Leaked memo outlines backdoor usage for government intercepts

Last week, The Tech Herald reported on the Indian group Lords of Dharmaraja, and their plan to release information taken from a recent breach of servers maintained by India’s military intelligence division. The story focused on Symantec’s source code, but has since expanded to India’s use of communication intercept protocols.

As it turns out, the Lords of Dharmaraja released a memo where a group of vendors known as RINOA (RIM, Nokia, and Apple), are said to have provided India with backdoors into their technology in order to them to maintain a presence in the local market space. These backend offerings allowed the military to conduct surveillance (RINOA SUR) against the US-China Economic and Security Review Commission.

Symantec is mentioned as well, with a sentence in the memo pertaining to them delivering source code for mobile platforms, but it also says that India’s Ministry of Defense has “an agreement with all major device vendors” to provide the country with the source code and information needed for their SUR (surveillance) platform.

Accordingly, the memo adds, personnel from Indian Naval Military Intelligence were dispatched to the People’s Republic of China to undertake Telecommunications Surveillance (TESUR) using the RINOA source code and CYCADA-based technologies.

In essence, the memo outlines the fact that India has a monitoring program in place that can track Internet (LAN, VPN, POP3), as well as telecomm-related communications. All of this made possible by the vendors, who offered backdoors and source code to the government. Yet, the vendors had little choice, if they wished to do business in India, one of the world’s largest markets for IT services. To prove that the TESUR operation leveraging RINOA SUR-based controls were effective, the memo included comments intercepted by the Indian government.

Overall, the memo expressed the fact that India’s Military Intelligence was pleased with the RINOA SUR platform.

Lawful Interception and IT Intrusion technologies are nearly as old as the laws allowing their usage. The existence of these tools has created a billion dollar industry, attracting organizations large and small, offering an assortment of wares to monitor communications and people.

By and large, the technologies are used legally by those controlling them. The U.S. has such technologies, and so does the U.K., Israel, Iran, Egypt, and nearly all other major governments on the planet. Seeing India on the list isn’t a shock.

Speaking about the memo and its impact, security and privacy researcher Christopher Soghoian commented, “Due to export control [requirements], NSA (and until 2010, Commerce Dept) have source code for all US made enterprise security/communications products.”

“Instead of worrying about hackers getting access to 5+ year old Norton code we should worry about what NSA/US Military does with recent code.”

He has a point, but it is unlikely that the U.S. will comment.

As an example of what intercept and monitoring tools can do, here are just two firms that offer such technologies, to governments all over the globe.

Shoghi Communications Ltd.

Focused on communications and signals intelligence, this firm is located in northern India, rather close to Pakistan. They work with governments mainly, based on company information, but offer some solutions to law enforcement as well.

Some of the technology available includes voice analysis, which goes hand in hand with the interception products that can listen to conversations on any platform. In addition to the voice-based monitoring and interception products, Shoghi offers the ability for agencies to collect, decode and analyze Wi-Fi IP traffic.

“The system can decode and re-construct captured IP packets like HTTP, FTP, SMTP, POP, chat and IP telephony etc. (Further protocols can be made available on request), from all 802.11x channel in stealth mode… The system is capable of capturing traffic on all fourteen 802.11x channels simultaneously [with or without] applying any capture filter,” product data explains.

“The system is capable of recovering WEP, WPA, WPA2-PSK keys. The SCL- 2052 has an additional option for an FPGA based key recovery accelerator capable of retrieving WPA keys at extremely high speeds. Multiple FPGA cards can be added to further boost the speed of key retrieval.”


ELAMAN is German-based firm that specializes in security and communications monitoring. They have headquarters in Munich, and a subsidiary in Dubai (UAE).

According to the company, they offer law enforcement and governments the ability to intercept “…all kinds of communication within different telecommunication networks and carriers inside and outside a country’s borders.”

They can monitor PSTN, private networks (PABX), wireless communications (WIFI & WIMAX), cellular communications (GSM, GPRS, CDMA, UMTS), and satellite communications such as VSAT (a small two-way satellite ground station), Thuraya (a satellite communication provider covering Europe, the Middle East, North, Central and East Africa, Asia and Australia), and Inmarsat (a British satellite telecommunications company).

Like this article? Please share on Facebook and give The Tech Herald a Like too!