Upload
bigbadleaker
View
224
Download
0
Tags:
Embed Size (px)
Citation preview
November 22, 2015
Unnoticed leak answers and raises
questions about operation Eikonal (Last edited: November 23, 2015)
Almost unnoticed, the Austrian member of parliament Peter Pilz
recently disclosednew information about operation Eikonal, under
which NSA and BND cooperated in tapping some fiber-optic cables
at a switching center of Deutsche Telekom in Frankfurt, Germany.
As part of the NSA umbrella program RAMPART-A, Eikonal was set
up to gather intelligence about targets from Russia, the Middle
East and North-Africa. Because the cables that were tapped came
also from countries like Austria, Switzerland, France, Belgium and
the Netherlands, there were fears that their communications were
intercepted too.
Here, the newly disclosed information will be discussed and
combined with things we learned from the hearings of the
German parliamentary commission that investigates NSA spying,
including operation Eikonal.
> See also: New details about the joint NSA-BND operation Eikonal
Overview of the joint NSA-BND operation Eikonal (2004-2008)
(Click to enlarge)
Leak
The new information comes from transcripts of some fax and e-mail messages from employees of BND,
Deutsche Telekom and the federal Chancellery, which Peter Pilz published on his website on October 23,
2015.
He never told how he got these highly sensitive documents, but as they were made available to the
parliamentary inquiry commission, it seems most likely someone from or very close to this commission
must have leaked them to Pilz. This leak was never investigated.
Media attention
Also remarkable is that the information and documents disclosed by Peter Pilz were almost completely
ignored by mainstream German media like ARD and ZDF and the major newspapers. The latest disclosure
was for example only reported by the Austrian paper Der Standard and the German tech website Heise.de.
By contrast, in neighbouring countries like Austria, Belgium and the Netherlands, the Pilz revelations were
big news and led to official investigations. Through May and June of this year, he had published lists of
communication links related to Switzerland, France, Luxembourg and Poland too, claiming they showed to
what extent BND and NSA spied upon these countries.
First part of the list with communication links related to France
(Source: Peter Pilz - Click to enlarge)
Whose's links?
Initially, Peter Pilz claimed these links were from a priority list of the NSA, but neither he, nor the
commission hearings could clearly confirm this. The Dutch website De Correspondent reported that there
was even a much larger list of some 1000 transit links, of which ca. 250 were marked in yellow.
Now, Pilz confirms that there's indeed such a large list: it was prepared by Deutsche Telekom and contains
all its 1028 transit links. Employees of BND had marked 256 of them in yellow, apparently the ones they
were most interested in, and hence the list became known as the BND priority list. He doesn't mention an
involvement of NSA at this stage anymore.
Now that we know the large list of over 1000 links isn't an even larger "wish list", but a list of all available
transit links, it could well be that BND tried to select around 20% of them, as a rather strange provision in
German law says that bulk collection is only allowed up to a maximum of 20% of a cable's capacity.
As Telekom Austria rented the channels to Vienna, we can assume that other national telecommunication
providers also rented their links to Frankfurt, with Deutsche Telekom being the owner of the cables as part
of their international backbone network.
Determining the access points
After BND selected the 256 channels, Deutsche Telekom had to look which of them ran through Frankfurt
and could be intercepted there. For this purpose Harald Helfrich of the lawful interception unit of Deutsche
Telekom AG (DTAG) sent his collegue mr. Tieger the following e-mail on September 16, 2003:
Hallo LK,
wie heute morgen besprochen übersende ich Ihnen die Liste der Transit-Leitungen der DTAG. Wir bitten
Sie die gelb unterlegten Verbindungen bzgl. ihrer Führung (z.B. Ffm 21 oder Norden-Nordeich) und ob in
der 2-Mb-Ebene greifbar, zu analysieren.
Anlage: Trans mit ausgesuchten Strecken
In this mail it is asked to analyse whether the transit channels marked in yellow can be intercepted at the
2 Mbit-level, either at Deutsche Telekom's Frankfurt am Main Point-of-Presence 21 (Ffm 21) or at Norden-
Norddeich.
The latter is a town at the northern coast of Germany, where the SeaMeWe-3 andTAT-14 submarine
cables land. For the parliamentary commission this was a reason to ask whether also cables where
intercepted over there, but that was strongly denied by the witnesses involved.
Selecting individual channels?
Interestingly, the phrase "ob in der 2-Mb-Ebene greifbar" suggests that it could be possible to just
intercept specific 2 Mbit/s channels while leaving the other ones untouched (one physical STM1-cable has
a data rate of 155 Mbit/s and contains 63 virtual channels).
Whether this is possible is important for how focused such cable tapping can be. Isolating individual
channels depends in the first place on where exactly the tapping takes place:
A. When the physical fiber is intercepted before it reaches the switch, it has to be bend in order to catch
the light that leaks. Because this leaking signal is much weaker, it has to be amplified before it can be
processed. In this way it's not possible to select individual channels: the eavesdropper gets everything
that runs over the fiber, and has to demultiplex the channels himself to select the ones that contain traffic
of interest.
Splitting a traffic from a fiber-optic cable by bowing it
(diagram: OSA Publishing, slightly simplified)
B. When the interception takes place at an optical switch itself, then it's possible to only grab the virtual
channels you are interested in. A physical cable contains channels which have to be demultiplexed at the
switch in order to be forwarded (switched) to the fiber that leads to the intended destination. When the
switch converts the optical signals into electronic signals it is even more easy to duplicate only individual
channels of interest.
Diagram showing (de)multiplexing at a fiber-optic switch
(diagram modified from Wikimedia Commons/Jflabourdette)
Different methods
During the commission hearing of March 26, 2015, Klaus Landefeld, board member of the DE-CIX internet
exchange, indicated that at least since 2009, interception takes place at the switch. Also, the so-called
G10-orders authorise interception based uponAutonomous System Numbers (ASN) which are used for
logical paths, rather than by naming physical cables to or from a certain city.
However, it seems that under operation Eikonal, the fiber-optic cables were tapped by splitting the cable
signal before it reached the switch. This was more or less clearly indicated by several witnesses heard by
the parliamentary commission, and there are several other indications too.
In 2004, it was apparently not yet possible to establish a tap at the switch itself to get access to individual
channels (although Deutsche Telekom could have demultiplexed the fiber and only forward the channels of
interest to BND, but this wasn't the case).
Government authorisation
After BND had made clear what they wanted, the Deutsche Telekom management wasn't sure whether
such cable access was legal. Therefore they wanted to be backed by the federal Chancellery. On
December 30, 2003, the coordinator for the intelligence services at the Chancellery, Ernst Uhrlau, sent the
following fax message to Kai-Uwe Ricke, then CEO of Deutsche Telekom, and Josef Brauner, head of the
landline division T-Com:
Sehr geehrter Herr Ricke, sehr geehrter Herr Brauner,
das Bundeskanzleramt ist sehr interessiert, dass der Bundesnachrichtendienst im Rahmen seines
gesetzlichen Auftrages kabelgestützte Transitverkehre aufklärt. Der vom Bundesnachrichtendienst in
Ihrem Unternehmen geplante Aufklärungsansatz steht aus hiesiger Sicht in Einklang mit geltendem Recht.
Ich darf auf diesem Weg die Anregung des Bundesnachrichtendienstes weitergeben, in der Deutschen
Telekom AG, T-Com, den Bereich RA 43 (Staatliche Sonderauflagen), zu dem bereits im Rahmen der
Strategischen Fernmeldekontrolle Kontakte bestehen, mit der Durchführung der auf Seiten der Deutschen
Telekom AG erforderlichen Maßnahmen zu beauftragen.
It says that in the opinion of the Chancellery, the proposed BND operation is according to German law.
The Chancellery encourages Deutsche Telekom to instruct its lawful intercept unit RA 43 (which is one of
four Regionalstellen für staatliche Sonderauflagenor ReSA) to start taking the necessary measures for the
interception.
Transit Agreement
On behalf of the board of Deutsche Telekom, Josef Brauner answers the fax from the Chancellery on
January 13, 2004. He says the T-Com division is aware of the importance of a well-functioning intelligence
service, and will therefore support the interception of cable-bound transit traffic:
Sehr geehrter Herr Ministerialdirektor,
gerne bestätigen wir Ihnen den Erhalt Ihres Schreibens vom 30. Dezember des letzten Jahres.
Die T-Com ist sich der Bedeutung eines gut funktionierenden Nachrichtendienstes für das Gemeinwesen
der Bundesrepublik Deutschland - insbesondere vor dem Hintergrund der terroristischen Angriffe des 11.
September 2001 - bewusst und wird daher die geplanten Aktivitäten des Bundesnachrichtendienstes, die
kabelgestützten Transitverkehre im Rahmen seines gesetzlichen Auftrages aufzuklären, unterstützen.
Entsprechend der Anregung des Bundesnachrichtendienstes wird diesseits unser Bereich RA43 (staatliche
Sonderauflagen) beauftragt, die hierfür von unserer Seite erforderlichen Maßnahmen vorzunehmen
Then on March 1, 2004, the BND and Deutsche Telekom signed the so-called Transit Agreement (pdf), in
which the latter agreed to provide access to its transit cables, and in return will be paid 6.500,- euro a
month for the expenses. This agreement was also leaked to Peter Pilz, who published it on May 18, 2015
in the Austrian tabloid paper Kronen Zeitung.
Preparing for collection
After the agreement had been signed, BND sent an e-mail on March 9, 2004 to Wolfgang Alster, head of
Deutsche Telekom's lawful interception unit RA 43 asking for the connection (schaltung) of the first
communication links. He adds that he had ordered the payment of the first two monthly payments:
Schaltauftrag
DTAG RA 433
Hallo Herr Alster,
Der Geschäftsbesorgungsvertrag "Transit" ist ja jetzt von beiden Seiten unterzeichnet und gestern habe
ich die beiden ersten Monatszahlungen veranlasst.
Daher erdreiste ich mich, Sie um die erste Schaltung von Leitungen zu bitten.
Realising the access was apparently not that easy, because it took until December 2004 before the first
cable was connected. Then it appeared that it's signal was too weak, so in January 2005 an amplifier was
installed - as the parliamentary commission was told by S.L., who was the BND project manager for
Eikonal (note that the use of an amplifier indicates tapping the entire fiber-optic cable).
At this first stage of operation Eikonal, only circuit-switched (Leitungsvermittelte) telephone
communications were intercepted. Collection of packet-switched(Paketvermittelte) internet
communications started in 2006 (see below).
RUBIN
On February 3, 2005, mr. Knau mailed his colleague Harald Helfrich at the RA 43 unit that an STM1-link
between switching center Frankfurt 21 and Luxembourg had been connected. Channels 2, 6, 14, and 50
contained the virtual channels that had Luxembourg as their endpoint:
Hallo Herr Helfrich,
Habe heute früh die o.g. Verbindung auf die Punkte 71/00/002/03 19 + 39 zugeschaltet. In der Anlage ist
die Belegung lt. RUBIN ersichtlich.
Auf den Kanälen 2, 6, 14, 50 befinden sich die in der Liste markierten DSVn mit der Endstelle
Luxembourg.
Bitte um Rückmeldung ob das ganze funktioniert.
Anlage: Belegung 7571 Luxbg
We also see the term RUBIN (German for ruby), and during the commission hearings it seemed that this
was an alternate codename for operation Eikonal. But when heard on January 15, 2015, Harald
Helfrich explained that RUBIN is actually a system that Deutsche Telekom uses to manage its
communication links and cables - which perfectly fits how the term is used in this e-mail.
Channels of interest
The next e-mail is also from February 3, 2005, but was already published by Peter Pilz on May 15, 2015
and is the only one that is available in what seems to be its original form. It's from Harald Helfrich, who
informs a mr. Siegert at the BND that mr. Knau had connected an STM1-link earlier that morning (see
previous e-mail). He says it contains the channels that were on the BND priority list:
This e-mail says that BND was interested in the following 2 Mbit/s channels from the Transit STM1-cable
"Ffm 21 - Luxembourg 757/1":
Channel 2: Luxembourg/VG - Wien/000 750/3
Channel 6: Luxembourg/CLUX - Moscow/CROS 750/1
Channel 14: Ankara/CTÜR - Luxembourg/CLUX 750/1
Channel 50: Luxembourg/VG - Prague/000 750/1
According to Peter Pilz, additional cables were connected on February 14 and 25, as well as on March 3,
2005. Unfortunately, he either doesn't possess or didn't disclose the related e-mails, so we still don't know
how many and which channels have actually been intercepted.
The interception of telephony communications therefore started in the Spring of 2005, which means that
collection under Eikonal only lasted for 3 years, and not 4 years, when one would count from signing the
agreement in 2004 until the end of the operation in 2008.
Ending telephone interception
Peter Pilz published the transcripts of two more e-mails, which are about ending the telephone
interception. On May 27, 2008, mr. Thorwald from Deutsche Telekom sent the following message to his
colleague Harald Helfrich, informing him that fully circuit-switched transit traffic isn't supported anymore.
Therefore, the extraction of transit traffic at the company's premises can be terminated:
Sehr geehrter Herr Helfrich,
Wie wir bereits telefonisch besprochen, teile ich Ihnen mit, dass die Verarbeitung von reinen
leitungsvermittelten "Transit-Verkehren" von uns nicht mehr durchgeführt wird.
Aus diesem Grund kann die Ableitung der Transit-Verkehre in unseren Betriebsräumen eingestellt werden.
Im leitungsvermittelten Bereich (Ableitung auf höherer Ebene) besteht aktuell der Bedarf zur Ableitung
von folgenden Verkehren:
+ 2 x STM-64
+ 4 x STM-16
After that, Thorwald writes that there's currently a need to extract the traffic of two STM-64 and four STM-
16 cables, which have a data rate of ca. 10 Gbit/s and 2,5 Gbit/s respectively. This is also said to be
circuit-switched, but "extraction at a higher level".
Anomalies
If we assume that Peter Pilz provided the correct date for this e-mail, it's strange that there was
apparently a need for new cable accesses, hardly a month before operation Eikonal was officially
terminated (June 2008).
Even more strange is that the e-mail says the new accesses are also circuit-switched (leitungsvermittelt),
while during the hearings it was testified that the collection of such telephone communications ended in
January 2007, after Deutsche Telekom fased-out its business model for dedicated transit cables. This e-
mail brings that message almost 1,5 years later!
Internet access
From the commission hearings we also learned that BND wanted access to internet traffic too, which is
packet-switched (Paketvermittelt). For this, the first cable became available by the end of 2005, but it
took some months before the backlink was also connected. In the spring of 2006 a second cable was
added, and the front-end system and the filters were tested until mid-2007.
Could it be that mr. Thorwald just made a mistake, and wrote "leitungsvermittelten" where he meant
"paketvermittelten"? But even then, why add new internet cables, just before the operation was ended?
Another question
A similar anomaly can be found in an e-mail, that according to Peter Pilz, was sent one day later, on May
28, 2008. In it, mr. Knau informed Harald Helfrich and his superior Wolfgang Alster that the access to four
STM1-cables can be terminated immediately.
Given what was said during the commission hearings, one would have expected that this also had
happened already in January 2007, instead of May 2008. It seems some things don't add up here.
Wie bereits fernmündlich besprochen, können nachfolgende STM1-Zuschaltungen mit sofortiger Wirkung
aufgehoben werden:
Ffm 21 - Stuttgart 10 757/22A
Ffm 21 - Paris 757/1
Ffm 21 - Reims 757/1
Ffm 21 - Luxembourg 757/1
Physical cables
Unlike the numerous virtual channels in the lists, this e-mail is about physical cables. "Ffm 21 -
Luxembourg 757/1" is the one mentioned in the e-mail from February 3, 2005, containing 4 channels of
interest to Luxembourg; the others are cables from Frankfurt (Ffm) to Reims, Paris, and Deutsche
Telekom's Point-of-Presence in Stuttgart. With this, we now have proof of 3 other cables having been
tapped.
According to a list (.docx) publiced by Peter Pilz, there are 29 channels to/from Reims and 22 channels
to/from Paris, all of which could easily have been in the fiber-optic cable between Frankfurt and Reims,
and Frankfurt and Paris, respectively, as one single STM1-cable contains 63 separate channels:
Frankfurt - Stuttgart: ? channels of interest
Frankfurt - Paris: 22 channels of interest
Frankfurt - Reims: 29 channels of interest
Frankfurt - Luxembourg: 11 channels of interest
Peter Pilz concludes that operation Eikonal was the start of NSA's illegal mass surveillance of European
telecommunications. But that's not supported by evidence. After Eikonal, NSA continued joint cable
tapping operations with BND and other European agencies, but as these programs are part of RAMPART-A,
they are mainly aimed at specific targets in Russia, North-Africa and the Middle East.*
BND cable tapping
Operation Eikonal did start something else though: it provided BND with the knowledge and the
experience for conducting cable tapping on its own: in 2009 they started intercepting cables from 25
internet service providers, this time at the DE-CIXinternet exchange in Frankfurt - as was revealed by Der
Spiegel on October 6, 2013.
Among these 25 providers are foreign companies from Russia, Central Asia, the Middle East and North
Africa, but also 6 German providers: 1&1, Freenet, Strato AG, QSC, Lambdanet and Plusserver, who
almost exclusively handle domestic traffic.
It appears that this interception takes place in cooperation with the DE-CIX Management and that the
various providers themselves didn't knew that this was happening. A smart move, as this provides BND
with just one single point-of-contact, while the indivual providers can honestly deny that their cables are
being intercepted.
Links and sources - Heise.de: BND-Operation Eikonal: "Freibrief" für die Telekom aus dem Kanzleramt - DerStandard.at: Pilz: Berlin genehmigte NSA-Spionage gegen Österreich - PeterPilz.at: "Ich darf die Anregung weitergeben..." Die Operation Transit in Europa
Geplaatst door P/K op 23:22
Email ThisBlogThis!Share to TwitterShare to FacebookShare to Pinterest
Labels: Eikonal, Germany, NSA Partnerships
No comments:
Post a Comment
http://electrospaces.blogspot.com/2015/11/unnoticed-leak-answers-and-raises.html
Tagebuch / Oktober 2015 Tagebuch
o YouTube o Flickr
AMTSGEHEIMNISSE
Texte
Zeit im Pilz
Gästebuch
Pilz Box
Pilz Bücher
Linkliste
Die Affäre "Kampusch"
Luftraum
FREITAG, 23. OKTOBER 2015
„ICH DARF DIE ANREGUNG WEITERGEBEN..."
DIE OPERATION TRANSIT IN EUROPA
28.2. 2002
Das Memorandum of Agreement MoA zwischen NSA und BND über Telekom-Überwachung in Europa wird abgeschlossen. Die NSA
darf den BND als Instrument zur Überwachung der Telekommunikation einsetzen.
16. September 2003
Die Überwachungsspezialisten der Deutschen Telekom AG erhalten einen „kleinen Auftrag". Aber der ist alles andere als klein. Das
belegt ein Mail, das Harald HELFRICH, der Mitarbeiter der "Regionalstelle für staatliche Sonderauflagen" ReSa der deutschen Telekom
AG seinem Kollegen Christof TIEGER sendet. Der Betreff verweist auf das kommende Projekt: „Analyse von Transit".
„Hallo LK,
wie heute morgen besprochen übersende ich Ihnen die Liste der Transit-Leitungen der DTAG. Wir bitten Sie die gelb unterlegten
Verbindungen bzgl. ihrer Führung (z.B. Ffm 21 oder Norden-Nordeich) und ob in der 2-Mb-Ebene greifbar, zu analysieren."
Anlage: „Trans mit ausgesuchten Strecken"
Die „gelb unterlegten Verbindungen" finden sich in der Beilage, der „Prioritätenliste" des BND. Die Deutsche Telekom hatte dem BND
eine Liste aller Transitverbindungen übergeben. Von 1028 Verbindungen haben Mitarbeiter des BND 256 gelb markiert. Jetzt soll die
ReSa feststellen, welche davon über Frankfurt laufen und daher dort angreifbar sind.
BND und Deutsche Telekom AG wissen jetzt wie es geht. Aber sie wissen nicht, ob die geplante Operation Transit legal ist - und ob sie
politisch gedeckt wird.
30. Dezember 2003
Ministerialdirektor Ernst UHRLAU dient als Geheimdienstkoordinator im Berliner Bundeskanzleramt . Frank Walter Steinmeier ist als
beamteter Staatsekretär im Bundeskanzleramt sein direkter politischer Vorgesetzter. Die Deutsche Telekom AG will dem Wunsch des
BND, auf Transitleitungen zugreifen zu können, nur dann nachkommen, wenn die Bundesregierung Rückendeckung gibt und einen
rechtlichen Blankoscheck ausstellt.
Das Bundeskanzleramt kommt dem Wunsch nach. Uhrlau faxt an den CEO der Deutschen Telekom AG, Kai-Uwe RICKE:
„Sehr geehrter Herr Ricke, sehr geehrter Herr Brauner,
das Bundeskanzleramt ist sehr interessiert, dass der Bundesnachrichtendienst im Rahmen seines gesetzlichen Auftrages
kabelgestützte Transitverkehre aufklärt. Der vom Bundesnachrichtendienst in Ihrem Unternehmen geplante Aufklärungsansatz steht
aus hiesiger Sicht in Einklang mit geltendem Recht.
Ich darf auf diesem Weg die Anregung des Bundesnachrichtendienstes weitergeben, in der Deutschen Telekom AG, T-Com, den
Bereich RA 43 (Staatliche Sonderauflagen), zu dem bereits im Rahmen der Strategischen Fernmeldekontrolle Kontakte bestehen, mit
der Durchführung der auf Seiten der Deutschen Telekom AG erforderlichen Maßnahmen zu beauftragen."
Damit hat das deutsche Bundeskanzleramt dem BND und der Deutschen Telekom AG mit einem juristischen Persilschein grünes Licht
gegeben.
13. Jänner 2004
Josef BRAUNER antwortet für den Vorstand der Deutschen Telekom AG in einem Brief an Ernst UHRLAU dem Bundeskanzleramt:
„Sehr geehrter Herr Ministerialdirektor,
gerne bestätigen wir Ihnen den Erhalt Ihres Schreibens vom 30. Dezember des letzten Jahres.
Die T-Com ist sich der Bedeutung eines gut funktionierenden Nachrichtendienstes für das Gemeinwesen der Bundesrepublik
Deutschland - insbesondere vor dem Hintergrund der terroristischen Angriffe des 11. September 2001 - bewusst und wird daher die
geplanten Aktivitäten des Bundesnachrichtendienstes, die kabelgestützten Transitverkehre im Rahmen seines gesetzlichen Auftrages
aufzuklären, unterstützen.
Entsprechend der Anregung des Bundesnachrichtendienstes wird diesseits unser Bereich RA43 (staatliche Sonderauflagen)
beauftragt, die hierfür von unserer Seite erforderlichen Maßnahmen vorzunehmen."
Die massiven rechtlichen Bedenken der Deutschen Telekom sind jetzt vom Tisch. Die Operation „Transit" kann gestartet werden.
1. März 2004
Die Deutsche Telekom AG und der Bundesnachrichtendienst unterzeichnen den Geschäftsbesorgungsvertrag „Transit". Darin
verpflichtet sich die Deutsche Telekom AG dem BND die Ableitung der gewünschten Leitungen zu ermöglichen und die Infrastruktur
dafür zur Verfügung zu stellen.
9. März 2004
Robert LAHN arbeitet im Büro für „technische Sonderaufgaben" im BND. Am 9. März erteilt er den Schaltauftrag an ReSa-Chef
Wolfgang ALSTER:
„Schaltauftrag
DTAG RA 433
Hallo Herr Alster,
Der Geschäftsbesorgungsvertrag „Transit" ist ja jetzt von beiden Seiten unterzeichnet und gestern habe ich die beiden ersten
Monatszahlungen veranlasst.
Daher erdreiste ich mich, Sie um die erste Schaltung von Leitungen zu bitten."
3. Februar 2005
Die Zuschaltungen beginnen.
8.15 Uhr:
Mail von KNAU/DTK an HELFRICH/DTK „betreff: STM1-Zuschaltung (Ffm 21 - Luxembourg 757/1)":
„Hallo Herr Helfrich,
Habe heute früh die o.g. Verbindung auf die Punkte 71/00/002/03 19 + 39 zugeschaltet. In der Anlage ist die Belegung lt. RUBIN
ersichtlich.
Auf den Kanälen 2, 6, 14, 50 befinden sich die in der Liste markierten DSVn mit der Endstelle Luxembourg.
Bitte um Rückmeldung ob das ganze funktioniert."
Anlage: „Belegung 7571 Luxbg"
10.42 Uhr:
Mail von HELFRICH/DTK an BND und ALSTER/DTK
„Hallo Hr. Siegert, Hr. Knau hat heute morgen wieder eine STM 1 zugeschaltet. in dieser befindet sich nun kein nationaler Verkehr
mehr (aus diesem Grunde fand auch die große Umschaltaktion statt). Die Verbindung Ffm 21 - Luxembourg 757/1 wurde auf die
Punkte 71 / 00/ 002 / 03 / 19 + 39 zugeschaltet. Vier der darin befindlichen 2MBit-Strecken befinden sich auf ihrer ersten
Prioritätenliste, diese sind zu finden auf:
Kanal 2: Luxembourg/VG - Wien/000 750/3
Kanal 6: Luxembourg//CLUX - Moscow/CROS 750/1
Kanal 14: Ankara/CTÜR - Luxembourg/CLUX 750/1
Kanal 50: Luxembourg/VG - Prague/000 750/1.
Bitte um eine kurze Rückmeldung, wenn alles o.k. ist. Ende nächste Woche folgt eine weitere STM1."
Damit wird die erste österreichische Verbindung von BND und NSA abgehört.
Aber die NSA erhält weit mehr als die vier Leitungen. In der abgehörten STM1 befinden sich 63 Kanäle. Sie alle konnten damit
abgeleitet und der NSA nach Bad Aibling überspielt werden.
Der damalige BND-Abteilungsleiter Reinhardt BREITFELDER beschreibt die Arbeitsweise vor dem NSA-Untersuchungsausschuss des
Deutschen Bundestages:
„Die (Datenströme) sind vorne geteilt worden, und zwar in einen G-10-Teil und in einen Routineteil. Dieser Routineteil wurde erst mal
G-10-gefiltert, weil man ja nie ausschließen kann, dass auch im Routineteil G 10 drin vorkommt. Nach dieser Filterung wurde dieser
Routineteil an die NSA in Deutschland, also in Bad Aibling unten, konkret weitergeleitet, und zwar nicht an die NSA direkt, sondern an
diese gemischte Arbeitsgruppe NSA-BND, die als JSA hier immer wieder auftaucht. So wurde das gemacht."
Am 14.2., am 25.2. und am 7.3.2005 erfolgen die nächsten Zuschaltungen.
Die Aktion Transit läuft in Frankfurt von März 2005 bis Mai 2008 im Vollbetrieb. 15 Mitarbeiter des BND überwachen so mehr als drei
Jahre lang einen großen Teil der europäischen und internationalen Telekommunikation vom Knoten in Frankfurt / Nied aus. Im Mai
2008 wissen NSA und BND, dass die Massenüberwachung funktioniert. Aber im Jahr 2008 haben sich die Technologie und damit die
Möglichkeiten der Überwachung weiter entwickelt.
28. Mai 2008
Siegfried KNAU/DTK sendet ein Mail an Harald HELFRICH/DTK und Wolfgang ALSTER(DTK
„Wie bereits fernmündlich besprochen, können nachfolgende STM1-Zuschaltungen mit sofortiger Wirkung aufgehoben werden:
Ffm 21 - Stuttgart 10 757/22A
Ffm21 - Paris 757/1
Ffm 21 - Reims 757/1
Ffm 21 - Luxembourg 757/1."
Damit wird die Ableitung dieser vier STM1-Leitungen in Frankfurt beendet. Aber ist das das Ende der NSA/BND-Telefonüberwachung?
Die Antwort gibt ein Mail vom Vortag:
27. Mai 2008
Schreiben von THORWALD/DTK an HELFRICH/DTK
„Sehr geehrter Herr Helfrich,
Wie wir bereits telefonisch besprochen, teile ich Ihnen mit, dass die Verarbeitung von reinen leitungsvermittelten „Transit-Verkehren"
von uns nicht mehr durchgeführt wird.
Aus diesem Grund kann die Ableitung der Transit-Verkehre in unseren Betriebsräumen eingestellt werden.
Im leitungsvermittelten Bereich (Ableitung auf höherer Ebene) besteht aktuell der Bedarf zur Ableitung von folgenden Verkehren:
+ 2 x STM-64
+ 4 x STM-16"
Die Massenüberwachung der europäischen Telefongespräche durch NSA und BND wird nicht eingestellt - sie wird „nur" auf ein
technisch weit höheres Niveau gestellt: Statt Verkehren in STM-1-Leitungen werden ab jetzt Verkehre vom Telefonat bis zu E-Mail,
SMS und Internet in STM-16- und STM-64-Leitungen mit der 16- bzw. 64-fachen Kapazität abgeleitet.
Die „Operation Transit" war der Einstieg in die NSA-Massenüberwachung europäischer Telekommunikation. Sie war der
entscheidende Wendepunkt zum ebenso umfassenden wie illegalen Überwachungsstaat - mit der Billigung durch die
Regierungen in Washington und Berlin.
http://www.peterpilz.at/2015-10/peter-pilz-tagebuch.htm
You are here: peterpilz.at> Diary
Diary / October 2015 diary
o YouTube o Flickr
Official secrets
Texts
Time in mushroom
Guestbook
Mushroom Box
Mushroom Books
Link List
The affair "Kampusch"
airspace
Friday, October 23, 2015
"May I Excitation passing on ..."
THE OPERATION TRANSIT IN EUROPE
28.2. 2002
The Memorandum of Agreement MoA between NSA and BND on telecom monitoring in Europe is finished. The NSA may use the BND
as a tool for monitoring telecommunications.
September 16, 2003
The monitoring specialists of Deutsche Telekom AG received a "small order". But that is anything but small. This is confirmed by an e-
mail that his colleague Christof Tieger sends Harald HELFRICH, the employees of the "Regional Centre for special government
regulations" ReSa of Deutsche Telekom AG. The subject refers to the upcoming project: "Analysis of Transit".
"Hi LK,
as this morning discussed I am sending you the list of transit lines by DTAG. We ask the yellow shaded links regarding. Its leadership
(eg Ffm 21 or north-north-calibration) and whether tangible to analyze in the 2-Mb-level. "
Plant: "Trans with selected lines"
The "yellow shaded compounds" can be found in the supplement, the "priority list" of the BND. The German Telekom had the BND
handed over a list of all transit connections. Of 1028 compounds BND 256 have highlighted in yellow. Now is the ReSa determine
which of them run over Frankfurt and therefore are vulnerable there.
BND and German Telekom AG now know how to do it. But they do not know whether the planned operation Transit is legal - and
whether it is politically covered.
December 30, 2003
Assistant Secretary of State Ernst Uhrlau serves as intelligence coordinator in the Berlin Chancellery. Frank Walter Steinmeier is a civil
servant State Secretary in the Federal Chancellery have direct political boss. The German Telekom AG wants the desire of the BND, to
have access to transit pipelines, only offspring, if the federal government is backing and a legal blank check issued.
The Federal Chancellery comes after the request. Uhrlau fax to the CEO of Deutsche Telekom AG, Kai-Uwe Ricke:
"Dear Mr. Doe, Mr Brown,
the Federal Chancellery is very interesting that the Federal Intelligence Service as part of its statutory mandate enlightens cable-based
transit traffic. The planned by the Federal Intelligence Service in your organization Enlightenment approach is of the view here in
compliance with applicable law.
I must pass on this way, the excitation of the Federal Intelligence Service, in Deutsche Telekom AG, T-Com, the RA section 43 (special
government regulations) to which there are contacts already resulting from the strategic telecommunications monitoring, to the
implementation of on the part of Deutsche Telekom to instruct AG necessary measures. "
Thus, the German Chancellor's Office gave the BND and the German Telekom AG with a clean bill of legal green light.
13th January 2004
Josef Brauner answers for the Executive Board of Deutsche Telekom AG in a letter to Ernst Uhrlau the Federal Chancellery:
"Dear Mr. Secretary,
We are happy to confirm receipt of your letter of 30 December of last year.
The T-Com recognizes the importance of a properly functioning intelligence service for the community of the Federal Republic of
Germany - especially in the light of the terrorist attacks of 11 September 2001 - aware and therefore the planned activities of the
Federal Intelligence Service, the cable-supported transit traffic within the framework of its legal responsibilities, educate, support.
According to the suggestion of the Federal Intelligence Service on this side our range RA43 (special government regulations) is
commissioned to make the necessary on our part for this action. "
The massive concerns Deutsche Telekom are now off the table. The operation "Transit" can be started.
March 1st, 2004
The German Telekom AG and the Federal Intelligence Service signed the agency agreement "Transit". In it, the German Telekom AG
is committed to enabling the BND to derive the desired lines and to provide the infrastructure for this purpose.
March 9, 2004
Robert LAHN working in the office for "special technical tasks" in BND On March 9, he issued the order to switch RESA Chef Wolfgang
ALSTER.:
"Switching order
DTAG RA 433
Hello Mr. Alster,
The Agency Agreement "Transit" is indeed now been signed by both sides and yesterday I led the first two monthly payments.
Therefore I erdreiste me to ask you about the first connection of transmission lines. "
February 3, 2005
The switch-ons begin.
8.15 Clock:
Mail of KNAU / DTK to HELFRICH / DTK "Subject: STM1-switching (FFM 21 - Luxembourg 757/1)":
"Hello Mr. Helfrich,
Have this morning the above connection is switched to the points 71/00/002/03 19 +. 39 In the complex the assignment RUBIN lt. Can
be seen.
On channels 2, 6, 14, 50 are marked in the list with the terminal are DSVN Luxembourg.
Request for feedback if the whole works. "
Plant: "Occupancy 7571 Luxbg"
10.42 Clock:
Mail from HELFRICH / DTK to BND and Alster / DTK "Hello Mr. Siegert, Hr. Knau today again switched an STM 1 tomorrow. This is
now no longer a national traffic (for this reason, also found the large switching action instead). The connection Ffm 21 - Luxembourg
757/1 been switched to points 71/00/002/03/19 +. 39 Four of the therein 2MBit trails are at their first priority list, this can be found on:
Channel 2: Luxembourg / VG - Wien / 000 750/3
channel 6: Luxembourg // CLUX - Moscow / CROS 750/1
channel 14: Ankara / CTÜR - Luxembourg / CLUX 750/1
channel 50: Luxembourg / VG - Prague / 000 750/1.
Please order a short feedback if everything is ok. End next week followed by another STM1. "
Thus the first Austrian combination of BND and NSA is listening.
But the NSA receives far more than the four lines. In the intercepted STM1 are 63 channels.They could all derived order and the NSA
will be dubbed to Bad Aibling.
The then Head of BND Reinhardt Breitfelder describes the operation before the NSA inquiry committee of the German Bundestag:
"The (data streams) have been divided front, in a G10 member and in a routine part. This routine part was only times G10 filtered,
because one can never rule out that even in routine part G 10 there exists. After this filtering this routine part of the NSA in Germany, ie
in Bad Aibling was passed down concretely, not directly to the NSA, but at this mixed working group NSA BND, which keeps coming up
here as JSA. So that was made. "
On 14.2., At 25.2. and on 7.3.2005 done the next switch-ons.
The Special Transit runs in Frankfurt from March 2005 to May 2008 in full operation. 15 employees of the BND monitor so more than
three years from a large part of the European and international telecommunications from the node in Frankfurt / Nied. In May 2008,
NSA and BND know that the mass surveillance works. But in 2008, have the technology and thus develop the possibilities of
surveillance.
May 28, 2008
Siegfried KNAU / DTK sends an email to Harald HELFRICH / DTK and Wolfgang ALSTER (DTK
"As discussed by telephone, following STM1 switch-ons can be canceled with immediate effect:
Ffm 21 - Stuttgart 10757 / 22A
Ffm21 - Paris 757/1
Ffm 21 - Reims 757/1
Ffm. 21 - Luxembourg 757/1 "
Thus, the derivation of these four STM1 lines in Frankfurt is terminated. But is that the end of the NSA / BND Wiretapping?
The answer is a mail from the previous day:
May 27, 2008
Be Thorwald / DTK to HELFRICH / DTK
"Dear Mr. Helfrich,
As we discussed over the phone, I inform you that the processing of pure circuit-switched "transit traffic" we will no longer be carried
out.
For this reason, the derivation of the transit traffic in our premises can be adjusted.
In circuit-switched portion (discharge at a higher level) is currently a need for the derivation of the following trades:
+ 2 x STM-64
+ 4 x STM-16 "
The mass monitoring of European calls by NSA and BND is not set - they will "only" put on a technically far higher level: instead will
operate in the STM-1 lines from now transports by telephone to email, SMS and Internet in STM-16 and STM-64 with the lines 16 or 64
times the capacity derived.
The "Operation Transit" was the introduction to the NSA mass surveillance European telecommunications She was the
decisive turning point for equally comprehensive as illegal surveillance state -. With the approval of the governments in
Washington and Berlin.
Send comment [8 comments] to top
Diary / October 2015 diary
o YouTube o Flickr
Official secrets
Texts
Time in mushroom
Guestbook
Mushroom Box
Mushroom Books
Link List
The affair "Kampusch"
airspace
<< Back
Friday, October 23, 2015
"May I Excitation PASS ..." THE OPERATION TRANSIT IN EUROPE 28.2. 2002 The Memorandum of Agreement MoA between NSA
and BND on telecom monitoring in Europe is finished. The NSA may use the BND as a tool for surveillance of telecommunications. 16 .
September 2003 The monitoring specialists of Deutsche Telekom AG received an
>> read more
answer
Reply:
Posted: 11/18/2015 14:06:15
as you can see on the basis of Paris was too little monitored. and with the results made too little. The Americans are right that
everything that smells just by extremism incarcerate at Guantanamo and
>> Read more
answer
Reply: white elite Posted: 11/22/2015 22:28:08
am überhaubt davür, vurauseilende to intern all non-white. Guantanamo in Europe, promises.
and is a rue!
answer
Reply:
Posted: 11/19/2015 22:47:07
Oida, you ghörst also eingsperrt and vagessn, AMIF .....
answer
Reply: NSA Posted: 10/28/2015 23:54:24
Good preparation Herrenpilz! However, they forgot our extremely effective tools that casual absolve us from European law and
ever. Yeah, we are the real cowboys Yahoooo, uh
>> read more
answer
Reply: no Posted: 10/25/2015 14:55:21
must of course not write that Nazi terror regime itself reveal the testimony they had therefore not warned disqualified himself and is a
pure
>> read more
answer
Reply: Peter Smith Posted: 10/24/2015 17:46:05
Can connect me only, thank you for their efforts to make this complex transparent. It would be interesting to clarify the question of what
is now the gentlemen in Berlin right under applicable law
>> read more
answer
Reply: Peter Smith Posted: 10/24/2015 18:18:15
Interesting side issue: Is the TTIP a figment of Article 2 North Atlantic Treaty, arranged "top" of the NATO and therefore a
secret? German Atlantic Society: lecture
>> read more
answer
Reply: Very Helfrich Posted: 10/23/2015 13:30:19
Thank you for your work, Mr Pilz. There is much more than a bad aftertaste in this Cabinet Merkel! Comprehensive monitoring appears
to be a large and cross-cutting issue here in fact
>> read more
answer
http://www.peterpilz.at/kommentar/2713/peter-pilz-tagebuch.htm#content
May 28, 2015
New details about the joint NSA-BND operation
Eikonal (Updated: October 7, 2015)
This weblog first reported about the joint NSA-BND operation Eikonal on October 15, 2014, but meanwhile
interesting new details became available from the hearings of the German parliamentary inquiry, and from
recent disclosures by a politician from Austria.
Under operation Eikonal, the NSA cooperated with the German foreign intelligence service BND for access
to transit cables from Deutsche Telekom in Frankfurt. Here follows an overview of what is known about
this operation so far. New information may be added as it comes available.
- Initial reporting - Parliamentary hearings -
- Disclosures from Austria -
> See for the latest: Unnoticed leak answers and raises questions about operation Eikonal
Initial reporting
Operation Eikonal was revealed by the regional German paper Süddeutsche Zeitungand the regional
broadcasters NDR and WDR on October 4, 2014. They reported that between 2004 and 2008, the German
foreign intelligence service BND had tapped into the Frankfurt internet exchange DE-CIX and shared the
intercepted data with the NSA.
For this operation, NSA provided sophisticated interception equipment, which the Germans didn't had but
were eager to use. Interception of telephone traffic started in 2004, internet data were captured since
2005. Reportedly, NSA was especiallyinterested in communications from Russia.
To prevent communications of German citizens being passed on to NSA, BND installed a special program
(called DAFIS) to filter these out. But according to the reporting, this filter didn't work properly from the
beginning. An initial test in 2003 showed the BND that 5% of the data of German citizens could not be
filtered out, which was considered a violation of the constitution.
Süddeutsche Zeitung reported that it was Deutsche Telekom AG (DTAG) that provided BND the access to
the Frankfurt internet exchange, and in return was paid 6000,- euro a month. But as some people noticed,
Deutsche Telekom was not connected to DE-CIX when operation Eikonal took place, so something didn't
add up.
As we will see, this was right, and the actual cable tap was not at DE-CIX, but took place at Deutsche
Telekom. Nonetheless, many press reports still link Eikonal to the DE-CIX internet exchange.
Operations center room in the former BND headquarters in Pullach
(Photo: Martin Schlüter - Click to enlarge)
Eikonal as part of RAMPART-A
As was first reported by this weblog on October 15, 2014, operation Eikonal was part of the NSA umbrella
program RAMPART-A, under which the Americans cooperate with3rd Party countries who "provide access
to cables and host U.S. equipment".
Details about the RAMPART-A program itself had already been revealed by the Danish
newspaper Information in collaboration with The Intercept on June 19, 2014. The program reportedly
involved at least five countries, but so far only Germany and, most likely, Denmark have been identified.
On October 20, Information published about a document from NSA's Special Source Operations (SSO)
division, which confirms that an operation codenamed "EIKANOL" was part of RAMPART-A and says it was
decommissioned in June 2008.
The slide below shows that under RAMPART-A a partner country taps an international cable at an access
point (A) and then forwards the data to a joint processing center (B). Equipment provided by the NSA
processes the data and analysts from the host country can then analyse the intercepted data (C), while
they are also forwarded to NSA sites in the US (D, E):
Parliamentary hearings
Because of the confusion about the role of Deutsche Telekom in operation Eikonal, the NSA investigation
commission of the German parliament (NSAUA) decided to alsoinvestigate whether this company assisted
BND in tapping the Frankfurt internet exchange.
During hearings of BND officials it became clear that operation Eikonal was not about tapping into the
Frankfurt internet exchange DE-CIX, but about one or more cables from Deutsche Telekom. This was
first confirmed by German media on December 4, 2014.
Hearing of November 6, 2014 (Live-blog)
According to witness T.B., who was heard on on November 6, 2014, it was just during the test period that
the filter system was only able to filter out 95% of German communications. When the system went live,
this percentage rose to 99% with a second stage that could filter out even more than 99%. When
necessary, a final check was conducted by hand.
Hearing of November 13, 2014 (Live-blog - Official transcript)
During this hearing, the witness W.K. said that Eikonal was a one of a kind operation, there was targeted
collection from traffic that transited Germany from one foreign country to another.
This was focussed on Afghanistan and anti-terrorism. Selected data were collected and forwarded to NSA.
The internal codename for Eikonal was Granat, but that name wasn't shared with NSA. There was even a
third codename.
For Germany, Eikonal was useful because it provided foreign intelligence for protecting German troops and
countering terrorism. The NSA provided better technical equipment that BND didn't had. In return, BND
provided NSA with data collected from transit traffic using search profiles about Afghanistan and anti-
terrorism. BND was asked to cooperate because NSA isn't able to do everything themselves.
Eikonal provided only several hundred useful phone calls, e-mail and fax messages a year, which was a
huge disappointment for NSA. This, combined with the fact that it proved to be impossible to 100%
guarantee that no German data were collected and forwarded, led BND to terminate the program.
For Eikonal, the cable traffic was filtered by using selectors provided by both NSA and BND. Although not
all selectors can be attributed to a particular country and there may have been up to several hundred
thousand selectors, witness W.K. said that BND was still able to check whether every single one was
appropriate: only selectors that could be checked were used.
> See also: German BND didn't care much about foreign NSA selectors
Hearing of December 4, 2014 (Live-blog - Official transcript)
During this hearing, BND-employee S.L., who was the project manager of operation Eikonal at BND
headquarters, testified. He told that BND had rented two highly secured rooms of ca. 4 x 6 meters in the
basement of a Deutsche Telekom switching center in the Frankfurt suburb Nied.
These rooms were only accessible for BND personnel and contained the front-end of the interception
system, existing of 19 inch racks, with telecommunications equipment like multiplexers, processors and
servers. These devices were remotely controlled from the headquarters in Pullach.*
Based upon analysis of public information about telecommunication networks, BND choose specific cables
that would most likely contain traffic that seemed useful for the goals of the operation. It became clear
that for redundancy purposes, cables only used 50% of their capacity. For example, 2 cables of 10 Gbit/s
carried only 5 Gbit/s of traffic, so in case of a disruption, one cable could take over the traffic of the other
one.
The switching center of Deutsche Telekom in Frankfurt-Nied
where some cables were tapped under operation Eikonal
(Screenshot: ZDF Frontal21 - Click to enlarge)
After a specific coax or fiber-optic cable had been selected, technicians of Deutsche Telekom installed a
splitter and a copy of the traffic was forwarded to one of the secure rooms, where it was fed into a (de-
)multiplexer or a router so the signal could be processed. After they got rid of the peer-to-peer and
websurfing traffic, the remaining communications data, like e-mail, were filtered by selectors from BND
and NSA.
The selected data were sent back to BND headquarters in Pullach over a leased commercial line, of which
the capacity was increased after the internet collection became fully operational. From Pullach to the JSA
in Bad Aibling there was a 2 Mbit/s line.
Timeframe
Eikonal started with access to a telephone cable (Leitungsvermittelt). Project manager S.L. told that the
first cable was connected (aufgeschaltet) in December 2004, but that it's signal was too weak. Therefore,
in January 2005, an amplifier was installed.
In February, March and April additional cables were connected, so telephony collection started in the
spring of 2005. By the end of 2006, Deutsche Telekom announced that its business model for dedicated
transit cables would be terminated, so in January 2007 the telephone collection ended.*
BND also wanted access to internet traffic (Paketvermittelt), for which the first cable became available by
the end of 2005, but because the backlink was missing, collection was technically not possible. This was
solved in 2006, and in the spring of 2006 a second cable was added, and they tested the front-end system
and subsequently the filter systems until mid-2007 (Probebetrieb).
During this stage, data were only forwarded to the joint NSA-BND unit JSA after a manual check. Fully
automated forwarding only happened from late 2007 until operation Eikonal was terminated in June 2008
(Wirkbetrieb).*
Legal issues
The collection of telephone communications from transit cables was done under the general authority of
the BND Act, with details specified in the "Transit Agreement" between BND and Deutsche Telekom, which
for the latter was signed by Bernd Köbele.
For the collection of internet data it was impossible to fully separate foreign and domestic traffic, so it
couldn't be ruled out that German communications were in there too. Therefore, BND requested an order
from the G10-commission, which, like the FISA Court in the US, has to approve data collection when their
own citizens could be involved.
A G10-order describes the communication channel (Germany to/from a specific foreign country) that BND
is allowed access to, the threat profile and it also authorizes the search terms that may be used for
filtering the traffic.*
Such an order allows the collection of G10-data (communications with one end German), which were
processed within BND's separate G10 Collection program. As a bycatch, this G10-interception also yielded
fully foreign traffic (Routine-Verkehre), which was used for operation Eikonal:
Some employees from Deutsche Telekom and from BND had doubts about the legality of this solution,
which seemed to use a G10-order as a cover for getting access to fully foreign internet traffic.
Eventually, the federal Chancellery, apparently upon request of the BND, issued a letter saying that the
operation was legal. This convinced the Telekom management and the operation went on. It didn't
become clear under what authority this letter was issued.
After BND had learned how to collect internet traffic from fiber-optic cable, it applied for G10-orders to intercept(one end German)
communications from 25 foreign and domestic internet service providers in 2008. This time these cables were being tapped at the DE-CIX
internet exchange, which is also in Frankfurt.
Results
The collection under operation Eikonal resulted in only a few hundred intelligence reports
(German: Meldungen) a year, each consisting of one intercepted e-mail, fax message or phone call. These
were burned onto a CD to hand them over to NSA personnel at the JSA.*
According to S.L., metadata (containing up to 91 fields) were "cleaned" so only technical metadata
(Sachdaten) were forwarded to the JSA, where they were used for statistical and analytical purposes.
Personal metadata (personenbezogene Daten), like e-mail and IP addresses were not shared. Technical
metadata are for example used to identify the telecommunication providers, transmission links and the
various protocols.
Hearing of December 18, 2014 (Live-blog - Official transcript)
During this hearing, a talkative general Reinhardt Breitfelder, head of the SIGINT division from 2003-
2006, confirmed many of the details from the earlier hearings of his subordinates. He also gave
impressions of the dilemmas in dealing with the NSA and what to do with the equipment they provide.
Hearing of January 15, 2015 (Live-blog - Official transcript)
In this hearing, the commission questioned two employees from Deutsche Telekom (Harald Helfrich and
Wolfgang Alster), but they provided very little new information, except for that Deutsche Telekom
personnel only knows between which cities a cable runs, but they don't know what kind of traffic it
contains - they are not allowed to look inside.
Hearing of October 1, 2015 (Live-blog)
Joachim Mewes from the Chancellary testified that somewhere in 2005, BND invited him and the G-10
Commission to visit the tapping site in Frankfurt, apparently as to show that no filtering took place there,
but that everything from the cable went to BND headquarters and was split up over there. This however
contradicts other testimonies, saying that filtering was conducted close to the access point.
A room where hearings of the parliamentary committee take place
(photo: DPA)
Disclosures from Austria
On May 15, 2015, Peter Pilz, member of the Austrian parliament for the Green party,disclosed an e-mail
from an employee of the Deutsche Telekom unit for lawful intercept assistance (Regionalstelle für
staatliche SonderAuflagen, ReSa), who notified someone from BND that apparently a particular fiber-optic
cable had been connected to the interception equipment. The e-mail describes this cable as follows:
Transit STM1 (FFM 21 - Luxembourg 757/1), containing 4 links of 2 Mbit/s:
Channel 2: Luxembourg/VG - Wien/000 750/3
Channel 6: Luxembourg/CLUX - Moscow/CROS 750/1
Channel 14: Ankara/CTÜR - Luxembourg/CLUX 750/1
Channel 50: Luxembourg/VG - Prague/000 750/1
STM1 stands for Synchronous Transport Module level-1, which designates a transmission bit rate of
155,52 Mbit/second. A similar multiplexing method isWavelength-Division Multiplexing (WDM) commonly
used in submarine fiber-optic cables. The latter having a much larger capacity, generally STM-64 or 9,5
Gbit/second.
The number 757 is a so-called Leitungsschlüsselzahl (LSZ), which denotes a certain type of cable. In this
case it stands for a channelized STM-1 base link (2 Mbit in 155 Mbit), which seem to be used for internal
connections.
According to the meanwhile updated LSZ List, the number 750 stands for a "DSV2Digitalsignal-
Verbindung 2 Mbit/s", which is a digital signal path.
The cable mentioned in the e-mail therefore only has a small capacity, which seems to indicate that NSA
and/or BND selected it carefully.
FFM 21 stands for "Frankfurt am Main 21", which according to Deutsche Telekom'snetwork map is the
name of the Point-of-Presence (PoP) located at its facility in the Frankfurt suburb Nied - the location where
that Eikonal tapping took place.
This means we have a physical cable running between Luxembourg and the Deutsche Telekom PoP in
Frankfurt, but containing channels to cities which are much further, so they have to connect to channels
within other physical cables that run from Frankfurt to Moscow, Prague, Vienna and Ankara, respectively:
As the e-mail is from February 3, 2005, it must relate to telephone collection, because for Eikonal, the first
cable containing internet traffic only became available by the end of that year.
The Transit agreement
On May 18, the Austrian tabloid paper Kronen Zeitung published the full "Transit Agreement"
(pdf) between BND and Deutsche Telekom, in which the latter agreed to provide access to transit cables,
and in return will be paid 6.500,- euro a month for the expenses. The agreement came into retrospective
effect as of February 2004.
This disclosure got little attention, but is rather remarkable, as such agreements are closely guarded
secrets. The Transit agreement existed in only two copies: one for BND and one for Deutsche Telekom.
It is not known how Pilz came into possession of these documents, but it seems the source must be
somewhere inside the German parliamentary investigation commission. They are the only persons outside
BND and Deutsche Telekom who, for the purpose of their inquiry, got access to the agreement and the
other documents.
Leaking these documents to Pilz seems not a very smart move, as it will further minimize the chance that
the commission will ever get access to the list of suspicious NSA selectors.
Country lists
On May 19, Pilz held a press conference (mp3) in Berlin, together with the chairman of the Green party in
Luxembourg and a representative of the German Green party. Here, Pilz presented a statement (pdf),
which includes the aforementioned e-mail, 10 questions to the German government, and two tables with
cable links to or from Austria and Luxembourg:
Lists of links that apparently were on a priority list of NSA.
LSZ = Leitungsschlüsselzahl (cable type indentifier);
Endstelle = Endpoint; Österreich = Austria.
(Source: Peter Pilz - Click to enlarge)
According to Pilz, the full list contains 254 (or 256) cable links. 94 of them connect EU member states, 40
run between EU members and other European countries like Switzerland, Russia, Serbia, Bosnia-
Herzegovina, Ukraine, Belarus and Turkey. 122 links connect European countries with nations all over the
world, with Saudi Arabia, Japan, Dubai and China being mentioned most.
The country which most links (71) run to or from is the Netherlands. The list for that country
was disclosed by Peter Pilz during a press conference in Brussels on May 28, 2015. The US, the UK and
Canada are not on the list, although there were apparently 156 links from/to Britain too.
Update:
On June 25, 2015, the Dutch telecommunications provider KPN announcedthe results of its inquiry into the
alleged tapping of its cables. It was very difficult to identify the channels in the list because meanwhile
KPN's whole network had been restructured. Eventually it became clear the connections (being channels
within cables and KPN only being responsible for the first half until Frankfurt) had been rented out under
telephony wholesale contracts, so it was impossible to trace individual customers or users.
Additional details
On June 5, 2015, Peter Pilz held a press conference in Paris, where he presented astatement
(.docx) containing a list of 51 transit links to or from France. Interestingly, this list now also includes some
additional technical identifiers for these links, which were apparently left out in the earlier ones:
First part of the list with links related to France
(Source: Peter Pilz - Click to enlarge)
On June 29, 2015, Peter Pilz presented a similar detailed list (.pdf) of 28 transit links to and from Poland.
According to the updated LSZ List, the new codes in these lists stand for:
- 703: VC3 Virtual Container connection with 48,960 MBit/s
- 710: (not yet known)
- 712: VC12 Virtual Container connection with 2,240 MBit/s
- 720: (not yet known)
- 730: (not yet known)
VC3 and VC12 are from the Synchronous Digital Hierarchy (SDH) protocol to transfer multiple digital bit
streams synchronously over optical fiber. This has the option for virtual containers for the actual payload
data. VC3 is for mapping 34/45 Mbit/s (E3/DS3) signals; VC4 for 140 Mbit/s (E4); VC12 for 2 Mbit/s (E1).
The new identifiers in this list stand for: O-nr.: Ordnungsnummer; GRUSSZ:Grundstücksschlüsselzahl;
FACHSZ: Fachschlüsselzahl.
No information about these identifiers was found yet, but by analysing the data in the list, it seems that
the FACHSZ codes are related to a telecom provider. France Telecom for example appears with FACHSZ
codes CFT, VPAS, VCP3, VB5 or 0.
The GRUSSZ number identifies a particular city, with the first two or three digits corresponding with the
international telephone country codes. The last two digits seem to follow a different scheme, as we can
see that a capital always ends with "10":
Paris = 33010
Lyon = 33190
Reims = 33680
Brussels = 32010
Prague = 42010
Oslo = 47010
Warsaw = 48010
Poznan = 48020
Moscow = 70010
It's possible that these are just internal codes used by Deutsche Telekom, as internationally, connections
between telephone networks are identified by Point Codes(PC). From the Snowden-revelations we know
that these codes are also used by NSA and GCHQ to designate the cable links they intercept.
> See also: How GCHQ prepares for interception of phone calls from satellite links
NSA or BND wish lists?
Initially, Peter Pilz claimed these links were samples from a priority list of the NSA, but on May 27,
he said in Switzerland, that the list was from BND, and was given to NSA, who marked in yellow the links
they wanted to have fully monitored.
The German parliamentary hearings were also not very clear about these lists. On December 4, project
manager S.L. confirmed that NSA had a wish list for circuit-switched transit links, but in the hearing from
January 15 it was said that there was a "wish list of BND" containing some 270 links. And on March 5,
former SIGINT director Urmann said he couldn't remember that NSA requested specific communication
links.
Maybe the solution is provided by the Dutch website De Correspondent, which reports that there is a much
larger list (probably prepared by BND) of some 1000 transit links, of which ca. 250 were marked in yellow
(probably those prioritized by NSA).
Whose cables?
Media reports say that these cables belong to the providers from various European countries, but that
seems questionable. As we saw in the aforementioned e-mail, it seems most likely that the lists show
channels within fiber-optic cables, and that the physical cables all run between the Deutsche Telekom
switching facility in Frankfurt and the cities we see in the lists.
In theory, these cables could be owned or operated by those providers mentioned in the lists, but then
they would rather connect at a peering point like the DE-CIX internet exchange, where providers exchange
traffic with eachother.
In this case, it seems more likely that the physical cables are part of Deutsche Telekom's Tier 1 network,
which is a worldwide backbone that connects the networks of lower-level internet providers.
Simplified structure of the Internet, showing how Tier 1, Tier 2 and Tier 3 providers
transit data traffic in a hierarchial way and how Tier 2 providers exchange
traffic directly through peering at an Internet eXchange Point (IXP)
(diagram: Wikimedia Commons - click to enlarge)
Questions
It is not clear how many of the over 250 links on the list were actually intercepted. We only know that for
sure for the STM-1 cable with the four channels described in the aforementioned e-mail from Deutsche
Telekom to BND.
Strange is the fact that during the parliamentary hearings, most BND witnesses spoke about "a cable in
Frankfurt", which sounds like one single physical cable, whereas the disclosures by Peter Pilz clearly show
that multiple channels must have been intercepted.
Update:
During the commission hearing of January 29, 2015, BND technical engineer A.S. said that under
operation Eikonal, telephone traffic came in with a data rate of 622 Mbit/s. This equals a standard STM-4
cable, which contains 252 channels of 2 Mbit/s. This number comes close to the channels on the "wish
list", but it seems not possible that those were all in just one physical cable.
Another question is whether it is possible to only filter the traffic from specific channels, or that one has to
have access to the whole cable.
It should be noted that not the entire communications traffic on these links was collected and stored, but
that it was filtered for specific selectors, like phone numbers and e-mail addresses. Only the traffic for
which there was a match was picked out and processed for analysis.
Possible targets
Based upon these documents, Peter Pilz filed a complaint (pdf) against 3 employees of Deutsche Telekom
and one employee of BND for spying on Austria, although at the same time he said he was convinced the
NSA was most interested not in Austrian targets, but in the offices of the UN, OPEC and OSCE in Vienna.
Apparently he didn't consider the fact that Eikonal was part of the RAMPART-A umbrella program, which is
aimed at targets in Russia, the Middle East and North Africa. Many cities mentioned in the disclosed lists
seem to point to Russia as target, and project manager S.L. testified that Eikonal was mainly used for
targets related to Afghanistan, which fits the fact that there are for example 13 links to Saudi Arabia.
Green party members from various countries claimed that this cable tapping was used for economical or
industrial espionage, but so far, there is no specific indication, let alone evidence for that claim.
Links and sources - LeMonde.fr: Deutsche Telekom a espionné la France pour le compte de la NSA
- Tagesschau.de: Europa verlangt Aufklärung von Berlin
- DeCorrespondent.nl: Er is geen enkel bewijs dat de Nederlandse kabels zijn afgetapt
- Volkskrant.nl: 71 KPN-internetverbindingen afgetapt door geheime diensten
- NRC.nl: Duitse BND tapte tientallen internetverbindingen KPN af
- DerStandard.at: BND-NSA-Affäre: Laut Pilz auch Spionage in Belgien und Niederlanden
- Golem.de: Telekom und BND Angezeigt: Es leakt sich was zusammen
- Zeit.de: Daten abfischen mit Lizenz aus dem Kanzleramt
Geplaatst door P/K op 23:22
Email ThisBlogThis!Share to TwitterShare to FacebookShare to Pinterest
Labels: Eikonal, Germany, NSA Partnerships
No comments:
Post a Comment
http://electrospaces.blogspot.com/2015/05/new-details-about-joint-nsa-bnd.html