Netizen Report: Researchers Shed Light on the Origins of Malware

Global Voices Advocacy’s Netizen Report offers an international snapshot of challenges, victories, and emerging trends in Internet rights around the world.

Activists and journalists around the world are increasingly reporting malware infection from what appear to be state-sponsored attackers, often using technologies purchased by surveillance firms like Hacking Team and Gamma International.

While this may sound like entirely bad news, the prevalence of malware — and the rising numbers of people who report receiving it — has allowed technical researchers to develop greater capacities to trace the building blocks and origins of malicious software, thereby shedding light on what often seems like a mysterious type of technology.

A new report from the Citizen Lab documents a four-year campaign of targeted spyware attacks against UAE journalists, activists and dissidents’ email and Twitter accounts. The attacks, which Citizen Lab attributes to someone they’re calling “Stealth Falcon”, are likely linked to the UAE government. At least six people targeted in these attacks have been either arrested, sought for arrest or convicted in absentia by the UAE in relation to their Twitter activity. This should come as no surprise — the UAE was the second biggest customer of targeted spyware firm Hacking Team, and paid the company over $634,500 to deploy spyware on 1,100 people.

There’s hope that more similar research will emerge in the coming months. A new collaborative software project, launched by a team of security researchers calling themselves the Digital Freedom Alliance, aims to document these cases by collecting incidents of state-sponsored malware infections from places like Citizen Lab and TargetedThreats.net. The group plans to develop maps of these threats, indicating the type of malware used, target type, the date of infection, and the location of the server used to control the malware.

Will Ghana shut down social media platforms on election day?

Although Ghana’s Communications Minister promised not to ban mobile apps for calls like WhatsApp and Skype, Ghanaian police now are considering a plan to shut down access to social media services during the country’s general elections in November. Ghana’s Inspector General of Police John Kudalor told reporters:

…if it becomes critical on the eve and also on the election day, we shall block all social media as other countries have done. We’re thinking about it. We are also thinking about the other alternative that the police should be IT compliant and get our own social media [account] to be able to stop these things on time.

The proposal has been widely opposed by lawyers, journalists, and netizens in Ghana, who expressed concerns that one of the continent’s stronger democracies is following precedents set by autocracies like Uganda.

Singapore police investigate political activists, seize electronics

Singapore police launched investigations into political blogger Roy Ngerng and human rights lawyer Teo Soh Lung, alleging that they had breached rules related to election advertising by posting messages on Facebook on and before election day. After two hours’ worth of interrogations on May 31, police searched their respective homes, seizing electronic devices including desktop computers, laptops, hard drives, and mobile phones. Police did not present a warrant for the search, despite pleas from Soh Lung’s lawyer. Following the search, Ngerng was made to hand over passwords to his laptop, phone and Facebook account.

Both Ngerng and Soh Lung have faced challenges from authorities in the past. Soh Lung, a lawyer and former candidate for the Singapore Democratic Party, was detained without trial in the late 1980s under Singapore’s Internal Security Act.

Algerian labor activist jailed for criticizing judiciary on Facebook

The first instance court in the city of Laghouat, Algeria sentenced a labor rights activist to six months in prison over a video he posted on Facebook. In the video, Belkacem Khencha, national coordinator of the Algerian League for the Defense of Workers’ Rights, criticized the court’s decision to sentence a friend and fellow activist to 18 months in prison for protesting government housing policies. The court ruled that Khencha violated a section of Algeria’s penal code which prohibits “casting discredit on the decisions of the courts.”

Power shortages leave Venezuelans offline and in the dark (literally)

Telecommunications and Internet connection quality are steadily deteriorating as Venezuela’s economic and political crisis worsens. In an effort to ration power, authorities have instituted country-wide power cuts that typically last for three or four hours each day, leaving a wide range of public and professional sector services inoperable. Outages have led to damaged devices, mobile phone network failures, and connectivity issues for hours after the electricity has been restored. Venezuela also now boasts one of the slowest Internet connections in Latin America — according to Akamai and Venezuelan Internet research group Acceso Libre, Venezuelans “enjoyed” an average Internet speed of 1.5 Mbps in 2015.

Gay dating apps leak key location data, leaving users at risk

Gay dating apps like Grindr, Hornet, and Jack’d may leak detailed location data that can allow one to locate a user with a margin of error of just a meter, according to a paper recently published by a Kyoto-based security researcher. The information can be obtained even if the user has chosen to obscure their location in the app’s settings. This is particularly concerning for app users in regions where homophobia is common or homosexual acts are illegal.

Turkey Crackdown Chronicle

Turkish journalist Özgür Öğret has been working with the Committee to Protect Journalists to produce a weekly report called the “Turkey Crackdown Chronicle,” where he describes ongoing government threats against digital and traditional journalists reporting on politics, violence and corruption in Turkey. Read this week’s installment here.

New Research

• Safer, Smarter Journalism: Survey on Digital Security in South Asia’s Media – International Federation of Journalists and South Asia Media Solidarity Network

• Stifling Dissent: The Criminalization of Peaceful Expression in India – Human Rights Watch

• Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents – Citizen Lab

The Netizen Report is produced by Global Voices Advocacy. Ellery Roberts Biddle, Marianne Diaz, Weiping Li, Sarah Myers West, and Kofi Yeboah contributed to this report.