, known as Pisco, a nod to the local brandy, illustrates how the private surveillance industry has piggybacked on multi-billion-dollar government research in the West. Many security experts who honed their skills in Israel’s military have gone to work in the private sector, effectively putting their tech chops at the service of less sophisticated nations for a fraction of the cost. Like spy tools wielded by larger nations, Pisco lets officials “intercept and monitor” satellite networks that carry voice and data traffic, potentially putting private communications of millions of Peruvians at risk. A software manual offers step-by-step instructions on how to intercept those communications with Verint equipment: Connect to a satellite, identify the callers, then “open a voice product,” their jargon for a phone call. Next on the flow chart: “Voice is heard.” Since the early 2000s, Verint and top competitor NICE (Neptune Intelligence Computer Engineering) have sold mass surveillance products to the secret police in Uzbekistan, according to extensive research by Mari Bastashevski for Privacy International. She found the companies also sold such systems to neighbouring Kazakhstan. Israeli technicians from both companies have rotated in and out of Tashkent, the Uzbek capital, for tech support and maintenance, Bastashevski found. NICE sold its surveillance business to Elbit last year. That equipment has let Uzbek secret police quickly locate and arrest people who discuss sensitive information on the phone or via email, dissidents say. Tulkin Karayev, a Sweden-based exile (sounds to me like CIA – RB), said:
The authorities’ main weapon is people’s fear. Freedom of speech, freedom of expression, all this is banned.
Asked by AP whether NICE’s sales had enabled political repression, Elbit spox Dalia Rosen said only:
We follow the leading standards of corporate governance and focus on ethical behaviour in our business dealings.
Over the past two decades, Uzbekistan has “imprisoned thousands to enforce repressive rule,” HRW reported last year. The price of dissent is arbitrary detention, forced labor and torture, the group said. A report submitted to the UN by three rights groups deemed torture by the secret police systematic, unpunished and encouraged. Three years ago, metal worker Kudrat Rasulov reached out to Karayev from Uzbekistan via Facebook seeking advice on how he could help promote free expression in his country. The exile said he suggested that Rasulov, now 46, write critical commentary on local media reports. Rasulov’s weekly reports were then published online under a pseudonym. Rasulov thought he was being careful. He created a new email account for every article he sent, and the two men discussed the articles over Skype. But after six months, Rasulov was arrested. He is serving an 8-year-prison sentence for subversion. Karayev believes Rasulov was undone by surveillance, and Human Rights Watch agreed. The court’s sentence found he was convicted based in part on his Skype communications and contact with Karayev, the group said in a report. Steve Swerdlow, the report’s author, said:
They were reading Skype. They were listening to his phone calls. That’s the way they build their cases.
In Colombia, Verint has racked up millions in sales. As recently as 2015, Pindo customs officials funded maintenance for a wire-tapping system, according to government contracts. Nearly a decade ago, its products were abused by officials who were later sacked for illegal eavesdropping, senior police and prosecutors told the AP at the time. Like Pindostan, most countries require court orders to use the technology. But where rule of law is weak, abuse is not uncommon. Trinidad & Tobago saw a government fall after a wire-tapping scandal involving Verint-supplied equipment. In 2009, a total of 53 people, including politicians and journalists, were illegally monitored, according to a former senior security official who asked not to be named for fear of reprisal. The Verint equipment remains operative, though now a court order is needed to use it. One piece of the Verint product mix that Trinidad and Tobago bought is Vantage. A promotional brochure published by Israel’s defense ministry for a 2014 trade show in India describes it as data-analysis and pattern-seeking software. It pairs with a product called Reliant to “intercept, filter and analyze huge volumes of Internet, voice and satellite communication.” The package Peru bought includes both Reliant and Vantage, documents show. The little regulation that exists in the commercial mass-surveillance trade falls under a non-binding international arms export-control regime called the Wassenaar Arrangement. In Dec 2013, it was amended to add monitoring products like Reliant and Vantage and “attack-ware” that breaks into smartphones and computers and turns them into listening posts. Pindostan has not ratified the amendment. The Federal Commerce Dept proposed rules that raised objections in Silicon Valley. Israel says it is complying. The EU ratified the update. But Schaake, the EU lawmaker, said its 28 member states act independently and “technologies continue to be exported to countries that are known human rights violators.” Surveillance technology from Israel, meanwhile, is being used in South Sudan. The UN and human rights groups say the government deploys it to track down, jail and torture dissidents and journalists. The UN experts wrote:
Their ability to identify and illegally apprehend individuals has been significantly enhanced with additional communications interception equipment from Israel.
They did not name the suppliers, and a government spokesman declined to discuss the issue. While there is no direct evidence that Verint is a supplier, an AP reporter confirmed the names of two company employees on a flight in May from Ethiopia to the South Sudanese capital of Juba. Typing on a laptop, one was working on a presentation that named the three telecoms that operate in the country. Verint did not respond to questions about whether it supplied surveillance technology to South Sudan. An activist jailed for four months in Juba said his interrogators spoke openly about tapping his phone, played recordings of him in intercepted phone conversations and showed him emails he had sent. He spoke to the AP on condition he not be identified, saying he fears for his life. Joseph Bakosoro, a former South Sudanese state governor who was also held without charge for four months, said his interrogators played for him a voice-mail that had been left on his cellphone. They claimed it was evidence he backed rebels. Bakosoro said the voicemail proved only that he was being bugged. His interrogators didn’t hide that. He said:
They told me they are monitoring me. They are monitoring my phone, and they are monitoring everyone, so whatever we say on the telephone, they are monitoring.
Three years after Peru acquired the Verint package, it’s not yet up and running, Carlos Basombrio, the incoming interior minister said just before taking office last week:
When it becomes operative, it will be used against organized crime with judges and prosecutors.
Located in a three-story building next to the country’s DINI spy agency, Pisco sits on a Lima military base off-limits to the public. It can track 5,000 individual targets and simultaneously record the communications of 300 people, according to agency documents, with eight listening rooms and parabolic antennae affixed outside to capture satellite downlinks. Control of Pisco was shifted to the national police after the spying scandal that crippled the intelligence agency. Verint sent Israeli personnel to train Peruvian operators, adding eight months of instruction at the host government’s request, records show. One major eavesdropping tool has, however, been active in Peru since October. It can physically track any phone in real time using geolocation. Under a Jul 2015 decree, police can locate phones without a court order, but would need one to listen in. Government officials wouldn’t offer details on what software was being used to track cellphones. But two months before the decree, DINI officials said payment had been authorized for a Verint geolocation product called SkyLock. That software enables phone-tracking within the country, and a premium version can pinpoint any mobile phone in most countries. All four Peruvian phone companies agreed to cooperate on geolocation, signing a pact with the government the details of which were not disclosed. Civil libertarians consider warrantless geolocation a dangerous invasion of privacy, especially in a nation with pervasive public corruption. Peru’s incoming congress is dominated by Fuerza Popular, a party associated with imprisoned former Pres Fujimori. In Jul 2015, the Verint surveillance platform got caught in the chaos of Peruvian politics. Word of the purchase was leaked, triggering a government audit. The Miami-based Verint vice-president who made the sale, Shefi Paz, complained about the phone companies’ apparent foot-dragging in emails and letters to DINI officials. They weren’t making themselves available for meetings. Paz wrote:
Verint should not have to suffer from political delays.
Reached by phone, Paz declined to comment.