#HackingTeam Leaks: Lebanon’s Cybercrime Bureau Exploited Angry Birds to Surveil Citizens’ Mobile Devices · Global Voices
Red bird pilot by fORCEMATION via deviantart.com (CC BY 3.0)
Since the massive hack of the controversial Italian security and surveillance technology firm Hacking Team, journalists and human rights defenders in the Arab region have been carefully combing the 400GB of leaked data.
Hacking Team is best known for its “Remote Control System” which the leaks confirm has been used by oppressive regimes in Saudi Arabia, Bahrain, Sudan, UAE, Oman, Morocco and Egypt to surveil and intimidate political opponents, journalists, and human rights advocates.
Two weeks ago, WikiLeaks published more than 1 million searchable emails from the hack, which have shed light on the modus operandi of the firm’s team, their communication with clients, and their regular analysis of the political dynamics in the Middle East and elsewhere.
Gamers, beware
In a previous post, we explored leaked files confirming that the Lebanese Army purchased Hacking Team’s Galileo spy software, among other products. WikiLeaks’ searchable database indicates that Lebanon’s Interior Security Forces (ISF), General Security and the Cybercrime Bureau also contacted Hacking Team in an effort to purchase the software. A simple search for any of these terms in WikiLeaks database renders dozens of results.
Among emails exposed in the leak, the first signs of communication between ISF, its intelligence branch, and Hacking Team appear in 2014. These and all other communications between Lebanese officials and Hacking Team were mediated by PSEC & KAF, a private electrical and engineering services company in Lebanon.
Emails indicate [see PDF reproduction of email attachments]* that Hacking Team conducted a “proof of concept” demo on July 23-24, 2014 on the Interior Security Forces premises in Beirut. A rough translation of the report indicates that during the demo, ISF personnel were able to successfully infect target devices. With the help of Hacking Team staff, they created a technical “backdoor” in the devices (a virtual channel through which authorities can monitor a user’s activities) by exploiting a security flaw in the mobile phone game application Angry Birds:
Along with the Lebanese Army and the Interior Security Forces, the Cybercrime Bureau established contact with Hacking Team on February 25, 2015. 235
Their email read as follows:
Sirs,
This is cybercrime and IP Bureau-interior security forces-Lebanon.
Please note that we are a law enforcement agency in Lebanon,specialized in cybercrime investigations and we think that your software “GALLILEO-remote control system” could be helpful in our job.
Therefore,you are kindly requested to provide us with all the details about that software including the features,price,contact person and email address in case we need any support,and how this
software could be helpful in our criminal investigations.
Best Regards.
Cybercrime and IP bureau
Interior security forces
Further emails indicate that a demo for Galileo RCS took place in Beirut on March 30, 2015 in the offices of the Cybercrime Bureau. A reproduction of the report from the demo appears below.*
The report also indicates that the Cybercrime Bureau had contact with Gamma, another leading surveillance technology company and creator of FinFisher, a spyware product with capabilities similar to Hacking Team’s Remote Control System.
The demo focused mainly on mobile infection and interception. The demo and reports were followed by an offer revealing that the Cybercrime Bureau pursued a contract under which they targeted 50 individuals for a total of 450,000 Euros.
Targeting activists and bloggers
Several activists and bloggers who have been subject to repeated summons and investigations by the Lebanon’s “cyber watchdog”, the Cybercrime Bureau, now suspect that authorities used Hacking Team products to infect their devices and monitor their communications.
In a recent article on data privacy and digital surveillance in Lebanon, journalist <PERSON> described a tense local scenario in which citizens and various government agencies have widely varying interpretations of what constitutes lawful surveillance in Lebanon. Here, he summarizes a common approach taken by Lebanon’s Cybercrime Bureau in the course of investigations:
When summoned, the cyber crime bureau agents reportedly pressure bloggers to sign draconian documents vowing to refrain from mentioning the company or individuals they have criticized in the future. In some cases, bloggers have claimed that police agents tricked them into giving up information by sending malware to their computers, a practice [Major <PERSON>, head of the Cybercrime Bureau] seemed to endorse by claiming ‘ethical hacking’ used by law enforcement is sometimes needed to protect the greater good. Yet, increasingly that greater good seems to be defined by the interests of the wealthy and well-connected…many activists and lawyers worry that the bureau is unregulated and poses a threat to free speech. 534