Researchers Find 25 Countries Using Surveillance Software

March 15, 2013

Researchers Find 25 Countries including Malaysia Using Surveillance Software

by Nicole Perloth (03-13-13) @

Last May, two security researchers volunteered to look at a few suspicious e-mails sent to some Bahraini activists. Almost one year later, the two have uncovered evidence that some 25 governments, many with questionable records on human rights, may be using off-the-shelf surveillance software to spy on their own citizens.

Morgan Marquis-BoireMorgan Marquis-Boire (left), a security researcher at Citizen Lab, at the University of Toronto’s Munk School of Global Affairs, and Bill Marczak, a computer science doctoral student at the University of California, Berkeley, found that the e-mails contained surveillance software that could grab images off computer screens, record Skype chats, turn on cameras and microphones and log keystrokes. The word “FinSpy” appeared in the spyware code. FinSpy is spyware sold by the Gamma Group, a British company that says it sells monitoring software to governments solely for criminal investigations.

Now, one year later, Mr. Marquis-Boire and Mr. Marczak have found evidence that FinSpy is being run off servers in 25 countries, including Ethiopia and Serbia, without oversight.

Until Mr. Marquis-Boire and Mr. Marczak stumbled upon FinSpy last May, security researchers had tried, unsuccessfully, for a year to track it down. FinSpy gained notoriety in March 2011 after protesters raided Egypt’s state security headquarters and discovered a document that appeared to be a proposal by the Gamma Group to sell FinSpy to the government of President Hosni Mubarak .

Martin J. Muench, a Gamma Group managing director, has said his company does not disclose its customers but that Gamma Group sold its technology to governments only to monitor criminals. He said that it was most frequently used “against pedophiles, terrorists, organized crime, kidnapping and human trafficking.”

But evidence suggests the software is being sold to governments where the potential for abuse is high. “If you look at the list of countries that Gamma is selling to, many do not have a robust rule of law,” Mr. Marquis-Boire said. “Rather than catching kidnappers and drug dealers, it looks more likely that it is being used for politically motivated surveillance.”

As of last year, Mr. Marquis-Boire and Mr. Marczak (right), with other researchers Bill Marczakat Rapid7, CrowdStrike and others, had found command-and-control servers running the spyware in just over a dozen countries. They have since scanned the entire Internet for FinSpy.

The Munk School is publishing their updated findings on Wednesday. The list of countries with servers running FinSpy is now Australia, Bahrain, Bangladesh, Britain, Brunei, Canada, the Czech Republic, Estonia, Ethiopia, Germany, India, Indonesia, Japan, Latvia, Malaysia, Mexico, Mongolia, Netherlands, Qatar, Serbia, Singapore, Turkmenistan, the United Arab Emirates, the United States and Vietnam.

In Ethiopia, FinSpy was disguised in e-mails that were specifically aimed at political dissidents. The e-mails lured targets to click on pictures of members of Ginbot 7, an Ethiopian opposition group. When they clicked on the pictures, FinSpy downloaded to their machines and their computers began communicating with a local server in Ethiopia.

“This continues the theme of FinSpy deployments with strong indications of politically motivated targeting,” the researchers wrote in their report.

A Turkmenistan server running the software belonged to a range of I.P. addresses specifically assigned to the ministry of communications. Turkmenistan is the first clear-cut case of a government running the spyware off its own computer system. Human Rights Watch has called Turkmenistan one of the world’s “most repressive countries” and warned that dissidents faced “constant threat of government reprisal.”

In Vietnam, the researchers found evidence that FinSpy was running on Android-powered phones. They found one Android phone infected with FinSpy that was sending text messages back to a Vietnamese telephone number. That finding was particularly troubling, researchers say, given recent clampdowns by the nation’s government. Last year, Vietnam introduced censorship laws that prohibit bloggers from speaking out against the country’s ruling Communist party. According to Human Rights Watch, at least 40 people had since been convicted and sentenced to prison terms. Many are now serving terms ranging from three to 13 years.

The sale of surveillance technology is still largely unregulated, but Mr. Marquis-Boire and Mr. Marczak’s findings have prompted greater scrutiny. Responding to their findings last fall, Germany’s foreign minister Guido Westerwelle called for an Europe-­wide ban on the export of surveillance technology to repressive regimes. And last month, Privacy International and other groups filed complaints with the Organization for Economic Cooperation and Development against Gamma Group and Trovicor GmbH, a German company that also sells surveillance software.

“I don’t think you can put technology back in the bottle,” said Mr. Marquis-Boire. “I understand why police would want to use this type of technology, but I’m just not for commercial companies selling them to nondemocratic regimes with questionable human rights records.”

5 thoughts on “Researchers Find 25 Countries Using Surveillance Software

  1. Well, to be fair, in our country, Malaysians have been openly critical of the Government in the cyberspace anyway especially in the AM and blogsphere where there is no need for any surveillance software to be employed by the Government to assist it in any tracking or profiling if and when required. If their criticisms are justified, Malaysians should not be unnecessarily worried about these spying softwares.

  2. Malaysians should not be unnecessarily worried about these spying softwares. -aliefalfa

    the problem here is the ABUSE of this software. the article also mentions that Britain and Germany use this software specifically for the surveillance of paedophiles, i.e.,for the purpose it is intended. in our country would it be used to track down homosexuals and opposition sexual escapades?
    ”But evidence suggests the software is being sold to governments where the potential for abuse is high”…. or in ordinary terms, countries with questionable human rights issues!. including Malaysia.
    actually bloggers should comment on this article.
    Dato’ has said his piece, how about Donplaypuks, Haris and the rest?

  3. Aliefalfa,

    We should not be worried about being spied upon if our criticisms of the government are justified? Because nothing says the Best Democracy in the World better than to spy on your citizens for being critical of you.

  4. First of all, NO ONE RATIONAL & ETHICAL OBJECTS the work of any state security sector professionals IF agenda is protection of citizens & the resources as it is done in Scandinavia and Israel.
    But, it is the TRUTH that, with this ‘state of the art’ tech development, ANY Law regarding ‘privacy of a citizen’ is a JOKE.
    Per example, in Serbia-the state run mostly by tycoons, with long record of oppression & abuse of the rights of ‘pay-role free’ noble minds, the state that keeps cultivating ‘special ties’ with murky Kremlin-the Parliament with broad consensus recently approved ‘the citizen privacy protection’ law. Not over-viewed, shady Military Counter-Intelligence service can “employ surveillance on the ‘target’ only under special permission granted by Public Prosecutor Office”. What hypocrisy?
    According to trusted sources the same MCI use a server with FinFISHER,‘hit-man’ spyware, to carry out the following: slow down/purge ADSL & wireless web, to remotely spy by activating PC video/audio devices, to remotely monitor & control ALL files incl. encrypted etc. while the citizens of Serbia have NO CLUE about it.
    MCI does it by evading anti-virus software using fake upgrades or through email physhing.
    This above gives the unprecedented Right of Might to the IMMATURE Big Brother!
    In backward societies the crime elite will be able to have total control over all life resources Would also lethally threat all who oppose their goals & gross manipulation of the mainstream ‘herd’…

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s