Collaborating companies: shady moves in a secretive sector
There is a common practice within the surveillance industry that makes the already murky market even harder to track: collaborating companies.
Within Privacy International's Surveillance Industry Index there are 83 documents detailing collaborations between companies involved in developing and selling surveillance technologies. These documents represent a variety of relationships – some are friendly companies, others advertise corporate partners, and some present themselves as a distributor of another's product.
These collaborations have real consequences, especially when it comes to holding the industry accountable. A Freedom of Information request from Privacy International to the Department for Business Innovation & Skills has confirmed that Datong, a Leeds-based surveillance company, attempted to export surveillance technology to an unnamed Asia Pacific country in 2009. However, it was not a Datong product that the company was trying to export, but in fact an IMSI Catcher built by Surrey-based Cellxion. Datong was acting as a distributor of Cellxion's product.
It is a common practice in the industry, which presents a challenge to export control authorities in their attempts to regulate effectively. The obfuscation that can occur by using networks of resellers, distributors and partner companies means that understanding the true destination of a product is made more difficult. The nature of the surveillance industry also means that combining two pieces of technology can create a remarkably more powerful system than if deployed separately. This raises further important questions about how to effectively regulate these technologies.
Cellxion and Datong: manufacturers and distributors
Coverage by the Guardian in 2011 suggested that an Asian Pacific country had tried to purchase a product from Datong in 2009. Datong made a request to the export control authority in the United Kingdom, the Department of Business, Innovation and Skills (BIS). This request to export was rejected by BIS on the grounds of risks of human rights abuse. Datong is now owned by Seven Technologies Group. At the time, no information was given about the type of technology that Datong was attempting to export. Privacy International lodged a Freedom of Information request in May 2014 to attempt to identify the type of technology to better understand why BIS rejected the export application.
The response from BIS showed that there were indeed records of a refused attempt to export by Datong in 2009. The technology that required authorisation to export was jamming equipment that is specially designed to "detect and exploit specific characteristics of the mobile telecommunications protocol employed (e.g. GSM)". This category fits the description of an IMSI Catcher, a surveillance technology that intercepts data from mobile phones used in a particular area. Documents from Datong reveal they have partners in Vietnam and Bangladesh within the Asia Pacific region.
While the rumour of the rejection was confirmed the document threw up further questions. The technology in question was given a name "Optima", and was referred to as a BTS transceiver module. BTS refers to Base Transceiver Stations - something which an IMSI Catcher will emulate - which further confirms the technology that Datong were attempting to export. However Datong did notactually build IMSI Catchers. Neither did the name Optima refer to any of their products. Datong built products for location monitoring through tracking devices, not intercepting data from mobile phones.
What was Optima? Why were Datong selling it? Had Datong been building and selling IMSI Catchers all along without specifically advertising that technology?
The discovery of a patent dispute in 2011 revealed the truth behind Datong and its attempted export. This dispute, on the right to patent IMSI Catchers , named as a party to a dispute alongside Cellxion, a Surrey based company that specialises in phone monitoring technology. A search for the product name Optima reveals Cellxion's IMSI Catcher. This particular product represents the cutting edge of the technology in surveillance of mobile phones, allowing the user to disable all handsets caught in the wide net cast by the technology.
While this finally revealed the manufacturer of the product, the relationship between Datong and Cellxion remained unclear from the court case. Cellxion's lawyers however, confirmed that Datong was in fact the UK distributor for Cellxion and their Optima IMSI Catcher.
This relationship between Datong and Cellxion – and and the difficulty in revealing it – is not unique. This is the private surveillance sector, where secrecy and obfuscation are natural operating policies for these companies. This makes the effective regulation of these technologies very difficult.
Collaborating to avoid responsibility
Some companies have used the relationship between manufacturers and distributors to absolve themselves of responsibilities for any misuse that surveillance technologies are put to. The prevalence of these relationships has also allowed one company in particular – Elaman – to position themselves as the surveillance industry's middleman. Finally, the combination of particular products could provide a much greater capacity than originally considered. This is another issue that export control authorities will need to weigh up in their consideration of applications for export licences.
Utimaco are a German company that acts as an Original Equipment Manufacturer (OEM) by providing mediation systems for surveillance on communications networks. These systems have been used in Iran, Tunisia and Syria. Utimaco took no responsibility for the sale of their product to Tunisia and Iran. At the time both countries had civil society under heavy oppression. Utimaco brushed the sales off as an issue of resellers selling on their products. They claimed they had not sold the product directly to these states so they could claim they weren't at fault for any use of their product for oppression. The manufacturer/distributor relationship appears to add - in the eyes of Utimaco - impunity to their actions. By providing a degree of separation between the manufacturer and the distributor, culpability for any sale to a repressive regime is at the feet of the salesperson. It fails to ask difficult questions of the manufacturer of such invasive technologies, while allowing companies' callousness over the use of the technologies to become a normal practice for the industry.
The German company Elaman, through alliances and collaborations acts the surveillance industries' salesperson. Elaman sells products by VASTech, Trovicor, Utimaco, Nokia Siemens Networks and Gamma International. One of the earliest appearances of FinFisher found in SII came from an Elaman brochure from 2007.
The surveillance technology itself can be made more powerful through collaboration. Gamma and Trovicor have an alliance which lead the two companies to "have jointly carried out major government projects worldwide". This work together would span both Trovicor's expertise – the development of massive monitoring centres operating across all communication networks and Gamma's - the deployment of intrusion software on a user's communication device. In one proposal made to Tajikistan by Trovicor in 2009, Gamma's trojan solution is included alongside Trovicor's own monitoring centre. It presents a worrying scenario in the hands of any actor regardless of whether they are a tin pot dictator or a democratic government.
Export controls are a first step
The decision in 2013 to place export controls on intrusion technologies and massive IP monitoring is a huge step forward in effectively safeguarding against exports of powerful surveillance technology to rights abusing regimes. Without export controls, Datong would never have been prevented from exporting Cellxion's IMSI Catcher. However, even with export controls in place the relationship between manufacturers of a product and their distributors complicates the enforcement of controls.
Export controls can only be wielded in an effective manner through understanding the relationships, the alliances, the distribution networks and the multi-faceted projects undertaken in this sector. Uncovering the practices of this secretive industry and holding it to account takes more than knowing who the technologies are being sold to, it also requires authorities to know who the companies are collaborating with along the way.
With thanks to http://netzpolitik.org/ for providing documents related to Tajikistan.
