(Image: Hacking Team)
The hunters become the hunted. Yesterday, hackers released what they claimed was 400 GB of internal documents stolen from Hacking Team 鈥� an Italian company that sells surveillance tools to governments and intelligence agencies.
The release of the documents has exposed the reality of the lucrative cyberweapons market.
Advertisement
Ever since, security experts have been poring over the files and publishing their findings. For one thing, the documents suggest Hacking Team marketed its products to a wide range of governments 鈥� including a host of repressive regimes.
Christopher Soghoian, principal technologist at the American Civil Liberties Union (ACLU), says he has downloaded a cache of company invoices in an effort to better understand which governments Hacking Team sold its products to.
鈥淭he invoices are fascinating,鈥� he says. 鈥淗acking Team has been selling their software to governments like Azerbaijan and Kazakhstan, Sudan, Vietnam, Ethiopia 鈥� a number of governments with documented histories of abusing human rights.鈥�
Soghoian admits that it鈥檚 possible the leaked documents have been tampered with in some way, but says his gut feeling is that they are largely authentic. 鈥淩esearchers have been studying Hacking Team for three or four years and the invoices match up with the countries we believe have been purchasing this stuff in the first place,鈥� he says.
Cheap surveillance
One striking revelation is that the cost of some of Hacking Team鈥檚 services is relatively low, according to Soghoian. Government agencies appear to be able to subscribe for as little as $50,000 a year.
The purchased information could allow such agencies to install surveillance programmes remotely onto target computers. 鈥淭his software is now basically affordable enough that any government can buy it,鈥� says Soghoian.
Hacking Team is far from the only firm working in this field. There鈥檚 Gamma International, the company behind , which can be remotely installed on a phone, tablet or computer in order to monitor a target鈥檚 activity and communications. The firm also had documents leaked by hackers in August last year.
FinFisher, like Hacking Team鈥檚 鈥淩emote Control System鈥�, has met with controversy thanks to its apparent use by repressive governments 鈥� to, for example.
The 鈥榚xploit鈥� market
The booming market for surveillance tools is no surprise, says Sean Sullivan, a security expert at F-Secure. He says that intelligence agencies have helped to fuel the market for 鈥渆xploits鈥� 鈥� methods of hacking computer systems.
鈥淥ne of the unintended consequences of folks like the NSA and GCHQ using the internet as a source for intelligence is that they hired people to find high-end exploits in software,鈥� he says. 鈥淵ou can鈥檛 have that without then also fuelling this ecosystem.鈥�
In a statement, company spokesman Eric Rabe said: 鈥淗acking Team has been the victim of an online attack, and we believe documents have been stolen from the company. We are investigating to determine the extent of this attack and specifically what has been taken. Obviously, we will work with appropriate law enforcement to determine who is responsible.鈥�
He added: 鈥淲e cannot comment on the validity of documents purportedly from our company. However, some of the information that is in the press today 鈥� and is reportedly based on these documents 鈥� is inaccurate. We are continuing our investigation.鈥�
Spying regulation
Edin Omanovic, a research officer at Privacy International, said the documents show that the trade in surveillance technology needs to be more tightly regulated.
鈥淎蹿迟别谤 the Arab Spring it was quite evident that a lot of European companies were involved in setting up the surveillance systems of most of the dictatorships in the region,鈥� he says. 鈥淸The EU is now] trying to ascertain the practicality of imposing export restrictions on technology like the sort of tools that Hacking Team makes.鈥�
Draft legislation to this effect could be ready by early next year, according to Omanovic. 鈥淚t underlines the essential need for regulatory action to be taken on these sort of companies. It鈥檚 not a problem that鈥檚 going to go away 鈥� it鈥檚 only going to get bigger.鈥�
