Friendly Fire How GCHQ Monitors Germany, Israel and the EU
The American spy stayed in northern Cornwall for three weeks. He was delighted with the picturesque setting, with its dramatic cliffs and views of the Atlantic.
In a classified report, the NSA employee also raved about the British signals intelligence agency GCHQ's field of antennas, located high above the Atlantic coast, about 300 kilometers (190 miles) west of London. Her Majesty's agents have been working at the site, where 29 satellite antennas are aimed skyward, for decades. The Cornwall intelligence base, once part of the Echelon global signals intelligence network, was previously known as "Morwenstow." Today the site is known as "GCHQ Bude."
In addition to its geographical conditions, which are ideal for monitoring important communications satellites, Bude has another site-specific advantage: Important undersea cables land at nearby Widemouth Bay. One of the cables, called TAT-14, begins at German telecommunications company Deutsche Telekom's undersea cable terminal in the East Frisia region of northern Germany.
There were suspicions as early as this summer that the British intelligence service in Bude was eavesdropping on German targets. Now documents from the archive of US whistleblower Edward Snowden contain the first concrete evidence to support this suspicion: German telephone numbers. SPIEGEL, Britain's Guardian and the New York Times, as part of a joint effort, were able to view and evaluate the material.
List Includes Embassies, Leaders
According to the documents, the GCHQ Bude station listed phone numbers from the German government network in Berlin in its target base as well as those of German embassies, including the one in Rwanda. That, at least, was the case in 2009, the year the document in question was created. Other documents indicate that the British, at least intermittently, kept tabs on entire country-to-country satellite communication links, like "Germany-Georgia" and "Germany-Turkey," for example, of certain providers.
The name of the European Union's competition commissioner and current European Commission vice president, Joaquin Almunia, also appears in lists as well as email addresses that are listed as belonging to the "Israeli prime minister" and the defense minister of that country.
The details from the British intelligence agency's databases could have political consequences. The British will now face an uncomfortable debate over their activities, which are apparently also directed against partner countries in the EU and the political leaders of those nations. SPIEGEL already reported in September on a GCHQ attack on partly government-owned Belgian telecommunications provider Belgacom.
Possible Headache for Cameron
At a dinner during the Brussels EU summit in late October, two days after SPIEGEL's revelation that Chancellor Angela Merkel's mobile phone had been tapped, French President François Hollande began a debate during the meal over surveillance practices in Europe and called for the establishment of a code of conduct for intelligence agencies.
British Prime Minister David Cameron remained oddly silent during the discussion, in solidarity with his American friends -- but also, presumably, because the GCHQ intelligence service doesn't behave very differently from its big brother, the National Security Agency, and because of their agency's close cooperation with the NSA in the realm of satellite surveillance. If it is confirmed that the British targeted the phones of German government officials and EU Commissioner Almunia, Cameron will have a problem.
The documents do not indicate the intensity and length of any collection of targets. The German numbers are only a small part of a bundle of documents filled with international telephone numbers and corresponding annotations. The documents viewed by SPIEGEL, the Guardian and the New York Times appear to represent only a small cross-section, and they include hundreds of telephone numbers from more than 60 different country codes. The bundle of documents provides the first glimpse of the scope of Britain's surveillance ambitions.
EU Figures, Companies Targeted
The documents also show that the surveillance net cast by GCHQ and its political overseers is remarkably comprehensive. From Bude and other GCHQ sites, the agency appears to be systematically monitoring international country-to-country telephone calls made through satellite connections, as well as email communications (known as "C2C," or computer-to-computer). This is evidenced by, for example, long lists relating to connections between places like Belgium and various African countries.
The entry "EU COMM JOAQUIN ALMUNIA" appears in an "informal" analysis of the communication paths between Belgium and Africa prepared in January 2009. At the time, the peak of the euro crisis, Almunia was still the EU economics and finance commissioner and he already had his own entry and personal identification code in the British target database, with the codename "Broadoak."
It's unlikely that the surveillance interest in him -- at least when it comes to industrial espionage -- has diminished since then. Almunia, now the EU's competition minister, is currently ruling on, among other issues, whether US Internet giant Google is abusing its market power, thereby harming European companies. Almunia recently imposed fines on US pharmaceutical giant Johnson & Johnson, as well as financial companies like Citigroup and J.P. Morgan Chase.
Non-Governmental Organizations Included
The EU commissioner's name also appears in a second document from 2008, which describes a communication path between France and Africa. According to the document, Almunia, or a number assigned to him in the British target database, called a number in Ivory Coast on Oct. 30 or 31, 2008. SPIEGEL was unable to obtain a response from Commissioner Almunia on the incident by the time it went to press.
In addition to many political and "diplomatic targets," the lists contain African leaders, their family members, ambassadors and businesspeople. They also include representatives of international organizations, such as those of United Nations agencies like the Food and Agriculture Organization (FAO), the United Nations Children's Fund (UNICEF) and the UN Institute for Disarmament Research (UNIDIR). A noticeably large number of diplomatic missions to the United Nations in Geneva are also listed.
Even non-governmental organizations like Doctors of the World (Médicins du Monde) appear on the British intelligence agency lists, along with a representative of the Swiss IdeasCentre and others. Individual companies can also be found on the list, especially in the fields of telecommunications and banking. The partly government-owned French defense contractor Thales, along with Paris-based energy giant Total, is also mentioned.
A Continuation of Echelon?
When GCHQ officials were asked about the suspicion arising from the documents that their organization engages in large-scale industrial espionage, they stated that while they were unwilling to address specific details, "one of the purposes for which GCHQ may be authorized to intercept communications is where it is necessary for the purpose of safeguarding the economic well-being of the UK" or state security. "Interception under this purpose is categorically not about industrial espionage," it stated.
The NSA also denied in a statement that it uses its "foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of -- or give intelligence we collect to US companies." In another statement, NSA officials said, "The United States collects foreign intelligence just as many other governments do."
Either way, it appears the British have come relatively close to the goals they state elsewhere in the documents to "exploit global telecommunications" and of "mastering the Internet." The documents that were reviewed also suggest that the satellite dragnet is likely a continuation of the legendary global Echelon surveillance network, which was the subject of an investigation by a committee of the European Parliament in 2000.
Codename: 'Carboy'
In their 2001 final report, the EU politicians presented a wealth of convincing evidence of industrial espionage allegedly committed through Echelon, and also made various demands on the United States. But only a few weeks later, the events of 9/11 pushed the criticism of the EU's partner to the back burner.
A map from the wealth of classified documents obtained by Snowden on the so-called "Fornsat" activities of the technical intelligence cooperation program -- informally known as the Five Eyes -- shows that the system of global satellite surveillance remained in operation.
Bude is referred to by its codename "Carboy" under a heading titled "Primary Fornsat Collection Operations." Another collection point in the alliance that also appears in the documents is the NSA's Sugar Grove listening post in northern Virginia, codenamed "Timberline."
It has been clear since the release of the Echelon report that intelligence services eavesdrop on international communications conducted by satellite -- and Germany's BND foreign intelligence agency is no exception. What is so politically charged about the current revelations is that the names and institutions of European neighbors, including EU representatives and various UN organizations, appear to be listed in the target databases. It would be hard to consider this to be anything less than an intelligence service attack on friends. The question now is whether the names and institutions are also intelligence targets for the NSA.
Israel Spying May Cause Tensions for US
GCHQ and NSA agents work together closely at Bude, which is a jointly operated listening post. Clearly the visitor from the United States who was so enchanted by the scenic Cornwall landscape was far from an isolated case. In fact, there are NSA agents who are permanently assigned to the Cornwall facility. The Guardian reported over the summer, based on information from other documents in the Snowden archive, that the NSA even assumed redevelopment costs of more than $20 million (€14.5 million). According to a secret GCHQ document from 2010, the British were making an effort to at least satisfy the NSA's minimum expectations, but had trouble keeping up with demand from the United States.
The close cooperation between Britain and the United States could prove highly controversial because the intelligence workers in Bude also targeted Israel. At least four Israeli targets are named in GCHQ lists, including an email address named as the "Israeli prime minister." The paper dates from 2009, when Ehud Omert was in office. Another email address is also sensitive. For a time, minister@mod.gov.il was central to Israeli foreign and security policy. Israeli Defense Minister Ehud Barak and his then chief of staff Yoni Koren personally used the mailing list. In its reporting, SPIEGEL learned that Barak coordinated a part of Israel's Iran policies using this account. It wasn't a forum for top-secret operations, but it was one for many internal decision-making processes.
The prime minister and his foreign minister are the two most important men in Israel. Anyone with access to their communications could quickly gain a lot of insights about the inner workings of Israeli politics.
Suggestions Germans Were Also Targeted
The lists of full numbers, names and email addresses certainly offer the potential for fresh political tensions in other places. Just last week, German Chief Federal Prosecutor Harald Range said that from his office's perspective, there is no evidence that the NSA or British intelligence has systematically monitored German telephone and Internet traffic. In a joint appearance before the British House of Commons in November, Britain's three top intelligence chiefs insisted that their work primarily involved counterterrorism operations.
The material viewed does indeed contain many references to possible terror suspects, suspected cases of nuclear proliferation and individuals associated with the taking of hostages. In many instances, the code names of current operations appear next to the listed numbers, including the operations of other British agencies, such as the Serious Organised Crime Agency (SOCA) police unit. Still, this doesn't explain the large number of so-called "hits" relating to political, diplomatic and business matters. These individuals, organizations and businesses must, therefore, have been defined as espionage targets.
A key document consisting of a long list of telephone numbers and dated Nov. 27, 2009 suggests that this also applies to German institutions and possibly German individuals. The surveillance operation recorded in the document was apparently focused on targets in crisis-ridden Congo, including members of the family of an African president, as well as senior military officials in the country, a cleric and a former vice-president. Two numbers with relevance to Germany are listed under a line that reads "list of all noted hits in priority order."
Berlin As 'Surveillance Target'
The words "German Emb in Rwanda" -- the German Embassy in the capital Kigali -- are noted next to the number "250-252575141." Further reporting revealed that the telephone number was the main line for the German Embassy in Kigali until 2011.
Five hits farther down the list, a combination of numbers leads directly to the German capital: "49-30-180 German Government Network." Those numbers include the country code for Germany, the area code for Berlin and the prefix for the Federal Government Information Network, to which government ministries in Berlin are connected. Any agency that would include that prefix for German government numbers must have considerable interest in political developments in Berlin.
SPIEGEL contacted several intelligence experts, who expressed the opinion that the list of German numbers under the term hits could only mean that GCHQ essentially declared these numbers to be surveillance targets.
GCHQ: Activities Are 'Authorized'
The documents SPIEGEL was able to examine do not indicate how intensively and during which periods of time the individual targets were actually monitored. However, the example of an African politician shows that even during a surveillance test run, the British intercepted and stored his mobile phone text messages in their entirety.
In response to a detailed list of questions, GCHQ answered that it does not comment on intelligence matters. It did state, however, that its own activities are "authorized, necessary and proportionate," and are conducted under the "rigorous oversight" of various supervisory bodies.
However, it must be assumed that the German Embassy in Rwanda and the number for the Berlin government network aren't the only targets with relevance to Germany. Rather, they were merely the only German numbers acquired during the period and on the specific communication path in question. The fact that the British agents monitor, at least intermittently, the entire signal paths of satellite communications between Germany and other countries means it is certain that significantly more numbers with the German country code, 0049, must appear in the GCHQ databases.
Search for New Targets
Moreover, the intelligence services participating in the satellite surveillance alliance are apparently constantly searching for new eavesdropping opportunities of interest, or at least they were in the period from 2008 to 2009, when the satellite surveillance documents SPIEGEL examined were created.
Some of the longer documents and hit lists are "informal reports" addressing test runs for new, previously unmonitored communication paths intended to "highlight the possible intelligence value." They are generally listed under "Bude Sigint Development," which means they relate to the identification and development of new targets.
According to the documents, most of the tests were conducted over a period of a few days, during which the intercepted numbers were apparently correlated with the target databases to determine whether ongoing monitoring would be worthwhile. The hit lists filled with names and numbers are the results of these tests. Each of the documents ends with a question: "Can this carrier be tasked to the collection system?" In many cases the answer is simply "yes." One such case is a communication path from Europe to Africa from the year 2008, in which EU Commissioner Almunia appears for the first time. In the January 2009 document in which Almunia is mentioned once again, the answer to the question at the end reads: "Not currently due to the data rate of the carriers." It is also noted that "future (…) updates will resolve this issue."
A Revealing Example
A report from August 2009 shows how much information the spies managed to intercept even in these test runs. It also mentions the president of the Economic Community of West African States (Ecowas), who is referred to as "Dr. Chambers" in the material. This appears to be a reference to the Ghanaian diplomat Mohamed Ibn Chambas, who worked for Ecowas in various capacities from 2001 to 2010. In late 2012, UN Secretary General Ban Ki Moon appointed him as the UN's Joint Special Representative for Darfur.
In 2009, the British apparently intercepted his text messages as part of a test run. The messages are marked in red in one of the documents, which is meant to highlight the potential value of another satellite link between Africa and Europe.
The documents include, among other things, more than a dozen of the complete texts of his messages, and reveal the whereabouts of the Ecowas president, who was in Liberia to receive a prize for his peace efforts. "Am in Liberia to receive a national award during their independence day celebration (sic) tmrow," reads one of the texts intercepted by the British. In another, Chambas recommends a book about Ghana's colonial history. It's "interesting and informative," the message, which is private and mundane like most of the others, informs.
SPIEGEL was unable to obtain a statement from Chambas before this article went to print about surveillance of his text messages.
But when contacted by reporters, Leigh Daynes, the UK executive director of Doctors of the World, said he was "shocked and surprised by these appalling allegations of secret surveillance on our humanitarian operations." He said his relief organization, like others, operates impartially and independently. "There is absolutely no reason for our operations to be secretly monitored," he said.
