#SootinClaimon.Com : ขอบคุณแหล่งข้อมูล : หนังสือพิมพ์ The Nation.

https://www.nationthailand.com/international/40009684

---

The co-founder of a company that has been trusted by technology giants including Google and Twitter to deliver sensitive passwords to millions of their customers also operated a service that ultimately helped governments secretly surveil and track mobile phones, according to former employees and clients.

Since it started in 2013, Mitto has established itself as a provider of automated text messages for such things as sales promotions, appointment reminders and security codes needed to log in to online accounts, telling customers that text messages are more likely to be read and engaged with than emails as part of their marketing efforts.

Mitto, a closely held company with headquarters in Zug, Switzerland, has grown its business by establishing relationships with telecom operators in more than 100 countries. It has brokered deals that gave it the ability to deliver text messages to billions of phones in most corners of the world, including countries that are otherwise difficult for Western companies to penetrate, such as Iran and Afghanistan. Mitto has attracted major technology giants as customers, including Google, Twitter, WhatsApp, LinkedIn and messaging app Telegram, in addition to China’s TikTok, Tencent and Alibaba, according to Mitto documents and former employees.

But a Bloomberg News investigation, carried out in collaboration with the London-based Bureau of Investigative Journalism, indicates that the company’s co-founder and chief operating officer, Ilja Gorelik, was also providing another service: selling access to Mitto’s networks to secretly locate people via their mobile phones.

That Mitto’s networks were also being used for surveillance work wasn’t shared with the company’s technology clients or the mobile operators Mitto works with to spread its text messages and other communications, according to four former Mitto employees. The existence of the alternate service was known only to a small number of people within the company, these people said. Gorelik sold the service to surveillance-technology companies which in turn contracted with government agencies, according to the employees.

Responding to Bloomberg’s questions, Mitto issued a statement saying that the company had no involvement in a surveillance business and had launched an internal investigation “to determine if our technology and business has been compromised.” Mitto would “take corrective action if necessary,” according to Mitto.

“We are shocked by the assertions against Ilja Gorelik and our company,” according to the company. “To be clear, Mitto does not, has not, and will not organize and operate a separate business, division or entity that provides surveillance companies access to telecom infrastructure to secretly locate people via their mobile phones, or other illegal acts. Mitto also does not condone, support and enable the exploitation of telecom networks with whom the company partners with to deliver service to its global customers.”

Gorelik didn’t respond to requests for comment. A Mitto representative declined to comment on Gorelik’s current role with the company.

Two former employees of a company that provides intelligence-gathering technology to government organizations and law enforcement said staff at the company had worked with Gorelik to install custom software at Mitto that their company’s customers could use to track the locations of mobile phones and, in some cases, obtain call logs for specific people. During the time the former employees say they engaged in the work, there was virtually no oversight of alleged surveillance carried out using Mitto’s systems, creating potential opportunities for misuse, they said.

In at least one instance, a phone number associated with a senior U.S. State Department official was targeted in 2019 for surveillance through the use of Mitto’s systems, according to a cybersecurity analyst familiar with the incident and documents reviewed by Bloomberg News. The analyst requested anonymity because of a confidentiality agreement. It’s not clear who was behind efforts to target the official, who wasn’t identified by the documents or the analyst.

Marietje Schaake, international policy director at Stanford University’s Cyber Policy Center, said the revelations were “troubling” and highlighted a “huge problem.”

“The biggest technology companies that provide critical services are blindly trusting players in this ecosystem who cannot be trusted,” said Schaake, after being told about Bloomberg’s and the Bureau’s reporting. “It’s dangerous for human rights. It’s dangerous for trust in an information society. And it’s dangerous for trust in companies.”

Senator Ron Wyden, a Democrat from Oregon and a member of the Senate intelligence committee, said in a statement to Bloomberg News that he had previously raised the alarm about security vulnerabilities in U.S. phone networks, which he feared could be exploited to spy on government officials. “I’m very concerned that the federal government has done nothing to protect federal employees from this sophisticated surveillance threat,” Wyden said.

Mitto’s partner networks have included Vodafone, Telefonica, MTN and Deutsche Telekom, according to company documents reviewed by Bloomberg. Vodafone said that its enterprise division has worked with Mitto in two countries to provide text-messaging services. A Telefonica representative said he wasn’t immediately able to confirm whether the company had a relationship with Mitto but said he was looking into the matter. MTN and Deutsche Telekom didn’t respond to requests for comment.

There’s no indication that the surveillance operation compromised any data of the tech companies that rely on Mitto to send messages. Representatives from Twitter and WhatsApp declined to comment. A spokesperson for LinkedIn, which Mitto has featured on a list of apparent clients on its website, said the company doesn’t work with Mitto and declined to say whether it has in the past. Alibaba said it couldn’t immediately confirm any relationship with Mitto. Representatives from Google, Telegram, TikTok and Tencent didn’t respond to requests for comment.

The investigation by Bloomberg News and the Bureau of Investigative Journalism is based on interviews with more than two dozen people, including former Mitto employees, surveillance industry insiders and cybersecurity professionals, as well as emails and documents describing the surveillance work. Nearly all of the former employees requested anonymity because they had signed confidentiality agreements or feared professional and personal retribution. Of the former employees interviewed for this story, only a handful said they knew specific details about the surveillance work.

The revelations offer another example of how governments and private contractors have allegedly exploited security weaknesses in global telecommunication systems to spy on people. There’s been a boom in technology tools that let governments hack, track and otherwise monitor people’s phones and communications, and the market for mobile phone surveillance technology has been valued as high as $12 billion. But despite the sector’s size, companies offering the tools often operate beyond public scrutiny and are subject to little regulation.

Many of the surveillance companies, such as Israel’s NSO Group, and their government clients say the technology is used to catch criminals and terrorists. But in recent years there have been numerous instances in which governments have used surveillance technology to spy on dissidents, journalists or others, according to reports by media organizations and digital rights groups.

“The private sector surveillance industry is growing fast, but it’s operating in the dark, without any accountability or transparency, and there have been real human rights implications because of that,” said Jonathon Penney, a research fellow at Citizen Lab, a research group at the University of Toronto that has repeatedly exposed alleged misuse of surveillance technology.

Mitto was co-founded by Gorelik and Andrea Giacomini, European entrepreneurs who were bound by their interest in telecommunications. While Mitto’s headquarters are in Switzerland, most of its roughly 250 employees have been based in Germany and more recently, Serbia, according to former employees.

Gorelik began his career as an IT specialist working for IBM, before becoming a technology entrepreneur and investor, helping to create a dating app named Lovoo, according to business records.

At Mitto, he assisted in building the company’s technical infrastructure. Aspects of his behavior and management style raised concerns, according to former employees, who allege he sent emails under a pseudonym and installed spyware on their computers.

Mitto leased hundreds of “global titles” from telecom companies – unique addresses that are used to route messages, giving the Swiss company the ability to send text messages in bulk to people internationally.

In Mitto’s early days, the company’s primary business was providing marketing and advertising services. Businesses would pay Mitto to send out millions of text messages promoting products or events, according to former Mitto employees. The company also specialized in delivering security codes for its customers, sending out by text message one-time passwords and two-factor authentication codes that enable people to verify their identity when logging into or creating accounts on websites, according to former employees.

By 2017, Mitto had set up direct connections to mobile phone networks in more than 100 countries, and established partnerships with leading telecommunications companies.

Between 2017 and 2018, Gorelik started giving surveillance-technology companies access to Mitto’s networks, which were then used to locate and track people via their mobile phones, according to four former employees.

The alleged venture involved exploiting weaknesses in a telecom protocol known as SS7, or Signaling System 7, a sort of switchboard for the global telecoms industry. First developed in the 1970s, SS7 contains numerous known vulnerabilities that governments and private surveillance companies have in the past targeted to spy on phones.

A U.S. Department of Homeland Security report in 2017 noted that security holes in SS7 made it possible for an adversary to determine the physical location of mobile devices and intercept or redirect text messages and voice conversations.

While there are newer telecom protocols available, mobile network operators continue to use SS7-based technologies despite security concerns, in part because it is costly and complex to replace, according to Tobias Engel, a researcher who specializes in mobile phone network security. Mobile phone network operators can use firewalls to identify and block surveillance attempts that exploit SS7 security weaknesses, but those systems need to be regularly updated and tested to be effective, he said.

Mitto’s deals with telecommunications companies, according to former employees, provided the company with SS7 access, which Mitto could use to route text messages in bulk across the world’s mobile networks.

But in that process, “there’s a lack of audit and a lack of accountability” that opens up the possibility for SS7 access to be exploited for surveillance purposes, according to Pat Walshe, a privacy expert with more than two decades of experience in the telecommunications industry.

The four former Mitto employees familiar with Gorelik’s alleged activities said he provided surveillance services to multiple companies. Gorelik also told some colleagues that he had connections to a national spy agency in the Middle East and was helping that country’s defense ministry track people’s locations, according to the former employees. Bloomberg isn’t naming the country at the behest of a Mitto representative, who said it could endanger its employees.

Four former employees of Cyprus-based firm TRG Research and Development said Mitto’s network was used by their company to provide surveillance services to customers from 2019 to 2021. The employees requested anonymity due to confidentiality agreements.

TRG provides a software platform to governments and law enforcement agencies, called Intellectus, that uses third-party applications to provide information requested by government agencies. TRG on its website says its mission is to “help our customers in the fight against crime and terror,” providing them with “conclusions based on our data collection and data fusion engines.”

Two of the former TRG employees said staff at the company had worked directly with Gorelik, using Mitto’s access to global mobile phone networks to obtain location data on targeted mobile phones and, in some cases, call logs showing who particular people were contacting and when. The other two former employees said they knew TRG had utilized Mitto’s network but didn’t confirm whether Gorelik had any personal involvement.

A TRG spokesperson denied the allegations and said the company has never had a “commercial relationship” with Mitto and hasn’t worked with Gorelik. “If anyone within TRG or Mitto has had such relationships, it is a personal relationship and is not related to TRG,” the spokesperson said. A Mitto representative declined to comment on the company’s alleged relationship with TRG.

Intellectus is operated solely by customers, the spokesperson said.

Government customers sign an end-user statement verifying the technology is used in according with their national laws and verifying there is no abuse of the system, the TRG spokesperson said. “TRG has an internal legal & compliance department which conducts thorough due-diligence checks for each and every end user,” the spokesperson said. “Automated algorithms in Intellectus may detect any misuse in regards to usage of the system, which subsequently block access of the respective user(s).”

Recent publicly posted job advertisements for roles at TRG have sought people with expertise in telecommunications signaling protocols such as SS7, as well as knowledge of “lawful interception,” an industry term understood to mean surveillance of communications. Images on TRG’s website show the Intellectus system can be used to track people’s locations, monitor their call and text-message records and identify their connections on Facebook.

The TRG spokesperson said the company doesn’t have spying or signaling abilities. “The personnel we hire are part of the TRG roadmap for providing the fusion solution to fight crime and terror,” the spokesperson said. “Such a solution requires many different vertical know-how in order to be a market leader.”

The four former TRG employees said that their work with Mitto’s network was carried out by them in their capacity as TRG employees and that the some of the company’s senior executives knew about it.

Gorelik had personally installed custom TRG software within Mitto’s computer networks, two of the former TRG employees alleged. They said that TRG’s software had established what’s called a “signaling connection” between Mitto and specific mobile network operators. Such connections are intended to be used for legitimate purposes including routing calls or messages to phones.

However, TRG’s software could be used to spy on targeted phones for government customers, according to the four former TRG employees. TRG’s software could send requests to mobile phone networks that could trick them into sending back a trove of data, according to the former TRG employees.

The full roster of customers for the surveillance business isn’t known, and Bloomberg wasn’t able to verify several companies that were identified by the former Mitto employees and several people working in the surveillance industry as purchasing the service.

Other surveillance firms have allegedly sold capabilities that exploit vulnerabilities in SS7 protocols to government customers, including the Israeli firm Rayzone and Bulgaria-based Circles, according to previous reports from the Bureau of Investigative Journalism and Citizen Lab.

Gorelik’s association with the surveillance industry was a closely guarded secret within Mitto, according to former employees. But one cybersecurity professional working in the telecommunications industry had suspicions.

One particular incident stood out from November 2019. A sudden flurry of signaling messages, which are commonly used to request location information about a particular phone, were targeted at the senior U.S. State Department official, according to records of telecommunication network activity seen by Bloomberg and a cybersecurity analyst who reviewed them. The analyst spoke on condition of anonymity due to a confidentiality agreement.

At least 50 of the signaling messages were sent to a U.S. phone network used by the official at a rate of one or more every second, seeking information about the person’s mobile phone and its location, the records show. The signaling messages were traced back to 15 different countries, where they had been sent through a series of unique addresses – or global titles – that were all leased by Mitto, according to the records.

On another occasion, in July 2020, Mitto’s network was linked to attempted surveillance of a person located in South East Asia, whose identity also wasn’t provided, according to the analyst. Global titles used by the company in Russia, Zambia, Madagascar and Denmark sent out a coordinated burst of signaling messages targeting the person’s phone, the records show. The messages included a command that can be deployed to surreptitiously access text messages, according to the cybersecurity analyst.

The analyst said the attempts targeting the State Department official and the person in South East Asia were flagged as malicious by security systems and blocked. Mitto’s system was detected engaging in similar activity on dozens of other occasions, according to the analyst and the records.

The data, the analyst said, made it clear that Mitto’s infrastructure had been used to enable signaling attacks globally. The analyst didn’t identify which surveillance technology company, if any, was involved in the alleged incidents.

For those who say they knew about it, Gorelik’s alleged surveillance work at Mitto caused some discomfort. The company, which bills itself as the industry’s “most trusted” provider of text message services, says it offers those services “free of any potential threats and risks.”

Three of the former employees at Mitto said they quit in part because they felt the work allegedly carried out by Gorelik in the surveillance sector had posed a conflict, undermining the company’s ability to guarantee the privacy and security of messages it processed.

Some of Gorelik’s behavior had raised other concerns too, the former employees said.

For more than a year, ending at the start of 2017, Gorelik was rarely in the company’s offices and sent emails and messages under the name “Ingo Gross,” according to seven former employees. The former employees said Mitto managers told them that Gorelik couldn’t use his real name for legal reasons that were never explained.

Shortly after that, Gorelik began to spy on some colleagues, using the company’s access to telecommunication networks to sometimes check his employees’ locations, six former employees said. Gorelik was also known to sometimes question employees’ use of their work computers for non-business purposes.

It later became clear how he knew what websites they were visiting. In the summer of 2019, a group of developers at Mitto’s office in Berlin discovered that Gorelik had installed a spy tool on work computers, which would take a screenshot every two minutes. Bloomberg reviewed images showing the spy tool in operation. It is illegal for companies to install spyware on employee computers in Germany unless there is solid evidence of criminal behavior or serious breach of duty, according to Henriette Picot, a Munich-based commercial technology lawyer.

Mitto said in a statement that it “uses customary and legal techniques” to monitor such things as who is accessing its computer network and internet activity on a random basis or based on concrete suspicions.

“None of our employees has ever brought to our attention that they feared illegal spyware was being used on their company-provided workstations,” the company wrote.

Some of the employees confronted Gorelik, who explained in a staff meeting that he had deployed the spy tool due to concerns about employees leaking proprietary information, the former employees said.

Mitto later scaled down its presence in Germany and relocated to Belgrade, Serbia, according to Stefan Link, a former senior customer support engineer. He said he didn’t have knowledge of the alleged surveillance service.

Link, who worked in Berlin for the company, said that his own job was outsourced to Serbia and his contract not renewed when it expired in mid-2018. “It was leadership based on fear,” he said, citing the alleged spying on employees’ computers and Gorelik’s occasional berating of colleagues. “And you didn’t know who you could trust.”

Published : December 07, 2021

By : Bloomberg

#SootinClaimon.Com : ขอบคุณแหล่งข้อมูล : หนังสือพิมพ์ The Nation.

https://www.nationthailand.com/international/40009680

---

WASHINGTON – The omicron variant of the coronavirus has been identified in at least 17 U.S. states since California reported its first case Dec. 1 – and Centers for Disease Control and Prevention Director Rochelle Walensky said cases are likely to increase as scientists rush to answer whether it is more transmissible or better able to evade the protections of existing vaccines.

“We are every day hearing about more and more probable cases,” Walensky said in an interview with ABC News on Sunday. Here’s where cases have been detected in the United States. The delta variant is still the dominant strain in the United States, and almost all coronavirus cases are associated with it, Walensky said.

New York City announced a coronavirus vaccine mandate for all private employers Monday as the city fights the spread of the omicron variant, and after the first seven cases among residents have been confirmed.

Mayor Bill de Blasio, D, said Monday morning that he had decided to impose the aggressive measure, which he described as the first of its kind in the nation, to help reduce further spread of the virus and prevent the city from being hit with another wave of infections ahead of the winter holidays.

Anthony Fauci, the nation’s top public health adviser, said Sunday that early reports about omicron cases being relatively mild are “encouraging.”

“Though it’s too early to really make any definitive statements about it, thus far, it does not look like there’s a great degree of severity to it,” Fauci told CNN’s State of the Union, as he expressed confidence that existing vaccines will confer “some degree, and maybe a considerable degree, of protection against the omicron variant, if, in fact, it starts to take hold in a dominant way in this country.”

Also Monday tighter rules for entry into the United States for international travelers went into effect. All incoming travelers will need to show proof of a negative test taken within a day of their departure, regardless of vaccination status.

People will be required to wear masks on airplanes, trains, buses and other transportation in the United States through March 18, according to senior Biden administration officials.

Published : December 07, 2021

By : The Washington Post

#SootinClaimon.Com : ขอบคุณแหล่งข้อมูล : หนังสือพิมพ์ The Nation.

https://www.nationthailand.com/international/40009679

---

A Myanmar court on Monday found ousted leader Aung San Suu Kyi guilty of charges including inciting public unrest and sentenced her to four years in prison – the first in a series of verdicts that could keep the 76-year-old Nobel laureate detained for the rest of her life.

Later Monday, state television announced that junta chief Min Aung Hlaing would reduce Suu Kyi’s sentence by two years and keep her detained in her current undisclosed location rather than moving her to a prison.

The reduction does not substantively change Suu Kyi’s fate, as she continues to face more serious charges with potential life sentences.

The United States, Britain, the United Nations and the European Union all roundly condemned the verdict, describing it as political.

“The military regime’s unjust conviction of Aung San Suu Kyi and repression of democratically elected officials are further affronts to democracy and rule of law in Burma,” Secretary of State Antony Blinken said in a statement Monday, using another name for the country. 

“The proceeding that today convicted Aung San Suu Kyi should not be confused with a trial – it is theatre of the absurd and a gross violation of human rights,” Tom Andrews, the U.N. special rapporteur on Myanmar, said on Twitter.

The closed-door trial in Naypyidaw, the capital, highlights the punitive treatment that the ruling junta is imposing on Suu Kyi, whom the military previously held under house arrest for almost two decades. After her release in 2010, she led her party to successive victories in quasi-democratic elections in 2015 and 2020, before the military seized power in February, again detaining Suu Kyi.

This time, the military seems intent on eliminating Suu Kyi as a political force. Since the coup, she has been held incommunicado in an undisclosed location. The military has piled on a dozen criminal charges against her, including campaigning during the pandemic, corruption and sedition; she faces more than 100 years in jail.

Rulings on two of those charges – inciting public unrest against the military and breaching covid-19 rules – were handed down Monday in a closed hearing. A person close to the trial, speaking on the condition of anonymity because of restrictions on talking to the media, said Suu Kyi received a sentence of two years for each charge.

Two other senior leaders of Suu Kyi’s National League for Democracy party, Myanmar’s deposed president, Win Myint, and Naypyidaw’s former mayor Myo Aung, were sentenced to two and four years, respectively. The verdicts were due to be handed down last week but were deferred until Monday. In that time, Suu Kyi was hit with a new charge of corruption.

Myanmar has spiraled deeper into chaos as the trial has unfolded, with armed conflict escalating in parts of the country and the military targeting anti-coup protesters. On Sunday, a military truck rammed into demonstrators in Yangon before soldiers opened fire on the small crowd. At least five were killed, according to local media outlets.

For decades, Suu Kyi advocated nonviolent resistance as she led the struggle for democracy and an end to the military’s dominance of the Southeast Asian country – a cause that won her a Nobel Peace Prize in 1991 and widespread acclaim in the West.

But facing a brutal crackdown by the armed forces in the wake of the coup this year, Myanmar’s people are increasingly adopting a more confrontational approach. A shadow government comprising Suu Kyi allies declared war on the military in September.

Experts say the military, under its commander in chief, Gen. Min Aung Hlaing, is set on neutralizing Suu Kyi as a political threat by subjecting her to harsher treatment than she endured during her years confined to her lakeside home in Yangon. Though Suu Kyi was barred from leaving during most of these two decades, the public knew of her whereabouts, and she was able to make brief appearances from behind the gates of her home and speak to diplomats.

Throughout the current trial, however, Suu Kyi has been allowed only brief access to her lawyers. Myanmar’s military government has not allowed diplomats, including an envoy from the Association of Southeast Asian Nations, to see her.

“Min Aung Hlaing appears determined to silence Aung San Suu Kyi and remove her completely from the political landscape,” said Richard Horsey, Myanmar adviser to the International Crisis Group.

Suu Kyi’s reputation in the West was tainted after she sided with her country’s generals in defending the military against charges of genocide stemming from its violent crackdown on the Rohingya Muslim minority in recent years.

This year, Myanmar’s people have suffered as the military has exacted retribution against opponents of the coup. Some 1,300 have been killed and more than 7,000 arrested, charged or sentenced, according to the Assistance Association for Political Prisoners (Burma).

“There are many detainees without the profile of Aung San Suu Kyi who currently face the terrifying prospect of years behind bars simply for peacefully exercising their human rights,” said Ming Yu Hah, Amnesty International’s deputy regional director for campaigns. “They must not be forgotten and left to their fate.”

As the daughter of Aung San, Myanmar’s independence hero, Suu Kyi remains beloved in her homeland – where she has almost godlike status – and the generals have long been wary of her appeal.

The military controls Myanmar through its State Administration Council. The junta says Suu Kyi and other ousted political leaders have been given a fair trial and insists the courts are independent. In practice, however, diplomats and experts say, the courts are subservient to the military administration.

Published : December 07, 2021

By : The Washington Post

#SootinClaimon.Com : ขอบคุณแหล่งข้อมูล : หนังสือพิมพ์ The Nation.

https://www.nationthailand.com/international/40009678

---

Israel said it will tighten supervision over the sale of cybersecurity exports, a decision that comes after a string of scandals involving foreign governments allegedly abusing technology developed by Israeli firms like NSO to spy on civilians.

Countries will only be able to buy Israeli technology after signing a declaration that they will use it “for the investigation and prevention of terrorist acts and serious crimes only,” Israel’s Ministry of Defense said in a statement on Monday. Violators of the new terms could be banned from using those technologies, the ministry said.

Foreign governments such as in Mexico and Saudi Arabia have allegedly used NSO’s Pegasus software to hack mobile phones of journalists and dissidents. A number of U.S. State Department employees were also recently hacked with NSO spyware. The U.S. blacklisted NSO earlier this month.

Pegasus is malware that allows clients to gain access to a target’s mobile phone. NSO maintains that the techhnology is intended only for governments and law enforcement to hunt down criminals and terrorists.

Published : December 07, 2021

By : Bloomberg