Vodafone has revealed the secret wires are widely used in the 29 countries it operates in. Photograph: Carl Court/AFP
Vodafone,
one of the world's largest mobile phone groups, has revealed the
existence of secret wires that allow government agencies to listen to
all conversations on its networks, saying they are widely used in some
of the 29 countries in which it operates in Europe and beyond.
The company has broken its silence on government surveillance
in order to push back against the increasingly widespread use of phone
and broadband networks to spy on citizens, and will publish its first
Law Enforcement Disclosure Report on Friday . At 40,000 words, it is the
most comprehensive survey yet of how governments monitor the
conversations and whereabouts of their people.
The company said
wires had been connected directly to its network and those of other
telecoms groups, allowing agencies to listen to or record live
conversations and, in certain cases, track the whereabouts of a
customer. Privacy campaigners said the revelations were a "nightmare scenario" that confirmed their worst fears on the extent of snooping.
In
Albania, Egypt, Hungary, India, Malta, Qatar, Romania, South Africa and
Turkey, it is unlawful to disclose any information related to
wiretapping or interception of the content of phone calls and messages
including whether such capabilities exist.
"For governments to
access phone calls at the flick of a switch is unprecedented and
terrifying," said the Liberty director, Shami Chakrabarti. "[Edward]
Snowden revealed the internet was already treated as fair game. Bluster
that all is well is wearing pretty thin – our analogue laws need a
digital overhaul."
In about six of the countries in which Vodafone
operates, the law either obliges telecoms operators to install direct
access pipes, or allows governments to do so. The company, which owns
mobile and fixed broadband networks, including the former Cable &
Wireless business, has not named the countries involved because certain
regimes could retaliate by imprisoning its staff.
Direct-access systems do not require warrants, and companies have no
information about the identity or the number of customers targeted. Mass
surveillance can happen on any telecoms network without agencies having
to justify their intrusion to the companies involved.
Industry
sources say that in some cases, the direct-access wire, or pipe, is
essentially equipment in a locked room in a network's central data
centre or in one of its local exchanges or "switches".
The staff
working in that room can be employed by the telecoms firm, but have
state security clearance and are usually unable to discuss any aspect of
their work with the rest of the company. Vodafone says it requires all
employees to follow its code of conduct, but secrecy means that it
cannot always verify that they do so.
Government agencies can also
intercept traffic on its way into a data centre, combing through
conversations before routing them on to the operator.
"These are
the nightmare scenarios that we were imagining," said Gus Hosein,
executive director of Privacy International, which has brought legal
action against the British government over mass surveillance.
"I
never thought the telcos [telecommunications companies] would be so
complicit. It's a brave step by Vodafone and hopefully the other telcos
will become more brave with disclosure, but what we need is for them to
be braver about fighting back against the illegal requests and the laws
themselves."
Vodafone's group privacy officer, Stephen Deadman, said: "These pipes exist, the direct access model exists.
"We
are making a call to end direct access as a means of government
agencies obtaining people's communication data. Without an official
warrant, there is no external visibility. If we receive a demand we can
push back against the agency. The fact that a government has to issue a
piece of paper is an important constraint on how powers are used."
Vodafone
is calling for all direct-access pipes to be disconnected, and for the
laws that make them legal to be amended. It says governments should
"discourage agencies and authorities from seeking direct access to an
operator's communications infrastructure without a lawful mandate".
All
states should publish annual data on the number of warrants issued, the
company argues. There are two types – those for the content of calls
and messages, and those for the metadata, which can cover the location
of a target's device, the times and dates of communications, and the
people with whom they communicated.
For brevity, the Guardian has
also used the term metadata to cover warrants for customer information
such as name and address. The information published in our table covers
2013 or the most recent year available.
A single warrant can target
hundreds of individuals and devices, and several warrants can target
just one individual. Governments count warrants in different ways and
New Zealand, for example, excludes those concerning national security.
While software companies like Apple and Microsoft have jumped to publish
the number of warrants they receive since the activities of America's NSA and Britain's GCHQ came to light, telecoms companies, which need government licences to operate, have been slower to respond.
In America, Verizon and AT&T have published data, but only on their domestic operations. Deutsche Telekom in Germany and Telstra in Australia have also broken ground at home. Vodafone is the first to produce a global survey.
It
shows that Malta is one of the most spied on nations in Europe. The
former British protectorate has a tiny population of 420,000, but last
year Vodafone alone processed 3,773 requests for metadata.
In
Italy, where the mafia's presence requires a high level of police
intrusion, Vodafone received 606,000 metadata requests, more than any
other country in which it runs networks. The number of warrants across
all operators is potentially many times that number, but the government
does not publish a national figure for metadata.
Italy's
parliament does disclose content warrants, however, and it issued
141,000 in 2012, compared with just 2,760 in the United Kingdom. In
contrast to the UK, terrorism concerns mean Ireland does not allow any
information on the number of content warrants to be made public.
Spain,
which has suffered terrorist strikes from Islamists and Basque
separatists, allowed Vodafone to disclose that it had received over
24,000 content warrants. Agencies in the Czech Republic made nearly
8,000 content requests from the network. After Italy, the Czech Republic
is the biggest user of metadata, issuing 196,000 warrants nationally in
the most recent year for which information has been published.
Tanzania, one of several African countries in which Vodafone operates,
made 99,000 metadata requests from the company.
Peter Micek,
policy counsel at the campaign group Access, said: "In a sector that has
historically been quiet about how it facilitates government access to
user data, Vodafone has for the first time shone a bright light on the
challenges of a global telecom giant, giving users a greater
understanding of the demands governments make of telcos. Vodafone's
report also highlights how few governments issue any transparency
reports, with little to no information about the number of wiretaps,
cell site tower dumps, and other invasive surveillance practices."
On
the question of whether the UK uses direct-access pipes, Vodafone's
Deadman said such a system would be illegal because Britain did not
permit agencies to obtain information without a warrant. The law does,
however, allow indiscriminate collection of information on an
unidentified number of targets. "We need to debate how we are balancing
the needs of law enforcement with the fundamental rights and freedoms of
the citizens. The ideal is we get a much more informed debate going,
and we do all of that without putting our colleagues in danger."
Snowden,
the National Security Agency whistleblower, joined Google, Reddit,
Mozilla and other tech firms and privacy groups on Thursday to call for a
strengthening of privacy rights online in a "Reset the net" campaign.
Twelve
months after revelations about the scale of the US government's
surveillance programs were first published in the Guardian and the
Washington Post, Snowden said: "One year ago, we learned that the
internet is under surveillance, and our activities are being monitored
to create permanent records of our private lives – no matter how
innocent or ordinary those lives might be. Today, we can begin the work
of effectively shutting down the collection of our online
communications, even if the US Congress fails to do the same."