Statement of the Hong Kong In-Media:The ICAC and Police Force shall disclose correspondences with hacker companies, Amend the Ordinance to secure privacy

Statement of the Hong Kong Inmedia:

The ICAC and Police Force shall disclose correspondences with
hacker companies Amend the Ordinance to secure privacy
16 July 2015

The WikiLeaks has previously disclosed that, the Independent Commission Against Corruption (the ICAC) has contacted the Hacking Team for services (note). It asked the company to demonstrate a remotely controlled malicious software called “Galileo Remote Control System”, which can intercept computers and mobile phones and similar telecommunication platforms. The ICAC, in the early morning of 15 July, has admitted that the Commission has contacted the company. According to the Ming Pao, in that email corresponds with the company, there are in fact at least 3 addresses of the local police and 5 addresses of the ICAC Operations Department.

The Hong Kong In-media is gravely concerned with issues on Internet freedom. We also monitor the development of the Interception of Communications and Surveillance Ordinance (Cap 589). The legislative intent of the Ordinance, is to monitor any interception of communication or any covert surveillance for the purposes of a specific investigation or operation, by or on behalf of public officers; as well as to ensure the four law enforcement agencies, namely the Customs and Excise Department, Police Force, Immigration Department and the ICAC, would respect citizens’ rights and privacy, while acting for crime prevention and/or the protection of public security. Interception and surveillance without public noticeThe ICAC has only admitted contacting the hacking company after the WikiLeaks leaked it. From this, we can see that the Ordinance does not sufficiently restrict and regulate the power prescribed to those operative departments for public interest. Had the ICAC subsequently bought the surveillance services, privacy and rights of the public would be severely undermined with unrestricted surveillances, if not offensive and malicious interception of computing devices.

“Galileo Remote Control System” is a investigative tool to spy all kinds of mobile devices and computers, stealing information from iPhone or Android platforms, reading data of internet users and accessing encrypted emails or files, as well as proving remote access to microphones and cameras. The system can save and leak information on web surfing history, documents transmission, keyboard input records, text and files and pictures, VoIP call monitoring, programme execution process, audio interception, camera interception, screen shots, instant messaging (Skype, Windows Live Messenger, Wechat, etc), materials of the clipboard, account passwords, in and out of mailboxes, phone recording, GPS location and contacts information, etc. At the same time, the spyware creates a backdoor, allowing the Hacking Team themselves to scrutinize the intercepted information and thereby releasing all personal data or information of such targets to even more outsiders that one cannot possibly trace.

The Hong Kong In-media calls that,

1. The authorities must report to the Legislative Council Panel on security in details, the legal basis of the law enforcement agencies’ use of such interception or surveillance technology, in particular the details of any software that the ICAC, Police Force and other agencies currently in use, including but not limited to information of suppliers, spyware name and versions, the number of targets and the investigation to prosecution ratio.

2. The Panel on Security must then call a special meeting to discuss the matter concerned.

3. The government must amend the Interception of Communications and Surveillance (Amendment) Bill 2015. The coverage of the current Bill is unquestionably obsolete; the law enforcement agencies need not go through scrutiny of the Ordinance to intercept popular telecommunication platforms like Whatsapp and Telegram. Instead they can obtain a warrant from Court, accessing information from Internet suppliers. The authorities must amend the types of platforms of telecommunications covered by the Ordinance, stopping any abuses of such means, so as to secure privacy of all citizens.

4. The ICAC and other law enforcement agencies must stop using hacker software of other countries.

Hong Kong In-media

16 July 2015

CC: The ICAC, Security Bureau and Legislative Council Panel on Security

Note: The Hacking Team is an infamous Italty-based hacking company that sells offensive intrusion and surveillance capabilities to governments to monitor their citizens. Founded in 2003, the company aims to serve governments, law enforcement bodies and intelligence agencies across the globe with spyware and malware, currently serving governments from 30 countries, including the human rights ill recorded countries Egypt, Singapore and Vietnam.