Greek telephone tapping case 2004-2005
Encyclopedia
The Greek wiretapping case of 2004-2005, also referred to as Greek Watergate, involved the illegal tapping
of more than 100 mobile phone
s on the Vodafone Greece
network belonging mostly to members of the Greek
government and top-ranking civil servants. The taps began sometime near the beginning of August 2004 and were removed in March 2005 without discovering the identity of the perpetrators.
The phones tapped included those of the Prime Minister Kostas Karamanlis and members of his family, the Mayor of Athens
, Dora Bakoyannis
, most phones of the top officers at the Ministry of Defense, the Ministry of Foreign Affairs, the Ministry for Public Order, members of the ruling party, ranking members of the opposition Panhellenic Socialist Movement
party (PASOK), the Hellenic Navy General Staff, the previous Minister of Defense and one phone of a locally hired Greek American employee of the American Embassy. Phones of Athens-based Arab businessmen were also tapped.
Foreign and Greek media have raised United States
intelligence agencies as the main suspects. AFP reported that one Greek official stated on background that the likely initial penetration occurred during the run-up to the 2004 Athens Olympics, stating: "it is evident that the wiretaps were organized by foreign intelligence agencies, for security reasons related to the 2004 Olympic Games
." The leader of the PASOK
socialist opposition George Papandreou said that the Greek government itself had pointed towards the US as responsible of the wiretaps by giving up the zone of listening range, in which the US embassy was included. However, the identity of the perpetrators was never conclusively established, in large part due to the botched manner in which the investigation was handled, initially by Vodafone and then by the Greek authorities.
switches
used by Vodafone Greece were compromised and unauthorized software was installed that made use of legitimate tapping modules, known as “lawful interception
”, while bypassing the normal monitoring and logging that would take place when a legal tap is set up. This software was eventually found to be installed on four of Vodafone's Ericsson AXE telephone exchanges
.
In modern mobile telecommunication networks, legal wiretaps, known as lawful interception
s, are performed at the switch. Ericsson AXE telephone exchanges support lawful intercepts via the remote-control equipment subsystem (RES), which carries out the tap, and the interception management system (IMS), software used for initiating addition of the tap to the RES database.
In a fully operating lawful interception system the RES and IMS both create logs of all numbers being taped allowing system administrators to perform audits in order to find unauthorized taps.
To successfully wiretap phone numbers without detection, as the intruders did, a special set of circumstances had to be present. The RES had to be active on the exchange, but the IMS had to be unused. At the time of the illegal wiretaps, Vodafone had not yet purchased the lawful intercept options, meaning the IMS was not present on their systems. However, an earlier exchange software upgrade had included the RES. In addition, the intruders needed to continue to have access to the exchange software to change tapped numbers, without alerting system administrators that the exchange had been modified. Normally, all changes to exchange software would be logged. To get around this, the intruders installed a rootkit
on the exchange, a piece of software that would modify the exchange software on the fly to hide all changes and, in case of an audit, to make the exchange appear as though it had been untouched.
When one of the tapped phones made or received a phone call, the exchange, or switch, sent a duplication of the conversation to one of fourteen anonymous prepaid mobile phones. As these phones are not associated with a contract, retrieving details of their owners is very difficult. About half of the intercepting phones were activated between June and August 2004. The base stations that serviced those phones were in an area near the center of Athens.
not being sent. Vodafone Greece
sent firmware dumps of the affected exchanges to Ericsson
for analysis. On March 4, 2005, Ericsson located the rogue code, 6500 lines of code written in the PLEX programming language
used by Ericsson AXE switches. Writing such sophisticated code in a very esoteric language required a high level of expertise. Much of Ericsson's software development for AXE had been done by an Athens-based company named Intracom Telecom, so the skills needed to write the rogue software were likely available within Greece.
On March 7, 2005, Ericsson notified Vodafone
of the existence of rogue wiretaps and software in their systems. The next day the general manager of the Greek Vodafone branch, George Koronias, asked for the software to be removed and deactivated. Because the rogue software was removed before law enforcement had an opportunity to investigate, the perpetrators were likely alerted that their software had been found and had ample opportunity to turn off the "shadow" phones to avoid detection. According to the head of Greece's intelligence service, Ioannis Korantis: "From the moment that the software was shut down, the string broke that could have lead us to who was behind this."
On March 9, the Network Planning Manager for Vodafone Greece, Kostas Tsalikidis
, was found dead in an apparent suicide. According to several experts questioned by the Greek press, Tsalikidis was a key witness in the investigation of responsibility of the wiretaps. Family and friends believe there are strong indications he was the person who first discovered that highly sophisticated software had been secretly inserted into the Vodafone network. Tsalikidis had been planning for a while to quit his Vodafone job but told his fiancée not long before he died that it had become "a matter of life or death" that he leave, says the family's lawyer, Themis Sofos. There is speculation that either he committed suicide because of his involvement in the tapping of the phones, or he was murdered because he had discovered, or was about to discover, who the perpetrators were. After a four-month investigation of his death, Supreme Court prosecutor Dimitris Linos said that the death of Tsalikidis was directly linked to the scandal. "If there had not been the phone tapping, there would not have been a suicide," he said.
In November, 2007, press reports in Greece quoted the Tsalikas family attorney, Themistokles Sofos, as saying they had commenced legal action against Vodafone, "suspect[ing] he was poisoned".
On March 10 Koronias asked to meet Prime Minister Karamanlis to discuss matters of national security. At 20:00 on the same day he presented the facts to the Minister of Public Order and the Prime Minister's chief of staff, and on the next day he presented them to the Prime Minister.
A preliminary judicial investigation was carried out, which due to the complexity of the case, lasted until February 1, 2006. The preliminary investigation did not point out any persons connected with the case. The investigation was hindered by the fact that Vodafone disabled the interception system, and therefore locating the intercepting phones was no longer possible (the phones were apparently switched off), and that Vodafone had incorrectly purged all access logs. Police rounded up and questioned as suspects persons who called the monitoring phones, but all callers claimed they called these phones because their number was previously used by another person.
Ericsson
has checked their equipment in other markets world-wide and has not found the illegal software installed anywhere else. "As far as Ericsson knows, this is a unique incident. We have never discovered anything like this before or since." Vodafone spokesman Ben Padovan said.
A recent appeal of the main opposition party, PASOK
, to form an investigating parliamentary committee was rejected by the governing party.
In December 2006 Vodafone Greece was fined €
76 million by the Communications Privacy Protection Authority, a Greek privacy watchdog group, for the illegal wiretapping of 106 cellphones. The fine were calculated as €500,000 for each phone that was eavesdropped on, as well as a €15 million fine for impeding their investigation.
On October 19, 2007, Vodafone Greece was again fined €19 million by EETT, the national telecommunications regulator, for alleged breach of privacy rules.
Telephone tapping
Telephone tapping is the monitoring of telephone and Internet conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitoring connection was an actual electrical tap on the telephone line...
of more than 100 mobile phone
Mobile phone
A mobile phone is a device which can make and receive telephone calls over a radio link whilst moving around a wide geographic area. It does so by connecting to a cellular network provided by a mobile network operator...
s on the Vodafone Greece
Vodafone Greece
Vodafone Greece is the Greek subsidiary of Vodafone. Its headquarters are in Halandri - one of the northern suburbs of Athens.Vodafone Greece was established in Greece in 1992 – under the trade name Panafon – with the participation of Vodafone Group Plc., France Telecom, Intracom and Data Bank, and...
network belonging mostly to members of the Greek
Greece
Greece , officially the Hellenic Republic , and historically Hellas or the Republic of Greece in English, is a country in southeastern Europe....
government and top-ranking civil servants. The taps began sometime near the beginning of August 2004 and were removed in March 2005 without discovering the identity of the perpetrators.
The phones tapped included those of the Prime Minister Kostas Karamanlis and members of his family, the Mayor of Athens
Athens
Athens , is the capital and largest city of Greece. Athens dominates the Attica region and is one of the world's oldest cities, as its recorded history spans around 3,400 years. Classical Athens was a powerful city-state...
, Dora Bakoyannis
Dora Bakoyannis
Dora Bakoyannis , born Theodora Mitsotaki , is a Greek politician. From 2006 to 2009 she was Minister of Foreign Affairs of Greece, the highest position ever held by a woman in the Cabinet of Greece; she was also Chairperson-in-Office of the Organization for Security and Co-operation in Europe in...
, most phones of the top officers at the Ministry of Defense, the Ministry of Foreign Affairs, the Ministry for Public Order, members of the ruling party, ranking members of the opposition Panhellenic Socialist Movement
Panhellenic Socialist Movement
The Panhellenic Socialist Movement , known mostly by its acronym PASOK , is one of the two major political parties in Greece. Founded on 3 September 1974 by Andreas Papandreou, in 1981 PASOK became Greece's first social democratic party to win a majority in parliament.The party is a socialist party...
party (PASOK), the Hellenic Navy General Staff, the previous Minister of Defense and one phone of a locally hired Greek American employee of the American Embassy. Phones of Athens-based Arab businessmen were also tapped.
Foreign and Greek media have raised United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
intelligence agencies as the main suspects. AFP reported that one Greek official stated on background that the likely initial penetration occurred during the run-up to the 2004 Athens Olympics, stating: "it is evident that the wiretaps were organized by foreign intelligence agencies, for security reasons related to the 2004 Olympic Games
2004 Summer Olympics
The 2004 Summer Olympic Games, officially known as the Games of the XXVIII Olympiad, was a premier international multi-sport event held in Athens, Greece from August 13 to August 29, 2004 with the motto Welcome Home. 10,625 athletes competed, some 600 more than expected, accompanied by 5,501 team...
." The leader of the PASOK
Panhellenic Socialist Movement
The Panhellenic Socialist Movement , known mostly by its acronym PASOK , is one of the two major political parties in Greece. Founded on 3 September 1974 by Andreas Papandreou, in 1981 PASOK became Greece's first social democratic party to win a majority in parliament.The party is a socialist party...
socialist opposition George Papandreou said that the Greek government itself had pointed towards the US as responsible of the wiretaps by giving up the zone of listening range, in which the US embassy was included. However, the identity of the perpetrators was never conclusively established, in large part due to the botched manner in which the investigation was handled, initially by Vodafone and then by the Greek authorities.
Exploitation of Vodafone's network
The EricssonEricsson
Ericsson , one of Sweden's largest companies, is a provider of telecommunication and data communication systems, and related services, covering a range of technologies, including especially mobile networks...
switches
Telephone exchange
In the field of telecommunications, a telephone exchange or telephone switch is a system of electronic components that connects telephone calls...
used by Vodafone Greece were compromised and unauthorized software was installed that made use of legitimate tapping modules, known as “lawful interception
Lawful interception
Lawful interception is obtaining communications network data pursuant to lawful authority for the purpose of analysis or evidence. Such data generally consist of signalling or network management information or, in fewer instances, the content of the communications...
”, while bypassing the normal monitoring and logging that would take place when a legal tap is set up. This software was eventually found to be installed on four of Vodafone's Ericsson AXE telephone exchanges
AXE telephone exchange
The AXE telephone exchange is a product line of circuit switched digital telephone exchanges manufactured by Ericsson, a Swedish telecom company. It was developed in 1974 by Ellemtel, a research and development subsidiary of Ericsson and Televerket.. The first system was deployed in 1976...
.
In modern mobile telecommunication networks, legal wiretaps, known as lawful interception
Lawful interception
Lawful interception is obtaining communications network data pursuant to lawful authority for the purpose of analysis or evidence. Such data generally consist of signalling or network management information or, in fewer instances, the content of the communications...
s, are performed at the switch. Ericsson AXE telephone exchanges support lawful intercepts via the remote-control equipment subsystem (RES), which carries out the tap, and the interception management system (IMS), software used for initiating addition of the tap to the RES database.
In a fully operating lawful interception system the RES and IMS both create logs of all numbers being taped allowing system administrators to perform audits in order to find unauthorized taps.
To successfully wiretap phone numbers without detection, as the intruders did, a special set of circumstances had to be present. The RES had to be active on the exchange, but the IMS had to be unused. At the time of the illegal wiretaps, Vodafone had not yet purchased the lawful intercept options, meaning the IMS was not present on their systems. However, an earlier exchange software upgrade had included the RES. In addition, the intruders needed to continue to have access to the exchange software to change tapped numbers, without alerting system administrators that the exchange had been modified. Normally, all changes to exchange software would be logged. To get around this, the intruders installed a rootkit
Rootkit
A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
on the exchange, a piece of software that would modify the exchange software on the fly to hide all changes and, in case of an audit, to make the exchange appear as though it had been untouched.
When one of the tapped phones made or received a phone call, the exchange, or switch, sent a duplication of the conversation to one of fourteen anonymous prepaid mobile phones. As these phones are not associated with a contract, retrieving details of their owners is very difficult. About half of the intercepting phones were activated between June and August 2004. The base stations that serviced those phones were in an area near the center of Athens.
Discovery of illegal taps
On January 24, 2005, an intruder update of exchange software resulted in customer text messagesShort message service
Short Message Service is a text messaging service component of phone, web, or mobile communication systems, using standardized communications protocols that allow the exchange of short text messages between fixed line or mobile phone devices...
not being sent. Vodafone Greece
Vodafone Greece
Vodafone Greece is the Greek subsidiary of Vodafone. Its headquarters are in Halandri - one of the northern suburbs of Athens.Vodafone Greece was established in Greece in 1992 – under the trade name Panafon – with the participation of Vodafone Group Plc., France Telecom, Intracom and Data Bank, and...
sent firmware dumps of the affected exchanges to Ericsson
Ericsson
Ericsson , one of Sweden's largest companies, is a provider of telecommunication and data communication systems, and related services, covering a range of technologies, including especially mobile networks...
for analysis. On March 4, 2005, Ericsson located the rogue code, 6500 lines of code written in the PLEX programming language
PLEX (programming language)
PLEX is a special-purpose, pseudo-parallel and event-driven real-time programming language. Dedicated for AXE telephone exchanges, it was developed by Göran Hemdahl at Ericsson. Originally designed in the 1970s, it has been continuously evolving since then...
used by Ericsson AXE switches. Writing such sophisticated code in a very esoteric language required a high level of expertise. Much of Ericsson's software development for AXE had been done by an Athens-based company named Intracom Telecom, so the skills needed to write the rogue software were likely available within Greece.
On March 7, 2005, Ericsson notified Vodafone
Vodafone Greece
Vodafone Greece is the Greek subsidiary of Vodafone. Its headquarters are in Halandri - one of the northern suburbs of Athens.Vodafone Greece was established in Greece in 1992 – under the trade name Panafon – with the participation of Vodafone Group Plc., France Telecom, Intracom and Data Bank, and...
of the existence of rogue wiretaps and software in their systems. The next day the general manager of the Greek Vodafone branch, George Koronias, asked for the software to be removed and deactivated. Because the rogue software was removed before law enforcement had an opportunity to investigate, the perpetrators were likely alerted that their software had been found and had ample opportunity to turn off the "shadow" phones to avoid detection. According to the head of Greece's intelligence service, Ioannis Korantis: "From the moment that the software was shut down, the string broke that could have lead us to who was behind this."
On March 9, the Network Planning Manager for Vodafone Greece, Kostas Tsalikidis
Kostas Tsalikidis
Kostas Tsalikidis died on March 9th, 2005 at the age of 39 during the Greek telephone tapping case 2004-2005 scandal- it looked like a suicide.Tsalikidis was Vodafone’s - Greece, Network Planning Manager...
, was found dead in an apparent suicide. According to several experts questioned by the Greek press, Tsalikidis was a key witness in the investigation of responsibility of the wiretaps. Family and friends believe there are strong indications he was the person who first discovered that highly sophisticated software had been secretly inserted into the Vodafone network. Tsalikidis had been planning for a while to quit his Vodafone job but told his fiancée not long before he died that it had become "a matter of life or death" that he leave, says the family's lawyer, Themis Sofos. There is speculation that either he committed suicide because of his involvement in the tapping of the phones, or he was murdered because he had discovered, or was about to discover, who the perpetrators were. After a four-month investigation of his death, Supreme Court prosecutor Dimitris Linos said that the death of Tsalikidis was directly linked to the scandal. "If there had not been the phone tapping, there would not have been a suicide," he said.
In November, 2007, press reports in Greece quoted the Tsalikas family attorney, Themistokles Sofos, as saying they had commenced legal action against Vodafone, "suspect[ing] he was poisoned".
On March 10 Koronias asked to meet Prime Minister Karamanlis to discuss matters of national security. At 20:00 on the same day he presented the facts to the Minister of Public Order and the Prime Minister's chief of staff, and on the next day he presented them to the Prime Minister.
A preliminary judicial investigation was carried out, which due to the complexity of the case, lasted until February 1, 2006. The preliminary investigation did not point out any persons connected with the case. The investigation was hindered by the fact that Vodafone disabled the interception system, and therefore locating the intercepting phones was no longer possible (the phones were apparently switched off), and that Vodafone had incorrectly purged all access logs. Police rounded up and questioned as suspects persons who called the monitoring phones, but all callers claimed they called these phones because their number was previously used by another person.
Ericsson
Ericsson
Ericsson , one of Sweden's largest companies, is a provider of telecommunication and data communication systems, and related services, covering a range of technologies, including especially mobile networks...
has checked their equipment in other markets world-wide and has not found the illegal software installed anywhere else. "As far as Ericsson knows, this is a unique incident. We have never discovered anything like this before or since." Vodafone spokesman Ben Padovan said.
Fallout
The investigation into the matter was further hampered when Greek law enforcement officials began to make accusations at both Vodafone and Ericsson, which forced experts on the defensive.A recent appeal of the main opposition party, PASOK
Panhellenic Socialist Movement
The Panhellenic Socialist Movement , known mostly by its acronym PASOK , is one of the two major political parties in Greece. Founded on 3 September 1974 by Andreas Papandreou, in 1981 PASOK became Greece's first social democratic party to win a majority in parliament.The party is a socialist party...
, to form an investigating parliamentary committee was rejected by the governing party.
In December 2006 Vodafone Greece was fined €
Euro
The euro is the official currency of the eurozone: 17 of the 27 member states of the European Union. It is also the currency used by the Institutions of the European Union. The eurozone consists of Austria, Belgium, Cyprus, Estonia, Finland, France, Germany, Greece, Ireland, Italy, Luxembourg,...
76 million by the Communications Privacy Protection Authority, a Greek privacy watchdog group, for the illegal wiretapping of 106 cellphones. The fine were calculated as €500,000 for each phone that was eavesdropped on, as well as a €15 million fine for impeding their investigation.
On October 19, 2007, Vodafone Greece was again fined €19 million by EETT, the national telecommunications regulator, for alleged breach of privacy rules.
See also
- National Committee of Telecommunications and PostEETTThe Hellenic Telecommunications and Post Commission or EETT is the Greek national regulatory authority for of the telecommunication and postal markets....
- Kostas TsalikidisKostas TsalikidisKostas Tsalikidis died on March 9th, 2005 at the age of 39 during the Greek telephone tapping case 2004-2005 scandal- it looked like a suicide.Tsalikidis was Vodafone’s - Greece, Network Planning Manager...
- NSA warrantless surveillance controversyNSA warrantless surveillance controversyThe NSA warrantless surveillance controversy concerns surveillance of persons within the United States during the collection of foreign intelligence by the U.S. National Security Agency as part of the war on terror...
- Covert listening deviceCovert listening deviceA covert listening device, more commonly known as a bug or a wire, is usually a combination of a miniature radio transmitter with a microphone. The use of bugs, called bugging, is a common technique in surveillance, espionage and in police investigations.A bug does not have to be a device...
(includes others cases) - The Cuckoo's Egg (book)The Cuckoo's Egg (book)The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage is a 1989 book written by Clifford Stoll. It is his first-person account of the hunt for a computer cracker who broke into a computer at the Lawrence Berkeley National Laboratory .-Summary:Clifford Stoll managed some...
External links
- International Herald Tribune: Greek cell phones tapped
- Athens News Agency: Gov't: Unprecedented mobile phone-tapping plot uncovered
- Greek Government Press Briefing, 06-02-02, partial English translation
- The Athens Affair by Vassilis Prevelakis and Diomidis Spinellis, IEEE Spectrum, 44(7):26–33, July 2007