{"id":81835,"date":"2016-10-24T12:00:13","date_gmt":"2016-10-24T11:00:13","guid":{"rendered":"https:\/\/www.transcend.org\/tms\/?p=81835"},"modified":"2016-10-23T19:04:47","modified_gmt":"2016-10-23T18:04:47","slug":"private-eyes","status":"publish","type":"post","link":"https:\/\/www.transcend.org\/tms\/2016\/10\/private-eyes\/","title":{"rendered":"Private Eyes"},"content":{"rendered":"

The Little-Known Company That Enables Worldwide Mass Surveillancex<\/em><\/p>\n

Image below: Other Means for The Intercept<\/p>\n

<\/p>\n

23 Oct 2016 – <\/em>It was a powerful piece of technology created for an important customer. The Medusa system, named after the mythical Greek monster with snakes instead of hair, had one main purpose: to vacuum up vast quantities of internet data at an astonishing speed.<\/p>\n

The technology was designed by Endace, a little-known New Zealand company. And the important customer was the British electronic eavesdropping agency, Government Communications Headquarters, or GCHQ.<\/p>\n

Dozens of internal documents and emails from Endace, obtained by The Intercept and reported in cooperation with Television New Zealand<\/a>, reveal the firm\u2019s key role helping governments across the world harvest vast amounts of information on people\u2019s private emails, online chats, social media conversations, and internet browsing histories.<\/p>\n

The leaked files, which were provided by a source through SecureDrop<\/a>, show that Endace listed a Moroccan security agency implicated in torture as one of its customers. They also indicate that the company sold its surveillance gear to more than half a dozen other government agencies, including in the United States, Israel, Denmark, Australia, Canada, Spain, and India.<\/p>\n

Some of Endace\u2019s largest sales in recent years, however, were to the United Kingdom\u2019s GCHQ, which purchased a variety of \u201cdata acquisition\u201d systems and \u201cprobes\u201d that it used to covertly monitor internet traffic.<\/p>\n

Documents from the National Security Agency whistleblower Edward Snowden, previously disclosed<\/a> by The Intercept, have shown how GCHQ dramatically expanded its online surveillance between 2009 and 2012. The newly obtained Endace documents add to those revelations, shining light for the first time on the vital role played by the private sector in enabling the spying.<\/p>\n

Stuart Wilson, Endace\u2019s CEO, declined to answer questions for this story. Wilson said in a statement that Endace\u2019s technology \u201cgenerates significant export revenue for New Zealand and builds important technical capability for our country.\u201d He added: \u201cOur commercial technology is used by customers worldwide \u2026 who rely on network recording to protect their critical infrastructure and data from cybercriminals, terrorists, and state-sponsored cybersecurity threats.\u201d<\/p>\n

\"Former<\/a>

Former Endace Director Ian Graham, right, meets New Zealand Prime Minister John Key in 2010.
Photo: NZNationalParty\/Flickr<\/p><\/div>\n

Endace says it manufactures technology that allows its clients to \u201cmonitor, intercept and capture 100% of traffic on networks.\u201d The Auckland-based company\u2019s motto is \u201cpower to see all\u201d and its logo is an eye.<\/p>\n

The company\u2019s origins can be traced back to Waikato University in Hamilton, New Zealand. There, in 1994, a team of professors and researchers began developing network monitoring technology using university resources. A central aim of the project was to find ways to measure different kinds of data on the internet, which was at that time only just beginning to take off. Within a few years, the academics\u2019 efforts proved successful; they had managed to invent pioneering network monitoring tools. By 2001, the group behind the research started commercializing the technology \u2014 and Endace was formed.<\/p>\n

Today, Endace presents itself publicly as focused on providing technology that helps companies and governments keep their networks secure. But in the past decade, it has quietly entered into a burgeoning global spy industry that is worth in excess of an estimated $5 billion annually.<\/p>\n

In 2007, Endace representatives promoted their technology at a huge surveillance technology trade show in Dubai that was attended by dozens of government agencies from across the world. Endace\u2019s advertising brochures from the show, which described the company\u2019s products and promoted the need for greater state surveillance, were published by WikiLeaks<\/a> in 2013.<\/p>\n

One Endace brochure explained how the company\u2019s technology could help clients \u201cmonitor all network traffic inexpensively.\u201d It noted that telecommunications networks carry many types of information: Skype calls, videos, emails, and instant message chats. \u201cThese networks provide rich intelligence for law enforcement,\u201d the brochure stated, \u201cIF they can be accessed securely and with high precision.\u201d<\/p>\n

\"Workers<\/a>

Workers lay undersea cables near Hiddensee Island, Germany.
Photo: Ullstein Bild\/Getty Images<\/p><\/div>\n

The United Kingdom\u2019s geographic location \u2014 situated between North America, mainland Europe, and the Middle East \u2014 made it a good market for Endace.<\/p>\n

Many major international undersea data cables cross British territory, and according to top-secret documents<\/a> from Snowden, as much as 25 percent of all the world\u2019s internet traffic flows through the U.K. The country\u2019s spies have worked to exploit this, with GCHQ tapping into as many of the cables as it can, sifting through huge volumes of emails, instant messages, social media interactions, and web browsing records as they are being transmitted across the internet.<\/p>\n

As of 2009, GCHQ\u2019s surveillance of undersea cables was well underway. The agency was measuring the amount of traffic it monitored in tens of gigabits per second (10Gs) \u2014 the equivalent in data of about 1 million average-sized emails every minute. The electronic eavesdropping agency was tapping into 87 different 10Gs capacity cables and funneling the collected data into its processing systems for analysis.<\/p>\n

By March 2011, GCHQ\u2019s aim was to tap into 415 of the 10Gs cables, and its longer-term goal was to \u201cgrow our internet access to 800 10Gs<\/a>.\u201d The agency wanted to build what it described as the largest covert surveillance apparatus in the world. And in an effort to fulfill that plan, it turned to Endace\u2019s technology.<\/p>\n

Leaked documents and emails from Endace, obtained by The Intercept, lay out a series of deals the company made with GCHQ to help it broaden its mass surveillance capabilities. A confidential February 2010 Endace statement of work<\/a> for GCHQ, for instance, outlined a \u00a3245,000 ($299,500) deal to upgrade \u201cmonitoring solutions\u201d for the British agency that were designed to intercept large amounts of internet traffic and send it into \u201cmemory holes\u201d \u2014 repositories used to store the data.<\/p>\n

The agency wanted to build the largest covert surveillance apparatus in the world.<\/em><\/strong><\/p>\n

Between November 2010 and March 2011, GCHQ purchased more technology from Endace, including specialized surveillance technology built for \u201cFGA only,\u201d a code name the company often uses in its internal documents to refer to GCHQ; it stands for \u201cfriendly government agency.\u201d<\/p>\n

A November 2010 company document<\/a> said that \u201cFGA\u201d had an order of 20 systems scheduled for delivery in March 2011. Each system was equipped with two \u201cdata acquisition\u201d cards capable of intercepting 20Gs of internet traffic. The total capacity of the order would enable GCHQ to monitor a massive amount of data \u2014 the equivalent of being able to download 3,750 high-definition movies every minute, or 2.5 billion average-sized emails an hour.<\/p>\n

Endace added in the document that \u201ca potential for 300-500 systems over the next two to three years is being discussed\u201d and noted that it was soon anticipating another order of \u201c30-40 additional systems.\u201d Indeed, the following month a new $167,940 purchase order<\/a> for 27 more systems arrived, and the items were swiftly dispatched for delivery to GCHQ\u2019s headquarters in Cheltenham, England.<\/p>\n

The records of the Endace sales are confirmed by internal GCHQ documents<\/a>, provided by Snowden, which describe the company\u2019s data capture devices being used as part of mass surveillance programs. GCHQ documents from 2010 and 2011 repeatedly mention the Endace products while discussing the capture of \u201cinternet-derived\u201d data to extract information about people\u2019s usage of services such as Gmail, Hotmail, WhatsApp, and Facebook.<\/p>\n

GCHQ declined to comment for this story.<\/p>\n

\"An<\/a>

An Endace diagram depicts a custom data capture system built for GCHQ.
Photo: Endance<\/p><\/div>\n

Throughout the summer of 2011, at Endace\u2019s offices in Auckland, New Zealand, the orders from GCHQ were continuing to flow in. Meanwhile, the company\u2019s engineers were busy turning their sights to new technology that could vastly increase surveillance capability. Endace was developing a powerful new product for GCHQ called Medusa: interception equipment that could capture internet traffic at up to 100 gigabits per second.<\/p>\n

Medusa was first logged in Endace\u2019s sales systems in September 2011. Endace staff produced weekly status reports<\/a> about their progress and updated GCHQ at biweekly\u00a0review meetings. By November 18, 2011, the first version of Medusa arrived at GCHQ. \u201cFGA are very pleased with the prototypes we delivered last week,\u201d Endace noted.<\/p>\n

Apparently after testing the Medusa prototype, GCHQ requested some refinements. One feature the agency wanted<\/a> was called \u201cSeparate MAC insertion by IP type.\u201d This suggests the British agency may have sought the ability to target individuals by searching internet traffic for the built-in hardware address of their computers, routers, or phones.<\/p>\n

Notably, the Medusa status reports reveal that Endace was using taxpayers\u2019 money to develop the new equipment for GCHQ. They state that the Medusa system was being built for \u201cFGA\u201d with funding from the Foundation of Research Science and Technology, the body that handed out New Zealand government research grants.<\/p>\n

In 2010, Endace received two<\/a> grants<\/a> totaling $11.1 million. A public announcement for the first grant \u2014 issued in July 2010 \u2014 said the funding was for \u201c50% of the cost of a series of substantial product developments over the next two years,\u201d but did not say what the products were nor who they were for.<\/p>\n

A New Zealand government spokesperson told The Intercept that he could not immediately give a \u201cdefinitive\u201d answer on whether the funding body had known Endace would use the grants to develop surveillance technology for GCHQ, but said it was \u201chighly unlikely Endace would have provided that information, as they were under no obligation to do so.\u201d<\/p>\n

Endace has never publicly disclosed any of its work with GCHQ, likely because it is subject to strict confidentiality agreements. In one contract<\/a> obtained by The Intercept, GCHQ states that Endace staff are bound to the U.K.\u2019s Official Secrets Act, a sweeping law that can be used to prosecute and imprison people who disclose classified information. GCHQ warned Endace that it must not \u201cmake any press announcements or publicize the contract or any part thereof in any way.\u201d<\/p>\n

\"The<\/a>

The back of two satellite antennae at GCHQ\u2019s surveillance base in Bude, England.
Photo: Education Images\/UIG\/Getty Images<\/p><\/div>\n

Endace\u2019s leaked client lists show three main categories of customers: governments, telecommunications companies, and finance companies.<\/p>\n

The government clients appear to be mostly intelligence agencies. A 2008 Endace customer list included: GCHQ; the Canadian and Australian defense departments (where their electronic spy agencies are located); a U.S. government contractor called Rep-Tron Systems Group, located in Baltimore, Maryland; and Morocco\u2019s domestic surveillance agency, the DGST.<\/p>\n

Other Endace customer lists contained in the leaked trove include the U.S. Army and the U.S. Navy\u2019s Space and Naval Warfare Systems Command, called SPAWAR; the Israeli Ministry of Defense (home of its Unit 8200 electronic spy agency); the government of India, the Spanish Ministry of Defense; and Denmark\u2019s Defense Intelligence Service.<\/p>\n

Endace\u2019s apparent dealings with the Moroccan agency, the DGST, are particularly controversial. Moroccan authorities have been persistently accused over more than five decades of committing a range of severe human rights abuses.<\/p>\n

In Morocco, digital surveillance is intimately linked with repression of peaceful dissent.<\/em><\/strong><\/p>\n

Amnesty International, in a 2015 report<\/a>, specifically singled out the DGST agency as a key perpetrator of recent abuses, accusing it of detaining people incommunicado and using brutal torture methods that included beatings, electric shocks, sexual violence, simulated drowning, drugging, mock executions, and food and sleep deprivation.<\/p>\n

Sirine Rached, Amnesty\u2019s North Africa researcher, told The Intercept that sales of surveillance technology to Morocco raised major concerns.<\/p>\n

\u201cIn Morocco, digital surveillance is intimately linked with repression of peaceful dissent \u2014 people who are peacefully protesting or criticizing the authorities face intimidation, arrest, unfair trials, and sometimes imprisonment,\u201d said Rached. \u201cWe fear that the more that these surveillance tools are sold [to Moroccan agencies], the more we will see human rights abuses, especially in relation to freedom of expression and information.\u201d<\/p>\n

Endace declined to comment on its dealings with Morocco. Stuart Wilson, Endace\u2019s CEO, claimed in a statement that he had to keep details about the company\u2019s customers confidential in order to help them \u201cbattle cyberthreats and breaches.\u201d<\/p>\n

\"An<\/a>

An Endace \u201cdata acquisition and generation\u201d card, used to monitor networks.
Photo: Endace<\/p><\/div>\n

Alongside its government clients, Endace has many major corporate customers.<\/p>\n

Endace\u2019s sales lists include finance industry giants such as Morgan Stanley, Reuters, and Bank of America. Endace\u2019s website says it provides financial companies with its monitoring technology to help \u201chigh-frequency traders to monitor, measure, and analyze critical network environments.\u201d<\/p>\n

In addition, Endace sells its equipment to some of the world\u2019s largest telecommunications companies, among them AT&T, AOL, Verizon, Sprint, Cogent Communications, Telstra, Belgacom, Swisscom, Deutsche Telekom, Telena Italy, Vastech South Africa, and France Telecom.<\/p>\n

Some of these companies may use the Endace equipment for checking the security of their networks. But a key strand of Endace\u2019s business involves providing technology for telecommunications firms that enables law enforcement and intelligence agencies to intercept the messages and data of phone and internet users.<\/p>\n

A company product strategy document<\/a> from 2010 said that Endace had \u201cseen early success\u201d providing a Lawful Intercept product to the major U.S. telco and internet company Sprint Corporation.<\/p>\n

All telcos and internet companies in the U.S., Europe, New Zealand, and a number of other countries are required by law to have \u201cintercept capable\u201d equipment on their networks. When police or spy agencies want private data about a customer (with or without a warrant, depending on the country), it can be extracted easily.<\/p>\n

When installed on a network, Endace\u2019s surveillance equipment can be used to perform targeted monitoring of individual people, but it can also be used to enable dragnet spying.<\/p>\n

In one of the leaked Endace documents obtained by The Intercept \u2014 under a section titled \u201ccustomer user stories\u201d \u2014 the company describes<\/a> a situation in which a government agency has obtained \u201cthe encryption keys for a well-known program.\u201d An Endace surveillance \u201cprobe,\u201d the document suggests, could help the government agency \u201cunencrypt all packets sent by this program on a large network in the last 24 hours.\u201d<\/p>\n

Once the data has been decrypted, the agency will be able to \u201clook for the text string \u2018Domino\u2019s Pizza,\u2019\u201d Endace joked, \u201cas they have information suggesting this is the favorite pizza of international terrorists.\u201d<\/p>\n

******************<\/p>\n

Documents published with this article:<\/em><\/p>\n