It gets even better: Europol flat out refused to help in the investigation [1]
> However, Europol wanted nothing to do with the investigation and refused to assist, according to two sources familiar with the interaction. Europol asserted that it would not carry out investigations into other European Union member states – in this case, the U.K. The Belgians were frustrated and believed Europol had stonewalled them for political reasons; they noted with suspicion that the organization was led by Rob Wainwright, who is British.
I mean, what are we doing here? How can Europol so blatently refuse a case? Isn't that a clear violation of the trias politica?
Europol as an organisation has no power to act on its own, it relies on the co-operation of the EU member states, and needs permission from the relevant national authorities to conduct investigations and arrest suspects. Regardless of the nationality of its leader, it can't realistically investigate British suspects if the British won't co-operate, and there's no prospect of them doing that here.
Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries, and none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it, and that would harm the fight against organised crime and terrorism.
Basically, when it comes to a supranational organisation like Europol, real separation of powers is impossible, because there's always a political calculus involved in a collaboration between sovereign countries with occasionally competing interests.
>Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries
That may well be, but without having any inside knowledge I'm pretty sure that the extent to which such incidents damage relations depends on more than a yes/no question. How was this done and why? Were any non-public inter-agency agreements or silent understandings breached? Was the UK acting alone on this or with the US?
I think all of this could influence the mood in the negotiations now taking place over the future security collaboration between the EU and the UK.
This incident will certainly not be the most important consideration by far. That would be just crazy. But it could add to the potential distrust of a UK now desperately dependent on getting into the good graces of the US, which isn't exactly seen as a staunch defender of the rule of law outside US territory.
The major question isn’t motive, it’s just “did you get caught...” and the modifier, “...publicly?” Even then it might not matter beyond some bad publicity; the UK still copies up to Russia for its gas suppply, and the murder of someone with a radiological weapon on UK soil didn’t stop that. The Israelis stole American nuclear material and secrets, and we’re still close.
Countries don’t have friends, they have interests, and allies.
>The major question isn’t motive, it’s just “did you get caught...”
I'm not in a position to know, but I find that unlikely. Say GCHQ was using Belgacom to spy on some Belgium based terror suspects ignoring Belgian privacy laws. Would that really be the same as if they had been spying on the Belgian government or on EU institutions in Brussels? I think not.
> none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it,
Well, now see it from the point of view of the other side. How will Belgium now see their future cooperation with europol? You are not wrong, but it is a stance which causes supranational organisations to whither until nothing is left.
> Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries, and none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it, and that would harm the fight against organised crime and terrorism.
> Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries
Why is this tolerated? Is it, perhaps that surveillance a country cannot legally conduct internally is conducted by its "friends", sometimes resulting in relevant information being shared with its own intelligence services?
What are they supposed to do, declare war on each other? Spying isn't a new craft. It's also arguably necessary given inter-national opaqueness on certain issues.
Knowing what motivates your neighbors allows you to navigate the relationships better
* Make a very public stink about it. Publicize exactly what was done, how and who was involved. Attempt to attract the interest of the media in the hope that the electorate of the country in question will find spying on allies objectionable.
* Raise the issue with the EU parliament or possibly the UN. This may not have hard consequences, but officials having to answer for the behavior of their spy agencies can put pressure on those spy agencies.
* Use any of the many cooperative agreements between the countries in question as leverage to demand action against the officials who authorized the spying, evidence that it won't happen again, or compensation.
Of course, all of these have potential downsides, and I've ordered them from what I think is low risk to higher risk. The fact that the usual result is a quiet diplomatic protest and sweeping the event under the rug suggests that governments think this kind of spying is acceptable, and the only problem is getting caught.
It's tolerated because the harm is small and the cost of retaliation is high enough that the target countries aren't willing to go very far to punish it. The spying carried out between allies is often about military information that the target country already has.
See, for example, the Jonathan Pollard case, where Israel stole US intelligence on Iran. The spy was imprisoned for almost 30 years (considered a bit extreme by the Israeli system, though that may reflect different norms about incarceration in general). Similarly, an American spy (Yosef Amit) sent information about Israeli troop deployments to the US, and was in prison for 7 years. Both sides worked hard to get their respective spies released, and were stubborn about not releasing the ones they had in custody, but because the countries were allied no one was willing to go to the mat over the issue.
> surveillance a country cannot legally conduct internally is conducted by its "friends", sometimes resulting in relevant information being shared with its own intelligence services?
Whether that is the reason more isn't done against foreign intrusions is hard to say. It seems that in this case many people would have liked to punish the UK for it, but there weren't many reasonable options for doing so.
>Aside from Belgacom, the agency has broken into the computer systems of the oil production organization OPEC; the Netherlands-based security company Gemalto; and organizations that process international cellphone billing records, including Switzerland’s Comfone. //
In theory any of these countries could surely just issue an arrest warrant for the head of GCHQ and order their extradition.
In view of that it seems there's some other aspect preventing such actions -- like blackmail by GCHQ. Or controlling powers in Belgian security being in part responsible.
Anyway, I wonder how much of this shit the Belgian public will put up with post Brexit.
It still seems illegal under UK law -- these things do show how the powers that be have no respect for the authority of the rule of law, that our democracy is only allowed inasmuch as it doesn't interfere with their plans.
The Belgian public neither knowd nor cares. The press should have made a fuss but didn't. I remember a couple of very short articles about it, which kind of sort of maybe said the British might have potentially but not likely been involved.
Belgium was designed to be a toothless and spineless state by the UK, France & Germany, and it's playing its part wonderfully.
> Belgium was designed to be a toothless and spineless state by the UK, France & Germany, and it's playing its part wonderfully.
Belgium is in its own way more often than not, which is a pity because with Brussels the de-facto capital of Europe the potential to become a regional power-house is definitely there. But Belgian politics, the language divide and a surprisingly large amount of corruption (a bit better than France but substantially worse than Germany and NL) do not help.
I can't really speak for large scale corruption, but small scale corruption and "bending the rules" is pretty much the only way anything gets done around here..
Maybe there are more interesting hacks to do ? What about https://www.ehealth.fgov.be/ or https://www.smals.be or nuclear plants networks (these are isolated I think, so extra bonus if one hacks into them)?
Given that someone sabotaged a turbine in a Belgian nuclear power plant a couple of years ago, I'm guessing the security isn't exactly top-notch. I've subcontracted for various Belgian government agencies (as a software engineer), and I've been less than impressed by their security practices...
I'm not saying ehealth is broken by design, but I won't be surprised if it turns out to be broken into a couple of years from now.
> In theory any of these countries could surely just issue an arrest warrant for the head of GCHQ and order their extradition.
The rules are different for states. Arresting a foreign security official for the actions they carried out in their official capacity is an inherently political/diplomatic decision, and not a normal criminal one.
There are some carve-outs for war crimes, but there's a reason those were so difficult to push through even for countries that haven't committed war crimes lately and aren't even liable to get into any wars any time soon - the whole concept goes against a lot of the assumptions of state sovereignty.
The powers of GCHQ are basically unconstrained by the law: "[GCHQ shall] monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material [...] in the interests of national security, [...] in the interests of the economic well-being of the United Kingdom [... or] in support of the prevention or detection of serious crime." per http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gch...
FWIW, I am not claiming the law to be right or just, but it _is_ the law as it currently stands. Also, prior to 1994, GCHQ operated entirely outside of the law (hence the Act's wording "There shall continue to be [GCHQ]"; for a long time, the existence of the agency wasn't even publicly acknowledged), so in some ways it is a step towards respecting the rule of law.
Also, strictly speaking, the King is above the law - the Monarch is the source of all law, and even Parliament acts through that power in its activities: https://en.wikipedia.org/wiki/Queen-in-Parliament
> technically the queen is above the law as she is sovereign and the source of all law
What rubbish. In the UK, Parliament is sovereign. The British monarchy can be entirely removed by an Act of Parliament. Not only is it sovereign, but it cannot be bound by any previous Parliament.
Your fake facts portray the UK as an absolute dictatorship.
The emphasis on OP's quoted line should be on _technically_.
A bill has to proceed through Royal Assent by the Queen before it becomes law [1]. It just happens that she is always timely with this duty and always agrees with Parliament.
Also the government's executive power is primarily through Royal prerogative [2]. _technically_ the Queen could exercise these powers herself for her own benefit.
The "checks and balances" that keep the Monarch from abusing these powers are a combination of tradition, facing the wrath of the British people and precedent set by what happened last time a monarch attempted to abuse royal prerogative [3]
The leading text of Parliament sovereignty is Dicey, and its principle are considered to form part of the uncodified Constitution. It succinctly explains that:
> Parliament means, in the mouth of a lawyer (though the word has often a different sense in conversation) The King, the House of Lords, and the House of Commons: these three bodies acting together may be aptly described as the "King in Parliament", and constitute Parliament. The principle of Parliamentary sovereignty means neither more nor less than this, namely that Parliament thus defined has, under the English constitution, the right to make or unmake any law whatever: and, further, that no person or body is recognised by the law of England as having a right to override or set aside the legislation of Parliament.
Note the use of the phrase "King in Parliament" - all law making authority derives from the historical powers of the Monarch, whereas the Lords and Commons guide and use that power. This can be seen in how UK Acts of Parliament begin "BE IT ENACTED by the Queen's most Excellent Majesty, by and with the advice and consent of the Lords Spiritual and Temporal, and Commons" - the Act is _enacted_ by the Queen, with the two Houses advising and consenting to the use of that ability.
Now it's possible that the role of the Monarch could be removed from the process, but it would arguably by one of the biggest fundamental _technical_ (not practical) changes to the British constitution in hundreds of years.
Why on earth would you do that? Yes, he's the head of the agency that breaks the law in your country, but you've got one of those too. There is 0 chance of extradition actually happening.
Why wouldn't you punish people who illegally hacked your countries companies at high cost to the companies, and by extension your citizens. Especially when the actions are illegal in that country, illegal in your country, and illegal by treaty that your countries are both part of.
The reasons not to have them indicted are "we don't want to keep the rule of law" and "we don't care about costs to our citizens" and "screw democracy, we want to play with the pawns too".
Yes, there is zero chance of extradition because such people give less than two shits about rule of law and democracy ... but that's exactly why one should care. They should evict all our UK government personnel from Belgium.
What is also quite interesting is that this (at least partially) came to light because of the NSA breach. Couple of months ago we had Trump blabing his mouth about the Dutch hacking the Russians. I wonder how much all this loosing of secrets affects the standing of the US in the intelligence community.
First, it strikes me as obvious that if the Brits did this then it would have had to have been with the blessing of their peers in Belgium
No senior GCHQ officer is going to sign off in a cyber hack of an ally unless they had a really good reason and had covered their own ass.
But if they’d really been freewheeling then it amazes me just how much impunity state apparatus can act with - what hope has an ordinary individual or private company got of protecting themselves and seeking redress through the courts?
"No senior GCHQ officer is going to sign off in a cyber hack of an ally unless they had a really good reason and had covered their own ass."
good reason: much more information
Covering: was very good, only because of Snowden it got linked to the UK
So even though it might be possible, that Belgium was in it on high level (you hack, but we get data conveniently without legal issues), it is also very possible, that they went for it without saying anything.
I’m starting to distrust the current security model of all major operating systems. Assuming a safe CPU - and that’s a big one already - I’d like a system where any random app does not have unfettered access to any user file, where individual files can be classified and restricted from being accessed by processes with network capabilities and so on. Android permissions are a start.
This and browsers should really just execute in their own externally managed sandbox
Want to try it now? You can try it with Steam, which is otherwise notoriously annoying to install on Linux:
flatpak install --user --from https://flathub.org/repo/appstream/com.valvesoftware.Steam.flatpakref
flatpak override com.valvesoftware.Steam --filesystem=$HOME
# run it with this command:
flatpak run com.valvesoftware.Steam
Unfortunately, if you're running X11, Steam can still spy on everything you're doing in X11. But Wayland is coming/is here, and fixes that too.
I think Qubes' approach should be the default. There is no valid reason for so many permissions by default. The current default for example on Debian is crazy! Any user can read the home directory of any other user by default! If somebody whould have told me that before knowing it, I would have considered it a bad joke. I can't fathom why it's not changed.
However, Qubes can't protect against malicious hardware. I see no way around it, we must have hardware with completely open sources.
It also runs your network connection and firewall in their own VMs, plus makes it easy to stack more. e.g. you want to connect to a VPN and then to Tor? No problem.
At the same time you can run your password manager in a VM with no network access.
Mandatory access controls were invented to address this exact weakness. Ironically, selinux might be the most mature implementation of it in Linux, if not the rest of the Unix land.
The article doesn't seem to touch on the motivation for the attack. (Perhaps it's taken to be obvious.) Why would the British government want to do this?
«
The British spies appear to have targeted Belgacom due to its role as one of Europe’s most important telecommunications hubs. Through a subsidiary company called Belgacom International Carrier Services, it maintains data links across the continent and also processes phone calls and emails passing to and from the Middle East, North Africa, and South America. But tapping into a broad range of global communications is only one possible motive. GCHQ may also have sought access to Belgacom’s networks to snoop on NATO and key European institutions, such as the European Commission, the European Parliament, and the European Council. All of those organizations have large offices and thousands of employees in Belgium. And all were Belgacom customers at the time of the intrusion.
»
The main motivation is that Bruxelles is in Belgium. The US / UK / “Five Eyes” security apparatus takes the EU more seriously than most EU members themselves. Among other things, they really don’t want for anything like “an European integrated army” to emerge as an alternative to Nato.
And the second motivation is that they can. The pre-Snowden speculation was that all major European carriers are targets for NSA and friends, and the Snowden files basically reinforced that view. The question is not “why should they spy on their allies”, everyone has always done that; the question is the degree of success that any given player achieves and what they do with the info they gather. In this case, it looks like the operation was a great success, followed by huge failure (it was burnt to the ground).
How can you get infected by just visiting a fake website, where they on windows, are we doing such a poor job, we like to brag with nice titles, architect etc, but the industry is quite shit, if you can get infected just by visiting a site.
Every current PC system can be broken, no matter which operating system it is running. Intelligence agencies use 0-day exploits and test the software they use against known antivirus software and intrusion detection systems.
There are also plenty of companies such as Lench/Gamma who overtly advertise their ability to penetrate any system. You can only buy or lease their software as a state actor, though.
> You can only buy or lease their software as a state actor, though.
there is a wide spectrum of actors in this space and besides the well known (Gamma/HackingTeam) also include many smaller firms that do not shy from working in a gray area and cater to both criminal enterprises, unstable regimes, warlords. Especially smaller fish fill the niche (AREA[¹], Negg[²], ...)
Though any of these providers they don't just give you a software because "solutions* would (due to their nature) rarely work out of the box. Instead they come with a consulting service contract to ensure the system is correctly used (to facilitate breaching the target). So "state actors" isn't restricted to spy-agencies but low-level law-enforcement who lack the budget and technical know-how for maintaining or creating these tools. So these systems are kind of a poor-mans TAO.
"After installing malware on the engineers’ computers by luring them to a fake version of the LinkedIn website, GCHQ was able to steal their keys to the secure parts of Belgacom’s networks and begin monitoring the data flowing across them. "
The computers of engineers are great targets for hacking. Dozens of package managers across languages and operating systems, as well as GitHub, provide easy vectors for getting complex code to execute on computer of the dev. Devs are used to running code from the terminal, and typically have many interesting files in their file systems that could assist with lateral movement or even lead to compromising of the build system (!!)
Despite this, devs are still generally very cavalier about running code from the internet on their machines. Often times they have no choice of security mitigations because their package manager is compromised by flaws in its design.
Monitor their communications so you know exactly what software they are using, then drop a 0-day on the forged site (I find it very unlikely that GCHQ don't stockpile Firefox/Chrome escapes and Windows/Linux priv. escalations etc.). There's little an individual can do against such a targeted attack without completely airgapping the machine which A) probably isn't viable for a network/software engineer and B) GCHQ are probably determined enough to gain physical access if they deem it necessary.
Hmm seems like Belgacom has had several visits from the NSA and/or GHCQ. The most likely reason for these friendly visits is that Belgacom manged(manages?) a couple of submarine cables in the middle east and north Africa. It's public knowledge that either the NSA or GCHQ had infected their core routers/switches.
When that story first came to light, what they didn't tell you is that the NSA was also in Deutsche bank and several other financial institutions. Perhaps they still are.
> However, Europol wanted nothing to do with the investigation and refused to assist, according to two sources familiar with the interaction. Europol asserted that it would not carry out investigations into other European Union member states – in this case, the U.K. The Belgians were frustrated and believed Europol had stonewalled them for political reasons; they noted with suspicion that the organization was led by Rob Wainwright, who is British.
I mean, what are we doing here? How can Europol so blatently refuse a case? Isn't that a clear violation of the trias politica?
[1] https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...