{"id":95494,"date":"2016-10-25T15:58:21","date_gmt":"2016-10-25T14:58:21","guid":{"rendered":"http:\/\/www.turkishnews.com\/content\/?p=95494"},"modified":"2023-07-26T11:03:48","modified_gmt":"2023-07-26T08:03:48","slug":"is-an-american-companys-technology-helping-turkey-spy-on-its-citizens","status":"publish","type":"post","link":"https:\/\/www.turkishnews.com\/en\/content\/2016\/10\/25\/is-an-american-companys-technology-helping-turkey-spy-on-its-citizens\/","title":{"rendered":"Is An American Company’s Technology Helping Turkey Spy On Its Citizens?"},"content":{"rendered":"
\n
<\/div>\n<\/header>\n
<\/div>\n
<\/div>\n
\n
\n
\n
\n
\n
<\/div>\n
\n

Thomas Fox-Brewster , \u00a0<\/span><\/p>\n

Forbes Staff <\/i><\/span><\/p>\n<\/div>\n

I cover crime, privacy and security in digital and physical forms.<\/span><\/p>\n<\/section>\n<\/div>\n<\/div>\n<\/div>\n

<\/div>\n
\n
\n
\n

\"\"<\/p>\n

Turkish President Recep Tayyip Erdogan delivers a speech during 27th Mukhtars (local administrators) meeting at the Presidential Complex in Ankara on September 29, 2016. (Photo credit \u2013 ADEM ALTAN\/AFP\/Getty Images)<\/p>\n<\/div>\n

\u201cI do not wish to spend the rest of my life with the regret of having been a part of Erdo\u011fan\u2019s insanity, so I\u2019m out.\u201d The company-wide email on April 4 from Kriss Andsten, a senior technical engineer for Fremont, California-based Procera Networks, landed with a thud and marked the beginning of an internal revolt that has rattled the telecom technology provider. Andsten went on to explain his grievance: the sale of Procera\u2019s deep packet inspection product for alleged surveillance by a totalitarian regime. \u201cWe are \u2026 heading down the rabbit hole where we\u2019re not using it for good anymore, in the name of chasing the next buck. A recent request from Turkey\u2026 seals the deal for me. The Cliff\u2019s Notes version is that we\u2019re selling a solution for extracting usernames and passwords from unencrypted traffic.\u201d After nine years at the company\u2019s offices in Malmo, Sweden, he resigned.<\/p>\n

The senior decision-making team at Procera considered the request legitimate, one that came from major operator Turk Telekom through a middleman, Ankara-based networking specialists Sekom, and would ostensibly be used to track fraudsters. It formed part of a lucrative $6 million contract for Procera, whose technology helps telecom operators manage internet traffic. Normally innocuous, deep packet inspection can help uncover malware or route data more efficiently.<\/p>\n

But a cadre of angry Swedish engineers who supported Andsten believed they were being asked to turn innocent tech into evil surveillance gear, and hand it to a regime that had become increasingly repressive. \u201cHell broke loose in Malmo,\u201d said one former employee.<\/p>\n

<\/div>\n

According to a half dozen current and former employees, who spoke on the condition of anonymity, leaked Procera documents and internal communications, Turk Telekom requested not just a feed of subscribers\u2019 usernames and passwords for unencrypted websites, but also their IP addresses, what sites they\u2019d visited and when. \u201cErdo\u011fan is insane and people could well die from this work,\u201d one former Procera employee told FORBES. Another said: \u201cThe installation in Turkey is large-scale surveillance of the population with feeds to one or other governmental agency\u2026 \u00a0If the company leadership thinks this is business we should be doing, they should answer for it publicly.\u201d<\/p>\n

Procera declined to discuss specific deals, but a spokesperson provided the following statement by email: \u201cProcera Networks strongly supports core principles of human rights and dignity for people around the world. We provide technology that helps telecom operators run their businesses more efficiently and enhance their customers\u2019 user experience. We do not provide technology for surveillance. We align our business with all applicable laws and globally-recognized standards of operations. Under the new management team established in the last year at Procera, we have continued to strengthen our policies and processes to help ensure that our products are used as intended.\u201d<\/p>\n

\n
Recommended by Forbes<\/span><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n

Founded in 2002, Procera\u2019s headquarters are in Fremont, though large chunks of its development work is done in Canada and Sweden, the latter serving deep packet inspection to Europe and the Middle East. In mid-2015, Francisco Partners, a private equity firm with $10 billion in assets, acquired Procera for $240 million. A new CEO, Lyndon Cantor, was installed at the top to drive Procera through the \u201cnext chapter in its strategic development,\u201d according to a company press release, as the executive team was given a refresh. The changes rankled some of Procera\u2019s left-leaning employees. One former employee told FORBES that the acquisition by Francisco Partners led to greater focus on \u201cregulatory compliance\u2026 mostly bulk surveillance.\u201d Another claimed: \u201cWhen Francisco Partners took control it was business ethics that mattered, not human ethics.\u201d<\/p>\n

In August, already-suspicious engineers grew more concerned. Researchers from the University of Toronto\u2019s Citizen Lab and mobile security firm Lookout raised questions about the ethics of another Francisco Partners portfolio company, NSO Group, a government spyware provider founded by an alum of Israel\u2019s vaunted intelligence agencies. (Francisco Partners bought its stake in the company for $120 million in 2014). Citizen Lab uncovered NSO\u2019s Pegasus malware targeting iPhones of a Mexican journalist and a UAE activist. The same day, FORBES reported that Francisco Partners added Circles to its roster of investments, another Israeli-founded surveillance firm, which sold contentious gear to hack a part of global telecoms networks, known as SS7. That cost the private equity firm $130 million, a source close to the deal told FORBES.<\/p>\n

In a statement, a Francisco Partners spokesperson refuted the criticisms: \u201cHaving invested in over 80 technology companies, we have demonstrated in our role as board members a nearly 20-year history of working with management teams on practicing appropriate corporate social responsibility and adhering to legal and ethical standards. This includes supporting management teams\u2019 commitments to make every effort to ensure their products are used legally, responsibly and ethically by their customers.\u201d<\/p>\n

\u2018Shocking\u2019 surveillance in Turkey<\/strong><\/p>\n

After they learned of\u00a0the username and password feature\u00a0shipping\u00a0through Sekom to Turk Telekom, Procera engineers feared they would in effect be supporting Turkey\u2019s surveillance state, whose actions have come under increased criticism from human rights groups. There have been plenty of disturbing cases: a 14-year-old in prison after criticizing Erdo\u011fan in a Facebook post, a doctor on trial after a meme he produced compared Erdo\u011fan to Lord of the Rings character Gollum. After the failed coup this summer, the assault on dissents has only intensified as Turkey enacted what Reporters Without Borders (RSF) called \u201cdraconian\u201d state of emergency laws. Any individual or organization deemed to have any connection to Fethullah G\u00fclen, a Turkish cleric in exile in the US whom Erdo\u011fan believes masterminded the coup, faces persecution. In July, 15,200 Ministry of Education personnel were suspended and faced investigation, 1,577 university deans were asked to resign, and 2,277 judges and prosecutors were detained, all because of alleged connections to G\u00fclen. Amnesty reported credible sources as claiming some of those detained were subjected to torture and rape. The state of emergency was, this October, extended for a further three months.<\/p>\n

\u201cThese are executive orders that should be under scrutiny, but they are rubber stamped by judges and there\u2019s no practical way to appeal these decisions,\u201d said Andrew Gardner, Amnesty International researcher for Turkey. Gardner was the target of an unsuccessful order to force Twitter to block his account \u2014 Twitter\u2019s most recent transparency report showed Erdo\u011fan\u2019s regime lodged 2,493 requests for content to be removed between January and June this year, more than any other country.<\/p>\n

\n

\"\"<\/p>\n

Turkish police use water cannon against teachers in Diyarbakir on September 9, 2016 during a protest against the suspension of over 10,000 teachers for suspected links to militants. (Photo credit –\u00a0ILYAS AKENGIN\/AFP\/Getty Images)<\/p>\n<\/div>\n

It\u2019s no wonder then that the idea of an American company supplying services that appeared to support Turkish surveillance caused so much concern, not only inside Procera but also among human rights and privacy advocates. \u201cTo have the power for password extraction at the network level is a quite shocking capability for any government to have, let alone Turkey where the respect for fundamental rights has taken a stark downturn recently,\u201d said Matthew Rice, advocacy officer at Privacy International, a not-for-profit organization. \u201cEveryone should be concerned not only that this capability was requested, but that it was provided\u2026 This work was unprecedented for not only Procera, but for the surveillance industry as a whole.\u201d<\/p>\n

\u2018NSA-grade tech\u2019<\/strong><\/p>\n

Two security experts compared the feature Procera sold to a weapon in the National Security Agency (NSA) arsenal. Nicholas Weaver, senior staff researcher focusing on computer security at the International Computer Science Institute in Berkeley, told FORBES Procera\u2019s capabilities were similar to those of a core function of the intelligence agency\u2019s XKEYSCORE software. According to files leaked by NSA whistleblower Edward Snowden, XKEYSCORE kept a constant monitor on internet traffic and siphoned off data of interest, including usernames and passwords. \u201cThat\u2019s XKEYSCORE 101,\u201d Weaver said of the Procera sale.<\/p>\n

Morgan Marquis-Boire, an ex-Google security staffer, Citizen Lab senior researcher\u00a0and the man\u00a0in charge of protecting First Look Media, said he expected nations to buy into NSA-esque tech. \u201cIt\u2019s not surprising to me that Procera has been found adding this capability to their existing solutions given what XKEYSCORE can accomplish,\u201d he told me after reviewing some of the leaked documents from Procera. \u201cIt stands to reason that the intelligence operations of many countries would see this as desirable.\u201d<\/p>\n

Sources\u2019 description of the Procera Turk Telekom project noted the former\u2019s PacketLogic tool would monitor connections and redirect traffic of interest \u2013 e.g. unencrypted logins \u2013 to another product, the Network Application Visibility Library (NAVL). That would probe the data packets further to retrieve usernames and passwords across Turk Telekom, which boasts 18 million mobile and 8.3 million broadband customers. It\u2019s one of the largest telecoms providers in Turkey,\u00a0said to run 80 per cent of the country\u2019s\u00a0fibre optics network and run the biggest ISP in the form of TTNet. Once an entirely state-owned asset, it\u2019s now private, though the Turkish Treasury still holds a 30 per cent stake.<\/p>\n

\n

\"\"<\/p>\n

A pedestrian passes an advertisement for Turk Telekom AS telecommunication services in the Nisantasi district of Istanbul, Turkey. Turk Telekom is one of the biggest operators in Turkey, though is still part-owned by the government. Photographer: Kerem Uzel\/Bloomberg<\/p>\n<\/div>\n

It could be argued the export of such a service would not cause much harm; most social media, email and security-critical sites are run over HTTPS, where connections between a computer or smartphone and a website are encrypted. But according to Google data, of the most-visited 100 non-Google sites on the web, 60 do not run HTTPS by default. Most news sites \u2013 from FORBES, to The New York Times, the BBC and Turkey\u2019s two most-read publications Hurriyet Daily News and the Daily Sabah \u2013 do not use HTTPS. At the same time, password re-use is prevalent. In a LastPass survey of 2,000 adults conducted this year, 61 per cent said they either use the same or similar passwords across websites. Thanks to those security weaknesses, hackers, be they government or criminal, can harvest passwords from unencrypted traffic and attempt to re-use them, or slightly different ones, on any site, and have a high chance of gaining access. Weaver also said that by capturing usernames, the Procera technology could be used to deanonymyze web surfing and more easily track what millions of Turk Telekom customers are doing.<\/p>\n

\u2018A really bad idea\u2019<\/strong><\/p>\n

Procera employees raised such concerns with CEO Cantor throughout the first half of 2016. \u201cCapturing passwords feels like a red line in the sand that we should not cross,\u201d co-founder and CTO Alexander Havang wrote on the company\u2019s internal social network, Confluence, extracts of which were obtained by FORBES. \u201cLawful intercept is not our key competency. If this is a regulatory requirement and not a business requirement from the operator, we should try to help them advocate why this is a really bad idea.\u201d (Havang declined to comment for this article after the executive team asked all staff to refer all press enquiries to the PR department).<\/p>\n

Another employee on the same thread asked: \u201cWhy do we want to extract password? What is the use case? This feels pretty bad.\u201d A Procera EMEA solutions engineer followed up, suggesting there was a fraud detection use case. In response, Andsten added: \u201cThere\u2019s no fraud detection use case that I\u2019m aware of that\u2019d require the password, and the entire use case smells way more like a social graph thing than a fraud thing. Either they make a pretty bad job of requirements or there\u2019s something else going on.\u201d He later added: \u201cEven if we discount the whole business of extracting passwords from the equation, what they are asking for is normally associated with a totally different market. I\u2019m concerned about what the real ask is here and what brand risk exposure we\u2019d be taking on.\u201d The thread ended in late March, with Andsten saying the feature was \u201coutside the scope of product features and requirement tickets.\u201d<\/p>\n

After learning the work with Turk Telekom was going ahead anyway, Andsten quit. His valediction opened a can of worms. \u201cHe essentially exposed the issue to the whole company,\u201d a former colleague said. Two days later, on April 6th, another company-wide email sent from a disposable, anonymous email address went out, signed La Resistance. It called on all who opposed the Turk Telekom deal to protest directly to Francisco Partners. \u201cWe have absolutely no reason to do unethical deals. Procera is a great company that could do good in the world. We used to be all about improving network quality. That\u2019s why we\u2019re here\u2026 Your email absolutely matters. Make it anonymous if you want. If a few voices are heard, it will sound like we have a few vocal people, but if a lot of voices are heard, there must be actions taken.\u201d<\/p>\n

On April 11th, Cantor held an emergency meeting in Malmo to hear employees out and, in light of the brewing discontent, revamp the ethics committee; in internal communications, employees had previously expressed frustration at the lack of transparency from the group, set up in late 2014 after deals to provide deep packet inspection for operators in the Middle East had proven sticky subjects. \u201cI don\u2019t want blood on my code,\u201d complained one engineer. \u201cIs it even possible to do ethical business in the Middle East?\u201d asked another.<\/p>\n

Sources recalled a particularly awkward Malmo moment. \u201cAll the developers proposed to stand up and give applause to [Andsten] because he had taken a stand,\u201d one source said. \u201cWith red ears the management team on stage had to participate in the applause of the person who\u2019d caused all their problems.\u201d<\/p>\n

\n

Procera Networks\u2019 office in Malmo, Sweden, where engineers were upset about its shipments to Turkey.<\/p>\n<\/div>\n

Procera didn\u2019t force unwilling staff to do the work. Current and former employees said the username and password extraction was partly outsourced to Canadian firm Northforge, claiming this was done to avoid exacerbating the relationship between engineers and execs. Procera did not comment on that aspect of the work. Northforge did not respond to requests for comment.<\/p>\n

Since Andsten\u2019s departure, another five engineers have quit, according to sources. The work continues, said current and former employees, who also said Cantor sent out further company-wide emails advising staff not to speak with press.<\/p>\n

Turkey\u2019s surveillance\u00a0regime<\/strong><\/p>\n

Though employees remain concerned about the Turkish government\u2019s access to usernames and passwords of millions of its citizens, Procera wasn\u2019t contracted by the Erdo\u011fan regime or even Turk Telekom. The contract was with Sekom, a systems integrator who worked to install the technology at the operator. (Sekom had not returned requests for comment.) A Turk Telekom spokesperson wrote in an email: \u201cAs Turkey\u2019s leading communication and entertainment technologies company Turk Telekom, we always work to deliver products and services with cutting edge technology to our customers. Towards this goal, we are upgrading and renewing outdated devices in our network infrastructure. During this renewal process, we have recently replaced some equipment in our network with updated versions through an auction. We will continue our offerings related to quota based services and parental control services to our customers with this new equipment.<\/p>\n

\u201cAt Turk Telekom, we are highly sensitive regarding protection and confidentiality of our customers\u2019 personal data and we fully comply with the rules and regulations we work within.\u201d The company declined to comment on the username and password extraction capabilities.<\/p>\n

Like any operator, Turk Telekom is at the mercy of government legislation. One of the more invasive regulations\u00a0\u2013 Law No. 5651\u00a0\u2013 requires each telecom company to log and store user activity for up to two years and submit that data to the government when requested by a court. The Homeland Security Act, passed in 2015, allows the Turkish government to spy on suspects\u2019 telecoms connections for 48 hours without the need to get permission from a judge.<\/p>\n

The Turkish embassy in London, the foreign office and the Prime Minister\u2019s office had not responded to repeated requests for comment on this article.<\/p>\n

Deep packet inspection<\/strong><\/p>\n

And like\u00a0any company working in deep packet inspection (DPI), Procera has had to tread a thin line between providing useful networking technology and dangerous surveillance gear. Procera would never describe itself as a surveillance company, but rather a QOE and QOS (quality of experience and quality of service) vendor for telecom operators.<\/p>\n

But DPI, whilst most often benign, is inherently invasive. \u201cDeep packet inspection enables surveillance at the outset,\u201d noted Citizen Lab\u2019s senior legal advisor Sarah Mckune. Its very purpose is to open up \u201cpackets\u201d of data flying across networks and inspect them to check if they should pass. Just like someone searching a package at the post office to determine if there\u2019s any illegal contraband inside, DPI scans every packet and logs what\u2019s inside, before deciding where to route the data or just trash it. Certain kinds of traffic might be prioritized if they need to be shifted faster, making DPI a core technology in the net neutrality debate. Or DPI can uncover malware and stop it from spreading.<\/p>\n

DPI has made headlines for controversial use cases. China, for instance, likes to use DPI in its infamous censorship and surveillance systems. Sunnyvale, California-based Blue Coat Systems, in which Francisco Partners was a significant investor, saw its DPI technology censoring the internet in Syria in 2011, just as the civil war was erupting. Human rights activists looked on agog, but Blue Coat later said\u00a0resellers were to blame and that it had not given permission for the technology to be shipped to the country. One reseller was later slapped with a maximum fine of $2.8 million by the Bureau of Industry and Security (BIS). (Francisco Partners also has stakes in Barracuda Networks and Dell Software, which both ship DPI products).<\/p>\n

Procera employees remained apprehensive about their paymaster\u2019s other DPI shipments. In particular, a deal signed through systems integrator Giza Systems for Egypt\u2019s National Telecom Regulatory Authority (NTRA), which had asked to use Procera\u2019s ScoreCard service to evaluate the network performance and subscriber experience for different operators, according to a leaked \u201cscope of work\u201d document.<\/p>\n

Legitimate work on the face of it, said one former staffer. But some employees remained perturbed about the potential for abuse of the product, so widely could the technology be deployed. The former staffer said: \u201cIt\u2019s an unusual and quite expensive way to accomplish it by tapping all traffic in the country and indexing it\u2026 when it would be simpler to just require your operators to give you quality metrics.\u201d They noted that the ScoreCard product keeps a searchable database of\u00a0a subscriber ID, what website they visited, and the location ID associated with their IP address. \u201cThat database is searchable for the end customer if they know how.\u201d But a person familiar with the company\u2019s business in the Middle East said that Procera has not sold or deployed any license capability for database access to any operator or regulator\u00a0in Egypt, and that the ScoreCard product does not conduct any type of surveillance.<\/p>\n

Meanwhile, Turkey continues to expand its control over the web. Just this month, more than 150\u00a0police personnel were reportedly arrested for using an encryption tool, ByLock, which the government believed\u00a0G\u00fclenists used to plot the putsch. Cloud services Microsoft OneDrive, Google Drive and Dropbox, as well as code repository Github were also blocked. The blackout was enforced in response to a leak of 50,000 emails of Turkey\u2019s energy minister and Erdogan\u2019s son-in-law Berat Albeyrak by communist hacktivist crew RedHack. Did Turk Telekom and Procera help enforce that blackout?\u00a0Neither had provided comment\u00a0at the time of publication.<\/p>\n

Tips and comments are welcome at TFox-Brewster@forbes.com or tbthomasbrewster@gmail.com for PGP mail. Get me on Twitter @iblametom and tfoxbrewster@jabber.hot-chilli.net for Jabber encrypted chat.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Thomas Fox-Brewster , \u00a0 Forbes Staff I cover crime, privacy and security in digital and physical forms. Turkish President Recep Tayyip Erdogan delivers a speech during 27th Mukhtars (local administrators) meeting at the Presidential Complex in Ankara on September 29, 2016. (Photo credit \u2013 ADEM ALTAN\/AFP\/Getty Images) \u201cI do not wish to spend the rest […]<\/p>\n","protected":false},"author":83,"featured_media":106713,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89],"tags":[1211,9884,1018],"class_list":["post-95494","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-turkey","tag-akp","tag-erdogan-regime-en","tag-recep-tayyip-erdogan"],"_links":{"self":[{"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/posts\/95494","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/users\/83"}],"replies":[{"embeddable":true,"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/comments?post=95494"}],"version-history":[{"count":0,"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/posts\/95494\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/media\/106713"}],"wp:attachment":[{"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/media?parent=95494"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/categories?post=95494"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.turkishnews.com\/en\/content\/wp-json\/wp\/v2\/tags?post=95494"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}