Investigation Finds Signs of Secret Phone Surveillance Across London

[MikeWB]

A VICE News investigation has found evidence that sophisticated surveillance equipment that spies on people's phones is being used across London, and uncovered a growing black market for the technology worldwide.

Signs of IMSI catchers — also known as stingrays or cell-site simulators — were found at several locations in the British capital, including UK parliament, a peaceful anti-austerity protest, and the Ecuadorian embassy.

A former senior surveillance insider also confirmed to VICE News that they have been used by UK police.

The portable devices are typically used by state law enforcement. They monitor thousands of phones at a time, and are capable of intercepting calls, text messages, and emails.

After going undercover, however, VICE News was offered an IMSI catcher for $15,000 from a company that claimed to have sold the devices to private companies and state law enforcement all over the world — including Russia, Africa, and the US.

Related: The Google Search That Made the CIA Spy on the US Senate

VICE News could not determine whether the signals it detected in London belonged to state apparatus, in part because of a UK law enforcement policy of refusing to discuss IMSI catchers on national security grounds.

IMSI catchers work by pretending to be mobile phone base stations, which connect our phones to the network. Phones connecting to the devices surrender their unique identifier (IMSI) and can be monitored.

However, they have sparked controversy among civil liberties campaigners because they automatically harvest information from all phones in a given radius — including those used by innocent people.

VICE News worked with global surveillance watchdog Privacy International over several months to accumulate evidence of IMSI catchers.

Police at the Million Mask March in London, November 5, 2015. (Photo by Daniel Bateman/VICE News)

IMSI Catchers in London
Privacy International's IMSI catcher detection equipment identified suspicious signals at several locations around London.

At an anti-austerity demonstration on June 20, which attracted thousands of largely peaceful protestors, the equipment detected a mobile phone tower that appeared to be moving.

It was a base station that showed "massive variance in signal strength" at different points of the march, said Richard Tynan, a technologist for Privacy International. It suggested that an IMSI catcher was inside the protest, logging campaigners' phones.

At the Ecuadorian embassy, home to WikiLeaks founder Julian Assange since August 2012, we witnessed another clue: a base station switching between network providers in rapid succession.

"Each base station is supposed to remain configured to only broadcast its own network ID," said Tynan. "Broadcasting a spoofed network ID is a hallmark of IMSI catchers."

Watch the VICE News documentary, Phone Hackers: Britain's Secret Surveillance:

The equipment also seemed to be in use close to St. Paul's Cathedral, where a base station was configured in an unusual way that was consistent with Tynan's understanding of IMSI catchers. The signal was also at its strongest level, but no base stations were visible.

At Westminster, an extremely strong signal was detected at the Cromwell Green entrance to parliament. The base station should have been visible — but there were no obvious phone towers, and none marked on the latest available records, which date to 2012.

Related: DC Police, the FBI, and Their Secret Agreement to Hide Cell Phone Spying

VICE News asked the House of Commons whether any phone signal boosters exist at this location. A press officer told us there was none and, after additional enquiries, instructed us to ask under freedom of information legislation. This was rejected on the grounds that disclosure of the information "would be likely to prejudice the prevention and detection of crime."


Suricatch: the IMSI catcher debuted by Groupe SSI at Milipol, Paris. (Photo by VICE News)

State Surveillance for Sale
In an airy expo hall to the north of Paris, state and company representatives are browsing row after row of defense equipment. People in smart suits wander the aisles, some sipping glasses of champagne, occasionally pausing to toy with cutting-edge firearms.

This is Milipol: one of the largest state security fairs in the world. Taking place in the third week of November 2015, the event is one of a small number of opportunities for the naturally reclusive surveillance industry to advertise its wares.

The so-called lawful interception industry is growing rapidly, with worldwide sales estimated to reach $1.3 billion by 2019, according to Markets and Markets research firm.

Groupe Sécurité Service Industrie's most prominent display was a brand new IMSI catcher, receiving its debut at Milipol. This merged video and phone surveillance, and had been well received at the fair, according to sales representative Philippe Grison.

Related: Court Rules That Muslims Can Sue the NYPD for Spying on Them

The 35,000-euro ($38,000) "pocket catcher" was very small and could be held by an individual, or set up in a box or a car, he said. It could catch information from more than 1,000 phones at a time.

The company had "very good relations with UK companies and enforcement agencies," Grison said.

According to Grison's colleague, another of their tools — a "situational awareness platform" that did not directly involve lawful interception — was being used by Birmingham, Merseyside, Thames Valley, and Leicester police forces.

"We have very good clients," the salesman added.

"As far as we're concerned our service is to provide law enforcement agencies with the technology to do their job," added Grison. "The way to use it depends on the regulations of their country."

Protestors surround a flare at the Million Mask March in London on November 5, 2015. (Photo by Daniel Bateman/VICE News)

"National Security"
VICE News sent freedom of information requests to police forces around the UK requesting information about their use of IMSI catchers. Yet the response was almost always the same — police would neither confirm nor deny that they use the technology on grounds of national security.

One former senior surveillance inspector told VICE News, however, that the devices have been used by UK police.

Sam Lincoln was the Chief Surveillance Inspector with the Office of Surveillance Commissioners — the body that oversees surveillance — from 2006-13. "It is a fairly common tactic that is used by police. And certainly from a legal perspective there is no bar," he said. "They would usually be used for locating fugitives, missing persons, identifying the location of subjects of interest, to trigger other parts of a covert operation."

Lincoln added that the devices might also have been used at protests: "Without talking about specifics, certainly there appears to be enough evidence in the public domain to suggest that they have been used in that way before, yes."

Getting a surveillance authorization for a device like an IMSI catcher is "not a straight rubber stamping job," he added. But there are too few inspectors reviewing the paperwork, he said. "We were identifying plenty of paperwork which some might view as invalid."

Related: How Colombia Built a Massive Surveillance 'Shadow State'

Black Market
The sale of powerful surveillance technology to repressive regimes and private individuals is regulated by a 41-country agreement called the Wassenaar arrangement. Several of the Milipol exhibitors expressed concern over a growing black market for the equipment, however, fueled by unregulated tech companies in China and Hong Kong.

VICE News approached a company selling IMSI catchers using an online marketplace. Posing as a consultant acting for a wealthy client, we asked if it would sell the technology to us, making it clear that we were not state representatives.

An organization calling itself HK Medsourcing, based in Hong Kong, agreed to sell us an IMSI catcher for $15,000-20,000. "It can catch around 1,200 numbers per minute," said salesman Edward Tian over Skype.

Using an IMSI catcher in the UK is illegal, so Tian said he could ship the device as a repeater — a mobile signal booster — to stop it from being confiscated by UK customs.

"Our company was started many years ago in a business of manufacturing mobile signal repeaters, you know, which are to boost the signal," he said. "We export it in the same name. Because they are, you know, in many aspects they are very similar. It's radio frequency equipment so we claim it's a repeater."

VICE News repeated that we were not state law enforcement or a dealer of IMSI catchers. "We are not very clear about the local law, about the recommendations," said Tian, "so you need to assure us that you are using it legally. And we make arrangements according to your requirements. That's not a problem."

The company said it has not sold any equipment to the UK before. But they had made sales to North America, South America, Africa, Russia, Israel, and "some south-east Asian countries." The week before they had attended a tender in Bangladesh — where security forces have been accused of extrajudicial killings by Human Rights Watch.

It also claimed to have sold technology to private companies. "A trade company or an investigation company," said Tian. He assured us over email that the device would be able to intercept text messages, but later expressed concerns about providing this capability to a private individual.

"Many people ask but at the moment we are a little bit reluctant. We are thinking about it because maybe some, the American CIA or anything or somebody follow us, we will be in trouble," Tian said. "We can talk through emails."


The IMSI Catcher offered to VICE News.

The UK
In the UK new oversight of surveillance is being considered in the draft Investigatory Powers Bill, but the current regime is "almost completely ineffective," according to David Davis, a senior backbench Conservative MP.

"I think the whole approach of IMSI catchers, which is a block collection of people's telephone information, is a general cause for concern," said Davis. "Largely because the public at large assume that interception of communications is the sort of thing that is done very specifically.

"The simple truth is there are intelligence agencies, police agencies in other countries who are our allies, who are dealing with the same threats who are much more open about it," he added.

A spokesperson for network provider Vodafone told VICE News it used "advanced technology systems" to protect customer data and did not allow any form of access to customer data by the authorities "unless we are legally obliged to do so."

They added: "There are wide-ranging legal restrictions prohibiting disclosure of any aspect of the technical and operating systems and processes used when complying with agency and authority demands. In some countries, it is unlawful even to reveal that such systems and processes exist at all."

A spokesperson for network provider O2 told VICE News that there it has no agreements in place with government or security services for the deployment of IMSI catchers.

"We do actively monitor our networks for a variety of threats, interference, and disruption and have never detected such equipment operating on our network," they added.

A spokesperson for EE responded to emails, but failed to deliver a comment.


https://news.vice.com/article/vice-news-investigation-finds-signs-of-secret-phone-surveillance-across-london