In response, governments have tried to crack down or use this to gather information about dissidents. On June 24th Citizen Lab, a Toronto-based cyberspace security outfit, said it had detected specialised spyware being used in Saudi Arabia—the first time it has seen such sophisticated software in that country. (The Saudi authorities have not responded to these allegations).
The software, known as a remote control device (RCS), can hack into mobile phones, giving the government access to all the user’s information—what he or she has looked at or written online and the call history, for example. Unlike basic surveillance software, the RCS can also transform the device into a monitoring tool by switching on and controlling the camera and microphone, without the user noticing.
Citizen Lab and Human Rights Watch, a New York-based rights group that is also looking into the case, reckon the Saudi government is using this particular software to monitor activists in the eastern province of Qatif, home to the country’s minority community of Shia Muslims. Anti-government protests took place there in 2011 and 2012.
Citizen Lab says the software was disguised as a copy of a mobile phone news application called Qatif Today. Once downloaded, the corrupted version of the application installs the spyware. Since news of the spyware clone broke, Qatif Today’s developers have flagged up the issue and reassured Saudis that the real version is unaffected.
Citizen Lab is unable to tell how many devices have been infected, but has linked the RCS to the legal Italian spyware providers known as Hacking Team. Hacking Team’s website says it provides the technology “to the worldwide law enforcement and intelligence communities”.
This is not the first time such surveillance spyware has been found in the Gulf. In October 2012 similar software known as FinFisher, manufactured by Anglo-German company Gamma, was linked to the monitoring of high profile dissidents in Bahrain. Like Hacking Team, Gamma only sells to governments.
Until recently such technology was only used by governments with a long history of expertise in spying, such as Russia, says Bill Marczak of Bahrain Watch, an NGO that monitors human-rights violations in Bahrain. “Now any government that is willing to spend several hundred thousand dollars can acquire these hacking tools and get the training they need,” says Cynthia Wong, who researches internet violations for Human Rights Watch.
That leaves activists more exposed than ever. “Social media activity is increasingly being used as evidence against us,” says a Saudi activist, who wishes to remain anonymous. Most online activists in the Gulf use pseudonyms on their Twitter or Facebook accounts, but Human Rights Watch says a common counter-tactic used by the authorities in the United Arab Emirates, for example, is to unmask users’ identities by recording their internet address and therefore their location.
Currently it is legal for governments to buy the spyware—the sale and export of surveillance tools is virtually unregulated by international law. Spyware providers say they sell their products to governments for “lawful purposes”. But activists allege that their governments violate national laws in their often politically motivated use of such software. They argue that companies should be held accountable for selling spyware to repressive governments.
Activists grumble that the growing use of spyware is being largely ignored. “This issue has not yet got the attention it deserves,” says Bahaa Nasr, a Lebanese representative of Cyber Arabs, an Arabic-language platform that promotes digital security and transparency in the region.
Without legal recourse, all activists and researchers can do is to expose the software and campaign against its use. Citizen Lab and Human Rights Watch have called for companies to carry out due diligence of governments before agreeing to sell them the software. However, Citizen Lab warns that the usual response to spyware detection is to encourage manufacturers “to update their software to evade detection”.