Original subtitles

BEN: Spyware is secretly used by governments

to track criminal activity.

This is about surveilling the activities of somebody

who is either thinking about breaking the law

or has actually broken it.

It's also deployed by repressive regimes

to spy on their opposition.

A government is a surveillance machine.

Journalists and dissidents are targeted for surveillance.

Whenever you speak against the government,

you are a terrorist.

Cyber weapons markets jeopardize lives in the name of profit.

We don't have official laws

that provide for transparency and accountability.

Should cyber mercenaries be held responsible?

♪

I'm going to meet someone who believes he's a victim

of cyber mercenary surveillance.

Mesay Mekonnen is a journalist for ESAT,

an Ethiopian news network.

From this nondescript office, Mesay and his team

can influence a country of more than 99 million.

So why don't you explain to me what ESAT is?

ESAT is an independent media organization.

It's established by Ethiopians, journalists who have been...

fled from Ethiopia because of the situation in Ethiopia.

We are working for the people of Ethiopia,

the voice for the voiceless,

so we are giving platform to the opposition.

And you're all journalists in exile?

Yeah, all.

The last 10 years, more than 100 journalists now have fled.

Why are the government going after journalists?

Media is their first enemy.

There's no free media in Ethiopia.

People working as free media,

they think that they are against the government.

And whenever you speak against the government,

you are a terrorist.

The Ethiopian government has been consistently singled out

by the UN and Human Rights Watch for instances

of targeting journalists for doing their work.

The Ethiopian government

continued harassing opposition members.

Several coalition members in Oromia and southern Ethiopia

are also intimidated, detained and tortured

for their involvement in politics.

In December 2013, ESAT employees

were targeted with a series of malware attacks through Skype.

I got this friend request, and the logo,

the person who sent me a friend request is ESAT's logo.

So I thought that it is a friend and not a bad guy,

so let me accept him.

When I accept him, he sent me immediately a PDF file,

and I tried to open.

There is... My computer, full of broken words,

and I got shocked.

To find out who was behind the attack and how they did it,

I traveled to San Francisco to speak with Bill Marczak

of Citizen Lab, a cyber surveillance watchdog.

When he came across the ESAT file Mesay received,

he got in contact with Mesay and examined the malware

that had infected his computer.

What did you discover?

So what we did was we looked at the server which the spyware

was communicating with to see if we could figure out any clues

about the spyware's origin.

The reason why spyware communicates with a server

is because it steals information off of your computer,

and it needs to send it to the attacker somewhere.

And one of the things we noticed is that

the server actually returned an SSL certificate that said,

"Issued by HTSRL."

An SSL certificate is a digital certificate used to authenticate

and create a secure link between a website and an end user.

And it also contained in the description,

"RCS Certification Authority," and RCS being the acronym for

Remote Control System, which is a product

of an Italian company known as Hacking Team.

Based in Italy, Hacking Team

has branded itself a global supplier of spyware,

with ads like this, featuring a shady black hat hacker

to hawk their tools and support services.

VOICE: Rely on us.

BEN: But they're not the only game in town.

Companies like FinFisher, CYBERBIT and Trovicor

also sell surveillance software.

Their spyware can surveil cell phones,

monitor your computer's camera and microphone,

and steal emails, passwords, contacts and files.

So we issued this report through Citizen Lab,

and immediately Hacking Team issued their denials.

But interestingly, we were monitoring the command

and control server which the spyware had communicated with,

and we noticed that it was very quickly pulled offline.

And then the hacks came back.

The hacks came back, yes.

In 2014, there were several instances where members of ESAT

received emails containing Hacking Team spyware.

Who was targeting them?

When we traced this spyware to this endpoint,

there was an internet address registered

to a satellite company which provides services across

all of Africa, the Middle East, and some places in Europe.

And we queried this range of IP addresses, and we found that

one of them had identified itself as INSA PC.

I was like, "Okay, Google, what is INSA?"

And the first hit was

Ethiopian Information Network Security Administration,

government of Ethiopia.

I was like okay, this is it.

Citizen Lab caught the Ethiopian government

trying to spy on journalists.

And the spyware they used was supplied by Hacking Team.

The one guy who could really explain the bigger picture

was Citizen Lab's director, Ron Deibert.

You've taken a particular interest

in digital surveillance tools.

Why is that?

There is a huge market for surveillance technologies,

and what we found is that that market extends to

some of the world's most notorious autocratic regimes

and human rights abusing countries.

And that's a problem from a human rights perspective.

Surveillance in and of itself is not a bad thing.

It is, I think, naive to expect we'd ever go back

to any sort of pristine time where there is no surveillance.

It's just part of human nature.

A government is a surveillance machine.

From the 15th century to today, it's the same.

The question is: what is that surveillance for,

and are there proper checks and balances around it?

That applies to what Citizen Lab does,

it applies to what Google does,

it applies to what the United States does.

Or Ethiopia.

Or Ethiopia, yeah.

How do you feel that there's a company in Italy,

that's a free country,

selling cyber surveillance tools to your country?

It's very, very unfortunate to, you know...

learn that these democratic countries, you know...

helping dictatorship in Africa.

Hacking Team had been caught red-handed,

so I wanted them to explain why they knowingly armed

an authoritarian regime with their surveillance tools.

BEN: In 2013 and 2014, the Ethiopian government targeted

journalists with spyware supplied and supported

by an Italian company called Hacking Team.

I think the view that we need 100% privacy

and anything else comes second is a shortsighted view,

and doesn't recognize the realities of the digital world.

Eric Rabe is Hacking Team's

Chief Marketing and Communications Officer.

We met in New York.

How about the case of Ethiopia?

Yeah, Ethiopia is a country that we became convinced

was using the software in an inappropriate way against

a person here in the US, a purported journalist.

The Ethiopian government frankly argued that that person

was also a member of a... an organization

that was actively trying to overthrow the government,

and that's why they wanted to surveil him.

So it was a legitimate sale to a customer who seemed to need it

and seemed to be willing to use it in an appropriate way.

We found out differently.

We suspended business with Ethiopia,

and they're not a client anymore.

These are some pretty powerful tools that you're selling.

What do they do exactly?

Well, they allow surveillance of activity in the digital space.

You know, with everything encrypted from end to end,

phone calls and internet communications

and email messages, the only way an investigator

can actually tell what somebody is doing

in that digital space is by accessing those tools

either before they're encrypted or after they're decrypted.

And that happens only in one place,

and that's on the device itself.

So this software allows observation

of that activity on the device.

So are these legitimate tools, do you think?

I think they are legitimate tools,

and I think they're really necessary for law enforcement.

This is not about, you know,

listening in on your cell phone conversation.

This is about surveilling the activities of somebody

who's either thinking about breaking the law

or who's actually broken it.

Although he has no direct evidence,

Mesay believes that the data gathered by

the Ethiopian government through Hacking Team's software

had devastating consequences for his colleagues.

Did any of the people that you were contacting

go to jail because of that hack?

Yeah!

Three of our contacts are now in jail.

So Hacking Team malware

essentially helped put Ethiopians in jail?

Definitely.

So you're talking about privacy, security.

What about human rights?

I don't think Hacking Team is the principle

human rights enforcement agency for the world.

We're a software company that serves law enforcement.

That's what we do.

We're not embarrassed about it.

We think it's important.

We spoke to people at ESAT who were the targets of Ethiopian

hackers, and they wondered why Hacking Team would sell

to a country who has obvious human rights violations.

Ethiopia was not on anybody's blacklist.

There was no prohibition that any country

- the US, the EU, NATO or anybody else -

had against Ethiopia at the time that software was sold.

That said, it doesn't take a global affairs PHD to know

that they've violated some really basic human rights.

Well, then I would suggest that

the appropriate... channel is for Italy, for example,

to refuse to allow us to sell there, or for the UN to act.

But then who's responsible

for what happens in the fallout of using these tools?

Does Hacking Team absolve themselves of that, or...?

No, I don't think so, but I think the human rights

organizations are unable to get to the countries involved

who are really responsible for the human rights abuses.

So they turn to, you know, those that they can reach,

that is companies like Hacking Team.

It's not an unreasonable political tactic to use,

but I don't think it's reasonable to say that

Hacking Team is responsible for human rights abuses.

But not everyone agrees.

On July 5th 2015, an infamous hacker known as Phineas Fisher

breached the Hacking Team's servers, exfiltrating

over 400 gigabytes of documents

and posting them online for anyone to see.

Security experts around the world

celebrated the leak on Twitter.

All of Hacking Team's dirty laundry spilt onto the internet,

exposing price lists and software source code.

Client lists showed sales to the FBI, DEA and US Army.

Even an officer with the Campus Police Force at UC Santa Barbara

was interested in buying its malware.

It also showed that Hacking Team was selling

to governments notorious for human rights abuses,

places like Kazakhstan, Bahrain and Sudan.

Maybe the hack was a good thing, it was a kick in the ass.

I don't think it was a good thing!

(Laughing) It was a...

You know, it was a criminal act.

It was.

I mean, there's sort of something about,

"Oh, we hacked into a company.

It's kinda cool, it's sort of Robin Hood, blah blah blah."

No, it's not Robin Hood.

It's Al Capone.

This is illegal.

You can't, just because you disagree with somebody,

you know, destroy them or attempt to destroy them.

And what about the hacker who hacked you guys?

Phineas Fisher?

I would love to meet him! (Laughing)

I wanted to meet the legendary Phineas Fisher too,

but that would prove to be pretty complicated.

Because after the leak, like any skillful hacker,

Phineas Fisher kept a low profile.

BEN: A black hat hacker had hacked Hacking Team's servers,

stealing hundreds of gigabytes of data.

After leaking it online,

Phineas Fisher all but disappeared.

But with an assist from my colleague at

VICE's tech and science site, Motherboard,

we finally negotiated interview terms.

Since we wouldn't be able to show his face,

the hacker had a strange request: he would only

do the interview if he was represented by a puppet.

These are the exact words from our live text exchange,

voiced by one of my colleagues.

What was the goal on hacking the Hacking Team data?

Were you trying to stop them?

Well, for the lulz.

I don't really expect leaking data to stop a company,

but hopefully it can at least set them back a bit

and give some breathing room

to the people being targeted with their software.

We spoke to some Ethiopian journalists who were targeted

by their government using Hacking Team's software,

and they wanted to thank you.

(Chuckling) Cool.

Kinda weird seeing my hacking addiction - I mean, hobby -

actually affecting people in the real world in a positive way.

What do you think of surveillance companies,

and Hacking Team specifically?

I would say they're people with no morals going where

the money is, but that's maybe not entirely true.

I imagine I'm not all that different

from Hacking Team employees.

The same addiction to that electronic pulse

and the beauty of the baud.

I imagine if you come from a background

where you see police as largely a force for good,

then writing hacking tools for them makes some sense.

But then Citizen Lab provides clear evidence it's being used

mostly for comic book villain level of evil.

In all, the FinFisher and Hacking Team customers

where targets of the spying have been identified in Bahrain,

Ecuador, Mexico, Ethiopia, it's all investigative journalists,

dissidents, political opposition, etc. being targeted.

Not real crime, but threats to those in power.

While Hacking Team was selling spyware

to law enforcement agencies tasked with catching criminals,

they also sold to authoritarian regimes who use their wares

to crack down on dissent.

Other details revealed through the Hacking Team data dump

was information about companies that were supplying Hacking Team

with the technology to build their spy tools.

Security firm Netragard was singled out for selling them

a zero-day; that is, an undiscovered security flaw

in software that can be exploited to penetrate a system.

Buying and selling zero-days is legal, but covert.

While they can be used to test and improve

a company's network security, zero-days can also be used

to inject malicious software into a computer.

A piece of technology that I created...

Well, brokered really, 'cause I didn't really create it.

But a piece of technology that I brokered, a deal that

I was involved with, potentially armed these rogue nations

with a tool that let them break into these other systems?

I didn't want any part of that.

Adriel Desautels admitted to selling a zero-day exploit

to Hacking Team after the ESAT hack.

I think that it should be your responsibility

to make sure that you are not selling to somebody

that you believe will do anything malicious.

That said, Netragard - respected, above-board company -

you sold to Hacking Team.

I know.

When you misuse a zero-day, who's more at fault:

the broker or the end user?

When you misuse a zero-day, the end user, absolutely.

I mean, if I sell...

You know, I'm Nike, and I sell shoes to some guy,

and he runs down a woman and rapes the woman.

Is it Nike's fault for selling the sneakers?

Or what about Microsoft?

How many people have been hacked by somebody

using Microsoft's operating system?

Microsoft's not accountable for that, right?

The ethics of it and the responsibility of it

are up to the actor or the team responsible

for executing that specific operation.

Adriel's moral dilemma seemed hard to avoid in the grey market

where zero-days are bought and sold,

a market fuelled by a booming cyber arms trade.

So I went to London to meet Edin Omanovic,

a cyber surveillance researcher for Privacy International.

So have you always been interested in the arms trade?

Yeah.

Just, you know, coming from Bosnia I've being interested in

conflict and the arms trade and foreign policy and so on.

Right, how the weapons gets where--

Yeah, exactly, yeah.

Does this surveillance market...

does it mirror at all the conventional weapons market?

What you've got in the arms market is a system whereby

governments have some kind of control over the exports.

So they would be able to say to this company,

"You're selling this.

We wanna be able to control who you're selling that to."

At the moment, that doesn't exist for

the surveillance market, because much of the technology is new.

Governments need to step in and say that if a product is being

sold from their country to a regime where it's gonna be used

for human rights abuses, they need to be able to stop that.

And who are the major players in it

who are buying these technologies?

It would be countries without their own capability

to develop these kind of tools,

which oftentimes tend to be authoritarian countries.

Where are these companies based that are selling them?

Generally they tend to be in well-developed countries

with big ICT and defense security sectors.

How big is this industry?

Actually, one of the scariest things is that

because it's so secretive, nobody actually knows.

There's been a few estimates by people in the industry,

somewhere in the region of $5 billion a year.

But ultimately, 'cause it's so secretive,

there's just no way of knowing.

They want it to be kept a secret.

So it stays in the shadows that way.

Stays in the shadows.

Cyber profiteers are getting rich

from a growing arms and surveillance market.

But cloaked in secrecy, there's no way of knowing

how big it really is.

And Citizen Lab director Ron Deibert thinks

there's an even more fundamental problem.

It's only going to continue to grow.

And once states' armed forces and intelligence agencies

start equipping themselves, their adversaries take it as

a challenge and do the same, and it ratchets up constantly.

There's certain conditions that tend to favour arms races,

and if you look at the environmental conditions

around cyberspace, many of them are there.

So like, you know, offense has the advantages,

speed and so on.

It's very difficult to verify.

Wow, that's a scary proposition.

We don't have enough weight

behind the idea of watching the watchers.

Marietje Schaake is a member of the European Parliament

from Holland.

She's been leading the charge to include spyware

under international arms law.

Do you think the vendors are responsible if they make a sale

to an authoritarian regime?

Well, they should be helped in making the right assessment.

If a company like Hacking Team can operate legally,

that is the most clear sign that our laws are outdated and

desperately need to be updated, to make sure that there is

no unintended consequences and that we stop this

grey and unregulated market from going on the way it does.

But can you really regulate, police computer code?

The fact of the matter is that we don't have official laws that

provide for transparency and accountability in this market.

There's only very few measures such as

the Wassenaar Arrangement or such as sanctions

on specific countries like Iran and Syria,

the worst of the worst human rights violators.

Hacker Phineas Fisher thinks there's not much difference

between the good guys and the bad guys anyway.

The difference between authoritarian regimes

and democratic ones is the Hacking Team customers

jail, torture and kill, where the democratic ones

have gentler ways of managing dissent.

But many in the international community

do see good and bad guys.

And that's why they drafted the Wassenaar Arrangement,

which regulates the export of both conventional arms

as well as technology that can be used as arms.

It's been signed by 41 countries.

In 2013, network surveillance and intrusion software

was added to its list of restricted items.

I think that that arrangement, as is built today,

will help to destroy the security industry.

Adriel is one of many security researchers

critical of the arrangement.

If you take a company that operates in multiple countries,

that company might suffer a breach, and you might have

a piece of technology here, you know, that is somehow

regulated because of offensive capabilities.

With Wassenaar in place, you can't just send that information

over to your other division.

You have to go and apply for the license,

and do all this other stuff.

And by that time, the hackers have had a field day

and taken whatever they wanted.

It prevents fast response.

I believe it was written with good intention,

but I believe it was written by politicians and people

who didn't really understand the nature of zero-days.

And more importantly, they didn't understand

how grey the boundaries are.

Despite the grey boundaries, Hacking Team claims to be

in full compliance with the Wassenaar Arrangement.

But in the wake of the leak, the Italian government revoked

Hacking Team's global license.

They now have to apply for an individual license every time

they want to export their software outside of Europe,

a sign that times may be changing

for spyware manufacturers.

If you could say anything to the hacker who hacked Hacking Team,

what would you say?

Please keep on.

Keep on hacking these hackers, and expose them.

They are helping, they are fuelling

dictatorship in Ethiopia.

The market for spyware is growing fast.

Without tough legislation around the sale of these cyber weapons,

anyone can be a target.

Including me, including you.