In a bombshell report published on Thursday, Jeremy Scahill and Josh Begley of The Intercept detail how the NSA and British Intelligence operatives managed to steal encryption keys from Gemalto, a Netherlands-based firm which produces a huge percentage of SIM cards used across the globe.
DON’T MISS: One of NSA’s most precious spying tools was just uncovered
With encryption keys in tow, it was rather trivial for the NSA and its English counterparts from GCHQ to monitor voice calls and data transmissions. Equally as important, possessing the encryption keys enabled eavesdropping without requiring any cooperation from wireless providers. What’s more, access to encryption keys enabled previously captured and encrypted data to be decrypted after the fact.
As for how it all went down, the NSA and GCHQ infiltrated Gemalto’s internal network. From there, they began keeping a close watch on employee emails and even Facebook accounts in an effort to discover and subsequently target potentially key targets worthy of enhanced monitoring:
In effect, GCHQ clandestinely cyberstalked Gemalto employees, scouring their emails in an effort to find people who may have had access to the company’s core networks and Ki-generating systems. The intelligence agency’s goal was to find information that would aid in breaching Gemalto’s systems, making it possible to steal large quantities of encryption keys. The agency hoped to intercept the files containing the keys as they were transmitted between Gemalto and its wireless network provider customers.
GCHQ operatives identified key individuals and their positions within Gemalto and then dug into their emails. In one instance, GCHQ zeroed in on a Gemalto employee in Thailand who they observed sending PGP-encrypted files, noting that if GCHQ wanted to expand its Gemalto operations, “he would certainly be a good place to start.” They did not claim to have decrypted the employee’s communications, but noted that the use of PGP could mean the contents were potentially valuable.
All in all, this latest report on NSA related activities certainly represents a black eye for those inclined to believe that our mobile communications are somewhat safe. If anything, the report actually bolsters the increasingly credible notion that everything we do on any type of electronic device can be tracked and monitored with ease, security mechanisms be damned. Just this week, for example, we highlighted how the NSA long ran a secretive spy program which involved the installation of an undetectable virus onto a hard drive’s firmware.
The full report from The Intercept is extremely detailed and well worth a read in its entirety.
