With new Chinese cyber-tools, Ethiopia more easily spies on its people

Human rights advocates worry that powerful surveillance technology is spreading in Africa, where many countries are becoming more authoritarian.

March 26, 2014 by Mark Clayton

BOSTON

Ethiopia’s government is deploying cutting-edge cyber and phone surveillance technologies from China and other nations to conduct widespread spying aimed at suppressing political dissent, according to a new report.

Using modern technology from Chinese telecom giant ZTE, Ethiopia’s state telecom company has spent the last five years meshing that gear with additional spy software from European suppliers to create government surveillance tools spanning social media, phone, and Internet communications, says the report by New-York based Human Rights Watch.

With that powerful system now in place, the ruling Ethiopian People’s Revolutionary Democratic Front (EPRDF) coalition is using its new capacities to ferret out and harass its political opponents, according to the report titled “They Know Everything We Do: Telecom and Internet Surveillance in Ethiopia.”

Ethiopia’s authoritarian regime has long watched its people. But the new technology allows it to far more easily spy on citizens, business people, politicians, journalists, and others – including, as it appears, the vast network of Ethiopians living abroad.

In the past year, a swath of East African nations from Ethiopia to Uganda, Kenya and Tanzania have been under criticism for tougher policies on free expression and for cracking down on multifarious civil society and NGO groups. Human rights monitors are concerned that new cheap and powerful spyware is already starting to be acquired and used by more African governments.

Internet usage in Ethiopia is still in its infancy with less than 1.5 percent of Ethiopians connected to the Internet and fewer than 27,000 broadband subscribers countrywide.

By contrast, neighboring Kenya has close to 40 percent access, the report notes. Only about a quarter of Ethiopia’s population has cell phones compared to 72 percent in Kenya.

Yet the chilling effect of surveillance on free speech is most significant in Ethiopia, an essentially one-party state where many now live in fear of answering any phone call from overseas – or expressing their true feelings on the phone. Many worry they will be hauled in to a police station and accused of affiliation with banned groups, according to the HRW report, which was based on 100 interviews with Ethiopians.

“One day they arrested me and they showed me everything. They showed me a list of all my phone calls and they played a conversation I had with my brother,” a former member of an Oromo opposition party, who is now a refugee in Kenya, told interviewers in May 2013.

“They arrested me because we talked about politics on the phone. It was the first phone I ever owned, and I thought I could finally talk freely,” the man said.

Governments around the world engage in surveillance, but in most countries judicial and legislative mechanisms are in place to protect privacy and other rights, the report found. Yet in Ethiopia “these mechanisms are largely absent,” HRW said.

Most of the technologies used to monitor telecom activity in Ethiopia have been provided since 2003 by ZTE, the report says. The company did not respond to HRW inquiries about steps it might be taking to address and prevent Ethiopian human rights abuses linked to unlawful mobile surveillance.

“Some of these Chinese and other companies have been complicit in the worst human rights abuses in Iran and Syria by providing these regimes with all too often hidden [cyber-surveillance] tools of oppression,” says Toby Dershowitz, vice president at the Foundation for Defense of Democracies, a Washington advocacy group in an e-mail interview.

At the same time, the report identifies some European companies as having supplied Ethiopia with advanced cyber surveillance technology used to target Ethiopians at home and abroad.

Indeed, Ethiopia appears to have acquired FinFisher surveillance software from the United Kingdom and German-based Gamma International – as well as Italy-based Hacking Team’s Remote Control System.

Such tools provide security and intelligence agencies with access to files, information, and activity on the infected target’s computer. They can log keystrokes, passwords, and turn on a webcam or microphone, essentially converting a personal computer into a microphone or other monitoring device.

Yet Ethiopia is just one among many nations deploying such technology, says Eva Galperin, a global policy analyst at the Electronic Frontier Foundation, a digital rights organization in San Francisco.

“It’s important to understand that Hacking Team and FinFisher are not the only players in this game,” Ms. Galperin says. “That’s just the tip of the iceberg.”

John Bumgarner, a former intelligence officer and cyber conflict expert, agrees. He says that US companies are part of the pattern, too.

“This report points a finger at the Chinese companies selling this hardware,” Mr. Bumgarner says. “But all they’re really doing is taking a page from the playbook of US companies that sell similar kinds of software.”

Powerful spyware is proliferating and is “virtually unregulated at the global level and there are insufficient national controls or limits on their export,” Human Rights Watch said. Rights groups last year filed a complaint at the Organization for Economic Co-operation and Development alleging such technologies have been deployed to target activists in Bahrain, for instance.

Researchers at Citizen Lab, a University of Toronto-based cyber research group, say they have identified FinFisher command and control servers in over 30 countries and have analyzed malware samples that appear to target users in places like Vietnam and Malaysia. Gamma has stated that it only sells its software to select countries for law enforcement purposes.

Human Rights Watch letters to the Addis Ababa government received no response. In response to Citizen Lab research and inquiry about the Ethiopian government’s use of FinSpy, an Ethiopian government spokesperson said in a statement to media, “I cannot tell you what type of instruments we’re going to use or not. I’ve no idea, and even if I did, I wouldn’t talk to you about it.”

Hacking Team, in public statements, says that it only sells its software to government law enforcement or intelligence agencies, not individuals or businesses. Governments can even monitor the use of the software via an “audit trail,” allowing government officials to monitor how employees are using the software so as to identify any “abuse” of the technology.

Yet Ethiopians living in the UK, United States, Norway, and Switzerland are among those known to have been infected with spyware. Lawsuits have been filed in the US and UK alleging illegal wiretapping, the report says.

Just last month, a Washington man with links to Ethiopia’s opposition party sued the Ethiopian government in US federal court, claiming government agents deployed espionage software to hack his personal computer and spy for months on his private communications.

The suit claims it found on his computer some 2,000 files linked to spyware called FinSpy, as well as signs his Skype calls, web-browsing history, and e-mails had been spied on in violation of US law.

“The Ethiopian government is using control of its telecom system as a tool to silence dissenting voices,” said Arvind Ganesan, business and human rights director at Human Rights Watch. “The foreign firms that are providing products and services that facilitate Ethiopia’s illegal surveillance are risking complicity in rights abuses.”

The Internet, Twitter, Facebook and other social media services figured prominently in the uprisings in Arab countries from Tunisia to Libya, and Egypt to Syria. But autocratic regimes are increasingly using them not to empower citizens, but instead build “electronic curtains” to repress their own populations, the report said.

In Syria, the government has waged a cyber battle against its own citizens and media beyond its borders, utilizing advanced cyber attack and surveillance techniques to identify and sometimes torture or kill dissidents.

The surveillance technologies “are not only used to stifle debate but to surveil, hunt down and even torture those whose views differ from these governments,” Mr. Dershowitz writes. “Those who don’t like this preview won’t like the movie to come if these companies and countries are not held accountable.”