Q and A with An East African Human Rights Activist

Now more than ever, the world needs human rights activists, civil liberties activists, privacy activists, privacy/encryption developers, cybersecurity researchers, and political dissidents!

Thanks to all these people all over the world for your courage and good work.

Activism, like charity, begins at home--- and your efforts on behalf of your fellow citizens will ultimately help people everywhere.

And thanks to Ailanthus for highlighting the critical role played by Tor (and WhatsApp and other applications) in protecting whistleblowers and human rights activists.

Last year comments in this blog highlighted that fact that the Kenyan government tried to hire the notorious Italian cyberespionage-as-a-service company Hacking Team:

http://allafrica.com/stories/201507201584.html
Kenyan Government Asked Hacking Team to Attack Dissident Website
Daniel Finnan
20 Jlu 2015

> Kenya's government negotiated to buy sophisticated spy software from Italian surveillance company Hacking Team, according to leaked emails published by WikiLeaks. Messages obtained through an attack against Hacking Team reveal that a representative of the government requested an attack against a website critical of the Kenyan government as a "proof of concept".
>
> "There is a website we would wish you urgently bring down, either by defacement or by making it completely inaccessible," said an email from a Kenyan representative sent to Hacking Team on 6 May 2015. It referred to the Kahawa Tungu website, which focuses on alleged corruption within the Kenyan government.
> ...
> "We've always suspected that there is some snooping around certain websites and around certain emails," Grace Githaiga, an associate of the Kenya ICT Action Network, told RFI. "Finally we're getting information publicly that the government has been making such requests to bring certain websites down."

Defacing an opposition blogger's website was a little too much for some HT employees, who urged the CEO to refuse the job. But HT was perfectly willing to work for the government of Ethiopia in targeting their own dissidents:

https://www.hrw.org/news/2015/08/13/ethiopia-hacking-team-lax-evidence-…
Ethiopia: Hacking Team Lax on Evidence of Abuse
Leaked Documents Show Need to Regulate Surveillance Sales
13 Aug 2015

> (New York, August 13, 2015) – The Italian spyware firm Hacking Team took no effective action to investigate or stop reported abuses of its technology by the Ethiopian government against dissidents, Human Rights Watch said today. A comprehensive review of internal company emails leaked in July 2015 reveals that the company continued to train Ethiopian intelligence agents to hack into computers and negotiated additional contracts despite multiple reports that its services were being used to repress government critics and other independent voices.

And Nigeria:

http://www.nigeriacommunicationsweek.com.ng/news/dickson-bayelsa-govern…
Dickson, Bayelsa Governor Pays N100m to Italians to Hack Phones in Nigeria
10 Jul 2015

> Bayelsa state government paid close to one hundred million naira to Hacking Team, an Italian firm, to hack computers and phones in Nigeria, according to Premium Times... new information emerging from the firm’s leaked internal data reported that Hacking Team is notorious for equipping governments with tools to hack citizens’ computers and phones, was itself hacked Sunday night and 415 gigabyte of internal data leaked to the public.
>
> Researchers have been pouring through the leaked documents since it was first leaked Sunday night, throwing up many shocking details of the firm’s secret dealings with Bayelsa state and other repressive governments, including Sudan, Russia, and Bahrain. Documents seen by Premium Times show that the Bayelsa government, a small state in Nigeria’s oil rich Niger Delta, paid Hacking Team N98 million to carry out internet attacks, in what appears to be the most ambitious hacking project by a Nigerian state government.
>
> The contract was signed in late 2013, Hacking Team’s internal documents, leaked after the Sunday night hack attack on the company, show.

And a whole host of other governments around the world:

https://www.theguardian.com/technology/2015/jul/11/hacking-team-hack-st…
Hacking Team hack casts spotlight on murky world of state surveillance
Alex Hern
11 Jul 2015

> In contrast to many of the private companies performing outsourced aggressive surveillance work for the world’s spy agencies, Hacking Team doesn’t try to hide behind a generic corporate identity. Gamma International, Academi and QintetiQ could be companies doing anything, but Hacking Team – well, it doesn’t take a genius to guess what line of work they are in. It sells its Remote Control System (RCS) software to law enforcement and national security agencies around the world, letting them hack into targets’ computers and mobile devices, install backdoors, and monitor them with ease. The company’s promotional material advertises its abilities: “Hack into your targets with the most advanced infection vectors available. Enter his wireless network and tackle tactical operations with ad-hoc equipment designed to operate while on the move … Remote Control System: the hacking suite for governmental interception. Right at your fingertips.”
> ...
> Back up for a minute to 2013. Reporters Without Borders (RSF) published an extensive report into “digital mercenaries” such as Hacking Team, who provide the technical expertise which underpins Snowden-era electronic surveillance. In it, the group named five “corporate enemies of the internet”: Hacking Team, Britain’s Gamma Group, Germany’s Trovicor, France’s Amesys, and America’s Blue Coat Systems. All of them, it said, “sell products that are liable to be used by governments to violate human rights and freedom of information”.

The HT leaks also showed that on behalf of someone tied to the Czech government, HT had targeted the Riseup mailserver:

https://wikileaks.org/hackingteam/emails/emailid/629790

This shows that a HT client using an address tied to the Czech police posted a request to an HT forum for an IE exploit (malware) (which, following the playbook recommended by Riseup to its clients, he could attach to a phishing email he planned to send to an unnamed Riseup user). And on 21 Nov 2014, an HT help desk employee forwarded the request to the HT malware developers:

> Ticket ID: MOO-684-39569
> URL: https://support.hackingteam.com/staff/index.php?/Tickets/Ticket/View/36…
> Name: Richard Hiller
> Email address: uzc.v3.data@pcr.cz
> Creator: User
> Department: Exploit requests
> Staff (Owner): -- Unassigned --
> Type: Issue
> Status: Open
> Priority: Normal
> Template group: Default
> Created: 21 November 2014 11:21 AM
> Updated: 21 November 2014 11:21 AM

> Please craete exploit Internet explorer
> Url: https://mail.riseup.net/rc/
>Thank you
> Rene
> Staff CP: https://support.hackingteam.com/staff

The HT developers then responded with a brief reply containing this ominous attachment:

> Attached Files
> # Filename Size
> 286575 agent_89f2e58782f7.exe 383.7KiB

Riseup plays a crucial role in Tails development (the Tails Project uses Tor, and is a Tor Project partner), but also provides anonymized forums to people fighting corruption and drug cartels in Mexico and other locales, to anti-austerity activists in Spain, to disability rights activists and environmentalists worldwide, and many other important and sometimes highly dangerous activities.

Indeed, reporting on cartel violence along the US-Mexico border is so dangerous neither US nor Mexican mainstream news outlets are willing to report on cartel shootouts. Far from helping citizens trying to expose the level of violence, time after time, corrupt US and Mexican "counter-narcotics" agents leak the names of citizen reporters to the very cartels which they know will respond by torturing and murdering anyone who threatens their illegal profits. Dozens of prominent bloggers have been murdered this way. By the numbers, their work is far more dangerous than the occupation of US police officer, or even US soldiers deployed in war zones.

A highly relevant irony: the HT data trove was obtained (and published, as a public service) by hacktivists:

http://www.engadget.com/2015/07/09/how-spyware-peddler-hacking-team-was…
How spyware peddler Hacking Team was publicly dismantled
Violet Blue
9 Jul 2015

> Early Monday morning, around 400GB of stolen internal company files belonging to Italian surveillance and intrusion software firm Hacking Team were distributed online through its freshly hacked Twitter account (changed to "Hacked Team").
>
> They were hacked by a hacker, or hackers. It was hackenfreude.
>
> And because Hacking Team -- a Reporters Without Borders "enemy of the internet" -- was so universally reviled by infosec professionals for their dealings with despotic governments (among other things), it became a group effort. Hackers around the world dug into the illicit files and all but completely dismantled Hacking Team's business, and reputation.

It is also notable that thanks to Wikileaks, anyone can search for their own country or suspect politician here (and I encourage everyone to do just that!):

wikileaks.org/hackingteam/emails/

But thanks to the USG's unceasing war on whistleblowers everywhere, even liberating information which needs to be free can result in lethal retaliation. Aaron Swartz wanted to free scientists from the stranglehold of publishers like Elsevier which hide the fruits of publically funded research behind outrageously overpriced "academic journal" paywalls. His actions resulted in his death at the hands of an cruelly overcharged prosecution by a politically ambitious DA. And now another activist has taken up the cause, and is also being targeted for government prosecution, although it remains to be seen whether the government of Kazakhstan will prove quite so lethal in targeting open access activists as the USG:

http://arstechnica.com/tech-policy/2016/04/a-spiritual-successor-to-aar…
A spiritual successor to Aaron Swartz is angering publishers all over again
Meet accused hacker and copyright infringer Alexandra Elbakyan.
David Kravets
3 Apr 2016

> ...
> Stop us if you’ve heard this before: a young academic with coding savvy has become frustrated with the incarceration of information. Some of the world's best research continues to be trapped behind subscriptions and paywalls. This academic turns activist, and this activist then plots and executes the plan. It's time to free information from its chains—to give it to the masses free of charge. Along the way, this research Robin Hood is accused of being an illicit, criminal hacker.
>
> This, of course, describes the tale of the late Aaron Swartz. His situation captured the Internet’s collective attention as the data crusader attacked research paywalls. Swartz was notoriously charged as a hacker for trying to free millions of articles from popular academic hub JSTOR. At age 26, he tragically committed suicide just ahead of his federal trial in 2013.
>
> But suddenly in 2016, the tale has new life. The Washington Post decries it as academic research's Napster moment, and it all stems from a 27-year-old bioengineer turned Web programmer from Kazakhstan (who's living in Russia). Just as Swartz did, this hacker is freeing tens of millions of research articles from paywalls, metaphorically hoisting a middle finger to the academic publishing industry, which, by the way, has again reacted with labels like "hacker" and "criminal."

The HT trove was one of the largest leaks in the public interest, but it has been eclipsed in size (and maybe in significance) by "The Panama Papers". The revelations in this rapidly developing story have already led to the resignation of the Prime Minister of Iceland and the FIFA "Ethics Officer" (now there is a contradiction in terms!), and has exposed some of the shady financial dealings of the political elite in dozens if not hundreds of countries all over the globe:

http://www.theguardian.com/news/2016/apr/06/panama-papers-reveal-offsho…
Panama Papers reveal offshore secrets of China’s red nobility
Disclosures show how havens such as British Virgin Islands hide links between big business and relatives of top politicians
Juliette Garside and David Pegg
6 Apr 2016

http://www.theguardian.com/news/2016/apr/04/panama-papers-ukraine-petro…
Ukraine’s leader set up secret offshore firm as battle raged with Russia
Petro Poroshenko registered company when his troops were being wiped out in eastern Ukraine, Panama Papers show
Luke Harding
4 Apr 2016

http://www.theguardian.com/news/2016/apr/06/mossack-fonseca-oil-firms-p…
Mossack Fonseca worked with oil firms owned by Iranian state despite sanctions
Documents show law firm at centre of Panama Papers leak carried on doing business with companies after learning of their real owners
Juliette Garside, David Pegg, Holly Watt and Helena Bengtsson
6 Apr 2016

http://www.theguardian.com/news/2016/apr/06/mugabe-zimbabwe-john-breden…
Alleged Mugabe cronies kept offshore firms years after UN alert raised
After sanctions were imposed, it took four years for all companies linked to John Bredenkamp to be shut down, Panama Papers show
Juliette Garside, David Pegg and Holly Watt
6 Apr 2016

https://www.truthdig.com/report/item/al-assad_familys_massive_stolen_we…
Panama Papers Revelation of Assad Family’s Stolen Wealth Helps Explain the Syrian Revolution
Juan Cole
6 Apr 2016

https://www.truthdig.com/report/item/the_panama_papers_and_middle_east_…
The Panama Papers and Middle East Leaders’ Secret Bank Accounts
Juan Cole
4 Apr 2016

> Initial reporting on the trove identified among the major political figures from the Middle East to possess such accounts were Alaa Mubarak (son of the deposed dictator), Ayad Allawi (former interim Iraqi prime minister under American occupation), Pakistani PM Nawaz Sharif, and Saudi King Salman.

Could any serious person even attempt to deny that this story has been published in the public interest? That these revelations may potentially benefit the citizens of dozens of countries?

But the USG is likely, at least in the short term, to focus on the fact that, according to the cofounder of the unsavory law firm at the center of "The Panama papers" scandal, this story has also resulted from hacktivism:

http://www.reuters.com
Panama law firm says data hack was external, files complaint
Elida Moreno and Enrique Pretel
5 Apr 2016

> The Panamanian lawyer at the center of a data leak scandal that has embarrassed a clutch of world leaders said on Tuesday his firm was a victim of a hack from outside the company, and has filed a complaint with state prosecutors... "We rule out an inside job. This is not a leak. This is a hack," Fonseca, 63, said at the company's headquarters in Panama City's business district. "We have a theory and we are following it," he added, without elaborating.

FBI is likely to heed Fonseca's warcry and focus on investigating the alleged cyberintrusion rather than the financial misdeeds of the political elites of "allies" such as Saudi Arabia in the so-called GWOT, exploiting the role of encrypted applications in organizing the year long investigation by more than 400 journalists at 100 news organizations around the world to further its agenda of endangering all the worlds journalists, dissidents, and activists by mandating secret weakening of the cryptographically protected tools we use every day (including Tor):

http://www.wired.com/2016/04/reporters-pulled-off-panama-papers-biggest…
How Reporters Pulled Off the Panama Papers, the Biggest Leak in Whistleblower History
Andy Greenberg
4 Apr 2016

> ...
> Obermayer tells WIRED he communicated with his source over a series of encrypted channels that they frequently changed, each time deleting all history from their prior exchange. He alludes to crypto apps like Signal and Threema, as well as PGP-encrypted email but declines to say specifically which methods they used. Each time the reporter and source re-established a connection, they would use a known question and answer to reauthenticate each other. “I’d say ‘is it sunny?’ You’d say ‘the moon is raining’ or whatever nonsense, and then both of us can verify it’s still the other person on the device,” Obermayer says.
> ...
> Obermayer declined to explain how their leaker sent Suddeutsche Zeitung hundreds of gigabytes or even terabytes of information at a time. That’s far too much to send over email, of course, though that quantity of data could easily be sent anonymously in the form of shipped encrypted hard drives. “I learned a lot about making the safe transfer of big files,” Obermayer says elliptically.
>
> The ICIJ’s developers then built a two-factor-authentication-protected search engine for the leaked documents, the URL for which they shared via encrypted email with scores of news outlets including the BBC, The Guardian, Fusion, and dozens of foreign-language media outlets. The site even featured a real-time chat system, so that reporters could exchange tips and find translation for documents in languages they couldn’t read. “If you wanted to look into the Brazilian documents, you could find a Brazilian reporter,” says Ryle. “You could see who was awake and working and communicate openly. We encouraged everyone to tell everyone what they were doing.” The different media outlets eventually held their own in-person meetings, too, in Washington, Munich, London, Johannesburg and Lillehammer, Ryle says.
> ...
> Weeks before contacting the subjects of the investigation, including Mossack Fonseca, Obermayer took one final precaution: he destroyed the phone and the hard drive of the laptop he’d used for his conversations with the source. “This may have seemed a little overachieving,” he notes, “But better safe than sorry.”

(One has visions of desperate FBI agents poking through every garbage dump in Germany, looking for pieces of iPhone. A noisesome job indeed.)

We concerned citizens who are poring over the Panama Papers hope that revelations of abuses by political elites will lead to positive change, by way of the kind of bloodless revolution which US Presidential candidate Bernie Sanders has been calling for.

US President John F. Kennedy once said something to this effect: those who would prohibit peaceful revolutions will guarantee violent revolutions.

Tor, WhatsApp and other tools are enabling peaceful revolutions.

USG agencies like FBI which are targeting Tor, WhatsApp and similar technologies will, if they succeed, prevent peaceful revolutions--- and thus to guarantee violent ones.

That is not unintentional, since it is "evidence" of violent revolutions which provide FBI with its raison d'être.

And whenever factual evidence is not available, FBI is perfectly willing to make stuff up. They call that a "sting operation"; see The Intercept for many excellent articles exposing this particularly contemptible FBI activity, which overwhelmingly targets vulnerable highly suggestible people with low IQ. To cite just one example:

https://theintercept.com/2016/03/30/fbi-honeypot-ensnares-michigan-man/
FBI Honeypot Ensnares Michigan Man
Trevor Aaronson
30 Mar 2016

> KHALIL ABU RAYYAN was a lonely young man in Detroit, eager to find a wife. Jannah Bride claimed she was a 19-year-old Sunni Muslim whose husband was killed in an airstrike in Syria. The two struck up a romantic connection through online communications.

Since its inception during WWI as the Bureau of Investigation, FBI has primarily functioned as an agency which targets domestic political dissent, including social justice reformers such as the Rev. Martin Luther King. (Suspicions remain about just far FBI was willing to go in targeting King--- and FBI undercover agent was actually standing on the balcony with King when he was assassinated. And FBI cannot deny the irrefutable documentary evidence that FBI Director-for-Life J. Edgar Hoover authored a poison pen letter urging King to commit suicide, which was accompanied by a selection of illegal FBI audiotapes of his bedroom.)

FBI's unceasing PR war on end-to-end encryption not only directly threatens the lives of the courageous volunteers performing the most dangerous acts on Earth but ultimately will, if the agency succeeds, guarantee violent revolution at home.

Very smart, Director Comey, very smart.