W7y8w3

SyriaCircumventing surveillance of internet communicationsKarim BitarIntroductionHardly a day passes without news about the conflictin Syria making headlines. After more thanthree years of clashes, the death toll is estimated tohave exceeded 150,000. 1 Since the early days of theuprising, the government has imposed strong restrictionson foreign media coverage of the events,granting access only to reporters who share its sideof the story.Under such restrictions, it would be expectedthat the opposition would turn to citizen journalismto provide coverage of the events from its perspective.Many initiatives were started for this purpose,using mobile phone cameras to record and documentevents, and broadcast this footage to theworld through the internet.With the internet becoming the only viablemedium for communication, the issue of the government’sability to intercept, block and exploit thecommunications of the opposition becomes a majorchallenge. Citizen journalists and activists had tofind creative measures to circumvent governmentsurveillance and protect their communications.In the following sections of this report, I investigatea major project implemented by the Syriangovernment to intercept and trace all the digitalactivities and communications of its citizens. I alsoexplore the tools and techniques developed by Syriancitizens to bypass the government’s intrusiveeye, and regain their privacy.Policy and political backgroundSurveillance of citizens’ communications is not newin Syria. While it has certainly intensified in scaleand scope over the past four years, government surveillancehas been a dominant theme in the countryfor decades, pre-dating the internet and digital communications.While the Syrian Constitution protectsfreedom of expression, and guarantees the privacy1 Evans, D. (2014, April 1). Death toll in Syria’s civil war above150,000: monitor. Reuters.www.reuters.com/article/2014/04/01/us-syria-crisis-tollidUSBREA300YX20140401of all communications of the country’s citizens, thegovernment does not seem to be too concernedabout that.Syria was ruled by a state of emergency law from1963 to 2011. 2 This law severely restricted personalliberty and freedom of expression. The massive secretservices organisation established shortly afterensured that the red lines were clearly drawn, andthose who crossed them were duly punished. As aresult, Syria became the 177th country (out of 179)on the Reporters Without Borders’ 2014 Press FreedomIndex, 3 and was given the “worst of the worst”title by Freedom House in 2014 for achieving thelowest possible ratings on all criteria in politicalrights and civil liberties. 4This explains the internet’s delayed entryinto the country, since an open, international anddifficult-to-control communication medium couldundermine the establishment and lead to situationsthe government may not tolerate. Over time,the government realised that it could use the exactsame technology to expand the scale and scope ofits traditional surveillance activities, and it soonacted to make mass surveillance of digital communicationsthe new reality.Pervasive surveillance in the digital ageIn late 2011, an Italian telecommunications company,Idea SpA, was caught in the midst of anunsettling controversy: the company was installingsurveillance equipment in Syria that would enablethe government to intercept every single email andinternet communication that flows through thecountry. 5The leaked details of the deal, which are highlycredible given the details they cite, indicate that theinstalled system would use deep packet inspec-2 Marsh, K., & Black, I. (2011, April 19). Syria to lift emergency ruleafter 48 years – but violence continues. The Guardian. www.theguardian.com/world/2011/apr/19/syria-lift-emergency-ruleviolence3 Reporters Without Borders. (2014). World Press Freedom Index2014. rsf.org/index2014/data/index2014_en.pdf4 Freedom House. (2014). Freedom in the World 2014.freedomhouse.org/report/freedom-world/freedom-world-20145 Elgin, B., & Silver, V. (2001, November 3). Syria Crackdown GetsItaly Firm’s Aid With U.S.-Europe Spy Gear. Bloomberg. www.bloomberg.com/news/2011-11-03/syria-crackdown-gets-italy-firms-aid-with-u-s-europe-spy-gear.htmltion to analyse the content of all traffic that travelsthrough the country’s national public data network(PDN). The national PDN constitutes the digitalcommunications backbone for the whole country,and all traffic – for internet service providers (ISPs),banks, voice over IP (VoIP), etc. – passes through itsinfrastructure. This would give the installed surveillancesystem comprehensive access to all digitalcommunications in the country, and the leaks of thedeal confirm that Idea SpA was training local personnelon operating the system’s monitoring andtracing capabilities.While Idea SpA used some of its own technologyto integrate the system, it also implementedseveral components from other hardware and softwarevendors, including US company NetApp Inc.,French company Qosmos SA, and German companyUtimaco Safeware AG. These companies werequick to announce that they were unaware thattheir products were shipped to Syria, and that theywere acquired locally in Italy. This raises seriousquestions about the effectiveness of export controlregulations for surveillance gear, and how easilysuch regulations can be circumvented.A primary concern for surveillance projects likethis is the argument that the government can usethem to hide its intrusive surveillance activitiesunder the “lawful interception” of citizens’ communicationsfor law enforcement purposes. In fact,that is precisely the claim stated by Idea SpA’s CEOin responding to the criticisms of his firm’s involvementin the project.What those who adopt this argument fail tomention, however, is that “lawful interception” istightly governed by checks and balances to ensureall activities are performed in accordance with thecountry’s constitution and applicable laws. Thisincludes, for example, the need for a court warrantthat is only issued after due legal process. Thesecrecy surrounding this project, and many similarothers, makes it impossible to verify its compliancewith these requirements.Another argument used to justify mass surveillanceis that “everybody else does it”. Withthe recent revelations on mass surveillance programmesin the United States, the United Kingdomand other countries, even established democracieswere caught in the act of invading the privacy oftheir citizens and those of other countries, despitelong traditions of freedom of expression and privacyprotection. If it is so easy to bypass the constitutionalguarantees and secretly intercept citizens’communications in these countries, how can muchless democratically developed countries be expectedto set a better example?The problem is actually compounded forcitizens of the latter, since they are subjected toseveral layers of spying and surveillance. At onelevel, their governments are engaging in intrusive,large-scale interception and surveillance of theircommunications. On another, they are subjected toforeign surveillance from countries other than theirown. It is not unrealistic to imagine this turning intoa global overlapping “spaghetti” of surveillanceprogrammes where everyone is spying on everyoneelse.In such a distrustful environment, it can bevery difficult to even track who is doing what. Forexample, the recent story of the US National SecurityAgency (NSA) bugging telecommunicationsequipment while in transit to its users without theknowledge of the equipment’s vendors themselves isa startling example. That story sparked global outrageamong customers of US technology companies,and prompted John Chambers, CEO of Cisco SystemsInc., to send a carefully worded letter to PresidentBarack Obama complaining against these acts. 6So how are people in Syria dealing with thisubiquitous surveillance of their everyday digitalactivities? History has taught us that humanshave an amazing ability to adapt to their environmentand develop creative solutions to overcomethe challenges that come their way. Syrians are noexception.In addition to many awareness raising campaignsand educational activities, such as theAmenny (Secure Me) Digital Awareness Week 7(which includes training courses on securing digitalcommunications, erasing trails, awareness videos,and tips on how to use online security tools), ateam of Syrian technology professionals developeda specifically designed distribution of the Linux operatingsystem called Virtus Linux to enable usersto easily hide their tracks and communicate withoutfear of the eyes of the person-in-the-middle (or,probably more accurately, people-in-the-middle). 8Another approach usually used by Syriancitizens to avoid surveillance is to develop “codelanguage”, using agreed upon substitutes for suspiciouswords and sentences in daily communication.Actually this practice was so widespread that somesubstitute phrases became famously known fortheir concealed synonyms. For example, most Syr-6 Bort, J. (2014, May 19). Cisco CEO Writes Letter To Obama AskingHim To Stop The NSA Hacking Into His Equipment. BusinessInsider. www.businessinsider.com/cisco-ceo-letter-to-obamaabout-nsa-2014-57 https://www.facebook.com/events/305539792943989/?ref_newsfeed_story_type=regular8 internetfreedomfh.strutta.com/entry/426472236 / Global Information Society Watch syria / 237