Keeping an Eye on Endace
Designed by little-known New Zealand company Endace, a powerful piece of technology called the Medusa system, had one main purpose: to vacuum up vast quantities of internet data at an astonishing speed. And it was created for one important customer: the British electronic eavesdropping agency, Government Communications Headquarters, or GCHQ.
Investigative journalists New Zealander Nicky Hager and United Kingdom-based Ryan Gallagher report for The Intercept, an online news source “dedicated to producing fearless, adversarial journalism.”
Dozens of internal documents and emails from Endace, obtained by The Intercept and reported in cooperation with Television New Zealand, reveal the firm’s key role helping governments across the world harvest vast amounts of information on people’s private emails, online chats, social media conversations, and internet browsing histories, according to Hager and Gallagher.
The leaked files, which were provided by a source through SecureDrop, show that Endace listed a Moroccan security agency implicated in torture as one of its customers. They also indicate that the company sold its surveillance gear to more than half a dozen other government agencies, including in the United States, Israel, Denmark, Australia, Canada, Spain, and India.
Some of Endace’s largest sales in recent years, however, were to the UK’s GCHQ, which purchased a variety of “data acquisition” systems and “probes” that it used to covertly monitor internet traffic.
Documents from the National Security Agency whistleblower Edward Snowden, previously disclosed by The Intercept, have shown how GCHQ dramatically expanded its online surveillance between 2009 and 2012. The newly obtained Endace documents add to those revelations, shining light for the first time on the vital role played by the private sector in enabling the spying.
Endace has never publicly disclosed any of its work with GCHQ, likely because it is subject to strict confidentiality agreements. In one contract obtained by The Intercept, GCHQ states that Endace staff are bound to the UK’s Official Secrets Act, a sweeping law that can be used to prosecute and imprison people who disclose classified information. GCHQ warned Endace that it must not “make any press announcements or publicise the contract or any part thereof in any way.”
All telcos and internet companies in the US, Europe, New Zealand, and a number of other countries are required by law to have “intercept capable” equipment on their networks. When police or spy agencies want private data about a customer (with or without a warrant, depending on the country), it can be extracted easily.
When installed on a network, Endace’s surveillance equipment can be used to perform targeted monitoring of individual people, but it can also be used to enable dragnet spying.
Original article by Ryan Gallagher and Nicky Hager, The Intercept, October 23, 2016.
Photo by Endace.
