NEW DELHI :In July 2015, when WikiLeaks published internal email records of Hacking Team, an Italian surveillance vendor, it gave a rare peek into the shopping basket of Indias intelligence agencies. One agency wanted to infect the mobile phones or SIM cards of all the subscribers in sensitive areas to continuously track their location with high accuracy", another was looking for a one-click solution to infect any type of platforms, models, etc. by just sending an SMS, without knowing any background about his target (sic)".
The agencies were enquiring about the Remote Control System (RCS), Hacking Teams flagship surveillance product. It is sold exclusively to intelligence and law enforcement agencies, and is designed to remotely monitor targets: it could copy files, record Skype calls, read emails and instant messages, capture typed passwords, and turn on a devices webcam and microphone to spy on the user.
Emails reviewed by Mint show that a multitude of Indian agencies were secretly negotiatingeither directly but mostly through a third-party contractorwith the Italian firm. It is, however, unclear whether the deals went through or not.
The spying features of RCS are strikingly similar to recent revelations about Pegasus, the spyware built by Israeli cybersecurity company NSO Group that targeted WhatsApp users and facilitated the complete takeover of the device to capture all its activity. Facebook-owned WhatsApp sued the company for installing surveillance malware on the phones of 1,400 users across four continents, including at least two dozen Indians activists, journalists, lawyers and academics.
Like Hacking Team, NSO Group claims it only sells software to government authorities. While the Indian government hasnt acknowledged any transaction with NSO Group, the 2015 email dump suggests this is standard practice. The agencies have been asking around for products that allow for intercepting WhatsApp messages since at least 2016," a senior security researcher who works closely with Indian intelligence agencies told Mint on condition of anonymity.
The WhatsApp hack has once again brought to light the concerns over surveillance abuse in India. The debate is often framed as a trade-off between user privacy and national security. Officials say there are processes in place to check misuse of power, but as the WhatsApp episode highlights, its not just suspected terrorists but civil rights activists who are often at the receiving end of intrusive state surveillance.
Actually, what we know about the surveillance regime in India is just the tip of the iceberg. Even without the deployment of expensive solutions like Pegasus to hack into your device, the government has ample sources to learn about your whereabouts from the data trails you leave behind. Heres how you can try to stay ahead of the snooping game.
Fallacies about encryption
Traditionally, surveillance is imagined as law enforcement listening to telephonic conversations or reading text messages of targets. In the cyber age, this extends to internet traffic: the state wants similar capabilities for digital communication including emails, instant messaging and VoIP calls (like Skype).
Here, encryption protects your information. Through publicly known mathematical algorithms, computer programs can turn a plain text (I will meet you at Punjabi Bagh, 8pm") into a cipher text through a special key. Only those having access to the key can decrypt the information to infer the meaning; for the rest its gibberish. WhatsApp for instance is end-to-end encrypted, meaning only the sender and receiver can read the content.
Thats why the Indian government wants WhatsApp to trace the origin of a message flagged as unlawful by law enforcement, a demand the American company says it cant deliver as WhatsApp itself doesnt have access to the special key to decrypt the information.
Encryption is important, and it provides some degree of protection from mass surveillance. But its not the end of the game: a malware attack on your mobile phone can take control of your device and will make your communications naked to the attackers eyes.
The power of malware
Imagine a castle with hundreds of doors. Dozens of security guards are deployed at every gate to protect the fort. You are sure no one can enter the castle. But one small entrance in an obscure corner is unknown and unprotected. The opponent, however, discovers it first and uses the route to enter the castle, breaching security.
In cybersecurity parlance, if the castle is your device or software, that unknown gate is a zero-day vulnerability", meaning you have zero days to protect your system if the attacker knows about a vulnerabilitya security weakness unintentionally designed in a piece of softwarebefore you do. This is exactly what happened in the case of the latest hack. Pegasus exploited an unknown security vulnerability to remotely instal spyware on the targets device.
Zero-day exploits are traded in the market. Many companies have bug bounty programs" where security experts are paid to report bugs in their products, a smart way to outsource security. Attackers have many ways to infect the target vulnerabilities with malware. First, sending infected PDF files or images sent as email attachments: if downloaded and opened, you inadvertently infect your own computer. Most of these are well-targeted campaigns to make the content look appealing enough for you to trust.
Then, just visiting a compromised Web page could instal dangerous software on your device, without you downloading any attachment or giving additional permission. Victims may come across such links through social media posts or email links. This attack usually takes advantage of a security flaw in the Web browser and aims to auto-run the exploit code to take over the device.
As a special case of this attack, a set of niche but popular websites that a target group regularly visits are infected with malware. When users visit the website next time, it is ready to infect the target group with malware. In September, TechCrunch reported that a number of malicious websites used to hack into iPhones over a two-year period were targeting Uyghur Muslims", most of whom live in Chinas Xinjiang state.
How do you protect yourself from malware attacks? If an attacker gets hold of a zero-day, you barely have any option. But as a precaution, you should ensure you use the latest version of the software. Outdated software is like a castle with open doors known to everyone but without any guards. Still, most people dont: According to the latest data from analytics firm StatCounter, only 33% of Indian smartphones are running the latest version of Android.
Moreover, cheaper smartphones, which ship with their own customized version of the Android operating system, are late to ship updates, leaving their users vulnerable to known attacks (See graphic for more ways to counter snooping).
M stands for metadata
Most people imagine government surveillance in terms of content: tapping phone calls to listen to conversations, ability to read the complete text of emails and messages. But more is happening under the hood: even without knowing the details of content, a lot can be inferred about ones whereabouts.
Just by the act of using a service, be it making a call or browsing the internet, we leave a valuable trail of data with telecom companies and internet service providers (ISPs): it includes call detail records (whom did you speak with, when and for how long), the location and IMEI number (which uniquely identifies a wireless phone or device) of both the caller and recipient, and the Web browsing history.
This is called metadata", everything except the content of the communication, and can be far more revelatory than most people imagine. Connect the dots and it provides an intimate lens into a persons life.
Sample what companies and governments can infer from metadata: they know you called a phone sex line in the night but dont know what you talked about; they know the people you speak with every day, once in a month or once in a year, revealing your close and distant contacts; they know you called a suicide prevention hotline but the topic is not known; they know if an informant is repeatedly talking to a human rights activist or journalist, but dont know what is being revealed; they know a girl called a gynaecologist, spoke for a half hour, then called a man whom she often speaks with late in the night, and then called the local abortion clinics number later that day; they know the websites you visit and time you spend looking at the content (no, incognito mode doesnt protect you from the eyes of the ISP).
The contents of calls are far more difficult to analyze in an automated fashion due to their unstructured nature," Edward Felten, a professor of computer science and public affairs at Princeton, explained in an affidavit filed by American Civil Liberties Union challenging the legality of the National Security Agencys mass collection of Americans phone records. A groups metadata can reveal intricacies of social, political, and religious associations," he wrote, adding: Given limited analytical resources, analyzing metadata is often a far more powerful analytical strategy than investigating content."
Location, location, location
Moreover, mobile phones are perennially giving away our location to the telecom companies through the signals they broadcast. By observing the signal strength that different towers receive from a particular subscribers mobile phone, operators can calculate where that phone must be located.
Location tracking is more than just knowing where you are at a given point in time: it could be used to try to find out whether certain people are in a romantic relationship, to find out who attended a particular meeting or who was at a particular protest, or to try and identify a journalists confidential source", the Electronic Frontier Foundation explained in a blog post.
In India, telecom licences require operators to provide direct access to all communication data and content to authorities even without a warrant. In 2009, the government announced it was building a Central Monitoring System that will provide it centralized access to the countrys telecommunications network and facilitate direct monitoring of phone calls, text messages, and Internet use by government agencies, bypassing service providers", the Human Rights Watch noted in 2013.
There is not much you can do to protect metadata surveillance, especially for calling and location tracking data. You can use a VPN (virtual private network) service to protect your browsing activity from the ISP or Tor browser for anonymous browsing, but both have their limitations.
The lack of law
The general saying that the law lags technological innovation by at least a generation does not apply to India. The country has no laws governing mass surveillance. For targeted interception, there are two main Acts governing the legal provisions for surveillance in India. First, the Indian Telegraph Act, 1885, which allows for the interception of telephonic calls and messages. Second, the Information Technology (IT) Act, 2000, which has provisions to intercept digital information including data stored on a computer, internet traffic and other data flows.
There is one key difference between the two Acts: The grounds under the IT Act are wider and lack some of the safeguards under the Indian Telegraph Act. Under the latter, there should be a condition of a public emergency" or interest of public safety" for intercepting the information. There is no such requirement under the IT Act, which makes it more powerful.
As India heads towards framing laws to protect user data and privacy, it remains to be seen if the state will curb its own powers of illegitimate surveillance to snoop on its citizens.
In conclusion
The truth is, cyberspace warfare is asymmetrically skewed towards the attacker, who needs to take advantage of just one weakness to exploit you. Defenders need to protect everything.
Which is why, when framing a digital security plan, it is not useful to ask a question like whether X technology is safe or not". Merely using Signal (a highly recommended encrypted instant messaging app) or Tor (that allows anonymous Web browsing) is not the solution. The recommended approach is to define what you are protecting, from whom, how much convenience you are willing to trade-off and then take specific security steps for clearly defined goals.
By adopting best practices to be secure online and following a plan, you can make it difficult for anyone to spy on you. But in the extreme case, if a nation-state really wants to target you, it probably can: your efforts will introduce roadblocks, make it financially more expensive to snoop on you, but nothing can offer a guarantee of complete privacy.
Samarth Bansal is a freelance journalist based in Delhi. He writes about technology, politics and policy.
Read the original post:
Smart users guide to the snooping game - Livemint
- Tor Browser Has a New WebTunnel Feature to Avoid Censorship - How-To Geek - March 14th, 2024 [March 14th, 2024]
- The CIA Is Now Trying to Recruit Russian Spies On Telegram - TIME - May 18th, 2023 [May 18th, 2023]
- Dark Web Alerts: Identifying Criminal Data Exposure on the Dark Web - Security Boulevard - May 18th, 2023 [May 18th, 2023]
- Mullvad aces security audit with this new privacy tool - TechRadar - May 18th, 2023 [May 18th, 2023]
- Billions of Google Chrome users warned to avoid browser over red alert privacy concerns check your sett... - The US Sun - May 18th, 2023 [May 18th, 2023]
- How the decision on Space Command's home will be made - POLITICO - May 18th, 2023 [May 18th, 2023]
- Bitcoin Mixers: Clearnet vs. Darknet Which Offers Greater Anonymity? - Crypto Mode - April 27th, 2023 [April 27th, 2023]
- Matt Taibbi: Report on the Censorship-Industrial Complex - Scheerpost.com - April 27th, 2023 [April 27th, 2023]
- The Ultimate 2023 Guide to The Tor Browser Explained - Pixel Privacy - January 31st, 2023 [January 31st, 2023]
- What is Tor & How Do You Use It? Microsoft 365 - January 17th, 2023 [January 17th, 2023]
- Improving privacy when browsing web: Alternative browsers and chrome extensions - HackRead - October 19th, 2022 [October 19th, 2022]
- Tor Browser Bundle - Free download and software reviews - CNET Download - October 11th, 2022 [October 11th, 2022]
- Hacktivists seek to aid Iran protests with cyberattacks and tips on how to bypass internet censorship - CNBC - October 11th, 2022 [October 11th, 2022]
- This security firm claims to have the right tool for your privacy, and it's not a VPN - TechRadar - September 15th, 2022 [September 15th, 2022]
- A VPN Isn't the Only Way to Change Your IP Address - CNET - September 11th, 2022 [September 11th, 2022]
- Hi, I'll be your ransomware negotiator today but don't tell the crooks that - The Register - August 6th, 2022 [August 6th, 2022]
- Rewards for Justice Reward Offer for Information on Russian Interference in U.S. Elections - United States Department of State - Department of State - July 29th, 2022 [July 29th, 2022]
- How Tor Is Fightingand BeatingRussian Censorship - WIRED - July 29th, 2022 [July 29th, 2022]
- What Is Incognito Mode And Should You Be Using It? - Forbes - July 29th, 2022 [July 29th, 2022]
- TOR Browser - Onion VPN on the App Store - July 17th, 2022 [July 17th, 2022]
- Tor Browser now bypasses internet censorship automatically - BleepingComputer - July 17th, 2022 [July 17th, 2022]
- The dangers of the dark web: being safe online - Open Access Government - July 13th, 2022 [July 13th, 2022]
- Tor vs VPN: Which One Should You Use? - Dignited - June 30th, 2022 [June 30th, 2022]
- Rewards for Justice Offers Up to $10 Million for Information on Foreign Interference in US Elections - HS Today - HSToday - June 30th, 2022 [June 30th, 2022]
- Kremlin tightens control over Russians' online lives threatening domestic freedoms and the global internet - Jacksonville Journal-Courier - June 30th, 2022 [June 30th, 2022]
- Defence in Amanda Todd 'sextortion' trial zeroes in on missing data - The Tri-City News - June 30th, 2022 [June 30th, 2022]
- Now that 'Roe' has been overturned, it's up to the tech industry to protect our data - Fast Company - June 30th, 2022 [June 30th, 2022]
- QAnon Is Celebrating the Return of Its Leader After 18 Months of Silence - VICE - June 30th, 2022 [June 30th, 2022]
- 3 ways to find out if your passwords are being sold on the Dark Web - Komando - June 22nd, 2022 [June 22nd, 2022]
- EXPLAINER: EFCC 'Linked Naira Marley to the Dark Web'. Here's What You Need to Know About the Internet's Most Hidden Part - FIJ NG - June 11th, 2022 [June 11th, 2022]
- What is the Dark Web? - AOL - May 28th, 2022 [May 28th, 2022]
- Cookie Banners Can Be AnnoyingHere's How To Block Them - WRAL News - May 28th, 2022 [May 28th, 2022]
- DuckDuckGo tries to explain why its browsers won't block some Microsoft web trackers - The Register - May 28th, 2022 [May 28th, 2022]
- Proton VPN Secure Core: what it is and when you should use it - TechRadar - May 28th, 2022 [May 28th, 2022]
- How to Download & Install Tor Browser in Windows 10 - May 7th, 2022 [May 7th, 2022]
- How to Unblock a Webpage from Behind a Firewall - Beebom - May 7th, 2022 [May 7th, 2022]
- Download Tor Browser For Windows & MAC (Offline Installer) - May 1st, 2022 [May 1st, 2022]
- Tor Browser - Dark Web Portal Exposed | Dark Web Wiki - May 1st, 2022 [May 1st, 2022]
- Top 10 dark web links & Tor websites for 2022 - Surfshark - May 1st, 2022 [May 1st, 2022]
- How to Install the Tor Browser on a Chromebook - May 1st, 2022 [May 1st, 2022]
- How to Anonymous access to the dark web with Tor - BollyInside - May 1st, 2022 [May 1st, 2022]
- How to Change the Tor Browser Language - How-To Geek - April 29th, 2022 [April 29th, 2022]
- Bites of Life: Shining Light on the Dark Web - Macalester College The Mac Weekly - April 29th, 2022 [April 29th, 2022]
- How to protect against the weakest link in cybersecurity THE USERS - Security Boulevard - April 29th, 2022 [April 29th, 2022]
- What Is Dark Social and Why It Matters - Legal Talk Network - April 29th, 2022 [April 29th, 2022]
- IP bans - why they happen and how to prevent them - Oneindia - April 29th, 2022 [April 29th, 2022]
- Deep Web Tor Browser - Tor Links - Onion Links (2022) - April 20th, 2022 [April 20th, 2022]
- How to Install and Use the Tor Browser on Linux - April 20th, 2022 [April 20th, 2022]
- The Best VPN for Binance 2022 [How to Use Binance With a VPN] - Cloudwards - April 20th, 2022 [April 20th, 2022]
- Three tactics for security providers in the age of Dark Web collaboration - SecurityInfoWatch - April 20th, 2022 [April 20th, 2022]
- Simple way to Install Tor Browser in Rocky Linux 8 - Linux Shout - March 17th, 2022 [March 17th, 2022]
- Laptop in Veltman apartment had what appeared to be 'hate-related material': docs - Lethbridge News Now - March 17th, 2022 [March 17th, 2022]
- How to Access Blocked Websites anywhere and for Free - BollyInside - March 17th, 2022 [March 17th, 2022]
- Download Tor Browser for Mac - Free - 10.0 - Digital Trends - March 11th, 2022 [March 11th, 2022]
- Open in Tor Browser Get this Extension for Firefox (en-US) - March 11th, 2022 [March 11th, 2022]
- Use Brave Private Browsing with Tor to Hide IP Address - OSXDaily - February 21st, 2022 [February 21st, 2022]
- Are Crypto Transactions More Transparent Than Wire Transfers? - InvestingCube - February 21st, 2022 [February 21st, 2022]
- The Truth about Dark Web Is It Really Dangerous? - Crypto Mode - February 21st, 2022 [February 21st, 2022]
- Tech-Savvy Professionals Among 22 Arrested In Dark Web Narcotics Operation - NDTV - February 15th, 2022 [February 15th, 2022]
- Download Tor Browser for Windows - Free - 11.0.3 - February 1st, 2022 [February 1st, 2022]
- Tor Project heads to Russian court to appeal against censorship - The Daily Swig - February 1st, 2022 [February 1st, 2022]
- Firefox Monitor may remove personal information now from the Internet - Ghacks Technology News - December 9th, 2021 [December 9th, 2021]
- The Real Russia. Today. Reining in an unruly Communist Party Meduza - Meduza - December 9th, 2021 [December 9th, 2021]
- See the stunning mansion Josh Duggar is calling home during his child pornography trial ahead of possible... - The US Sun - December 9th, 2021 [December 9th, 2021]
- Whats the Difference Between the Deep Web and the Dark Web? - How-To Geek - December 9th, 2021 [December 9th, 2021]
- How to Access the Dark Web Complete Guide? - The Bulletin Time - December 7th, 2021 [December 7th, 2021]
- Theres More to Threat Intelligence Than Dark Web Monitoring - Security Boulevard - November 25th, 2021 [November 25th, 2021]
- You have to work on this through the routeras options diet plan, as some items immediately restore previous setup after a forced reboot - ADOTAS - November 25th, 2021 [November 25th, 2021]
- What is Tor (Browser) & How does it work? | CyberNews - November 23rd, 2021 [November 23rd, 2021]
- Privacy-Protective Internet Browser Tor Is Running Low on Servers - Gizmodo - November 23rd, 2021 [November 23rd, 2021]
- Yes, the Internet has become safer but a VPN is still needed - TechGenix - November 19th, 2021 [November 19th, 2021]
- Scots businessman caught with the 'most serious' category of child abuse images jailed - Scottish Daily Record - November 19th, 2021 [November 19th, 2021]
- Anna and Josh Duggar welcomed daughter Madyson Lily on October 23, their 7th child * starcasm.net - Starcasm - November 17th, 2021 [November 17th, 2021]
- Tor Browser (Alpha) 11.0.9 Download | TechSpot - November 5th, 2021 [November 5th, 2021]
- US government offers $10 million bounty for information on Colonial Pipeline hackers - The Verge - November 5th, 2021 [November 5th, 2021]
- The Tor Browser: What is it and why would you use it ... - October 24th, 2021 [October 24th, 2021]
- Tor Explained: What is Tor? How Does It Work? Is It Illegal? - October 21st, 2021 [October 21st, 2021]
- Alternatives to Using a VPN That Provided Excellent Anonymity While Online - TechBullion - October 21st, 2021 [October 21st, 2021]
- Slicing open The Onion Router (Tor) with no tears - ComputerWeekly.com - October 19th, 2021 [October 19th, 2021]
- What is the dark web? - fox4kc.com - October 19th, 2021 [October 19th, 2021]