Spying in Central Asia was once reserved for shadowy figures bugging apartments to deliver intelligence to Moscow. But the post-Soviet surveillance state has a new accomplice – European software companies. Experts had long-suspected Hacking Team, a company based in Milan, of supplying spyware to authoritarian regimes but a hack of Hacking Team this month appeared to confirm that listed among their clients are the National Security Services of Uzbekistan.
Hacking Team sells Remote Control Software (RCS). If used in the manner advertised by Hacking Team, RCS enables the Uzbek security services to extend its surveillance of citizens beyond traditional wiretapping to the next level – secret capture of data that often has never been digitally communicated. The spyware is used to copy files from a hard-drive, record Skype calls, copy passwords, and can even turn on a device’s webcam and microphone to spy on the user. RCS bypasses encryption techniques employed to protect users, and therefore remains undetectable. In 2014, Citizen Lab claimed to have identified three RCS points in Uzbekistan. Now, the appearance of Uzbekistan on Hacking Team’s leaked list appears to confirm that, contrary to their claims, they are enabling a regime with one of the worst human rights records in the world to aggressively spy on its citizens.
In Uzbekistan, political and civil rights are almost non-existent. Forced labour in the country’s vast cotton fields, compulsory sterilization of women, and pervasive use of torture are the reality of life for millions. The few activists or journalists who highlight the abuses in the 14-year regime of President Islam Karimov are persecuted and tortured by the State, as in the case of human rights defender Elena Urlaeva. A crackdown on political dissent followed the 2005 Andijan massacre – in which hundreds of peaceful demonstrators were shot by members of the security services – accompanied by intensified state surveillance. Activists, human rights defenders and independent journalists who shine a light on these abuses often only become aware of their surveillance upon presentation with illegally-obtained evidence in court. Uzbek law fails to adequately protect citizens from surveillance and incursions on privacy, and the National Security Services operates with almost total impunity.
Despite the history of pervasive surveillance by the Soviet regime in Central Asia, human rights defenders in the region have relatively low awareness of digital security. Myles G. Smith, an independent analyst on Central Asia, credits this to the impression amongst activists that there are ‘more important issues to work on’. Ignorance of digital security in Uzbekistan is also fueled by the suppression of civil society that might otherwise advance privacy and digital security. ’Decades of living under these conditions have left journalists and activists numbed to the threats. More often than not, someone from these communities will conclude that there is no use trying to circumvent government surveillance – if the government decides to ‘get you’, they can do so with impunity at a time of their choosing’, explains Smith.
Digital security and privacy of human rights defenders and journalists are crucial for the protection of human rights and efforts to establish democracy in authoritarian regimes. With their capacity to communicate and organize compromised, those who shine a light on corruption and abuses are rendered increasingly ineffective and isolated. Protection against state surveillance is also a global issue – affecting not only frontline defenders, but also activists and whistleblowers in advanced democracies. As highlighted by British Prime Minister David Cameron’s ongoing efforts to ban encryption, this right to privacy is under attack around the world as calls to extend state surveillance capacity are justified by claims of counter-extremism. Without the adoption of European Union bans on export of malware or the improvement of international legal mechanisms, companies like Hacking Team will continue to supply the demand for intrusive surveillance software from governments around the world. For human rights defenders in Uzbekistan, this failure is turning the security services from shadowy figures in the street to spies in their bedroom.