[governance] More on surveillance: GCHQ intercepted foreign politicians' communications at G20 summits

Tue Jun 18 09:02:21 EDT 2013

GCHQ intercepted foreign politicians' communications at G20 summits

Exclusive: phones were monitored and fake internet cafes set up to gather
information from allies in London in 2009

Ewen MacAskill, Nick Davies, Nick Hopkins, Julian Borger and James Ball
The Guardian, Monday 17 June 2013
Documents uncovered by the NSA whistleblower, Edward Snowden, reveal
surveillance of G20 delegates' emails and BlackBerrys. Photograph: Guardian

Foreign politicians and officials who took part in two G20 summit meetings
in London in 2009 had their computers monitored and their phone calls
intercepted on the instructions of their British government hosts,
according to documents seen by the Guardian. Some delegates were tricked
into using internet cafes which had been set up by British intelligence
agencies to read their email traffic.

The revelation comes as Britain prepares to host another summit on Monday –
for the G8 nations, all of whom attended the 2009 meetings which were the
object of the systematic spying. It is likely to lead to some tension among
visiting delegates who will want the prime minister to explain whether they
were targets in 2009 and whether the exercise is to be repeated this week.

The disclosure raises new questions about the boundaries of surveillance by
GCHQ and its American sister organisation, the National Security Agency,
whose access to phone records and internet data has been defended as
necessary in the fight against terrorism and serious crime. The G20 spying
appears to have been organised for the more mundane purpose of securing an
advantage in meetings. Named targets include long-standing allies such as
South Africa and Turkey.

There have often been rumours of this kind of espionage at international
conferences, but it is highly unusual for hard evidence to confirm it and
spell out the detail. The evidence is contained in documents – classified
as top secret – which were uncovered by the NSA whistleblower Edward
Snowden and seen by the Guardian. They reveal that during G20 meetings in
April and September 2009 GCHQ used what one document calls "ground-breaking
intelligence capabilities" to intercept the communications of visiting
delegations.

This included:

• Setting up internet cafes where they used an email interception programme
and key-logging software to spy on delegates' use of computers;

• Penetrating the security on delegates' BlackBerrys to monitor their email
messages and phone calls;

• Supplying 45 analysts with a live round-the-clock summary of who was
phoning who at the summit;

• Targeting the Turkish finance minister and possibly 15 others in his
party;

• Receiving reports from an NSA attempt to eavesdrop on the Russian leader,
Dmitry Medvedev, as his phone calls passed through satellite links to
Moscow.

The documents suggest that the operation was sanctioned in principle at a
senior level in the government of the then prime minister, Gordon Brown,
and that intelligence, including briefings for visiting delegates, was
passed to British ministers.

A briefing paper dated 20 January 2009 records advice given by GCHQ
officials to their director, Sir Iain Lobban, who was planning to meet the
then foreign secretary, David Miliband. The officials summarised Brown's
aims for the meeting of G20 heads of state due to begin on 2 April, which
was attempting to deal with the economic aftermath of the 2008 banking
crisis. The briefing paper added: "The GCHQ intent is to ensure that
intelligence relevant to HMG's desired outcomes for its presidency of the
G20 reaches customers at the right time and in a form which allows them to
make full use of it." Two documents explicitly refer to the intelligence
product being passed to "ministers".

One of the GCHQ documents. Photograph: Guardian

According to the material seen by the Guardian, GCHQ generated this product
by attacking both the computers and the telephones of delegates.

One document refers to a tactic which was "used a lot in recent UK
conference, eg G20". The tactic, which is identified by an internal
codeword which the Guardian is not revealing, is defined in an internal
glossary as "active collection against an email account that acquires mail
messages without removing them from the remote server". A PowerPoint slide
explains that this means "reading people's email before/as they do".

The same document also refers to GCHQ, MI6 and others setting up internet
cafes which "were able to extract key logging info, providing creds for
delegates, meaning we have sustained intelligence options against them even
after conference has finished". This appears to be a reference to acquiring
delegates' online login details.

Another document summarises a sustained campaign to penetrate South African
computers, recording that they gained access to the network of their
foreign ministry, "investigated phone lines used by High Commission in
London" and "retrieved documents including briefings for South African
delegates to G20 and G8 meetings". (South Africa is a member of the G20
group and has observer status at G8 meetings.)

Another excerpt from the GCHQ documents. Photograph: Guardian

A detailed report records the efforts of the NSA's intercept specialists at
Menwith Hill in North Yorkshire to target and decode encrypted phone calls
from London to Moscow which were made by the Russian president, Dmitry
Medvedev, and other Russian delegates.

Other documents record apparently successful efforts to penetrate the
security of BlackBerry smartphones: "New converged events capabilities
against BlackBerry provided advance copies of G20 briefings to ministers …
Diplomatic targets from all nations have an MO of using smartphones.
Exploited this use at the G20 meetings last year."

The operation appears to have run for at least six months. One document
records that in March 2009 – the month before the heads of state meeting –
GCHQ was working on an official requirement to "deliver a live dynamically
updating graph of telephony call records for target G20 delegates … and
continuing until G20 (2 April)."

Another document records that when G20 finance ministers met in London in
September, GCHQ again took advantage of the occasion to spy on delegates,
identifying the Turkish finance minister, Mehmet Simsek, as a target and
listing 15 other junior ministers and officials in his delegation as
"possible targets". As with the other G20 spying, there is no suggestion
that Simsek and his party were involved in any kind of criminal offence.
The document explicitly records a political objective – "to establish
Turkey's position on agreements from the April London summit" and their
"willingness (or not) to co-operate with the rest of the G20 nations".

The September meeting of finance ministers was also the subject of a new
technique to provide a live report on any telephone call made by delegates
and to display all of the activity on a graphic which was projected on to
the 15-sq-metre video wall of GCHQ's operations centre as well as on to the
screens of 45 specialist analysts who were monitoring the delegates.

"For the first time, analysts had a live picture of who was talking to who
that updated constantly and automatically," according to an internal review.

A second review implies that the analysts' findings were being relayed
rapidly to British representatives in the G20 meetings, a negotiating
advantage of which their allies and opposite numbers may not have been
aware: "In a live situation such as this, intelligence received may be used
to influence events on the ground taking place just minutes or hours later.
This means that it is not sufficient to mine call records afterwards –
real-time tip-off is essential."

In the week after the September meeting, a group of analysts sent an
internal message to the GCHQ section which had organised this live
monitoring: "Thank you very much for getting the application ready for the
G20 finance meeting last weekend … The call records activity pilot was very
successful and was well received as a current indicator of delegate
activity …

"It proved useful to note which nation delegation was active during the
moments before, during and after the summit. All in all, a very successful
weekend with the delegation telephony plot."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.igcaucus.org/pipermail/governance/attachments/20130618/aca16d85/attachment.htm>
-------------- next part --------------
____________________________________________________________
You received this message as a subscriber on the list:
     governance at lists.igcaucus.org
To be removed from the list, visit:
     http://www.igcaucus.org/unsubscribing

For all other list information and functions, see:
     http://lists.igcaucus.org/info/governance
To edit your profile and to find the IGC's charter, see:
     http://www.igcaucus.org/

Translate this email: http://translate.google.com/translate_t