All language subtitles for cyberwar.s01e03.720p.hdtv.x264-w4f_Track02

BEN: Spyware is secretly
used by governments

to track criminal activity.

This is about surveilling
the activities of somebody

who is either thinking
about breaking the law

or has actually broken it.

It's also deployed
by repressive regimes

to spy on their opposition.

A government is a
surveillance machine.

Journalists and dissidents
are targeted for surveillance.

Whenever you speak
against the government,

you are a terrorist.

Cyber weapons markets jeopardize
lives in the name of profit.

We don't have official laws

that provide for transparency
and accountability.

Should cyber mercenaries
be held responsible?

♪

I'm going to meet someone
who believes he's a victim

of cyber mercenary surveillance.

Mesay Mekonnen is a
journalist for ESAT,

an Ethiopian news network.

From this nondescript office,
Mesay and his team

can influence a country
of more than 99 million.

So why don't you explain
to me what ESAT is?

ESAT is an independent
media organization.

It's established by Ethiopians,
journalists who have been...

fled from Ethiopia because of
the situation in Ethiopia.

We are working for
the people of Ethiopia,

the voice for the voiceless,

so we are giving platform
to the opposition.

And you're all
journalists in exile?

Yeah, all.

The last 10 years, more than
100 journalists now have fled.

Why are the government
going after journalists?

Media is their first enemy.

There's no free
media in Ethiopia.

People working as free media,

they think that they are
against the government.

And whenever you speak
against the government,

you are a terrorist.

The Ethiopian government has
been consistently singled out

by the UN and Human Rights
Watch for instances

of targeting journalists
for doing their work.

The Ethiopian government

continued harassing
opposition members.

Several coalition members in
Oromia and southern Ethiopia

are also intimidated,
detained and tortured

for their involvement
in politics.

In December 2013, ESAT employees

were targeted with a series of
malware attacks through Skype.

I got this friend
request, and the logo,

the person who sent me a
friend request is ESAT's logo.

So I thought that it is a
friend and not a bad guy,

so let me accept him.

When I accept him, he sent
me immediately a PDF file,

and I tried to open.

There is... My computer,
full of broken words,

and I got shocked.

To find out who was behind
the attack and how they did it,

I traveled to San Francisco
to speak with Bill Marczak

of Citizen Lab, a cyber
surveillance watchdog.

When he came across the
ESAT file Mesay received,

he got in contact with Mesay
and examined the malware

that had infected his computer.

What did you discover?

So what we did was we looked at
the server which the spyware

was communicating with to see if
we could figure out any clues

about the spyware's origin.

The reason why spyware
communicates with a server

is because it steals information
off of your computer,

and it needs to send it
to the attacker somewhere.

And one of the things
we noticed is that

the server actually returned
an SSL certificate that said,

"Issued by HTSRL."

An SSL certificate is a digital
certificate used to authenticate

and create a secure link between
a website and an end user.

And it also contained
in the description,

"RCS Certification Authority,"
and RCS being the acronym for

Remote Control System,
which is a product

of an Italian company
known as Hacking Team.

Based in Italy, Hacking Team

has branded itself a
global supplier of spyware,

with ads like this, featuring
a shady black hat hacker

to hawk their tools
and support services.

VOICE: Rely on us.

BEN: But they're not
the only game in town.

Companies like FinFisher,
CYBERBIT and Trovicor

also sell surveillance software.

Their spyware can
surveil cell phones,

monitor your computer's
camera and microphone,

and steal emails, passwords,
contacts and files.

So we issued this report
through Citizen Lab,

and immediately Hacking Team
issued their denials.

But interestingly, we were
monitoring the command

and control server which the
spyware had communicated with,

and we noticed that it was
very quickly pulled offline.

And then the hacks came back.

The hacks came back, yes.

In 2014, there were several
instances where members of ESAT

received emails containing
Hacking Team spyware.

Who was targeting them?

When we traced this
spyware to this endpoint,

there was an internet
address registered

to a satellite company which
provides services across

all of Africa, the Middle East,
and some places in Europe.

And we queried this range of
IP addresses, and we found that

one of them had identified
itself as INSA PC.

I was like, "Okay,
Google, what is INSA?"

And the first hit was

Ethiopian Information Network
Security Administration,

government of Ethiopia.

I was like okay, this is it.

Citizen Lab caught
the Ethiopian government

trying to spy on journalists.

And the spyware they used
was supplied by Hacking Team.

The one guy who could really
explain the bigger picture

was Citizen Lab's
director, Ron Deibert.

You've taken a
particular interest

in digital surveillance tools.

Why is that?

There is a huge market for
surveillance technologies,

and what we found is that
that market extends to

some of the world's most
notorious autocratic regimes

and human rights
abusing countries.

And that's a problem from
a human rights perspective.

Surveillance in and of
itself is not a bad thing.

It is, I think, naive to
expect we'd ever go back

to any sort of pristine time
where there is no surveillance.

It's just part of human nature.

A government is a
surveillance machine.

From the 15th century
to today, it's the same.

The question is: what is
that surveillance for,

and are there proper checks
and balances around it?

That applies to
what Citizen Lab does,

it applies to what Google does,

it applies to what
the United States does.

Or Ethiopia.

Or Ethiopia, yeah.

How do you feel that
there's a company in Italy,

that's a free country,

selling cyber surveillance
tools to your country?

It's very, very
unfortunate to, you know...

learn that these democratic
countries, you know...

helping dictatorship in Africa.

Hacking Team had been
caught red-handed,

so I wanted them to explain
why they knowingly armed

an authoritarian regime with
their surveillance tools.

BEN: In 2013 and 2014, the
Ethiopian government targeted

journalists with spyware
supplied and supported

by an Italian company
called Hacking Team.

I think the view that
we need 100% privacy

and anything else comes second
is a shortsighted view,

and doesn't recognize the
realities of the digital world.

Eric Rabe is Hacking Team's

Chief Marketing and
Communications Officer.

We met in New York.

How about the case of Ethiopia?

Yeah, Ethiopia is a country
that we became convinced

was using the software in
an inappropriate way against

a person here in the US,
a purported journalist.

The Ethiopian government frankly
argued that that person

was also a member of
a... an organization

that was actively trying to
overthrow the government,

and that's why they
wanted to surveil him.

So it was a legitimate sale to a
customer who seemed to need it

and seemed to be willing to
use it in an appropriate way.

We found out differently.

We suspended business
with Ethiopia,

and they're not
a client anymore.

These are some pretty powerful
tools that you're selling.

What do they do exactly?

Well, they allow surveillance of
activity in the digital space.

You know, with everything
encrypted from end to end,

phone calls and
internet communications

and email messages,
the only way an investigator

can actually tell
what somebody is doing

in that digital space is
by accessing those tools

either before they're encrypted
or after they're decrypted.

And that happens
only in one place,

and that's on the device itself.

So this software
allows observation

of that activity on the device.

So are these legitimate
tools, do you think?

I think they are
legitimate tools,

and I think they're really
necessary for law enforcement.

This is not about, you know,

listening in on your
cell phone conversation.

This is about surveilling
the activities of somebody

who's either thinking
about breaking the law

or who's actually broken it.

Although he has
no direct evidence,

Mesay believes that
the data gathered by

the Ethiopian government
through Hacking Team's software

had devastating consequences
for his colleagues.

Did any of the people
that you were contacting

go to jail because of that hack?

Yeah!

Three of our contacts
are now in jail.

So Hacking Team malware

essentially helped put
Ethiopians in jail?

Definitely.

So you're talking
about privacy, security.

What about human rights?

I don't think Hacking Team
is the principle

human rights enforcement
agency for the world.

We're a software company
that serves law enforcement.

That's what we do.

We're not embarrassed about it.

We think it's important.

We spoke to people at ESAT who
were the targets of Ethiopian

hackers, and they wondered
why Hacking Team would sell

to a country who has obvious
human rights violations.

Ethiopia was not on
anybody's blacklist.

There was no prohibition
that any country

- the US, the EU,
NATO or anybody else -

had against Ethiopia at the
time that software was sold.

That said, it doesn't take
a global affairs PHD to know

that they've violated some
really basic human rights.

Well, then I would suggest that

the appropriate... channel
is for Italy, for example,

to refuse to allow us to sell
there, or for the UN to act.

But then who's responsible

for what happens in the
fallout of using these tools?

Does Hacking Team absolve
themselves of that, or...?

No, I don't think so, but
I think the human rights

organizations are unable to
get to the countries involved

who are really responsible
for the human rights abuses.

So they turn to, you know,
those that they can reach,

that is companies
like Hacking Team.

It's not an unreasonable
political tactic to use,

but I don't think it's
reasonable to say that

Hacking Team is responsible
for human rights abuses.

But not everyone agrees.

On July 5th 2015, an infamous
hacker known as Phineas Fisher

breached the Hacking Team's
servers, exfiltrating

over 400 gigabytes of documents

and posting them online
for anyone to see.

Security experts
around the world

celebrated the leak on Twitter.

All of Hacking Team's dirty
laundry spilt onto the internet,

exposing price lists
and software source code.

Client lists showed sales
to the FBI, DEA and US Army.

Even an officer with the Campus
Police Force at UC Santa Barbara

was interested in
buying its malware.

It also showed that
Hacking Team was selling

to governments notorious
for human rights abuses,

places like Kazakhstan,
Bahrain and Sudan.

Maybe the hack was a good thing,
it was a kick in the ass.

I don't think it
was a good thing!

(Laughing)
It was a...

You know, it was a criminal act.

It was.

I mean, there's sort
of something about,

"Oh, we hacked into a company.

It's kinda cool, it's sort of
Robin Hood, blah blah blah."

No, it's not Robin Hood.

It's Al Capone.

This is illegal.

You can't, just because
you disagree with somebody,

you know, destroy them or
attempt to destroy them.

And what about the hacker
who hacked you guys?

Phineas Fisher?

I would love to meet him!
(Laughing)

I wanted to meet the
legendary Phineas Fisher too,

but that would prove
to be pretty complicated.

Because after the leak,
like any skillful hacker,

Phineas Fisher
kept a low profile.

BEN: A black hat hacker had
hacked Hacking Team's servers,

stealing hundreds of
gigabytes of data.

After leaking it online,

Phineas Fisher
all but disappeared.

But with an assist
from my colleague at

VICE's tech and science
site, Motherboard,

we finally negotiated
interview terms.

Since we wouldn't be
able to show his face,

the hacker had a strange
request: he would only

do the interview if he was
represented by a puppet.

These are the exact words
from our live text exchange,

voiced by one of my colleagues.

What was the goal on hacking
the Hacking Team data?

Were you trying to stop them?

Well, for the lulz.

I don't really expect
leaking data to stop a company,

but hopefully it can at
least set them back a bit

and give some breathing room

to the people being targeted
with their software.

We spoke to some Ethiopian
journalists who were targeted

by their government using
Hacking Team's software,

and they wanted to thank you.

(Chuckling)
Cool.

Kinda weird seeing my hacking
addiction - I mean, hobby -

actually affecting people in the
real world in a positive way.

What do you think of
surveillance companies,

and Hacking Team specifically?

I would say they're people
with no morals going where

the money is, but that's
maybe not entirely true.

I imagine I'm not
all that different

from Hacking Team employees.

The same addiction to
that electronic pulse

and the beauty of the baud.

I imagine if you
come from a background

where you see police as
largely a force for good,

then writing hacking tools
for them makes some sense.

But then Citizen Lab provides
clear evidence it's being used

mostly for comic book
villain level of evil.

In all, the FinFisher and
Hacking Team customers

where targets of the spying have
been identified in Bahrain,

Ecuador, Mexico, Ethiopia, it's
all investigative journalists,

dissidents, political
opposition, etc. being targeted.

Not real crime, but
threats to those in power.

While Hacking Team
was selling spyware

to law enforcement agencies
tasked with catching criminals,

they also sold to authoritarian
regimes who use their wares

to crack down on dissent.

Other details revealed through
the Hacking Team data dump

was information about companies
that were supplying Hacking Team

with the technology to
build their spy tools.

Security firm Netragard was
singled out for selling them

a zero-day; that is, an
undiscovered security flaw

in software that can be
exploited to penetrate a system.

Buying and selling zero-days
is legal, but covert.

While they can be used
to test and improve

a company's network security,
zero-days can also be used

to inject malicious
software into a computer.

A piece of technology
that I created...

Well, brokered really, 'cause
I didn't really create it.

But a piece of technology
that I brokered, a deal that

I was involved with, potentially
armed these rogue nations

with a tool that let them
break into these other systems?

I didn't want any part of that.

Adriel Desautels admitted to
selling a zero-day exploit

to Hacking Team
after the ESAT hack.

I think that it should
be your responsibility

to make sure that you are
not selling to somebody

that you believe will
do anything malicious.

That said, Netragard -
respected, above-board company -

you sold to Hacking Team.

I know.

When you misuse a zero-day,
who's more at fault:

the broker or the end user?

When you misuse a zero-day,
the end user, absolutely.

I mean, if I sell...

You know, I'm Nike, and I
sell shoes to some guy,

and he runs down a
woman and rapes the woman.

Is it Nike's fault for
selling the sneakers?

Or what about Microsoft?

How many people have
been hacked by somebody

using Microsoft's
operating system?

Microsoft's not
accountable for that, right?

The ethics of it and
the responsibility of it

are up to the actor
or the team responsible

for executing that
specific operation.

Adriel's moral dilemma seemed
hard to avoid in the grey market

where zero-days
are bought and sold,

a market fuelled by a
booming cyber arms trade.

So I went to London
to meet Edin Omanovic,

a cyber surveillance researcher
for Privacy International.

So have you always been
interested in the arms trade?

Yeah.

Just, you know, coming from
Bosnia I've being interested in

conflict and the arms trade
and foreign policy and so on.

Right, how the
weapons gets where--

Yeah, exactly, yeah.

Does this surveillance market...

does it mirror at all the
conventional weapons market?

What you've got in the arms
market is a system whereby

governments have some kind
of control over the exports.

So they would be able
to say to this company,

"You're selling this.

We wanna be able to control
who you're selling that to."

At the moment,
that doesn't exist for

the surveillance market, because
much of the technology is new.

Governments need to step in and
say that if a product is being

sold from their country to a
regime where it's gonna be used

for human rights abuses, they
need to be able to stop that.

And who are the
major players in it

who are buying
these technologies?

It would be countries
without their own capability

to develop these kind of tools,

which oftentimes tend to be
authoritarian countries.

Where are these companies
based that are selling them?

Generally they tend to be in
well-developed countries

with big ICT and
defense security sectors.

How big is this industry?

Actually, one of the
scariest things is that

because it's so secretive,
nobody actually knows.

There's been a few estimates
by people in the industry,

somewhere in the region
of $5 billion a year.

But ultimately,
'cause it's so secretive,

there's just no way of knowing.

They want it to be
kept a secret.

So it stays in the
shadows that way.

Stays in the shadows.

Cyber profiteers
are getting rich

from a growing arms
and surveillance market.

But cloaked in secrecy,
there's no way of knowing

how big it really is.

And Citizen Lab director
Ron Deibert thinks

there's an even more
fundamental problem.

It's only going to
continue to grow.

And once states' armed forces
and intelligence agencies

start equipping themselves,
their adversaries take it as

a challenge and do the same,
and it ratchets up constantly.

There's certain conditions
that tend to favour arms races,

and if you look at the
environmental conditions

around cyberspace,
many of them are there.

So like, you know,
offense has the advantages,

speed and so on.

It's very difficult to verify.

Wow, that's a scary proposition.

We don't have enough weight

behind the idea of
watching the watchers.

Marietje Schaake is a member
of the European Parliament

from Holland.

She's been leading the
charge to include spyware

under international arms law.

Do you think the vendors are
responsible if they make a sale

to an authoritarian regime?

Well, they should be helped in
making the right assessment.

If a company like Hacking
Team can operate legally,

that is the most clear sign
that our laws are outdated and

desperately need to be updated,
to make sure that there is

no unintended consequences
and that we stop this

grey and unregulated market
from going on the way it does.

But can you really regulate,
police computer code?

The fact of the matter is that
we don't have official laws that

provide for transparency and
accountability in this market.

There's only very
few measures such as

the Wassenaar Arrangement
or such as sanctions

on specific countries
like Iran and Syria,

the worst of the worst
human rights violators.

Hacker Phineas Fisher thinks
there's not much difference

between the good guys
and the bad guys anyway.

The difference between
authoritarian regimes

and democratic ones is the
Hacking Team customers

jail, torture and kill,
where the democratic ones

have gentler ways
of managing dissent.

But many in the
international community

do see good and bad guys.

And that's why they drafted
the Wassenaar Arrangement,

which regulates the export
of both conventional arms

as well as technology
that can be used as arms.

It's been signed
by 41 countries.

In 2013, network surveillance
and intrusion software

was added to its list
of restricted items.

I think that that arrangement,
as is built today,

will help to destroy
the security industry.

Adriel is one of many
security researchers

critical of the arrangement.

If you take a company that
operates in multiple countries,

that company might suffer
a breach, and you might have

a piece of technology here,
you know, that is somehow

regulated because of
offensive capabilities.

With Wassenaar in place, you
can't just send that information

over to your other division.

You have to go and
apply for the license,

and do all this other stuff.

And by that time, the hackers
have had a field day

and taken whatever they wanted.

It prevents fast response.

I believe it was
written with good intention,

but I believe it was written
by politicians and people

who didn't really understand
the nature of zero-days.

And more importantly,
they didn't understand

how grey the boundaries are.

Despite the grey boundaries,
Hacking Team claims to be

in full compliance with
the Wassenaar Arrangement.

But in the wake of the leak,
the Italian government revoked

Hacking Team's global license.

They now have to apply for an
individual license every time

they want to export their
software outside of Europe,

a sign that times
may be changing

for spyware manufacturers.

If you could say anything to the
hacker who hacked Hacking Team,

what would you say?

Please keep on.

Keep on hacking these
hackers, and expose them.

They are helping,
they are fuelling

dictatorship in Ethiopia.

The market for spyware
is growing fast.

Without tough legislation around
the sale of these cyber weapons,

anyone can be a target.

Including me, including you.