How UK Spies Hacked a European Ally and Got Away with It

Europol as an organisation has no power to act on its own, it relies on the co-operation of the EU member states, and needs permission from the relevant national authorities to conduct investigations and arrest suspects. Regardless of the nationality of its leader, it can't realistically investigate British suspects if the British won't co-operate, and there's no prospect of them doing that here.

Furthermore, all large countries, like Britain, France and Germany, engage in this kind of espionage against "friendly" countries, and none of them want an agency like Europol getting involved, because then they would reduce their co-operation with it, and that would harm the fight against organised crime and terrorism.

Basically, when it comes to a supranational organisation like Europol, real separation of powers is impossible, because there's always a political calculus involved in a collaboration between sovereign countries with occasionally competing interests.

The Belgian public neither knowd nor cares. The press should have made a fuss but didn't. I remember a couple of very short articles about it, which kind of sort of maybe said the British might have potentially but not likely been involved.

Belgium was designed to be a toothless and spineless state by the UK, France & Germany, and it's playing its part wonderfully.

> It still seems illegal under UK law

Under what law?

Why on earth would you do that? Yes, he's the head of the agency that breaks the law in your country, but you've got one of those too. There is 0 chance of extradition actually happening.

> It still seems illegal under UK law

CMA doesn't apply: https://www.legislation.gov.uk/ukpga/1990/18/section/10

The powers of GCHQ are basically unconstrained by the law: "[GCHQ shall] monitor or interfere with electromagnetic, acoustic and other emissions and any equipment producing such emissions and to obtain and provide information derived from or related to such emissions or equipment and from encrypted material [...] in the interests of national security, [...] in the interests of the economic well-being of the United Kingdom [... or] in support of the prevention or detection of serious crime." per http://www.legislation.gov.uk/ukpga/1994/13/crossheading/gch...

> In theory any of these countries could surely just issue an arrest warrant for the head of GCHQ and order their extradition.

The rules are different for states. Arresting a foreign security official for the actions they carried out in their official capacity is an inherently political/diplomatic decision, and not a normal criminal one.

There are some carve-outs for war crimes, but there's a reason those were so difficult to push through even for countries that haven't committed war crimes lately and aren't even liable to get into any wars any time soon - the whole concept goes against a lot of the assumptions of state sovereignty.

"No senior GCHQ officer is going to sign off in a cyber hack of an ally unless they had a really good reason and had covered their own ass."

good reason: much more information

Covering: was very good, only because of Snowden it got linked to the UK

So even though it might be possible, that Belgium was in it on high level (you hack, but we get data conveniently without legal issues), it is also very possible, that they went for it without saying anything.

You can already do something like this with Flatpak on Linux https://en.wikipedia.org/wiki/Flatpak or VMWare Thinapp for Windows https://en.wikipedia.org/wiki/VMware_ThinApp.

Want to try it now? You can try it with Steam, which is otherwise notoriously annoying to install on Linux:

  flatpak install --user --from https://flathub.org/repo/appstream/com.valvesoftware.Steam.flatpakref
  flatpak override com.valvesoftware.Steam --filesystem=$HOME

  # run it with this command:
  flatpak run com.valvesoftware.Steam

Unfortunately, if you're running X11, Steam can still spy on everything you're doing in X11. But Wayland is coming/is here, and fixes that too.

Mandatory access controls were invented to address this exact weakness. Ironically, selinux might be the most mature implementation of it in Linux, if not the rest of the Unix land.

You should take a look at QubesOS : https://www.qubes-os.org. Each application starts in a VM in order to isolate them from each other.

The only issue is that QubesOS rely on paravirtualization (it's a Xen hypervisor underneath) for process isolation.

(By the way Windows is taking the same path with ApplicationGuard)

Big boys told us to do it.

From the article:

« The British spies appear to have targeted Belgacom due to its role as one of Europe’s most important telecommunications hubs. Through a subsidiary company called Belgacom International Carrier Services, it maintains data links across the continent and also processes phone calls and emails passing to and from the Middle East, North Africa, and South America. But tapping into a broad range of global communications is only one possible motive. GCHQ may also have sought access to Belgacom’s networks to snoop on NATO and key European institutions, such as the European Commission, the European Parliament, and the European Council. All of those organizations have large offices and thousands of employees in Belgium. And all were Belgacom customers at the time of the intrusion. »

The main motivation is that Bruxelles is in Belgium. The US / UK / “Five Eyes” security apparatus takes the EU more seriously than most EU members themselves. Among other things, they really don’t want for anything like “an European integrated army” to emerge as an alternative to Nato.

And the second motivation is that they can. The pre-Snowden speculation was that all major European carriers are targets for NSA and friends, and the Snowden files basically reinforced that view. The question is not “why should they spy on their allies”, everyone has always done that; the question is the degree of success that any given player achieves and what they do with the info they gather. In this case, it looks like the operation was a great success, followed by huge failure (it was burnt to the ground).

"After installing malware on the engineers’ computers by luring them to a fake version of the LinkedIn website, GCHQ was able to steal their keys to the secure parts of Belgacom’s networks and begin monitoring the data flowing across them. "

FFS.

Every current PC system can be broken, no matter which operating system it is running. Intelligence agencies use 0-day exploits and test the software they use against known antivirus software and intrusion detection systems.

There are also plenty of companies such as Lench/Gamma who overtly advertise their ability to penetrate any system. You can only buy or lease their software as a state actor, though.

Monitor their communications so you know exactly what software they are using, then drop a 0-day on the forged site (I find it very unlikely that GCHQ don't stockpile Firefox/Chrome escapes and Windows/Linux priv. escalations etc.). There's little an individual can do against such a targeted attack without completely airgapping the machine which A) probably isn't viable for a network/software engineer and B) GCHQ are probably determined enough to gain physical access if they deem it necessary.