reader comments 7
Share this story
GCHQ and the NSA have spied on air passengers using in-flight GSM mobile services for years, newly-published documents originally obtained by Edward Snowden reveal.
Technology from UK company AeroMobile and SitaOnAir is used by dozens of airlines to provide in-flight connectivity, including by British Airways, Virgin Atlantic, Lufthansa, and many Arab and Asian companies. Passengers connect to on-board GSM servers, which then communicate with satellites operated by British firm Inmarsat.
“The use of GSM in-flight analysis can help identify the travel of a target—not to mention the other mobile devices (and potentially individuals) onboard the same plane with them,” says a 2010 NSA newsletter.
A presentation, made available by the Intercept, contains details of GCHQ’s so-called “Thieving Magpie” programme.
GCHQ and the NSA intercepted the signals as they were sent from the satellites to the ground stations that hooked into the terrestrial GSM network.
Initially, coverage was restricted to flights in Europe, the Middle East, and Africa, but the surveillance programme was expected to go global at the time the presentation was made.
GCHQ’s Thieving Magpie presentation explains how in-flight mobile works.
Ars has asked these three companies to comment on the extent to which they were aware of the spying, and whether they are able to improve security for their users to mitigate its effects, but was yet to receive replies from Inmarsat or AeroMobile at time of publication.
A SitaOnAir spokesperson told Ars in an e-mail:
The article and documentation which you highlight makes reference to interception of a signal as it is transited through a satellite network.
The SitaOnAir service uses an Inmarsat satellite constellation for backhaul.
As would be the case for any mobile network operator, SitaOnAir’s ground infrastructure contains various elements of security protection.
The Thieving Magpie presentation explains that it is not necessary for calls to be made, or data to be sent, for surveillance to take place.
If the phone is switched on, and registers with the in-flight GSM service, it can be tracked provided the plane is flying high enough that ground stations are out of reach.
The data, we’re told, was collected in “near real time,” thus enabling “surveillance or arrest teams to be put in place in advance” to meet the plane when it lands. Using this system, aircraft can be tracked every two minutes while in flight.
If data is sent via the GSM network, GCHQ’s presentation says that e-mail addresses, Facebook IDs, and Skype addresses can all be gathered. Online services observed by GCHQ using its airborne surveillance include Twitter, Google Maps, VoIP, and BitTorrent.
Meanwhile, Le Monde reported that “GCHQ could even, remotely, interfere with the working of the phone; as a result the user was forced to redial using his or her access codes.” No source is given for that information, which presumably is found in other Snowden documents, not yet published.
As the French newspaper also points out, judging by the information provided by Snowden, the NSA seemed to have something of a fixation with Air France flights.
Apparently that was because “the CIA considered that Air France and Air Mexico flights were potential targets for terrorists.” GCHQ shared that focus: the Thieving Magpie presentation uses aircraft bearing Air France livery to illustrate how in-flight GSM services work.
Ars asked the UK’s spies to comment on the latest revelations, and received the usual boilerplate response from a GCHQ spokesperson:
It is longstanding policy that we do not comment on intelligence matters.
Furthermore, all of GCHQ’s work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary, and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners, and the parliamentary intelligence and security committee.
All our operational processes rigorously support this position.
In addition, the UK’s interception regime is entirely compatible with the European Convention on Human Rights.
So that’s OK, then.
This post originated on Ars Technica UK