Mass Surveillance Ethics: Western Tech in Authoritarian States

[00:00:12]this is a film about a world in which surveillance has no limits and what can happen when it's in the hands of repressive governments [Music] this is the story of how british technology may have helped silence a generation in the arab world for each and every case where someone is silenced or ends up in prison with the help of eu made technologies i think is is unacceptable our investigation shows how britain's leading weapons manufacturer has profited from exporting sophisticated officially classified equipment every country willing to write a paycheck to the right party can do this sort of surveillance but nobody wants to admit it we reveal that some of this equipment is so powerful that foreign governments who've bought it have the capability of using it against the uk and its allies threatening national [Music] security in this film we show that powerful british cyber surveillance equipment has secretly been sold to repressive governments in the middle east our investigation begins in beirut the lebanese capital i've come to beirut because we've tracked down a cyber security expert from the region he lives out of a suitcase because with so many people at risk he's constantly traveling to train them on how to protect themselves muhammad muscati works with human rights organizations journalists and activists so this is my phone he's going to show me how easy it is for a government to get access to my phone he's infecting it with a spyware program this could also be done remotely by a government but it's old-school off-the-shelf technology today it's possible to pin down someone's location read their emails even change their text messages and that's just the beginning foreign i'm leaving lebanon to start my journey into the gulf region but even when i'm in another country muhammad will be able to see [Music] [Music] [Music] foreign and muhammad is right i am in dubai in the united arab emirates i've come here to meet ahmed mansour he's an activist who was imprisoned for tweeting about abuses by the uae government it spent so much money targeting him that he's become known as the million-dollar dissident [Music] um ahmed was protesting against unfair trials and arbitrary detention he was also charged with insulting the nation's leadership he shows me how his email was hacked exposing all his messages and contacts [Music] an independent investigator said that the uae government was almost certainly responsible following his release from jail ahmed isolated himself to protect his friends and family i stayed in touch with ahmed after we finished filming but then in march 2017 i heard he disappeared weeks later his family discovered he was being held in solitary confinement without charge in al-sadr prison in abu dhabi according to the uae news agency his crime was using social media to spread false and misleading information that harms national unity and damages the country's reputation his case has caused alarm worldwide so if you look at a context like the uae where a human rights defender like ahmed mansour has been you know punished simply for speaking out against the government in favor of human rights then the implications of sending or providing sophisticated surveillance equipment to monitor communications of activists and civil society are very serious ahmed was arrested because of his social media posts but we've discovered that the uae has the power to monitor his private communications too in fact it has the power to monitor all of its people all of the time it now has a kind of surveillance that doesn't infect the phone or computer it's completely external and so it's almost impossible to detect it's called mass surveillance so a little massiveness in the whole as in the west governments in the arab world have invested millions in mass surveillance it's a uniquely powerful tool for learning what the population is up to [Music] uh [Music] this kind of mass surveillance has chilling implications for all of us what's shocking is where it's coming from one of the world's most liberal countries this is auburn in denmark a former industrial city reinventing itself as a center for the new knowledge economy i'm heading over the bridge to a place called norisombu i'm going to visit a company that specializes in cyber surveillance it was called eti in 2011 it was bought by bae the uk's biggest arms manufacturer today it's called bae systems applied intelligence and it makes a surveillance system that's been sold to the united arab emirates around the back two large satellite dishes an employee wants to know what we're doing what's the reason you're filming you know who makes cyber security for no that's what we want to know yeah who do you make excitement that's why we don't answer you it seems very secretive whatever it is it's a weapon manufacturer and and by that you will know that being a weapon manufacturer they're not going to say anything and so that's the policy and nobody would speak to us but after months of research we found a former employee who agreed to talk about his former work provided his identity was disguised he's portrayed by an actor you're always under some kind of surveillance you weren't sure who your friends were who your enemies were there were different rooms you couldn't go into if you didn't have a specific level of clearance after a while i was allowed to go into those rooms that's where they kept the equipment this surveillance solution was so closely guarded because of its extraordinary power it can collect catalog and analyze millions of people's communications both private and public you'd be able to intercept any internet traffic if you wanted to do a whole country go ahead you'd probably need something to narrow your search down either by a specific person a specific email address specific ip address or specific keywords to search for the surveillance tool goes by multiple names but one of them is evident it's one of the reasons bae wanted to buy the danish cyber security company this sales brochure describes evident as a highly sophisticated tool for mass surveillance and it says it's able to integrate targeted capabilities too you could pinpoint people's location based on cellular data you could follow people around they were quite far ahead with voice recognition they were capable of decrypting stuff as well governments have always collected information about us but we now generate much more data about ourselves and technological advances make it far easier for the state to collect it this is my not so secret device it's sending out information about me every second of the day that information is called metadata it tells the internet service provider my phone is the source of the message along with dates times subject lines locations and numbers or addresses of the people i'm communicating with [Music] and all you do is basically record what people are doing and search it later so if i'm an intelligence agency i need the capability to target anybody and i don't know until tomorrow who i wish i knew about today so the easiest solution is just record basically everybody's web browsing and behavior and then go from there once i have somebody i need to look for it's a technology that allows you to rewind time it can go back years exposing our each and every search and contact that's a serious threat to everyone's privacy what all this means is that it's possible to monitor a country's entire network of communications you just need to buy the right kind of high-tech solution and evident is one such solution nick weaver is a frequent visitor to arms fairs like this one in qatar it keeps him on top of the fast evolving technology among the conventional arms and war equipment are still selling cyber surveillance technologies under international law this kit is defined as military since it has the potential for use as an offensive weapon nick is one of the few experts willing to talk openly about mass surveillance every country willing to write a paycheck to the right party can do this sort of surveillance but nobody wants to admit it and why is that because it's dangerous because it's creepy the the notion that all your web surfing is captured because all that stuff is unencrypted is just frankly creepy even if something is never abused it just disturbs people creepy or not there's little doubt that mass surveillance can be used to identify criminals and extremists according to the home office it's also been significant in every major counterterrorism investigation of the last decade the more terrorist instance there are the more people will start to see the benefits of favoring security over privacy and i sense a mood and that's all i can do is sense a mood among the public that actually that has moved the cursor more in favor of security and away from individual privacy because people recognize it's a trade-off [Music] keep on moving more than ever in the wake of the london and manchester terror attacks this trade-off is on the minds of the british public and government the uk government has a very close relationship with bae last year the ministry of defense spent over 4.6 billion pounds on bae equipment and senior government representatives meet with bae at least once a week the uk government is considered world expert when it comes to cyber intelligence and bae has played a major part in that as a key supplier of technical tools to british intelligence agencies but the question is should they be selling similar equipment to foreign governments i've come back to denmark where some new evidence about bae and its mass surveillance tool has come to light i'm meeting reporters from dagbladet information a danish newspaper at the daily editorial meeting lassos go anderson is briefing colleagues lassa and sebastian gerding are working with us investigating the cyber technology made by bae subsidiary in denmark in all of these cases in the copies that we have of the documents bae systems applied intelligence is mentioned as the exporter bae needs a danish license to export from its subsidiary here lassa obtained a copy of one of these licenses after making a freedom of information act requests to the danish business authority bae was asked if they had any objections they did so the dba blacked out some of the details also they thought they tried to redact which company was exporting this stuff to the uae and they also trusted who was the customer in the uae but they messed up their redactions so here for instance you can see the end user of the equipment is ministry of interior instead of uae and uh you can also see which company is selling the system i'll just find the place where it's most visible oh wow you can see it says bae systems systems applied intelligence as in nursing incredible using the same method of investigation we've established that bae has sold its evident technology to saudi arabia qatar oman morocco and algeria the license spells out exactly what it can do you can see here that what they're selling is an ip monitoring and data analysis system to be used for national security and serious crime investigation bae's website says the company sells its products according to normal commercial imperatives it states that the company respects human rights wherever they operate in 2016 cyber and intelligence contributed nearly 1.8 billion pounds to company turnover it's a lucrative business but no one at bae was prepared to discuss it in a statement the company told us our technology plays a crucial role in enabling the uk and its allies to combat the threat of international terrorism bae systems is committed to operating ethically and responsibly we have robust policies and procedures in place to ensure that our international exports to overseas governments are all fully compliant with international export regulations as well as our own strict criteria to evaluate every potential contract so what happens when a country is under surveillance by evidence i've come to tunisia to find out [Music] president was tunisia's dictator for 23 years before he was overthrown by democratic forces he was also an early customer of eti the danish company later bought by bae binali had the evidence system installed in the basement of one of his own houses the temptation for a dictator to control his opposition is great and more than that bin ali wanted to know what people were thinking too today all that's left in the basement is one old computer rack tunisian intelligence is a murky world but after weeks of searching we found someone who operated the evidence system for ben ali his job was to monitor the whole of tunisia's internet activity an actor portrays him s foreign so an example might be you know that these are the people at a protest that's your starting point or you might know that you're interested in people who have read a given article and you go from there and you build basically a profile of what they do and then if somebody's really interesting then you can switch to an active attack the information evident provided about websites social media emails and blogs was given to a team that worked closely with bin harley himself we found someone from that specialist intelligence unit his words [Music] the consequences were no laughing matter for those targeted binali locked up thousands of his opponents in tunisia's prisons [Applause] it was in tunisia in december 2010 that a spark ignited the arab spring events that compelled many governments across the region to seek out state-of-the-art surveillance technologies for bae this was an opportunity the company approached eti the danish producers of the evidence surveillance system and bought it for 137 million pounds the deal included long-running contracts with saudi arabia we can reveal that bae has continued to sell surveillance equipment to saudi arabia as recently as 2016.

[00:22:51]inside the country a well-founded fear of surveillance has led many people to change their behavior um is saudi arabia's best-known female activist in 2011 inspired by the protests in tahrir square she posted a video promoting her campaign to allow saudi women to drive her phd professor she was arrested she believes the saudi authorities must have hacked her social media the knowledge that there is surveillance being carried out by governments is having a chilling effect if you look at a country like saudi arabia where a few years ago there was an emerging human rights community which was doing some very important work part of that group has left the country you know out of fear for the consequences of what will happen to them and the other part of that community are too scared to talk to us because of what they fear may happen and they know that if they do communicate with us they're very likely to be listened to [Applause] i've heard about a former saudi air force officer who also now lives abroad was caught posting pro-democracy statements online fearing arrest he had to flee his country [Music] then after [Music] since filming this interview menel has moved to australia like manal yahya felt he had to leave saudi arabia he fears what might happen if people feel they have no when it comes to human rights saudi arabia is at the bottom of the international league and as a result baes armed sales to the saudis have always been controversial some argue it's actually unlawful for the british government to allow the exports of these tools if one looks at british arms export law which covers all sorts of military equipment and training and services no export license is supposed to be granted if there is a strong chance that the sale of that equipment will increase the likelihood of the breaking of international humanitarian law this argument andrew feinstein believes would also apply to the exports of surveillance technology i have no doubt that the british government is acting illegally in terms of its own laws in selling cyber surveillance equipment to the government of saudi arabia we requested interviews with both the foreign office and the department for international trade which is responsible for approving exports of cyber equipment both declined to speak to us we have discovered from bae's export licenses that the company has also sold its mass surveillance system to oman so it's the next stop in my investigation it's long been britain's main listening post in the gulf and is still an important ally i'm here to find out about mass surveillance in action because it leaves no trace it's almost impossible to know it's been used but sometimes as in oman the evidence is strongly suggestive nabhanil haneshi's story begins when he was picked up by the authorities after romans short-lived arab spring foreign [Music] [Music] um [Music] that was enough for this paper to brand them as terrorists nabhan was jailed for 18 months in 2014 neban got asylum in london people sent him stories of human rights abuse in oman so he set up the omani human rights network to publicize them all communication with his sources was kept secret um despite all napan's efforts he believes the information sent to him was being intercepted by me i wanted to meet one of those arrested in oman we'll call him syed to disguise his identity an actor speaks his words sayed says the omani authorities were watching the network members private accounts from the outset like but the precautions were in vain all those who wrote to nabhan were picked up by the authorities [Music] on the authorities rounded up seven members of the network nabahan says they were jailed and tortured all of them had napan as their common contact i'm asking nikueva what this says about the method of surveillance that probably suggests that they are doing bulk recording of email metadata so bulk recording do you mean mass surveillance yes that is a the most suggestive evidence of mass surveillance once you have a message of interest then it's a matter of pulling threats so people talk about surveillance being looking for needles and haystacks but it's not what it is is you have to start with some piece of information saeed was certain that sooner or later he'd be arrested he tried to escape from oman and cross into the uae when he arrived at the border crossing he was detained by the omani authorities we don't know for sure that evident was the system used to monitor saeed but his experience is consistent with what we know about it we know that evident was sold to oman could they have used evident to do this and is it this powerful um it certainly seems that way page 26 in the brochure that it's got cell location viewer target location the the investigator package specifically has tools for following phone movements so it integrates into the phone company's data and allows you to get the data from the network operator so it really looks like they have that as a selling feature syed was interrogated over 12 days even after his release he believed he was still under surveillance started it's become too dangerous to report human rights abuses i'm on my way to a london-based ngo called privacy international they investigate government surveillance dr gus hussein says that what's happening in the arab world is part of a disturbing global trend that is the greatest tragedy of surveillance when it comes to political reform the the the defense of democracy and democratic values is that surveillance will destroy people's confidence in organizing in expressing and sharing ideas and trying to create a political movement that will all be chilled because surveillance will be everywhere this is bae's london headquarters we've been told that if a potential sale poses any big ethical questions they're debated here we want to ask bae about another discovery that we've made that not only poses questions about ethics but about national security as well we found out that evident has a further top secret capability decryption decryption also known as cryptanalysis is a powerful tool that can read the contents of our communications even if they've been encrypted for security this decryption capability is considered so vital to our national security that its export is supposed to be tightly controlled the british government has even denied exports of a similar technology to its close ally australia yet bae has sold this kit to the middle east we've uncovered an email exchange from 2015 that shows that the uk export authority was very worried about the decryption tools bae was exporting from denmark the british told the danish export authority that we would refuse a license to export this cryptanalysis software from the uk because of criteria 5 concerns criteria 5 refers to the national security of the uk and its allies the suggestion is that a country could use this software to get access to britain's own communications professor ross anderson is head of cryptography at cambridge university well once you have sold equipment to someone they can probably do with it what they want you take the case for example of an arab country which wants to buy bankrupt analysis equipment supposedly for its own law enforcement purpose now suppose that they have embassies in london in washington in paris and in berlin right what's to stop them from putting bulk surveillance equipment in our cities and then using the cryptanalysis equipment to decipher all the mobile phone calls that we hear in london or paris or washington or berlin despite britain's objections the danish authorities approved the export to the uae the danish foreign ministry turned down our request for an interview in a statement on the export of cryptanalysis equipment they told us if an eu member state makes a request to the danish business authority not to grant an export authorization if the export might prejudice its essential security interests then an export authorization will not be granted we have also found out that bae has made other sales of its cryptanalysis software through denmark to oman qatar algeria and morocco in addition to the uae if you enable a middle eastern power to get bulk surveillance and cryptanalytic capabilities against mobile phones in london that's potentially a real strategic thread some argue there could still be a justification for selling these kinds of weapons i would imagine the consideration that plays in people's minds is not so much the economic advantage for weapons like this is that the security of the state we're talking to is so closely linked to ours or they are tracking people who are a direct threat to britain and we need their assistance but even at the expense of them not upholding the same values that we have hold here in the uk it's a trade-off none of these countries have the same ethical moral code as we do in britain but we still do it every country therefore involves some form of compromise some form of judgment about how those tools are going to be used no one in the british government would speak to the bbc about the findings of this film in a statement the department for international trade said the government takes its defence export responsibilities very seriously and operates one of the most robust export control regimes in the world all export license applications are assessed on a case-by-case basis against strict criteria taking account of all relevant factors at the time of the application including human rights considerations one of the few european politicians prepared to discuss the export of surveillance technology is the dutch mep maricha shaka well each and every case where someone is silenced or ends up in prison with the help of eu made technologies i think is is unacceptable the fact that these companies are commercial players are developing these highly sophisticated technologies that could have a deep impact on our national security on people's lives etc requires us to to look again at what kind of restrictions may be needed what kind of transparency and accountability is needed in this market before it turns against our own interests and our own principles during the making of this film we met nearly a dozen insiders from bae the government and the intelligence community they're all bound by legal restrictions but one of them agreed to have his words spoken by an actor at the government level there are holes and loops in the export license system that no one seems in a hurry to shut this is partly ignorance but also companies take advantage of government policies ultimately you have no control over how the countries that buy this stuff use the kit in this film we've shown that a british company is selling cyber surveillance equipment to repressive governments in the middle east in addition by exporting its decryption facility bae is giving these governments the potential to turn the same secret and invasive technology against britain itself it may be time to look more closely at the new kinds of weapons that britain is selling [Music] [Music] you