Egypt, FinFisher Intrusion Tools and Ethics	Posted by Mikko @ 09:17 GMT | Comments

There’s unrest in Egypt, Tunisia, Libya, Bahrain and elsewhere in the Arab world.

Two days ago, protesters in Nasr, Egypt took over the Headquarters of the Egyptian State Security.

Inside the HQ, the protesters gained access to loads of confidential state documents.

Among them was a document that is highly relevant to computer security: an offer for a product called FinFisher sent to the Egypt State Security Investigation Department.

Note: we can’t confirm the origin of this document. We got it from Mostafa Hussein. You can download the full document from here. [PDF, 1.3MB]

FinFisher seems to be an Intrusion and Spying software framework, developed and sold by a German company. It seems to include multiple components, including an “infection proxy” and various intrusion tools.

We don’t know if Egypt State Security purchased the tool or not. We don’t know if they were using it to spy on their own citizens. We don’t know who else could be using it.

The obvious question here is: do we detect FinFisher? And the answer is: we don’t know, as we don’t have a sample at hand we could use to confirm this.

The obvious follow-up question is: if somebody gets us a known copy of FinFisher, would we knowingly add detection for it? And the answer is: yes we would.

We are in the business of selling protection. We’re selling products to protect our customers from attack programs — regardless of the source of such programs.

It’s easy to imagine a case where our customer would be innocent of any wrongdoing, but would be suspected for a crime he didn’t commit. In such a situation he would have full expectation of his antivirus protecting him against trojans, even if those trojans would be coming from the government. This would be even more relevant if the customer lives in a totalitarian state. Like some of our customers do.

It’s perfectly possible that we have already received a sample of FinFisher or some similar tools from our customers. However, if that has happened we have been unable to distinguish them from “normal” criminal trojans. We don’t have any known government intrusion tools in our possession.

We’ve never received a request from any police force or intelligence organization anywhere in the world, asking not to detect their trojans. If they use trojans, they do not submit them to us.

And even if an official would contact us, asking not to detect their trojan, we would follow our guideline on this, published years ago in 2001. Please see our public statement on this very topic.

It would be a slippery slope to stop detecting government trojans. If the USA’s government would ask us not to detect something and we would do it, then what? Should we avoid detecting hacking software used by governments… of which country? Germany? UK? Israel? Egypt? Iran?

“When we stormed State Security Police headquarters in Nasr City, which hosted one of Mubarak’s largest torture facilities, on Saturday I found two DVDs in one of the offices, both titled “أرشيف السادة ضباط الجهاز” The Agency Officers’ Archive. The DVDs included profile pictures of State Security officers, organized in folders. Each folder had the officers’ name. Some however did not have the names. There were also sub folders that included pictures of those officers in social events like weddings.

I don’t know what was the purpose of these two DVDs, but I sincerely thank the State Security officials who gave us this present on a golden plate. I’ve uploaded the profile pictures to this flickr set and added them to the Piggipedia. I urge you all to circulate them. And if you have any more information about those officers please come forward.

Each member of SS has to be brought to justice. This was an agency devoted to spying, surveillance, torture and murder. Every member of this organization from the informer all the way up to the generals should be prosecuted. SS has to be dissolved. It cannot be “restructured” like what the current PM is calling for.

Although those torturers violated our private lives on a daily basis, bugging our phones, offices, and even our bedrooms, I will respect the privacy of their families and will not publish the photos of their social events that included family members.

Dear SS, yes you had every right to be worried from the Piggipedia. We will expose you, bring shame on you. You forced millions of Egyptians to live in fear and terror. Now you have to answer for your crimes.”

Written on March 8, 2011 by Chilton Tippin in Email, Mobile, Unified Messenging

Egyptian protesters raided the State Security Intelligence Directorate over the weekend, finding and posting on Facebook documents that point to the Mubarak government’s involvement in terrorism, domestic spying, and torture.

Protesters have posted several of the thousands-of-seized documents on a Wikileaks-styled Facebook page, called Amn Dawla Leaks (National Security Leaks) and blasted them over Twitter using photo-sharing service Yfrog. The interim military government has requested the return of the documents, and protest organizers fear that the documents, which have proliferated throughout the country, will be lost or devalued, rendering them useless for future prosecutions.

The leaked trove–much of which is uncorroborated–lays open a litany of abuses and private affairs. The information unearths everything from vote rigging, torture, and terrorist plots to a sex tape made by a female member of the Kuwaiti royal family. Files discovered in the raids paint a Mubarak regime that meticulously monitored its people, collecting emails, wiretap recordings, and text messages sent and received by millions of Egyptian citizens. Other dispatches sent from high-ranking officials ordered the military to use live rounds at the advent of the protests. One document ordered police officers to conceal or destroy the files to keep them from falling into the protesters’ hands.

The most controversial document allegedly shows the State Security’s involvement in the bombing of a Coptic Christian church that killed 21 and wounded more than 80 people on Jan. 1, 2011. According to The Vancouver Sun, the document helped fuel Coptic protests that are currently taking place in the city. If true, the document could cast doubt on claims made by the Egyptian government that the bombing was carried out by the Army of Islam, an arm of Al-Qaeda.

The raids speak to the freedom-of-information culture that has swept Egypt and much of the Middle East. That the Facebook page models the logo and design of Wikileaks highlights the sentiment among the common men and women in Egypt: eschew authority and bring information to light using the Internet, social media–the tools that have given us power and voice.