Your Source for Leaks Around the World!

Codename GERONTIC: Vodafone-Subsidiary Cable & Wireless Paid Millions to Help GCHQ Spy, Hired Spook, Hacked Competitor

In Archive, GCHQ, NSA Files, Surveillance, Vodafone on November 28, 2014 at 6:04 AM

11/20/2014

Ryan Gallagher/TheIntercept:

They flow deep underneath the Atlantic Ocean and into the United Kingdom below the golden sands of idyllic beaches. But the internet cables that come ashore at the coast of Cornwall, England, are not just used to connect the country with the rest of the world.

According to new reports based on documents from National Security Agency whistleblower Edward Snowden, the cables have become an integral part of the global mass surveillance system operated by the British spy agency Government Communications Headquarters, intimately assisted by a company now owned by Vodafone, the world’s third largest cellphone network provider.

The latest details about the extent of the spying were revealed on Thursday by Britain’s Channel 4 News and German news outlets Süddeutsche ZeitungNDR and WDR, who worked in partnership with Intercept founding editor Laura PoitrasThe Intercept obtained a preview of the revelations in advance of their publication.

According to the reports, British telecommunications firms have helped GCHQ dramatically scale-up the volume of internet data it collects from undersea cables. In the five years leading up to 2012, there was a 7,000-fold increase in the amount of data the agency was sweeping up, with its computers monitoring some 46 billion private communications “events” every day, according to documents cited in the reports. The data swept up from the cables would include content from emails, online messages, browsing sessions, and calls made using internet chat tools.

British telecommunications company Cable & Wireless played a leading role in the secret cable tapping operation, according to the reports, and the collaboration appears to have gone further than simply complying with the law in helping implement the surveillance.

The company provided GCHQ with updates on opportunities it could give the agency to tap into internet traffic, and in February 2009 a GCHQ employee was assigned to work within Cable & Wireless in a “full-time project management” role. The British government paid Cable & Wireless more than £5 million ($9 million) of taxpayers’ money as part of an annual lease for GCHQ to access the cables. The agency described the company a “partner” and designated it the codename Gerontic.

According to the reports, Cable & Wireless also appears to have helped GCHQ obtain data from a rival foreign communications company, India’s Reliance Communications, enabling the spies to sweep up communications sent by millions of internet users worldwide through a Reliance-owned cable that stretches from England across Asia and the Middle East. This so-called “access point” for GCHQ was named Nigella and located near an agency surveillance base in Bude, Cornwall (pictured above). Reliance did not respond to a request for comment.

In July 2012, the multinational phone company Vodafone bought Cable & Wireless for about $1.5 billion. The documents indicate that the Nigella surveillance access point remained active as of April 2013.

11/25/2014

SüddeutscheZeitung:

In August 2013 Süddeutsche Zeitung and NDR first named Vodafone as one of the companies assisting the GCHQ. Reports that Vodafone secretly provided customer data to intelligence agencies damaged the company’s relation to German customers. Few months later Der Spiegel reported that the NSA had spied on Chancellor Angela Merkel, whose cell phone was on a Vodafone contract.

This could be a coincidence. No evidence suggests that Vodafone was involved in the “Merkelphone” scandal. But unlike Facebook, Yahoo, or other companies forced to cooperate with the intelligence services, Vodafone has yet to challenge the GCHQ publicly.

Vodafone has provided no explanation as to why GCHQ discussed “potential new deployment risks identified by GERONTIC” in June 2008. According to the Snowden-documents “GERONTIC” was the GCHQ codename for Cable & Wireless, and after acquisition in 2012 (at least for a while) presumably for Vodafone.

gerontic-1

The documents show regular “Joint Project Team” meetings between june 2008 until at least february 2012 and that a GCHQ employee worked full-time within Cable & Wireless.

gerontic-2

The leaked Snowden documents also contain numerous references to payments from GCHQ to Cable & Wireless in return for access to cables and infrastructure, some of is which listed as active well after Vodafone’s takeover.

In February 2009 some £6 million was paid to Cable & Wireless, now Vodafone, and a 2010 budget references a £20.3 million expense.

gerontic-3

A July 2009 document shows that Cable & Wireless either owned or leased 29 out of 63 cables to which GCHQ had access to via partnerships, providing almost 70% of the total data accessible to GCHQ from the cables.

gerontic-4

One access, codenamed NIGELLA, is particularly interesting. It refers to the Fiber-Optic Link Around the Globe (FLAG) cable network which interconnects at the Skewjack landing station in Cornwall. According to the documents, GCHQ accessed the FLAG cables through GERONTIC as “Landing Partner”, even though FLAG was owned by the Indian company Reliance Globalcom, now called Global Cloud Xchange.

gerontic-5

The documents detail how GCHQ targeted the FLAG cable system and gained access to the non-partner network through a Computer Network Exploitation (CNE) operation. The data feeds into INCENSER, a system defined as “a special source collection system” and a “GERONTIC delivery from the NIGELLA access”. The documents suggest that mainly the Flag Europe Asia (FEA) cable was targeted.

Through NIGELLA, the document suggests, GCHQ could also see so-called performance statistics and obtain “weekly automated pulls of flag router monitoring webpages”. Simply put: since GCHQ did not have a partnership with the owner, it hacked its way in and used Cable & Wireless to send data back to the GCHQ processing centre.

gerontic-6

The latest mention of INCENSER is dated April 25th 2013 – well after Vodafone had acquired Cable & Wireless. Vodafone says it has no indication “that there is network access to the infrastructure of any other company” and that it had no knowledge about the operation.

gerontic-7

In response to these allegations, Vodafone said that an internal investigation found no evidence of unlawful conduct, but the company would not deny it happened.

“What we have in the UK is a system based on warrants, where we receive a lawful instruction from an agency or authority to allow them to have access to communications data on our network. We have to comply with that warrant and we do and there are processes for us to do that which we’re not allowed to talk about because the law constrains us from revealing these things. We don’t go beyond what the law requires” a Vodafone spokesperson told Channel 4.

GCHQ did not return commentary, quoting: “longstanding policy”, but stated that it works “in accordance with a strict legal and policy framework”. Vodafone said that it went through the records and found no evidence that Cable & Wireless had broken German, UK or European Union laws before the takeover.

Vodafone however wrote in the same statement that a “small number” of employees currently “process demands” from intelligence agencies, but that “such demands are processed ‘blind’ with no information whatsoever about the context”.

Related Link: List of GCHQ Undersea Phone/Internet Cable Taps

  1. […] that the NSA intercepts direct Internet traffic flowing on some international cables, and secretly involved in the communication nodes management in the private sector. In the flood of trivial DNS queries […]

    Like

  2. […] = Verizon REMEDY = BT Cable GERONTIC = Vodafone PINNAGE = Global Crossing LITTLE = Level 3 VITREOUS = Viatel STREETCAR = […]

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: