Hacking Team openly advertises what it calls its "Remote Control System," (RCS) a piece of malware remotely installed on a target’s computer or smartphone. As the company touts: "Evidence collection on monitored devices is stealth and transmission of collected data from the device to the RCS server is encrypted and untraceable."
The security research group, Citizen Lab, has shown that Hacking Team’s smartphone malware has been spotted in the wild in many countries around the world, including Mexico, Morocco, Malaysia, Hungary, and more.
The new revelation comes from two independent investigations released Wednesday by Privacy International and Vice Motherboard. The London-based nonprofit also published documents from Hacking Team that claim it can monitor "hundreds of thousands of targets" per installation.
When Ars called Cicom’s listed number and left a voicemail, we soon got a call back from Alex Velasco, whom Vice Motherboard identified as the company’s general manager.
"It’s all there in the article, I can’t answer any questions," he said, before hanging up.
Neither the Department of Justice, nor the US Army, immediately responded to Ars’ request for comment by phone and e-mail.
"We cannot identify clients because of the sensitive nature of the work that they do in fighting crime," Eric Rabe, Hacking Team's chief American spokesman, e-mailed Ars late Wednesday night. "I also cannot confirm any relationship between the company Cicom and Hacking Team."
He added:
Hacking Team is in compliance with all export laws including the recent Wassenaar protocols implemented at the beginning of this year. Indeed, there is no allegation of any illegal activity whatsoever by any of the companies or agencies named in this story. We are proud of the assistance we offer to law enforcement and intelligence services. Illegal drug sales over the Internet, services for terrorists and other horrific crimes are routinely negotiated and provided using the devices Hacking Team helps law enforcement surveil. Our leading technology helps fight criminals and terrorists who routinely use the Internet, mobile devices and computers to exploit and threaten peaceful and law abiding citizens of every country.
When Ars asked further how he explained the fact that Hacking Team and Cicom share an address in Annapolis, Maryland, he wrote:
The address of the office we have used in Annapolis, Maryland, is a corporate hosting company, Regus, that provides office space to probably 50 different companies who take offices at that same location. (Our office is moving to Reston, Virginia. The Anapolis office has been essentially closed, though we have some furniture stored there for some time.) As I say, I have no comment on our relationships with other companies or clients.
Experts also agree that it’s only a matter of time before these surveillance tools turn up in the hands of local law enforcement, if they haven’t already.
"I would bet money that they’ve sold to local cops, I just don’t have a smoking gun," Chris Soghoian, a technologist with the American Civil Liberties Union, told Ars.
"They are targeting that market. If their sales people haven’t been able to sell to local law enforcement, then they’re not doing their job. I’m sure someone has bought the software, but like the stingray, they’re hiding what they’re doing."
Annapolis Exchange Parkway… a dead giveaway
The evidence that those two American government agencies purchased from Hacking Team stems from public records. Those filings show that a company called Cicom USA was hired by the US Army in 2011 to do two jobs worth $365,225 and seven more with the DEA worth $927,000 between 2012 and 2014.A March 2012 Request for Information from the DEA showed that it was interested in acquiring a "fully functional and operational product proven to be capable of providing a Remote Control Host Based Interception System for device or target specific collection pursuant to authorized law enforcement use." Less than two months later, the DEA found that Cicom USA was the only such company available to provide this product and service.
There is little information as to who or what Cicom USA is, other than that it is headquartered at 1997 Annapolis Exchange Parkway, Annapolis, Maryland—the exact same listed address of Hacking Team in the United States.
Other filings show that as of Fiscal Year 2012—the same year as Cicom’s largest single contract ($575,000)—it reported just three employees and annual revenue of $3 million.
"I knew the Hacking Team address was in Annapolis, and recognized it," Soghoian told Ars, when Privacy International showed him the Cicom contracts.
Wheels of justice grind ahead
Many legal experts find this expansion of judicial and police power troubling, particularly given that the United States Department of Justice wants the legal authority to broaden its ability to hack criminal suspects’ computers. (In February 2015, Google published its formal opposition to the proposed revision.)Federal agents have been known to use such tactics in past and ongoing cases: a Colorado federal magistrate judge approved sending malware to a suspect’s known e-mail address in 2012. But similar techniques have been rejected by other judges on Fourth Amendment grounds. If this rule revision were to be approved, it would standardize and expand federal agents’ ability to surveil a suspect and to exfiltrate data from a target computer regardless of where it is.
In April 2013, a federal judge famously denied the FBI when it asked for permission in its warrant request to target an overseas suspect via his webcam.
"It is not surprising that the DEA has had early access to these and other surveillance capabilities," Ahmed Ghappour, a law professor at the University of California, Hastings, told Ars by e-mail.
"The ‘war on drugs’ has been used as a petri dish for all sorts of surveillance capabilities, and questionable tactics like parallel construction. This is just the latest example. Perhaps most frightening will be use of these capabilities by state police forces, who lack any meaningful training or oversight on the use of hacking tools, and who typically exercise more discretion than their federal counterparts."The San Francisco-based professor added that because federal prosecutors are especially aggressive in drug-related cases, they often push intensely for plea bargains.
"Less trials means less opportunity to file suppression motions that uncover surveillance technologies or questionable tactics such as parallel construction," he noted.
Brian Owsley, a former federal magistrate judge who is now a law professor at Indiana Tech, coincidentally is about to come out with a law journal article on this exact issue.
He shared with Ars a copy of that article, "Beware of Government Agents Bearing Trojan Horses," which is forthcoming in the Akron Law Review.
There are both dangers and benefits that come with the Government’s use of Trojan devices. There is a danger that such devices will collect information not meant to be obtained from innocent third parties. However, one benefit is that these devices enable the Government to catch criminals that may have evaded them in the past. Other good news about the government’s use of Trojan devices is that the government seeks a search warrant when using the devices, which it often does not do in other applications for electronic surveillance. The problem, however, is that some magistrate judges, in reviewing the Trojan device applications, are not closely hewing to the requirements of Rule 41(b) and are granting these applications where the rule should not allow them.
Ultimately, judges reviewing applications for search warrants must be diligent in ensuring that the standards are satisfied before granting them. Moreover, judges must account for the likelihood that third party data may be swept up within any search and develop appropriate protocols to safeguard innocent individual’s privacy. This measure is necessary to ensure that, while the Government pursues criminals, the rights of the American people are not violated.
reader comments
25