You might imagine a hacker as either a computer freak with criminal energy or a thin, young guy wearing a black hoodie. That is of course a stereotype and far from the reality. There are hacker groups that operate individually, hackers related to organised crime and even government hackers.
Government hackers are especially dangerous, because they are highly skilled and are** supported by a country’s government, so they can **do whatever they want, basically. They can also get assistance from internet service providers (ISPs) or software developer that leave backdoors in their programs open.
Famous cases of such hacking are documented in the Snowden leaks, but government hacking even takes place outside of intelligence services. In Germany, there are trojans called “Bundestrojaner” and “Staatstrojaner”, which translates to “Federal Trojan Horse” and “State Trojan Horse” in English. The code names that DigiTask, the developing company gave the Trojans, are 0zapftis / r2d2 StaatsTrojaner. Those malicious programs were developed by the Federal Criminal Police Office (FCBI), or Bundeskriminalamt (BKA) in German. We have briefly mentioned these Trojans in “Surveillance by Governments“, but we now want to go into greater detail with the malware.
The Trojans were officially approved by a court ruling from the Federal Constitutional Court of Germany (BVerfG), in 2008. The tools are intended to be used to fight extremist groups and prevent terrorist attacks. The ruling was made in a time, where computers were not as present as today and the first iPhone was just released. The FBCI did not limit themselves to terrorists. As you might have guessed, that was only a pretext. In reality, they are mainly used for general surveillance and petty crime like asylum application fraud, money counterfeiting and in cases of minor drug possession. The programs are designed to make it very easy for authorities to search your PC for evidence.
That can be done without you noticing and remotely. The first such Trojans were released in 2007 and 2012, for use on PCs, smartphones and PDAs. The authorities tried to infect many PCs through various methods, for example by sending emails with the malicious code. The purpose was installing keyloggers or wire-tapping Skype and VoIP (voice chat). The evidence is then transmitted to FBCI servers in Hesse. The Trojan is also able to execute any program on your machine and update itself (gotta get those juicy government hacker patches! 😈). It uses proxies to hide the identity of the authority that is using it.
All of that was done secretly, but the German Chaos Computer Club discovered the malware and released the disassembled code of the program. From that code, it was obvious that the software was designed poorly. Especially the ability to execute programs that was built into the Trojan, made your entire machine a mess of wide-open security loopholes. The trojan was developed by a company called DigiTask that now offers installation of the software and “Skype-Capture” as surveillance services to German authorities. *Chaos Computer Club report on the Bundestrojaner, download the binaries of the Bundestrojaner (It is the actual Trojan, so do it at your own risk!). *
As of 2014, the capabilities of the software have been greatly expanded and it is now composed of 15 individual programs. That makes it a complete software suite for targeted cyber surveillance. Instead of letting DigiTask program the tool, the new Bundestrojaner has been developed by the FBCI itself, with the support of 4Soft and CSC. CSC’s parent company has worked together closely with the NSA, in the past.
The current version has not been disassembled and analysed yet, which is worrying. The FBCI has launched a task-force together with authorities from neighbouring European countries like the Netherlands to coordinate inner-European use. Additionally, the FBCI is doing its best to hide those activities from the public, since they are operating on the borderline of legality. They do not share anything with the press and only German MPs can get details by filing an official request for information in the parliament. The answers the FBCI gives are very vague and basically do not contain any news, they are just repeating the same meaningless phrases.
You can take for granted that other nations are doing the same or worse. The state malware is likely not going to prevent any crimes. Instead, Federal Trojans are used to keep the population under control. They limit the inviolable right to privacy in the own apartment and the right to be free from unjustified (and unnecessary) infringement by the state. It also does not respect human dignity. All of these rights are guaranteed by the German constitution, but do you really think the FBCI cares about that?
Searching someone’s apartment without them noticing is hard to do, but doing the same digitally with remote access to their computer is easy. All they need to run such an attack is the signature of a judge that justifies the procedure. They are allowed to do so based on §100a and §100b of the German StPO law (Strafprozessordnung). They only need the judge to use the software, preventively installing it is completely legal, they can install it on every machine they want and activate the bug on your desk if needed. It is also possible that they use self-replicating mechanisms to spread the Trojan.
Former German Minister of Justice and Consumer Protection Heiko Maas massively increased the number of ways it can be used. Maas expanded the number of offences for which a federal online search using malware can be performed to 27. Many of them are not even serious crimes.
Supposedly, there is a new malware for Android devices from the German authorities. It was discovered by Kaspersky and is able to record audio, extract WhatsApp messages and connect to networks controlled by the attacker. It is called “Skygofree” and was discovered together with several similar tools for Windows. Kaspersky reported that it is arguably the “most powerful spyware tools that we have ever seen for this platform”. It is not proven that this is a new Federal Trojan Horse, but judging from how advanced the tool is, it is likely. The Kaspersky researchers suspect that it comes from an Italian developer, similar to the developer HackingTeam from Milan, who supplied repressive governments with surveillance software, including Sudan, Bahrain, Venezuela, and Saudi Arabia. Report from Kaspersky, article from golem.de
Other notable state Trojans are DarkComet (CIA / NSA), FinFisher (Lench IT solutions / Gamma International), DaVinci / Galileo RCS (HackingTeam sold this platform to repressive governments), TAO QUANTUM/FOXACID (NSA) Magic Lantern (FBI) and WARRIOR PRIDE (GCHQ in the UK).
On the left, you see a poster from the Russian Ministry of Defence that informs employees about the importance of information security. If you are interested, you can read the article Government hacking on Wikipedia, more state Trojans can be found here.
The government should protect citizens from security issues by reporting them to developers to fix them. Instead, state hackers exploit those loopholes and take advantage of them. Criminal hackers can then also discover the backdoor and run devastating attacks like the WannaCry ransomware attack in 2017. Governments do not defend the people, but attack them. We hope that we could help you understand that it is not a little annoying PC virus you need to protect yourself from, but an army of state hackers backed by government institutions. Their hacking tools are identical to those of organized crime hackers and there is a whole industry devoted to producing hacker utilities for law enforcement. Those tools would be highly illegal in the hands of someone without a uniform.
There is a global development in governments and law enforcement who more and more try to restrict our secure communication. Many states are investigating ways to limit the possibilities that we have. This can happen on the technological side through government hackers, but also through outlawing encryption and private communication.
“When secure communication using encryption or anonymisation techniques become forbidden or are regarded as suspicious by authorities, we do not live in a democracy anymore. When law enforcement and authorities stop basing their actions on the law, we are not far away from a dictatorship anymore”. — InvisibleUser
Government hacking bears enormous risks. The software government hackers develop for their purposes is extremely powerful and professional. These weapons could get into the hands of criminal hackers and cause immense damage in the digital world. All it takes is one corrupt employee in law enforcement who steals the program and sells it on the black market. There are plenty of such people, so it is only a question of time before that happens.
After analysing how “democracies” like Germany attack their own citizens, we would like to tell you one thing: There is hope! Currently, we still have many possibilities to protect ourselves and open-source developers are doing their best to always keep our technology one step ahead of oppressive governments.