Exclusive:
phones were monitored and fake internet cafes set up to gather information from
allies in London in 2009
 |
Documents uncovered by the NSA whistleblower, Edward Snowden, reveal
surveillance of G20 delegates' emails and BlackBerrys. Photograph: Guardian |
Foreign
politicians and officials who took part in two G20 summit meetings in London in
2009 had their computers monitored and their phone calls intercepted on the
instructions of their British government hosts, according to documents seen by
the Guardian. Some delegates were tricked into using internet cafes which had
been set up by British intelligence agencies to read their email traffic.
The
revelation comes as Britain prepares to host another summit on Monday – for the
G8 nations, all of whom attended the 2009 meetings which were the object of the
systematic spying. It is likely to lead to some tension among visiting
delegates who will want the prime minister to explain whether they were targets
in 2009 and whether the exercise is to be repeated this week.
The
disclosure raises new questions about the boundaries of surveillance by GCHQ and
its American sister organisation, the National Security Agency, whose access to
phone records and internet data has been defended as necessary in the fight
against terrorism and serious crime. The G20 spying appears to have been
organised for the more mundane purpose of securing an advantage in meetings.
Named targets include long-standing allies such as South Africa and Turkey.
There have
often been rumours of this kind of espionage at international conferences, but
it is highly unusual for hard evidence to confirm it and spell out the detail.
The evidence is contained in documents – classified as top secret – which were
seen by the Guardian. They reveal that during G20 meetings in April and
September 2009 GCHQ used what one document calls "ground-breaking
intelligence capabilities" to intercept the communications of visiting
delegations.
This
included:
• Setting
up internet cafes where they used an email interception programme and
key-logging software to spy on delegates' use of computers;
• Penetrating
the security on delegates' BlackBerrys to monitor their email messages and
phone calls;
• Supplying
45 analysts with a live round-the-clock summary of who was phoning who at the
summit;
• Targeting
the Turkish finance minister and possibly 15 others in his party;
• Receiving
reports from an NSA attempt to eavesdrop on the Russian leader, Dmitry
Medvedev, as his phone calls passed through satellite links to Moscow.
The
documents suggest that the operation was sanctioned in principle at a senior
level in the government of the then prime minister, Gordon Brown, and that
intelligence, including briefings for visiting delegates, was passed to British
ministers.
A briefing
paper dated 20 January 2009 records advice given by GCHQ officials to their
director, Sir Iain Lobban, who was planning to meet the then foreign secretary,
David Miliband. The officials summarised Brown's aims for the meeting of G20
heads of state due to begin on 2 April, which was attempting to deal with the
economic aftermath of the 2008 banking crisis. The briefing paper added:
"The GCHQ intent is to ensure that intelligence relevant to HMG's desired
outcomes for its presidency of the G20 reaches customers at the right time and
in a form which allows them to make full use of it." Two documents
explicitly refer to the intelligence product being passed to
"ministers".
According
to the material seen by the Guardian, GCHQ generated this product by attacking
both the computers and the telephones of delegates.
One
document refers to a tactic which was "used a lot in recent UK conference,
eg G20". The tactic, which is identified by an internal codeword which the
Guardian is not revealing, is defined in an internal glossary as "active
collection against an email account that acquires mail messages without
removing them from the remote server". A PowerPoint slide explains that
this means "reading people's email before/as they do".
The same
document also refers to GCHQ, MI6 and others setting up internet cafes which
"were able to extract key logging info, providing creds for delegates,
meaning we have sustained intelligence options against them even after
conference has finished". This appears to be a reference to acquiring
delegates' online login details.
Another
document summarises a sustained campaign to penetrate South African computers,
recording that they gained access to the network of their foreign ministry,
"investigated phone lines used by High Commission in London" and
"retrieved documents including briefings for South African delegates to
G20 and G8 meetings". (South Africa is a member of the G20 group and has
observer status at G8 meetings.)
A detailed
report records the efforts of the NSA's intercept specialists at Menwith Hill
in North Yorkshire to target and decode encrypted phone calls from London to
Moscow which were made by the Russian president, Dmitry Medvedev, and other
Russian delegates.
Other
documents record apparently successful efforts to penetrate the security of
BlackBerry smartphones: "New converged events capabilities against
BlackBerry provided advance copies of G20 briefings to ministers … Diplomatic
targets from all nations have an MO of using smartphones. Exploited this use at
the G20 meetings last year."
The
operation appears to have run for at least six months. One document records
that in March 2009 – the month before the heads of state meeting – GCHQ was
working on an official requirement to "deliver a live dynamically updating
graph of telephony call records for target G20 delegates … and continuing until
G20 (2 April)."
Another
document records that when G20 finance ministers met in London in September,
GCHQ again took advantage of the occasion to spy on delegates, identifying the
Turkish finance minister, Mehmet Simsek, as a target and listing 15 other
junior ministers and officials in his delegation as "possible
targets". As with the other G20 spying, there is no suggestion that Simsek
and his party were involved in any kind of criminal offence. The document
explicitly records a political objective – "to establish Turkey's position
on agreements from the April London summit" and their "willingness
(or not) to co-operate with the rest of the G20 nations".
The
September meeting of finance ministers was also the subject of a new technique
to provide a live report on any telephone call made by delegates and to display
all of the activity on a graphic which was projected on to the 15-sq-metre
video wall of GCHQ's operations centre as well as on to the screens of 45
specialist analysts who were monitoring the delegates.
"For
the first time, analysts had a live picture of who was talking to who that
updated constantly and automatically," according to an internal review.
A second
review implies that the analysts' findings were being relayed rapidly to
British representatives in the G20 meetings, a negotiating advantage of which
their allies and opposite numbers may not have been aware: "In a live
situation such as this, intelligence received may be used to influence events
on the ground taking place just minutes or hours later. This means that it is
not sufficient to mine call records afterwards – real-time tip-off is
essential."
In the week
after the September meeting, a group of analysts sent an internal message to
the GCHQ section which had organised this live monitoring: "Thank you very
much for getting the application ready for the G20 finance meeting last weekend
… The call records activity pilot was very successful and was well received as
a current indicator of delegate activity …
"It
proved useful to note which nation delegation was active during the moments
before, during and after the summit. All in all, a very successful weekend with
the delegation telephony plot."
Related Article:
