Ghana receives phone hacking tools from UK, US and Interpol,
In May 2019, senior members of Ghana’s law enforcement posed
for photos with the U.S. ambassador to their country at a ceremony in the
capital, Accra.
Between them they held boxes and bags, gifts from the U.S.
government to Ghana which, according to one of the recipients, contained Israeli
phone hacking technology.
That recipient was Maame Yaa Tiwaa Addo-Danquah,
then-director general of the Ghana police’s criminal investigation department.
In May 2020, she spoke to CPJ about how the U.S. and U.K.
governments, as well as Interpol, provided Ghana’s security forces with digital
investigations training and technology.
She cited tools made by the Israel-based Cellebrite
corporation – whose website says their technology can break locks and
encryption – and two U.S.-based companies, IBM and Digital Intelligence.
Journalists in Ghana say they are worried about how such
technology may be used against them or their sources.
Last year, CPJ documented the use of Cellebrite’s Universal
Forensic Extraction Device (UFED) by Nigerian security forces, and how the
military targeted journalists’ phones and computers with a “forensic search”
trying to reveal their sources.
Six days before the U.S. gave the same tools to Ghana, The
Washington Post reported on how police used UFED to retrieve documents from
journalists’ phones in Myanmar.
Amid the coronavirus pandemic, Cellebrite has pitched its
technology to help authorities access devices of infected people to trace their
contacts, Reuters reported in April.
“If a state agency can decode my system without access to my
password, that is scary,” Emmanuel Dogbevi, managing editor of the website
Ghana Business News, told CPJ in early July.
Dogbevi, a member of the International Consortium of
Investigative Journalists, has reported on sensitive subjects, including
offshore finances and Ghana’s purchase of hardware from the Israel-based
spyware company NSO Group.
He told CPJ that many sources were already hesitant to speak
for fear of being identified, and the years-long pattern of Ghanaian
authorities trying to intimidate journalists left him worried he too may be
targeted.
“Sources send me information, send me documents. I wouldn’t
want anyone to have access to that,” Dogbevi said.
Before being transferred from criminal investigations to
head police welfare in January 2020, Tiwaa Addo-Danquah said she sought to
strengthen prosecutions by building the police’s capacity to extract and
analyze information from phones and computers.
“In this [digital] era, most of the evidence are held on
electronic devices…You arrest one person and the person says I’m not going to
inform you [of] my accomplice. These are the tools that can help you to know
who or whom that person is talking to,” she told CPJ.
A year earlier, in June 2019, officers from Ghana’s National
Security Ministry arrested editor Emmanuel Ajarfor Abugri and reporter Emmanuel
Yeboah Britwum, both of the Modern Ghana news website, held them for days, and
searched their phones and computers in an effort to reveal their sources for a
report on National Security Minister Albert Kan Dapaah, CPJ reported at the
time.
Abugri told CPJ his devices were taken to an “IT room” and
he was forced to give the officers his passwords. “They were going into my
gadgets,” he said.
The Greater Accra police command still has Abugri’s phones
and tablets, while the National Security Ministry has his computer, Abugri
said. (A police spokesperson, Afia Tengey, said she was unable to comment
because she could not locate the case files).
The experience changed the way Abugri thought about the
safety of information: “Sometimes in journalism there are certain information
that are very confidential to you, that you don’t want any other person to know
the source…having those information on your gadgets and those same gadgets are
in the hands of certain people [security forces], I feel threatened.”
Abugri sued Ghana’s National Security Coordinator, Inspector-General
of Police, and Attorney General claiming his arrest and detention, including
alleged torture, violated his constitutionally guaranteed rights; the case is
due in court July 15, he told CPJ.
CPJ’s calls to Kan Dapaah following the June 2019 arrests
and in June 2020 rang unanswered.
But Tiwaa Addo-Danquah told CPJ that she had at times relied
on the National Security Ministry digital forensics and surveillance capacities
to assist with police investigations.
“If the phone is on, [based on a telephone number] they were
able to tell that this person was here at this time, he moved here at this
time,” she said.
Manasseh Azure Awuni, a freelance investigative journalist,
told CPJ the arrests of the Modern Ghana journalists and seizure of their
devices shows that journalists and sources are vulnerable.
“If it has happened to some journalists, it is possible it
can happen to me,” Awuni said.
Awuni said he received death threats and was forced into
hiding in 2019 because of a documentary that alleged Ghana’s ruling party
operated a secret militia group. The party denied ties to the group, he said.
“It can exert a chilling effect on press freedom,” Roland
Affail Monney, President of the Ghana Journalists Association, told CPJ of
security forces’ capacity to break into journalists’ phones and computers.
Ghana’s police first received Cellebrite’s UFED technology
from Interpol in 2017 at training for West African law enforcement in Cote
d’Ivoire, Tiwaa Addo-Danquah told CPJ.
The year before, Cellebrite signed an agreement to provide
Interpol with “digital forensic equipment [including UFED] and training
services over a three-year period,” according to their websites.
Interpol’s press office acknowledged in an email that has
provided Cellebrite tools to some national police but did not identify which
countries or otherwise elaborate.
Tiwaa Addo-Danquah said that in 2019 the U.K. trained and
provided Ghanaian police with IBM i2 Analyze to help organize and evaluate information
pulled from devices.
IBM i2 Analyze “facilitates analysis of large volumes of
data” and “uncover[s] hidden connections,” according to its website.
CPJ emailed the British High Commission in Accra requesting
an interview regarding U.K. digital forensics support for Ghanaian law
enforcement, but no interview was arranged before publication.
IBM’s head of communications for the Middle East and Africa,
Mark Fox, told CPJ in an email that IBM had “no record of selling or providing”
IBM i2 Analyze to the government of Ghana, but declined to comment on whether
Ghana’s police used the technology.
“[W]e carefully review potential business opportunities to
ensure they do not conflict” with IBM’s principles of trust and
transparencyExternal link, Fox said.
Separately, a 2019 British Immigration Enforcement document
appears to show that the agency supplied Ghana’s Immigration Service with
Detego digital forensics equipment made by U.K.-based MCM Solutions (the
document misspells the equipment as “Detago”).
Detego can “[e]xtract and seamlessly analyse data from
multiple devices,” according to MCM’s website.
In March 2019, MCM posted on Twitter that its staff were in
Ghana “conducting an advanced [Detego] training course for a number of
specialist units.”
John-Paul Backwell, MCM Solutions’ global sales and
marketing director, told CPJ that the company had multiple clients in Ghana,
but did not respond by publication time to a question about which security
agencies had the technology.
Backwell said MCM Solutions’ ambition was to have their
technology “used for good” to “solve security challenges,” but acknowledged the
company “cannot always control how a customer uses the software.”
MCM Solutions would investigate cases where their tools may
have been used against journalists, he said.
The U.S. embassy provided Ghana with Cellebrite UFED and
UltraBlock, another digital forensics tool made by the Digital Intelligence
corporation, in May 2019 at the ceremony with U.S. Ambassador Stephanie
Sullivan, Tiwaa Addo-Danquah told CPJ.
UltraBlock is used to facilitate the extraction of information
from hard drives, but does not have decryption capacity, Chris Stippich, the
president of Digital Intelligence, told CPJ by phone in late June.
He said company policy did not permit him to comment on
Digital Intelligence’s customers.
Procurement documents reviewed by CPJ and a report by the
Nextgov news website indicate that in December 2018 the U.S. embassy in Ghana
made a request to purchase UFED and UltraBlock technology.
The request specified UFED be capable of “extraction” and
“decoding” of major cellphone models, including Android, Blackberry, Nokia, and
Huawei, as well as GPS systems like TomTom.
According to a U.S. government database, State Department
contracts were awarded to two U.S.-based companies—BIT DIRECT INC and Lyme
Computer Systems, Inc— for cyber investigations equipment for Ghana. Other
contract listings indicate that in recent years U.S. embassies around the world
have ordered equipment directly from Cellebrite.
CPJ’s calls and an email to Josh Longacre, Lyme Computer
Systems’ CEO and president, as well as calls and a voicemail to the publicly
listed number for BIT DIRECT INC, went unanswered.
CPJ’s questions emailed to Cellebrite’s press office and
Masao Koda, a representative for Cellebrite’s Japan-based parent company, Sun
Corporation, were not answered before publication.
The U.S. embassy in Ghana told CPJ in an emailed statement
that it gave the country’s police and the Economic and the Organized Crime
Office (EOCO) “assistance to enhance their capability in investigating
cyber-related offenses” with technology and training.
It said those who were trained underwent “Leahy vetting,” a
reference to U.S. laws that prohibit spending on foreign security forces
implicated in human rights abuses.
The embassy did not directly answer CPJ’s questions specific
to UFED and UltraBlock.
CPJ reached Frank Adu-Poku, Executive Director of Ghana’s
EOCO, by phone in May 2020, but he declined to comment.
Ghana immigration service spokesperson Michael Amoako-Atta
told CPJ by phone that he would check for information about British support in 2019,
but CPJ’s subsequent calls and text messages to Amoako-Atta went unanswered.
“Any data that is accessed by police would be done so in
accordance with [the] law,” Sheila Kessie Abayie-Buckman, a spokesperson for
Ghana’s police, told CPJ by phone.
She said a “framework for police-media relations and safety
of journalists” launched on July 1 would help curb instances where officers
seized journalists’ devices or interrogated them about their sources.
Abayie-Buckman did not provide answers to emailed questions
concerning police use of Cellebrite and IBM technology.
“Sometimes I think it is good for governments to have that
kind of [digital forensics] tools,” Abugri told CPJ, noting that there are
public safety reasons for devices to be searched.
“But in a situation where people like us [journalists] are
involved…those tools are not being used for their intended purpose…that is
where it becomes a worry.”
Comments
Post a Comment