Speaker 1: Get in touch with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Johnathan Strickland. I'm an executive producer here
Speaker 1: at how Stuff Works, and I heart radio and I
Speaker 1: love all things tech and today. As often is the
Speaker 1: case with tech Stuff, even though I say I love
Speaker 1: all things tech at the beginning of the show, it
Speaker 1: begins with a caveat because I don't love everything. In
Speaker 1: this particular story, it's a really shocking one. On January nineteen,
Speaker 1: Reuter's published a long piece about a secret spy project
Speaker 1: out of the United Arab Emirates. The project is called
Speaker 1: Project Raven and how the agency that was overseeing Project
Speaker 1: Raven had hired away hackers and cybersecurity experts, a lot
Speaker 1: of them from America, including American citizens who had previously
Speaker 1: worked for the United States National Security Agency or n
Speaker 1: s A, which is a pretty big deal. So what
Speaker 1: exactly is going on here? Well, in this episode, I'm
Speaker 1: going to talk about the n s A and what
Speaker 1: it does first before I get into Project Craven. And
Speaker 1: I'm doing that for two real important reasons. One is
Speaker 1: that Project Raven employed lots of former n s A
Speaker 1: employees or contractors, and Project Craven appears to use many
Speaker 1: of the same techniques that have been developed and relied
Speaker 1: upon over at the n s A for many years.
Speaker 1: Another is that while much of Project Raven is still
Speaker 1: a mystery, we haven't seen all of the documents that
Speaker 1: Reuters has referred to. That Reuters came in possession too
Speaker 1: of some of these documents rather, but we haven't. I
Speaker 1: haven't seen them all. But I figure that by understanding
Speaker 1: what the n s A is and what it does,
Speaker 1: we can extrapolate quite a bit to understand what Project
Speaker 1: Raven is all about. So we're gonna start with talking
Speaker 1: about the n s A and what they do, and
Speaker 1: then switch over to Project Raven in more detail. So
Speaker 1: the n s A formally became an agency back in
Speaker 1: nineteen fifty two, but the motivation for creating the n
Speaker 1: s A dates further back. In fact, it dates back
Speaker 1: to the First World War. A guy named Herbert Osborne Yardley,
Speaker 1: who was a telegraph operator, served as a cryptographer with
Speaker 1: American forces in France during World War One. This was
Speaker 1: not unusual. A lot of telegraph operators worked in various
Speaker 1: theaters of war, either as communications officers or cryptographers, and
Speaker 1: he recognized that the United States really needed to step
Speaker 1: up its game because he was handling communications from top
Speaker 1: brass and he found that the American Command was using
Speaker 1: codes that were outdated and or easy to break. He
Speaker 1: even broke a few of them on his own. So
Speaker 1: he advocated for a much wronger approach to cryptography, and
Speaker 1: he would eventually become the lead of the so called
Speaker 1: Cipher Bureau, sometimes also known as the Black Chamber. Pretty
Speaker 1: ominous sounding name right there. This office would intercept messages
Speaker 1: from around the world and attempt to decode them to
Speaker 1: figure out what the heck is really going on out there.
Speaker 1: And this practice was not universally accepted in government circles,
Speaker 1: and the un S Secretary of State Henry L. Stimpson,
Speaker 1: who served under President Herbert Hoover, famously pulled funding for
Speaker 1: the office in nineteen nine. He found the very concept
Speaker 1: of reading messages intended for other people to be abhorrent,
Speaker 1: or at least that's what he said. He essentially made
Speaker 1: a comment along the lines of a gentleman does not
Speaker 1: read another gentleman's letters, so you wouldn't intercept someone's mail
Speaker 1: and read what that was written. To them and then
Speaker 1: pass it back along. That would be illegal, and he says, well,
Speaker 1: the same thing should be true between nations. Now, there's
Speaker 1: definitely a healthy debate that we could have about whether
Speaker 1: or not the methods used by the Black Chamber were
Speaker 1: justifiable or ethical. According to the Saturday Evening Post, this agency,
Speaker 1: the Black Chamber was known for making deals with telegraph
Speaker 1: companies to get access to communications across those companies infrastructures.
Speaker 1: So it would be a lot like the news that
Speaker 1: broke in when Edwards Snowden revealed that the n s
Speaker 1: A had agreements or had essentially strong armed major internet
Speaker 1: companies in order to get access to electronic communication companies
Speaker 1: like Google, Facebook, Yahoo, and Microsoft, among others. Now, we're
Speaker 1: going to get back to that, but anyway, my point
Speaker 1: is something's never changed, right. This was originally back in
Speaker 1: uh the nineteen twenties with telegraph companies, and then you
Speaker 1: fast forward to the twenty tens and you find out
Speaker 1: the same things going on, but now with internet companies.
Speaker 1: You also realized that Yardley's response to the office getting
Speaker 1: shut down was to write a tell all book about
Speaker 1: the Black Chamber. It essentially said, well, if you're gonna
Speaker 1: if you're going to close out the Cipher Bureau, then
Speaker 1: I'm going to write a book about all the stuff
Speaker 1: we did. And he effectively spilled the secret beans to
Speaker 1: the world, much like Edward Snowden did in although to
Speaker 1: be fair, uh, Yardley was doing it kind of out
Speaker 1: of spite, whereas Snowden apparently was doing it because he
Speaker 1: had strong feelings that the um the practices of the
Speaker 1: n s A were We're against freedom, really against a
Speaker 1: certainly against an expectation of privacy. So history really does
Speaker 1: repeat itself in some ways. Well. While the Black Chamber
Speaker 1: was in the process of getting shut down, in nine,
Speaker 1: the United States Army opened up its own intelligence gathering
Speaker 1: office called the Signal Intelligence Service or s i S.
Speaker 1: The s I S took possession of the files that
Speaker 1: Yardley's office had generated during its operations, so they got
Speaker 1: hold of the Cipher Bureau files. This new office became
Speaker 1: the core of the n s A when President Truman
Speaker 1: formally created the agency in nineteen fifty two. According to
Speaker 1: the n s a's own website, the purpose of the
Speaker 1: agency is to end i quote, save lives, defend vital networks,
Speaker 1: advanced US goals, and alliances and protect privacy rights. That
Speaker 1: last one is kind of interesting to me. The n
Speaker 1: s A is part of the Department of Defense, so
Speaker 1: it is no longer a branch of the army or
Speaker 1: any specific branch of the military. It's part of the
Speaker 1: Department of Defense overall. It's meant to gather intelligence, both
Speaker 1: foreign and domestic, largely through signal processing or intercepting electronic
Speaker 1: means and radio means of communication. But you might wonder
Speaker 1: what the heck is the difference between the n s
Speaker 1: A and the other intelligence agencies, because we talk a
Speaker 1: lot about different intelligence agencies and it's pretty easy to
Speaker 1: get them all confused. So you've got the c i
Speaker 1: A or the Central Intelligence Agency. That agency focuses on
Speaker 1: foreign intelligence, and it's mostly concerned with the kind of
Speaker 1: spy stuff we associate with the movies, though in reality
Speaker 1: it's rarely anywhere near as glamorous or as easy to follow.
Speaker 1: Things get a lot more messy and a lot less
Speaker 1: um flashy in real life. But this is the agency
Speaker 1: that oversees covert ops and counterintelligence efforts in other countries
Speaker 1: and passes information along to the executive branch of the government.
Speaker 1: For those of you not in the United States, the
Speaker 1: executive branch would include the president and the presidential staff.
Speaker 1: The FBI, or the Federal Bureau of Investigations, fills a
Speaker 1: similar role, but for domestic concerns, so stuff that happens
Speaker 1: inside the United States and usually involving US citizens. It's
Speaker 1: also the lead law enforcement agency and focuses a lot
Speaker 1: on counter terrorism and just investigations in general. So this
Speaker 1: is the agency that was famously profiled in the X Files,
Speaker 1: although obviously that was a real work of fiction anyway,
Speaker 1: the n s A is mostly concerned with making and
Speaker 1: breaking codes, so it focuses on ways to communicate secretly,
Speaker 1: and they do this in order to keep us interest
Speaker 1: safe and also how to break all the other codes
Speaker 1: that are out there so that we know what the
Speaker 1: heck is going on. And they do this both for
Speaker 1: foreign communications and domestic communications, which leads critics to point
Speaker 1: at the n s A and say they're spying on you,
Speaker 1: and the n s A might say, sure, we have
Speaker 1: all your data, but we don't look at it unless
Speaker 1: you have given us a reason to look at it.
Speaker 1: Fun times. We'll touch on that a little more a
Speaker 1: bit later. There's also one other agency, in the intelligence community.
Speaker 1: I feel that I should mention which is the Defense
Speaker 1: Intelligence Agency or d i A. You don't tend to
Speaker 1: hear about this a lot in the United States, especially
Speaker 1: if you're just you know, a citizen, a civilian. This
Speaker 1: is part of the Department of Defense, just like the
Speaker 1: n s A is, and this agency focuses specifically on
Speaker 1: military intelligence and combat support. So, uh, that's why you
Speaker 1: don't tend to hear it in your day to day
Speaker 1: life as a civilian. It's really a military application. Until recently,
Speaker 1: the general public in the United States had not heard
Speaker 1: a whole lot about the n s A, with a
Speaker 1: couple of famous exceptions, and this was something the agency
Speaker 1: itself took advantage of. The CIA and FBI are far
Speaker 1: more prominent in the American psyche, there typically romanticized in
Speaker 1: popular culture as the stuff of spies and crime investigations. Now,
Speaker 1: when the n s A was first formed in the
Speaker 1: nineteen fifties, it was effectively a secret organization that was
Speaker 1: not publicly disclosed. In fact, there was a little bit
Speaker 1: of a joke that n s A stood for no
Speaker 1: such agency. However, the nature of communications and the widespread
Speaker 1: use of cipher in cryptography, and the growing ranks of
Speaker 1: an SSAY employees meant that by the late nineteen sixties,
Speaker 1: it was pretty much impossible to maintain that the n
Speaker 1: s A was non existent or even trying to keep
Speaker 1: it a shadow organization. It became clear at that point
Speaker 1: that there was such an agency, although a lot of
Speaker 1: people still didn't really understand what it was doing, so
Speaker 1: the n s A activities weren't widely communicated or understood
Speaker 1: among the general public. There were a few spikes and awareness,
Speaker 1: as I alluded to earlier in the mid nineteen seventies,
Speaker 1: in the aftermath of the Watergate scandal, there was a
Speaker 1: major one. There was a Senate investigation that revealed that
Speaker 1: the n s A had been intercepting telegrams leaving or
Speaker 1: entering the United States, including correspondence between American citizens, and
Speaker 1: it was a program called Project Shamrock. Another shocking revelation
Speaker 1: was that the n s A had been monitoring communications
Speaker 1: between civil rights leaders during the nineteen sixties, including Martin
Speaker 1: Luther King Jr. And a couple of U. S senators
Speaker 1: as well. There were records that the agency was also
Speaker 1: keeping tabs on people who objected to the United States
Speaker 1: being involved in the Vietnam War, and all of this
Speaker 1: led to Congress establishing a new set of guidelines that
Speaker 1: the n s A would have to follow, and it
Speaker 1: was meant to restrict how and when they could collect information.
Speaker 1: It was called the Foreign Intelligence Surveillance Act or FISA
Speaker 1: f i s A. To get permission to spy on
Speaker 1: American citizens, the n s A would first have to
Speaker 1: get permission from a special court established just for that purpose.
Speaker 1: It was called a surveillance court or an intelligence court.
Speaker 1: This wasn't quite the same thing as securing a warrant
Speaker 1: through a normal court, but it was a check on
Speaker 1: the NSA's power. They couldn't just wantonly start listening in
Speaker 1: on people and and have it be legal. So things
Speaker 1: pretty much went that way for the next couple of
Speaker 1: decades until September eleven two one. That's when we had
Speaker 1: the terrorist attacks here in the United States that were
Speaker 1: so devastating, and in the wake of that, the President
Speaker 1: of the United States at that time, George W. Bush,
Speaker 1: expanded the n s a s powers and authorized the
Speaker 1: agency to monitor communications, including phone calls and emails, of
Speaker 1: American citizens without having to secure a warrant. From this
Speaker 1: surveillance court first, the idea being that this would speed
Speaker 1: things up and potentially prevent further catastrophe. But the flip
Speaker 1: side of that was there was no oversight. There there
Speaker 1: were no checks on this power. The New York Times
Speaker 1: broke a story about this warrantless wire tapping program in
Speaker 1: two thousand five, and then a couple of years later,
Speaker 1: under tremendous political pressure, President Bush ended the practice. But
Speaker 1: then we get to when a former contractor with the
Speaker 1: n essay someone who had worked with the c i
Speaker 1: A before that, a guy named Edward Snowden, dumped an
Speaker 1: enormous amount of information on the world, revealing that the
Speaker 1: n s A had been gathering data about telephone calls
Speaker 1: and Internet communication between millions of Americans in widespread operations.
Speaker 1: The n s A attempted to mitigate the impact of
Speaker 1: this revelation, uh in part by saying that while it
Speaker 1: was in fact gathering all this information, no one was,
Speaker 1: you know, actually looking at the information unless they needed to,
Speaker 1: in which case they totally said they were securing permission
Speaker 1: first from a top secret court that couldn't publish its decisions.
Speaker 1: This might sound like a get off of jail free
Speaker 1: card to you, and a lot of people criticized this approach,
Speaker 1: the idea that the n s A could go to
Speaker 1: a secret court and get approval without having to reveal
Speaker 1: any of this to anybody, and then do a search
Speaker 1: on all this data that likely would include stuff about
Speaker 1: you in it, and anything they turned up they could
Speaker 1: potentially focus on and and use in some way further
Speaker 1: down the road. That was pretty disturbing. So they were
Speaker 1: think the information like crazy, but they said, we aren't
Speaker 1: going to search it or look for anything specific unless
Speaker 1: we already have approval. This still was not really comforting
Speaker 1: to a lot of people. It wasn't something that many
Speaker 1: people found justifiable. There were a lot of complaints and
Speaker 1: criticisms um and it also it involved an increase in
Speaker 1: resentment toward companies like Google, Facebook, Microsoft, companies that were
Speaker 1: at least in appearance, cooperating with the n s A. However,
Speaker 1: I covered a lot of this back in when the
Speaker 1: news first broke, So rather than go over all that again,
Speaker 1: we'll just move on. And this was the super fast
Speaker 1: overview of n s A. Obviously, there's tons of stuff
Speaker 1: we could talk about. You could do a full mini
Speaker 1: series about the n s a no problem. And if
Speaker 1: I were to do that, I would have to bring
Speaker 1: Ben Bolan on because if you want to talk about
Speaker 1: people who know stuff that they don't want anyone else
Speaker 1: to know, they know, he's the guy to go to.
Speaker 1: Right now, let's take a quick break and when we
Speaker 1: come back, we'll cover the story that inspired this particular episode.
Speaker 1: But first a word from our sponsor. On January nineteen,
Speaker 1: as I said earlier, Reuters published a special report. The
Speaker 1: title of that special report is Inside the U a
Speaker 1: e S Secret hacking team of US mercenaries. It is
Speaker 1: an amazing read. I highly recommend you seek it out. Now.
Speaker 1: I'm going to cover the basics of that piece in
Speaker 1: this episode, but I wanted to give special mention to
Speaker 1: journalists Christopher Byng and Joel Schekman who wrote the piece.
Speaker 1: Most of the article focuses on Lori Stroud, who is
Speaker 1: an x n s A employee through who later on
Speaker 1: worked with the n s A through a security contractor
Speaker 1: as well, who then landed a position with a United
Speaker 1: Arab Emirates top secret program Project Raven. Stroud has the
Speaker 1: distinction of being involved in that massively publicized n s
Speaker 1: A league from as well so Nut's backtrack a bit.
Speaker 1: Stroud started as a direct employee of the n s
Speaker 1: A back in two thousand three. Then in two thousand
Speaker 1: nine she officially left as being an n s A
Speaker 1: employee and came back to work for the n s
Speaker 1: A as a contractor of a part of a team
Speaker 1: of cybersecurity and intrusion experts or you could call them
Speaker 1: hackers if you like, who worked as a consultant to
Speaker 1: the n s A. H The consulting company she was
Speaker 1: working with was called Booze. Alan Hamilton's still is called Booze.
Speaker 1: Allen Hamilton's still exists. So she was still working for
Speaker 1: the n s A, but as a contractor rather than
Speaker 1: as a full time employee. She could actually make a
Speaker 1: lot more money doing essentially the same work as she
Speaker 1: had been doing before. And it was Stroud who actually
Speaker 1: recommended that Edwards Snowden be brought on her team at
Speaker 1: the n s A. And I've already explained how that
Speaker 1: turned out anyway, after Snowden shocked the world by leaking
Speaker 1: all the information on what the n s A had
Speaker 1: been up to and then fled the United States, understandably,
Speaker 1: Stroud's team from Booze Allen Hamilton's was pretty much persona
Speaker 1: non grata at the n s A. No one was
Speaker 1: really keen to work with them. They they ended up
Speaker 1: bearing a lot of the responsibility because they had recommended
Speaker 1: Snowdon to be put on the n s A team
Speaker 1: in the first place, So that doesn't reflect well when
Speaker 1: your recommendation turns around and purposefully dumps a ton of
Speaker 1: top secret information. Stroud received an offer from another former
Speaker 1: NSA agent named Mark Buyer to work through a different
Speaker 1: security consulting firm, this one called cyber Point, and Stroud
Speaker 1: would be able to work on a prestigious cyber security
Speaker 1: project overseas in Abu Dhabi, and she took the offer.
Speaker 1: He said it was very attractive, so she leaves Booze
Speaker 1: Allen and joins CyberPoint. Stroud is then sent to Abu Dhabi,
Speaker 1: and upon arriving, she was initially told her job was
Speaker 1: going to be in counter terrorism, so essentially she would
Speaker 1: work with other experts to detect intrusion attempts on the
Speaker 1: ua ES government servers, so if anyone was trying to
Speaker 1: hack in, she was supposed to be part of the
Speaker 1: team detecting that sort of stuff. Determining who was doing
Speaker 1: it and blocking them. She would also be in charge
Speaker 1: of patching vulnerabilities. This was just meant to be a
Speaker 1: defensive project. And she also found out her office was
Speaker 1: going to be in a converted mansion in Abu Dhabi.
Speaker 1: The facility is called the Villa, and it all seemed
Speaker 1: too good to be true, and upon arrival she was
Speaker 1: brought into two different briefings back to back. The first briefing,
Speaker 1: which according to Reuters, has been referred to as the
Speaker 1: Purple briefing, was pretty much the story I just told
Speaker 1: you that Stroud was told before she came on board
Speaker 1: that she would be working to protect the ua ES
Speaker 1: computer and communications infrastructure. Upon the conclusion of that briefing, however,
Speaker 1: she was told that whole story was just a cover story,
Speaker 1: that that wasn't really what she would be doing. And
Speaker 1: then she was told what her real purpose was and
Speaker 1: she was received the second briefing, which was dubbed the
Speaker 1: Black briefing. Now, this is a top secret project that
Speaker 1: was meant to be denied by anyone working in the
Speaker 1: u A government as even existing. The team at Reuters, however,
Speaker 1: actually got hold of a copy of the materials used
Speaker 1: in the black briefing. Those materials concerned the U a
Speaker 1: e S National Electronic Security Authority, or in e s
Speaker 1: A NISSA. It's essentially the U a e S version
Speaker 1: of the n s A here in the United States.
Speaker 1: So according to Reuters, the information in this briefing outline
Speaker 1: the true purpose of Project Raven and that it was
Speaker 1: meant to be quote offensive operational division of NISSA end quote.
Speaker 1: So that means instead of trying to detect intrusions and
Speaker 1: plug security vulnerabilities, Strold would actually be working with a
Speaker 1: team dedicated to spying on other people too, gathering data
Speaker 1: on them, to intercepting communications and deciphering those communications. But
Speaker 1: that's pretty much what she was doing at the n
Speaker 1: s A, so it wasn't like this was a huge
Speaker 1: change in what she had been doing leading up to
Speaker 1: this point. In fact, that was the whole reason why
Speaker 1: she was hired. NISSA would supply the team of Project
Speaker 1: Raven with a list of people that it said were
Speaker 1: enemies of the UAE government. Then the Project Raven team
Speaker 1: was tasked to gather as much information on those people
Speaker 1: as they possibly could. They would track their movements using
Speaker 1: location data. They would build out what amounted to be
Speaker 1: dossiers on each of those people, electronic dossiers and just
Speaker 1: amount huge amounts of information that could potentially be used
Speaker 1: by other parts of the UAE government. And let's talk
Speaker 1: about that for a second. The government of the United
Speaker 1: Arab Emirates is a little complicated if you're looking at
Speaker 1: it from the perspective of an American like me, you know,
Speaker 1: compared to the American system of government. Now, for those
Speaker 1: who aren't that familiar, the name of the nation implies this.
Speaker 1: The UAE is not just a single unified people. It's
Speaker 1: actually a collection of seven monarchies or emirates kingdoms. Two
Speaker 1: of those are ruled by the same royal family and
Speaker 1: the others are ruled by different families. So you end
Speaker 1: up even though you have seven emirates, you have six
Speaker 1: ruling families. So the six rulers, the six heads of
Speaker 1: those ruling families are collectively the Federal Supreme Council of
Speaker 1: the u a E. In addition to that Council, there
Speaker 1: is a Council of Ministers that's led by the Prime Minister.
Speaker 1: More on that in a second. And there's also a
Speaker 1: group of leaders called the Federal National Council. Uh. Some
Speaker 1: of the members of this council, they're about forty people
Speaker 1: in it total. Some of them are appointed and some
Speaker 1: of them are elected. Uh. And then there's the Federal
Speaker 1: Supreme Court, which is very similar to the Supreme Court
Speaker 1: in the United States, at least in theory. The Federal
Speaker 1: Supreme Council, that group of leaders technically elects a president
Speaker 1: and a vice president to oversee the entire United Arab Emirates.
Speaker 1: Practically speaking, however, the president is the head of the
Speaker 1: ruling family of Abu Dhabi called Al nah Jan. The
Speaker 1: vice president and the prime minister. The same person is
Speaker 1: the head of the ruling family of Al Maktoum, that
Speaker 1: as the royal family that oversees Dubai. Now, there are
Speaker 1: no political parties in the u A. In fact, they're
Speaker 1: illegal in the u A, and ultimately everyone in the
Speaker 1: government is there on the pledge sure of the ruling families.
Speaker 1: There's not really a democratic process here. The elected members,
Speaker 1: you know, I mentioned that though, that that forty member
Speaker 1: Federal National Council, some of them are elected. Those elected
Speaker 1: members are only advisors. The only people who have any
Speaker 1: legislative authority are appointed. So again, all power ultimately comes
Speaker 1: from these ruling families. The government of the u a
Speaker 1: E has drawn criticism regarding how it operates, and the
Speaker 1: UAE government is eager to get more information on those
Speaker 1: who do criticize the government. They are not particularly well
Speaker 1: looked upon by the u a E. Before a Project Raven,
Speaker 1: the u a E largely relied on primitive means to
Speaker 1: spy on these identified enemies to get electronic data on them.
Speaker 1: So typically in the old days, NISSA that that a
Speaker 1: agency would send an operative to get physical access to
Speaker 1: a targets computer or mobile device and install monitoring software
Speaker 1: on it. So you actually have to get to that
Speaker 1: person's computer and then install some malware. That's actually a
Speaker 1: pretty tricky challenge, even if the target happens to live
Speaker 1: within the borders of your country. But some of u
Speaker 1: a es identified enemies are foreigners who live abroad, so
Speaker 1: getting physical access to their machines wasn't always practical or
Speaker 1: in some cases wasn't even possible, and that's where we
Speaker 1: get to Project Raven. The u a E wanted people
Speaker 1: who had experience designing malware that could monitor communications and
Speaker 1: then send reports back to h Q on an ongoing basis,
Speaker 1: so the government formed Project Raven in two thousand nine. Initially,
Speaker 1: the plan was just to hire on American experts to
Speaker 1: design and lead the program for between five to ten years,
Speaker 1: and the goal would be to pass on that that
Speaker 1: knowledge and skill set to to mentor Imarati intelligence officers
Speaker 1: so that they could then take over the program from
Speaker 1: that point and run it themselves. So then they would
Speaker 1: phase out the American operatives from Project Raven, and the
Speaker 1: u a E. Wanted people who understood how to infiltrate
Speaker 1: a machine remotely, which, as it turns out, often depends
Speaker 1: largely upon social engineering. Now, I've talked about social engineering
Speaker 1: several times on this show, but just to remind you
Speaker 1: what it's all about. It's a term for a broad
Speaker 1: range of strategies that are all meant to manipulate a
Speaker 1: person using social interactions, rather than trying to brute force
Speaker 1: your way into a computer system. It's much much easier
Speaker 1: to trick someone into voluntarily sharing their login information with
Speaker 1: you than it is to brute force your way into
Speaker 1: the typically secure system. So, for example, you might pose
Speaker 1: as an I T professional who has been higher on
Speaker 1: to install updates to a computer and say, I need
Speaker 1: to install this update, give me your log in so
Speaker 1: I can put it on there and then I'll be
Speaker 1: off your way. But in reality, what you're doing is
Speaker 1: installing malware to spy on a person's every move. In
Speaker 1: the case with Project Raven, one of the stories they
Speaker 1: told was some operatives who posed as human rights activists
Speaker 1: who were sympathetic to the missions of other activists target
Speaker 1: activists people the u a A had identified as being
Speaker 1: enemies of the state, and it was all in an
Speaker 1: effort to win over their confidence and trick them into
Speaker 1: installing malware, and it worked. We've seen this sort of
Speaker 1: stuff work lots of times and lots of different applications.
Speaker 1: Project Raven received directives to focus on people who were
Speaker 1: known to speak out against the UAE government. Project Raven
Speaker 1: would monitor social media and gather data about people who
Speaker 1: had said critical things about the UAE and the monarchies.
Speaker 1: Stroud relayed that it wasn't her team that ever made
Speaker 1: a decision and to go after anyone or to take
Speaker 1: action against someone. They were just there to dig up
Speaker 1: dirt and occasionally trick people into installing malware. Now that
Speaker 1: sounds a little bit like a justification to me something
Speaker 1: that someone might cling to in order not to get
Speaker 1: too wrapped up and how involved you are in the
Speaker 1: overall big picture stuff. But it also was away for
Speaker 1: the u a E to separate the operatives in Project
Speaker 1: Raven from any actions so that the Raven activities wouldn't
Speaker 1: stand out too much. There was a plausible deniability element there.
Speaker 1: The u a E likely didn't want to draw any
Speaker 1: attention to these operatives from especially not from the international community,
Speaker 1: and probably not from the n s A in particular,
Speaker 1: because anything that would target, say an American citizen, would
Speaker 1: immediately jump up on the n s AS red flag
Speaker 1: list of this is unacceptable. You can't use American operatives
Speaker 1: to help spy on Americans. Defensive measures are one thing,
Speaker 1: but actively spying on people as another. Another interesting point
Speaker 1: in the report is how Stroud seemed able to deal
Speaker 1: with the realities of her work as long as it
Speaker 1: didn't involve targeting American citizens. Monitoring the activities of a
Speaker 1: British journalist, for example, seemed like fair game, but when
Speaker 1: it came to doing the same to American citizens, she
Speaker 1: felt that was a betrayal. And I find this particularly
Speaker 1: interesting that somehow a person's citizenship makes an action against
Speaker 1: them either acceptable or not acceptable. That as long as
Speaker 1: it's not against the people from my own country, this
Speaker 1: is okay. But once it is people from my own country,
Speaker 1: it's not okay. Never mind if the other countries are
Speaker 1: allied with the home country or not. In two thousand fifteen,
Speaker 1: the UAE told Project Raven employees that if they wanted
Speaker 1: to continue on with the program, they would need to
Speaker 1: join a UAE cyber defense company called Dark Matter. So
Speaker 1: this was the u A saying we're handing over control
Speaker 1: of Project Raven to a different consulting firm. This consulting
Speaker 1: firm is Dark Matter, and if you want to stay on,
Speaker 1: you need to sign on with them. Over the next
Speaker 1: couple of years, the American team members were digitally sequestered
Speaker 1: from some of the Project Raven operations, and by that
Speaker 1: what I mean is they were not given full access
Speaker 1: to all of the information that Project Raven was gathering.
Speaker 1: The Americans made up a good percentage of the operatives
Speaker 1: in Project Raven who were intercepting communications and gathering data,
Speaker 1: but they weren't the only ones. There were a lot
Speaker 1: of citizens of the Emirates who were there too. Who
Speaker 1: were also working on this, and there were some information,
Speaker 1: some files that the American team was specifically told don't
Speaker 1: look at this stuff, this isn't for you. There were
Speaker 1: these Immaradi only collections of data, which led to concern
Speaker 1: among the American team that maybe some of the targets
Speaker 1: of Project Raven could be the Americans, which would put
Speaker 1: them in a pretty tight spot. And as it turns out,
Speaker 1: they were right to be worried. I'll explain more in
Speaker 1: a second, but let's take another quick break to thank
Speaker 1: our sponsor. As it turns out, Stroud's work earned her
Speaker 1: a promotion to lead analysts, and while doing her job,
Speaker 1: she started noticing some troubling trends. She found files dedicated
Speaker 1: to American targets, including several journalists. She brought that to
Speaker 1: the attention of her superiors. Because the American operatives had
Speaker 1: been reassured that the program would not target American citizens,
Speaker 1: she was reprimanded because she looked into these areas that
Speaker 1: the Americans were told don't look here, and she had
Speaker 1: looked there. She her her job as lead analysts gave
Speaker 1: her the access um and but she didn't technically have
Speaker 1: permission to look at that Her manager, who had convinced
Speaker 1: her to take the job in the first place, had
Speaker 1: said that any targeting of Americans was only to be
Speaker 1: handled by non American staff on Project Raven, but that
Speaker 1: hardly seems comforting. Stroud was initially put on leave after
Speaker 1: she brought this stuff to the attention of her superiors,
Speaker 1: and her passport was confiscated, which had to have been terrifying.
Speaker 1: She was stuck in the U a e. For about
Speaker 1: a couple of months before the government allowed her to leave,
Speaker 1: and upon her return to the United States, she quickly
Speaker 1: sought out the FBI to tell them about what was
Speaker 1: going on, and then, presumably at some point around that
Speaker 1: same time, approached the journalists from Reuters to start sharing
Speaker 1: her story with them. And this is where we start
Speaker 1: to get into a very tough series of questions. And
Speaker 1: I'm not I'm not being flippant about this. I really
Speaker 1: do think these are difficult questions to answer. The very
Speaker 1: nature of intelligence and counter intelligence is fraught with ethical issues.
Speaker 1: So on the one hand, they're definitely governments or organizations
Speaker 1: and people out there who, through their goals and methods,
Speaker 1: may cause harm to entire populations and even entire countries
Speaker 1: and knowing what they're up to is absolutely key in
Speaker 1: making sure that harm doesn't actually happen to prevent it
Speaker 1: from happening. On the other hand, it's very easy to
Speaker 1: get sloppy with this, to over extend this capability and
Speaker 1: to loop in people who are just living their lives
Speaker 1: or you know, here in America, we at least in theory,
Speaker 1: have have a dedication to freedom of the press and
Speaker 1: freedom of speech. So people who speak up for causes
Speaker 1: they believe in, if they're not inciting people to violence
Speaker 1: or are advocating for destruction of any sort, if they're
Speaker 1: advocating for change, like human rights activists are. In the
Speaker 1: American perspective, that's totally within their rights and that should
Speaker 1: be supported. But that's not the way it is all
Speaker 1: over the world. Laurie Stroud's line, the line she drew
Speaker 1: where she said everything before this is pretty much okay.
Speaker 1: That line stopped at targeting American citizens. Now someone else
Speaker 1: might have a different line. They might extend their boundaries
Speaker 1: to include people from other nations. Uh, but you know,
Speaker 1: not for terrorists, but maybe for people who are human
Speaker 1: rights activists or are criticizing a government but not calling
Speaker 1: for an overthrow or revolution or something. Those people might say, well, no,
Speaker 1: I'm gonna I'm gonna include those in my line to
Speaker 1: not just people from my own country, but people who
Speaker 1: aren't doing any active harm but are advocating for change.
Speaker 1: A third type of person might say, Nope, everyone's fair game.
Speaker 1: I was paid to do a job and I'm just
Speaker 1: gonna do my job. And that leads to another series
Speaker 1: of questions. There's this idea of taking on this sort
Speaker 1: of work on a contract basis for governments other than
Speaker 1: your own home country. Is that ethical? If you were
Speaker 1: to renounce your citizenship and you became the citizen as
Speaker 1: inn of another country, I think you could easily argue
Speaker 1: that you no longer hold any allegiance to your former homeland,
Speaker 1: and now your new home is what you will. You
Speaker 1: have allied yourself too, But assuming you remain a citizen
Speaker 1: of Country A, would it then be okay to join
Speaker 1: an intelligence agency and country B. Even if countries A
Speaker 1: and B are allies, that still seems a little questionable,
Speaker 1: particularly if, as your role as an intelligence officer in
Speaker 1: country BE occasionally requires you to spy on people in
Speaker 1: Country A. Project Raven was originally intended to be a
Speaker 1: program in which the experts from America would share those
Speaker 1: knowledge and all those skills with Amiradi intelligence agencies. But
Speaker 1: even that little bit of a gray area what would
Speaker 1: be problematic in some cases. I mean, if they were
Speaker 1: to share any any sort of practices that were considered
Speaker 1: top C secret and therefore not practices the n s
Speaker 1: A would be terribly keen on other countries getting hold of.
Speaker 1: That's a problem all in itself. The fact that Reuters
Speaker 1: used the word mercenary in the headline for their peace
Speaker 1: that has a lot of implications. Mercenaries hold no allegiance
Speaker 1: to any particular authority. They go where the money is,
Speaker 1: so a mercenary might work for one side in a
Speaker 1: conflict and then switch sides to the opposition with no
Speaker 1: thought about it other than the money's right. Related to
Speaker 1: the story is the revelation that the UAE apparently took
Speaker 1: advantage of a security vulnerability in iPhones that used to exist.
Speaker 1: It has since been patched, So according to c net,
Speaker 1: the UAE government purchased this app from some unnamed outside country.
Speaker 1: So someone else developed it, and then the u A
Speaker 1: government bought it, and the original programmers created a tool
Speaker 1: called car the mom that exploited the vulnerability in the
Speaker 1: iPhone by sending a message through the native I message
Speaker 1: app on iPhones. So, according to reports, all you had
Speaker 1: to do was send one of these messages through the
Speaker 1: I Message app to the target iPhone and that would
Speaker 1: be enough to compromise the target iPhone. From then on,
Speaker 1: Karma would gather data including messages, email, location information, and
Speaker 1: photos from the iPhone and automatically send it back to
Speaker 1: the spies. This operation happened from seventeen. It did come
Speaker 1: to an end, but that's because Apple issued a security
Speaker 1: patch that fixed some of those vulnerabilities in sen and
Speaker 1: it limited the usefulness of Karma. While Apple had already
Speaker 1: fixed this problem, and it's possible that Apple did this
Speaker 1: withhout even knowing that Karma existed. The news that it
Speaker 1: was in widespread use in the UAE was another blow
Speaker 1: against the company, which is also reeling from the revelation
Speaker 1: that a security flaw in the FaceTime video calling app
Speaker 1: on iPhones can allow someone to listen in on a
Speaker 1: person's iPhone just by making a video call, even if
Speaker 1: the other person didn't accept the incoming call. So let's
Speaker 1: say you use FaceTime to call somebody they haven't taken
Speaker 1: the call, it would activate the microphone, so you could
Speaker 1: listen in on the target iPhone microphone, which is pretty
Speaker 1: scary stuff. I'm gonna do a full episode about that
Speaker 1: in the future. I have a guest I want to
Speaker 1: bring on to have a discussion about this. In the
Speaker 1: wake of this Reuter's report, the Committee to Protect Journalists,
Speaker 1: which is a nonprofit headquartered in America and it promotes
Speaker 1: freedom of the press around the world, issued a statement
Speaker 1: criticizing Project Raven and the targeting of journalists in particular.
Speaker 1: A coordinator at the organization said, quote, what we've learned
Speaker 1: about Project Raven raises significant concerns over the links to
Speaker 1: which the UAE will go in targeting journalists, and the
Speaker 1: involvement of former US intelligent officials is also disturbing. Immaradi
Speaker 1: officials must stop targeting the press at home and abroad,
Speaker 1: and the US must make it clear to their allies
Speaker 1: that hacking journalists phones is not a legitimate counter terror strategy.
Speaker 1: End quote. Now, I wish I had an answer to
Speaker 1: how it would be best to conduct intelligence and counterintelligence
Speaker 1: operations because the stakes can be very, very high. They're
Speaker 1: certainly high for the people who are under surveillance, and
Speaker 1: it's potentially high for millions of people depending upon the
Speaker 1: specific situation. My main takeaway from this story is that
Speaker 1: it's important to guard your own security as best you can.
Speaker 1: Is best to practice smart secure behaviors, use stuff like
Speaker 1: VPNs and encryption whenever possible. Don't trust that services that
Speaker 1: depend upon your data for business will be ethical and
Speaker 1: how they handle that data or careful in how they
Speaker 1: handle it, and someone else might get hold of it.
Speaker 1: And remember that even if an agency or organization is
Speaker 1: not actively doing bad things against people, in general, agencies
Speaker 1: and organizations are made up of people, and individual people
Speaker 1: may behave in ways that are outside the perhaps the
Speaker 1: parameters of the respective organizations. I'll give you a specific
Speaker 1: example back in One of the many stories that came
Speaker 1: out in the wake of this data dump about the
Speaker 1: n s A was that there were some n s
Speaker 1: A employees who had been misusing the tools developed for
Speaker 1: the widespread wire tapping project for their own personal benefit.
Speaker 1: So n s A was saying, yes, we're gathering all
Speaker 1: this data, but we're not looking at it. We're only
Speaker 1: interested in specific information at any given time, and when
Speaker 1: we are, we go through the proper procedures to make
Speaker 1: sure all the teas acrossed, all the eyes are dotted,
Speaker 1: and then we will conduct our investigation. So sure we've
Speaker 1: got the evidence already, but we won't get it until
Speaker 1: we've got the proper authority to do so. But that
Speaker 1: did not stop some members of the n s A
Speaker 1: staff from using those very same tools to spy on
Speaker 1: specific people they knew personally, like ex lovers or a spouse.
Speaker 1: So while the agency could have been as good as
Speaker 1: its word and said, yes, we aren't doing anything unethical
Speaker 1: with this, we're following all the rules that have been
Speaker 1: set down. Nothing outside of that as being done. Even
Speaker 1: if they're telling the truth about that people in the agency,
Speaker 1: we're overstepping their bounds and abusing this tool because they
Speaker 1: were people and because the tool let them do that.
Speaker 1: So even if you trust in governments, let's say that
Speaker 1: you know you, you're like I, I believe ultimately that
Speaker 1: the people in the government are good people. I'm going
Speaker 1: to trust them. Remember, not everyone working in those governments
Speaker 1: happens to be trustworthy, and they may take advantage of
Speaker 1: tools even if the overall government is on the up
Speaker 1: and up about it, so be careful out there. I
Speaker 1: wanted to cover this because it reminds us of how
Speaker 1: important information is, how it can be used as a
Speaker 1: weapon against us, even if we haven't done anything wrong,
Speaker 1: and that we should keep that in mind and not
Speaker 1: be too cavalier about how we, you know, store data,
Speaker 1: how we access data, the kinds of technologies we use,
Speaker 1: the kind of services we use. It's good to keep
Speaker 1: this in mind because you never know when it's going
Speaker 1: to come back to hunt you in some way, even
Speaker 1: if again, you haven't done anything wrong. You don't have
Speaker 1: to have done anything wrong for you to end up
Speaker 1: on a list somewhere. It's possible this podcast has put
Speaker 1: me on a list somewhere. It's possible this podcast has
Speaker 1: put me on multiple lists. But the only list I
Speaker 1: really care about is that wonderful list that lives in
Speaker 1: your heart. Favorite Podcasts hosted by Jonathan Strickland. I hope
Speaker 1: this one's in the top three. That wraps up this
Speaker 1: episode of tech Stuff. If you have any comments or questions,
Speaker 1: maybe you've got a suggestion for a future episode, send
Speaker 1: me an email the addresses Text Stuff at how stuff
Speaker 1: works dot com, drop on by our website that's over
Speaker 1: at tech Stuff podcast dot com. You'll find the archive
Speaker 1: of episodes there, as well as other ways to contact us.
Speaker 1: Don't forget the head over to the merchandise store that's
Speaker 1: t public dot com slash tech stuff. Every purchase you
Speaker 1: make goes to help the show, and we greatly appreciate it.
Speaker 1: And I'll talk to you again on the q T
Speaker 1: really soon for more on this and thousands of other topics.
Speaker 1: Is it how stuff works dot com