The Right to Privacy in Thailand: Privacy International Submission to Human Rights Committee 5. IMSI catcher and other surveillance technologies The technical surveillance capabilities of the Thai agencies are not officially known. According to reports by Citizen Lab of the University of Toronto in 201319 and leaked communications in 201520, Thailand may be the current or previous user of the advanced surveillance technology, Remote Control System Galileo, marketed by the Italian firm Hacking Team. The Galileo system has the ability to bypass encryption, take control of a user’s device, and to monitor all activities conducted on the device, poses significant threats to the right to privacy.21 More recently, government documents have revealed that Thailand purchased IMSI (International Mobile Subscriber Identity) catchers. In January 2015, the Swiss government released the list of export licences granted to companies based in Switzerland that were selling surveillance technologies.22 The document reveals that between March 2012 and January 2013, Thailand has purchased nine items requiring an export licence under the category “Mobile telecommunications interception or jamming equipment, and monitoring equipment” and the subcategory “Interception equipment designed for the extraction of voice or data, transmitted over the air interface”. This
is the category of licence IMSI catchers require. Likewise, in the UK, since 2015, the Department for Business, Innovation and Skills also started publishing data on export licences. Thailand obtained six different licenses for telecommunications interception equipment from the UK.23 IMSI catchers are devices that mimic the operation of a cell tower device in order to entice a users’ mobile phone to surrender personally identifiable data such as the SIM card number (IMSI). In recent years, IMSI catchers have become far more sophisticated and can perform interception of voice, SMS and data. They are also able to operate in a passive mode that is virtually undetectable as it does not transmit any data. Further, IMSI catchers are becoming increasingly cheap and these devices have been miniaturised to the point of being concealable on a person in a crowd rather than requiring a large van. But IMSI catchers are far from harmless given that their capacity to interfere with right to privacy goes beyond the person targeted.24 19 20 21 22 23 24 Marczak, Bi., Guarnieri, C., Marquis-Boire, M, and Scott-Railton, J., Mapping Hacking Team’s “Untraceable” Spyware, The CitizenLab, University of Toronto, February 2014. Available at: https://citizenlab.org/wpcontent/uploads/2015/03/Mapping- Hacking-Team%E2%80%99s-_Untraceable_-Spyware.pdf Wikileaks files published 8 July 2015, RE: (Draft) End User Statement. Available at:
See also: TIKIT Delivery Preparation, Available at https://ht.transparencytoolkit.org/FAE%20DiskStation/5.%20SWAP/TIKIT%20 %28Thailand%29/TIKIT_Delivery_Preparation.txt, Delivery Certificate https://ht.transparencytoolkit.org/FAE%20 DiskStation/5.%20 SWAP/TIKIT%20%28Thailand%29/TIKIT_Delivery_Certificate.pdf Galileo is a remote control system which allows to take control of a target and to monitor them even if they are using encryption. Hacking Team sells it as a tool to “bypass encryption, collect relevant data out of any device, and keep monitoring your targets wherever they are, even outside your monitoring domain.” For more information: https://www.hackingteam.it/images/stories/galileo.pdf See https://www.privacyinternational.org/node/98 See https://docs.google.com/spreadsheets/d/11_TtwzbRIP9QD_aKA6ej8REFwVsS-hmB91WCTAYfP9g/edit#gid=831716195 An IMSI catcher is portable equipment that allows the interception of data (phone communications, messages, location data) from phones in its surrounding environment. Inorder for a mobile phone to function it has to communicate with a cell tower. The phone then chooses the cell tower it communicates with based on the strength of the signal. An IMSI catcher pretends to be a powerful cell tower - it sends a very strong signal so that the phone in the surrounding areas connect to it instead of to an actual cell tower. Once connected to the IMSI catcher some data becomes available to the person in control of the IMSI catcher. IMSI catchers are often presented as a tool for targeted interception (one has to be geographically close to the targeted person to intercept their communications), yet IMSI catchers can capture all the data of all phones in their surrounding perimeter that connect to it. And indeed, some metadata from nearly every phone in the area surrounding it. There is also no technical barrier for the operator to intercept many phone conversations and SMS messages simultaneously. In general, each device can intercept eight phones in parallel but additional hardware can be purchased to multiply this value to the desired rate. 6