A program used by governments around the world to access and monitor a person’s digital footprint across mobile networks and the internet has been uncovered by two sets of researchers who have broken down how it works.
Produced by an Italian operation simply known as the Hacking Team, two separate researchers in Moscow and Toronto were able to find the program called the Remote Control System (RCS) Galileo. From the company’s description of the program, it has far-reaching capabilities across almost all mobile operating systems, including iOS, Android, Windows Mobile and BlackBerry, according to Wired.
However, as the most common on the market, iOS and Android allow for the greatest collection of information by governments and police forces. Such information includes emails, text messages, call history and almost all of a user’s digital footprint, all gathered with a relatively simple command process.
The only way the phone user could notice their phone was being accessed would be through a hardly noticeable slow-down in performance and, more noticeably, an increased use in data by the phone.
And yet, Android users targeted would potentially see little sign that they are being targeted, as the Google OS has the added vulnerability of being able to turn on the phone’s Wi-Fi and steal the data without much notice.
An elaborate and protected process
Galileo works by placing command-and-control servers in the co-operating countries to orchestrate the botnet attacks against smartphones. These servers now amount to more than 350 in 40 countries, 64 of which are in the US alone while Ireland has one.
Further evidence from a leaked copy of Galileo’s user manual shows the Hacking Team was well aware it was a target for online privacy activists and researchers, such as researcher Sergey Golovanov, who wrote about the findings on his blog.
A multitude of protection software was included in the program, which openly advises governments and law-enforcement agencies to establish proxy servers to route the siphoned data through to lessen detection.
The Toronto-based Citizen Labs, which also discovered the program, said the ease with which a government or organisation can use it is worrying from a privacy point of view.
“This type of exceptionally invasive toolkit, once a costly boutique capability deployed by intelligence communities and militaries, is now being marketed for targeting everyday criminality and ‘security threats,’” Citizen Labs said.
“An unstated assumption is that the entities able to buy these tools will use them correctly, and primarily for law-enforcement purposes. As our research has shown, however, by dramatically lowering the entry cost on invasive and hard-to-trace monitoring, it lowers the cost of targeting political threats.”
