Robots read your email, your phone gives away personal information even without a wiretap, and the microphone in your laptop can become a "bug".
The revelations of former US National Security Agency (NSA) employee Edward Snowden continue to shock the world: according to him, the US authorities carry out large-scale monitoring of the internet — reading email and data on social networks and forums, tracking communication over video services, and more.
One of the latest reports: US intelligence agencies are able to tap any smartphone in the world.
Responding to the fugitive sysadmin's accusations, former NSA director General Michael Hayden advised the world to redirect the questions now being put to the US government to the authorities of every other state without exception, which, in his words, are doing exactly the same.
Admittedly, Snowden told IT specialists and the intelligence services of other countries nothing new. Dmitry Medvedev, for example, does not make calls on the iPhone that Steve Jobs gave him, and information security specialists allowed Angela Merkel to use a smartphone only this year (a special model was developed for her). Military computers, and the computers that government agencies around the world use to store classified information, run on custom-made boards (spyware can be "hard-wired" straight into a device) and special software.
Paranoia? Vesti asked IT specialists who work in cybersecurity how justified such precautions are, whether Ukraine's own security agencies keep the same kind of watch on Ukrainians, and how Snowden himself stays protected.
Phone: it gives away your gender, nationality and habits
Edward Felten, professor of computer science and director of the Center for Information Technology Policy at Princeton University, recently published an article describing how much can be learned about a person from a phone call even without listening in on the conversation itself.
A special program assigns metatags to every call, and "digital portraits" are built on that basis. For the analysis it is enough to track a few calls in a day and compare them with a year's call records. For example, a person spends two minutes on the phone with a gynecology clinic, then five minutes with a number they call every year on Mother's Day, and then calls a number the subscriber talks to at length after midnight. The next call is to a family planning center. You can tell at once that this is a woman with problems in her personal life.
Gender. During business hours women have short conversations with a wide range of contacts, while in the evenings and at weekends they have long talks with five or six chosen numbers. Men do not like to "hang on the phone".
Age. If a person often misdials, calls rarely and only during the day, makes little use of SMS, avoids mobile internet and has up to five numbers on their call list, they are most likely a pensioner. Young people can be identified by their heavier use of mobile data compared with voice calls. And if a subscriber does not communicate before lunch on weekdays, this is a university student or a schoolchild.
Origin. People from the former USSR celebrate February 23 and March 8 by sending greeting texts to people from back home, the Irish always celebrate St. Patrick's Day, and Americans celebrate Father's Day and Mother's Day.
Email: robots always read your mail
Almost every Ukrainian has a mailbox with a free email service. But not everyone who ticks "I agree" under the terms of service stops to think about what exactly they are agreeing to.
Right after the Snowden scandal, Google issued an explanatory press release: "People who use web services should not be surprised that their messages are processed by the provider before they reach the recipient's inbox. A user has no reasonable grounds whatsoever to believe that information they voluntarily pass on through third parties remains confidential."
It is important to understand that, in the same way, special robot programs read and analyze emails on all free email services without exception. Their creators did this so that users are shown advertising that takes their personal interests into account. For example, if you mention in an email that you have had a baby, videos and banners for baby products will keep appearing on your screen for a long time. However, emails containing information about crimes are forwarded to intelligence agencies for analysis — especially when they concern any form of radicalism (religious fanaticism, ideas about the superiority of one race over another), drugs, weapons and so on. Naturally, US intelligence agencies have access to the services of American companies, Russian ones to information on servers located in Russia, and European ones to servers in Europe.
"Only paid services from local IT firms guarantee anonymity," says Oleksandr Kyselevsky, head of the IT company SL Global Service. But only if the information is transmitted over secure channels and in encrypted form. Even if law enforcement confiscates the servers, it will not be able to access the data.
Webcams: not just for chatting
It is common knowledge that a video call on Skype or any other video service is passed from server to server, and in the process the information is not only stored but also duplicated many times over (this is done to get a high-quality picture).
If intelligence agencies need to watch someone's conversation in real time, or even a recording of it a week after it took place, they can do so without hacking anything (judging by the data Snowden made public, the companies that own the services grant them access themselves upon request concerning a specific person).
Not everyone knows, however, that users can also be spied on through the webcams found today in practically every smartphone, tablet and laptop. A Swiss national, John Matherly, proved how easy this is. Back in 2009, supposedly to test network equipment for vulnerabilities, he created the Shodan service, which "tests" but in fact breaks into internet-connected cameras; its database currently contains up to one and a half billion accessible network devices. They include baby monitors, routers, IP phones and personal mobile devices (tablets, smartphones, laptops). What is frightening is that the service managed to find, and make publicly available, vulnerabilities in networks of traffic lights, building heating systems and even entire industrial plants, water treatment facilities and power stations.
In a similar way, even an internet-connected microphone (for example, one built into a smartphone) can be switched on and conversations recorded with special equipment. Bugs now exist only in 20th-century spy films.
Smartphones are easy to hack
It was reported recently that intelligence agencies (of various countries) are buying exploit programs from hackers that provide remote access to the hard drive of any computer connected to the internet. According to Snowden's data, if a hacked computer is synced with a smartphone, the agencies gain access to text messages, the contact list, and photos and videos.
"All user activity on the internet is stored and analyzed. Data is never deleted from servers," says Hennadiy Hulak, an IT security expert at the Kyiv company IQusion. According to him, intelligence agencies do not need to hack a user's computer at all: technically, all the information can be intercepted through the internet service provider or through the companies that own the cloud services the smartphone, tablet or computer is synced with. If Snowden is to be believed, global IT companies that claim to protect users' personal data reliably voluntarily handed the NSA and the CIA software for cracking their own encryption codes. And although Microsoft, Yahoo, Google, Facebook, PalTalk, AOL and a number of others rushed to deny it, "a bad aftertaste remained". It also emerged recently that the TOR network, which supposedly guarantees anonymity, is partly funded by the US government — if a user is in the intelligence agencies' sights, it is foolish to count on the information they send through it being safe.
An internet-connected device also makes it easy to track a user's location and to intercept whatever they post online. The only protection is a paid anonymizer program plus additional data encryption.
How Edward Snowden hides from intelligence agencies
Snowden, who knows how intelligence agencies work, is almost comically paranoid. Foreign media have described his quirks, and we asked IT specialists to explain why he acts the way he does.
In Hong Kong, Snowden made his visitors take the batteries out of their mobile phones and hide the phones themselves in the fridge
A fridge muffles sound well, and some models (with a metal casing) block radio signals as well.
He keeps compromising material on the intelligence agencies on four hard drives disconnected from any computer
The hard drives could at most be stolen: no one can view or destroy Snowden's files remotely.
He refused to talk to the media by phone, even over an encrypted channel
Communication channels can only be secured with cryptography (the voice is converted into a digital signal and then encrypted). What matters is not only the strength of the encryption algorithm but also how correctly it is applied. Any mistake made out of ignorance or oversight will lead to a breach.
He would not transmit information over the internet
Browsers keep a history of visits and like to report user activity back to their developers (Chrome, in particular, does this). Among other things, they can be used to intercept passwords.
He does not use email himself and advises others not to
Without knowing where the mail is physically stored, and whether some quirks in how the software and hardware work (such as the nearest cell towers or a MAC address) give away your location or identity, you cannot consider this tool safe.
What next: there will be no secrets left in the world of the future
"The question of whether total monitoring of the internet and voice communications is needed is a coin with two sides," believes Yuriy Syvytsky, member of the supervisory board of the IT consortium Intecracy Group. If, for example, Andrei Chikatilo's proclivities had been detected through his internet activity — and he would clearly have visited certain websites — more than 50 lives could have been saved. In such cases surveillance is justified, as it is for preventing terrorist attacks, mass murders and other serious crimes.
On the other hand, information gathered with the help of IT could be used to exert pressure. For example, a user starts a petition against the war in Syria, and an information system puts them on a list of people to be refused a visa or a job at an international company. "This issue has to be regulated by international conventions, as with chemical weapons," Syvytsky believes.
"Snowden showed billions of internet users that we live in a new world, a world where it is hard to hide anything," says Hennadiy Hulak. And this process has only just begun. While it is still possible to resist surveillance to some extent today, with the development of mobile internet, growing volumes of transmitted data and the spread of facial recognition and biometric systems, secrets will disappear altogether.
The SBU does not know everything
The picture with foreign intelligence agencies is clear. But what about Ukraine? A source in the Security Service of Ukraine (SBU), speaking on condition of anonymity, told Vesti that there is currently no total surveillance of Ukrainians: "It is carried out only within an open criminal case, when serious crimes are involved. In that case, special equipment is installed on the data transmission channel. The decision to take such action must be set out in a court ruling."
In practice this is a formality, as judges sign such papers from the SBU without reading them. But no global monitoring system has been created — the idea of installing special equipment at all internet providers and telecom operators exists only in the form of draft laws. That is why Ukraine's security agencies seize servers physically.
Law enforcement has the right to conduct surveillance
MP Sviatoslav Oliynyk, the author of the new Criminal Procedure Code (which came into force in November last year), says that Ukrainian law allows law enforcement agencies to carry out so-called "covert investigative actions".
Moreover, surveillance may target not only a suspect but also another person, if watching them can yield information about a crime. Covert audio and video monitoring, as well as inspection, seizure or arrest of correspondence, are permitted. In addition, the law allows monitoring of calls, SMS, MMS and online correspondence, and the extraction of data from a computer without the owner's knowledge.
Within a year, officers of the SBU or the Interior Ministry are obliged to notify a citizen that they were under surveillance.