UK sale of surveillance equipment to Macedonia raises questions over export licence policy

How the British sold surveillance equipment to Macedonia

Senior officers of the Macedonian UBK made a trip to London in 2010 and reportedly agreed the purchase of surveillance equipment from the British company Gamma International, part of the Gamma Group.

Emails from the Foreign and Commonwealth Office (FCO), obtained by Computer Weekly, confirm that Macedonia bought “interception equipment from Gamma” the following year.

And in May 2012, the UK government approved an export licence to Gamma International to supply six sophisticated devices, called 3G-N 2F IMSI catchers, with a 3G Blind Call function.

David Lidington, the then minister for state for Europe and current secretary of state for justice, was consulted on the decision. He did not wish to comment when approached by Computer Weekly.

The IMSI catchers were capable of capturing and recording mobile phone voice calls, SMS messages and covertly recording details of mobile phone calls made within the range of their antennas – on a huge scale.

The customer was the Ministry of Interior (MOI) in Skopje, the government department responsible for the policing of organised crime, and the Security and Counterintelligence Administration (UBK), Macedonia’s equivalent to MI5. The UBK was later implicated in the surveillance scandal that shook the country from early 2015.

The Foreign Office’s Arms Export Policy Department (AEPD) and Human Rights and Democracy Department (HRRD), together with the British Embassy in Skopje, considered the human rights record of the Macedonia government before recommending approval for Gamma International’s export licence.   

Surveillance equipment needed to tackle organised gangs

According to an internal report obtained by Computer Weekly, the Ministry of Interior intended to buy Gamma’s surveillance equipment for “geo-locating and tracking” the 3G mobile telephone traffic belonging to organised criminal gangs. “Organised crime remains a significant problem in Macedonia, and there is an operational need for the MOI to have the best equipment to combat it,” the FCO memo states.

The document shows that if the Foreign Office team did have concerns over illegal surveillance by the Macedonian government, they were allayed by the Macedonian Parliament’s introduction of legislative controls to limit telephone intercepts to organised crime cases, and discussions in the Macedonian Parliament to improve Parliamentary oversight of surveillance.

The report quoted heavily from the latest 2011 EU progress report on Macedonia, which noted that the Macedonian government had stepped up its supervision of the police, and that the Ministry of Interior had been willing “in several cases” to bring criminal cases against police officers involved in alleged criminal offences.

However, it failed to mention that the same 2011 EU progress report on Macedonia had raised doubts about the ability of the Macedonian government to carry out effective oversight of the country’s police and intelligence services.

The report states that the Macedonian Ministry of Interior unit “is yet to be transformed into an authority that is fully independent from the police with the ability to implement effective investigations”.

“Parliamentary oversight of intelligence and counter-intelligence services remains weak. In 2010, only one session of the Parliamentary Committee was convened. There is insufficient cooperation between the Parliamentary Committee and the Bureau for Security and Counterintelligence,” it said.

Covert mobile phone monitoring favoured by police forces

IMSI catchers are a favoured form of surveillance for police forces around the world because they do not require cooperation from mobile operators to monitor large numbers of mobile phones.  They can be used to send automated messages to crowds during protests.

They gather data by conducting man-in-the-middle attacks against mobile phone users. The device pretends to be a cell tower and acts as a malicious relay for mobile phones in the area, which gives the IMSI operator the opportunity to eavesdrop on the network traffic.

They can be worn on the body or in a backpack to allow police to mix with crowds or protests, and can also be used in cars or mounted in fixed locations. The fixed devices have access to better power supplies, giving them greater range and capabilities.

Gamma International’s IMSI catchers are capable of capturing and recording mobile phone voice calls, SMS messages and covertly recording details of mobile phone calls made within the range of their antennas – on a huge scale

The range of IMSI catchers depends on the power available and the terrain of the area being monitored, but typically they can intercept calls anywhere from tens of metres to 1-2km. In “catch and release” mode, IMSI devices from some manufacturers can acquire metadata and location at a rate of “1,500 handsets per minute across five networks”.

Gamma’s 3G IMSI catchers, whose specifications have been leaked online, allow the interception all voice calls and SMS messages either made or received. They can spoof the identity of a target phone to send SMS messages or make voice calls that appear to come from the person under surveillance.

They can block calls so they are not received by the target, and divert or edit SMS messages before they are received. The company’s 3G Blind Call capability ensures that the phone can transmit information to the catcher without the target being aware.

Gamma International’s catalogue shows the features of its IMSI catchers

According to its sales brochure, Gamma’s IMSI catchers are capable of hoovering up metadata, location and SMS data, and phone conversations at a rate of up to 20 simultaneous calls recorded per device.

UK government accused of short-sightedness

Privacy campaigners have accused the UK government of short-sightedness in approving the export licence.

“The UK government has consistently claimed that the current system of assessing licences is robust, but it’s clear here that it has failed to properly scrutinise the legal framework governing surveillance in Macedonia,” says Privacy International researcher Edin Omanovic.

“The use of IMSI catchers is considered so sensitive in the UK that the police refuse to comment on them. Yet the government has been licensing their export to dozens of destinations, including to countries with horrific human rights records where surveillance is routinely used to target activists, journalists and opposition members,” says Omanovic.

That the UK approved this licence to a department which appears to have been engaging in illegal wiretapping on a mass scale illustrates the huge risks involved and just how short-sighted and counter-productive this is.

The Foreign and Commonwealth Office’s assessment that Macedonia’s attempts to bring greater scrutiny to the UBK and stronger parliamentary scrutiny were to prove, at best, optimistic.

• Gamma International: The Macedonia Files – download the key research documents referred to in this article here.

A legal expert told Computer Weekly: “Where there are more red flags, one would generally expect enhanced due diligence to be conducted in respect of licence applications. In the case of Gamma International, this may extend to factors such as Gamma’s track record and Macedonia’s questionable human rights record.”

Uranija Pirovska, who was the director of the Helsinki Committee for Human Rights when the export licence was issued, says that in 2011 – the year before the UK government approved the export licence – there were already clear indications that Macedonians were living in a non-democratic regime.

She cites the brutal murder of a young man at the hands of former prime minister Gruevski’s bodyguards on the night of the 2011 elections, and the arrest of opposition politician Ljube Boskovski the day after. It also emerged that the Ministry of Interior had tried to cover up the involvement of Gruevski’s bodyguards in the 2011 murder.

When the leaked tapes came to surface in February 2015, Pirovska found she had been wiretapped since 2011. “We [activists and journalists] had the strong suspicion that we were being wiretapped back then, as you could hear that the phone conversation was not clean,” she says.

The tapes also exposed several high-profile corruption scandals that are being investigated by the Special Prosecution (SJO). Accusations include money laundering, irregularities in public procurement, the illegal demolition of buildings belonging to political opponents, electoral fraud and more. Five cases involve the former prime minister Gruevski himself.

Macedonia promises surveillance reforms

Macedonia’s new government, led by the Social Democrats, was formed in May 2017. A particular challenge for the new administration is to prevent illegal surveillance in the future.

The EU sponsored two investigations, led by former European Commission director Reinhard Priebe, to tackle systemic failures with the rule of law and widespread corruption in Macedonia. The two inquiries, known as the Priebe reports, were compiled in June 2015 and in September 2017 by a Senior Experts’ Group.

They place particular focus on ensuring proper oversight over the Bureau of Security and Counterintelligence (UBK) and strongly recommend that the direct access to technical equipment by UBK should be removed.

Responding to Computer Weekly, the Macedonian government affirmed its commitment to ensure this by following the recommendations set out in the Priebe reports. “Negative political influences have been removed, and the government is undertaking measures to strengthen the surveillance over the system for communication monitoring,” it says.

Pressure groups have argued that it should be a key priority for the current Macedonian government to ensure that the country’s intelligence agencies never again get direct access to telecommunications networks, to prevent such abuses from happening in the future. That work, says the Macedonian government, has yet to be completed.