A spying government, an enemy of the Internet

BPA: The 2012 report of the press-freedom group Reporters Without Borders classified Bahrain as one of the countries that are “enemies of the Internet.” According to the organization’s criteria, the listed countries impose restrictions on the Internet, monitor the published contents and imprison bloggers.

Though the organization considered 2011 to be “the most dangerous year” for Internet users, Bahrain was chosen among the most five enemies of Internet in 2012.

The organization said that it added Bahrain to its list after the death of the Bahraini blogger Zakariya al-Ashiri while in government custody in 2011. It also suggested that the Bahraini authorities have arrested many Internet users and opened a campaign to defame those who protest for freedom of expression and communications.

The issue of censorship of cyber activists in Bahrain – whether they are journalists, bloggers or photographers – has become a hot issue addressed by many organizations that work for human rights and freedom of opinion and expression around the world. The many arrests of journalists, human rights activists and politicians resulting from Internet censorship have added to the urgency of the issue.

Bahrain Watch, a volunteer initiative led by group of cyber activists and specialists, is the first group to document the use of British spyware by Bahraini government to spy on activists. The organization documented this in its report published on July 25, 2012.

Bill Marczak, a Bahrain Watch founder, and the researcher Morgan Marquis-Boire, a member of Citizen Lab, a Canadian-based group that analyzes the interplay of communications technology and human rights, analyzed a list of suspicious messages sent to a group of Bahraini activists during 2012. Their examination found that it appeared the messages contained attachments that uploaded spyware to the computers of the targeted persons. Some of these messages have used the name of Melissa Chan, a journalist for Al Jazeera English Channel.

The organization’s investigations have showed that the spyware is called FinSpy, a product of the British company Gamma International. The company itself was previously criticized for supplying the same spyware to the Egyptian president Hosni Mubarak before he was ousted.

Several methods used by the Bahraini government to censor activists were documented. These included sending online messages containing spyware that automatically uploads to the recipient’s device, and hacking Facebook and Twitter IP addresses in order to determine the identities of their users and arrest them. In addition, the government demanded the passwords to the online accounts of arrested cyber activists to access their personal contacts and investigate their associates.

Bahrain Watch pointed out in a July 31, 2013, report that Bahraini authorities had launched a spy campaign against activists on the Internet, targeted at least 120 accounts and arrested 11 people accused of posting Twitter messages from anonymous accounts insulting the king.

The eight-month Bahrain Watch investigation showed that the Bahraini government is uncovering the identity of the people behind the anonymous accounts by sending messages containing links to spyware that identifies the accounts’ Internet Protocol addresses. These messages are often sent from fake accounts on social networking sites like Facebook and Twitter. The messages often bear the names of well-known government opposition figures or other false personalities that would not arouse suspicion.

When the targeted person clicks on the spy link, the IP address of his home or mobile phone’s Internet line is identified. With this information, the government can request the records of the account’s Internet provider to identify the name and address of the owner of the Internet line or the mobile phone related to the revealed IP number.

The report, titled “The IP Spy Files: How Bahrain’s Government Silences Anonymous Online Dissent,” documented the cases of five people who were arrested on charge of insulting the king on Twitter. Some of them confirmed having been targeted and pursued through spy links.

The examination of court documents in these cases shows that prosecutors’ charges are initially based on linking the IP address of the accused person with the anonymous account on Twitter insulting the king. However, the public prosecutor refuses to reveal the way of obtaining IP numbers; he just stated that the numbers were discovered by “special means” that “shall not be revealed.”

In some of these cases, defense teams have warned that the accounts were still active even though the accused persons were in prison. Bahrain Watch indicated that the government was secretly exploiting the accounts to target their followers through private messages.

The report pointed out that IP spy links cannot be reliably used to recognize the real identity of the writer of tweets using a fake name; people other than the original writer can click on the spy link and open the link through an Internet line that is not registered to the writer.

In at least one case, an operator of an anonymous Twitter account clicked on an IP spy link using someone else’s Internet connection; the subscriber of the connection was jailed for one year for operating the account despite the fact that he was not the one who had posted  tweets about  the king.

The report documented more than 120 pro- and anti-regime accounts that have been targeted in the last two years with spy links using a public mention such as a tweet that is visible to the public.

The investigation concluded that in at least six cases, activists were targeted by spy links already opened by an IP address affiliated with Bahraini security authorities. These spy links are connected to hundreds of others sent from the same network of accounts. According to the investigation, one of these accounts is referred to an officer in the Electronic Crimes Unit in the Ministry of Internal Affairs.