NSA hacked SIM card maker to steal key codes to track cell phone users, data

Top secret documents previously provided by former NSA contractor Edward Snowden have revealed that the US and Britain broke into the network of the world’s largest SIM card maker to compromise global communications.

According to the documents obtained by The Intercept, the online news magazine founded by Snowden collaborator Glenn Greenwald, the US National Security Agency (NSA) and its British counterpart, the Government Communications Headquarters (GCHQ), stole the encryption keys used to secure voice calls and texts from Gemalto, the largest manufacturer of SIM cards in the world.

photo Oregon Department of Transportation

Two billion SIM cards are made annually by Gemalto. They are used by 450 wireless network providers around the world, including AT&T, T-Mobile, Verizon and Sprint, subsequently effecting the bulk of the world’s telephonic communications.

Gemalto has headquarters around the globe, including a US office in Texas, but is incorporated in the Netherlands and traded on the Eurolist.

By compromising the company’s internal computer network and stealing valuable encryption keys, the NSA and GCHQ have been able to render as useless the security measures used to protect communications sent through hundreds of networks the world over.

From Greenwald’s Twitter page:

NSA/GCHQ hack empowered them “to secretly monitor a large portion of the world’s cellular communications, including both voice and data.” – @ggreenwald

According to Jeremy Scahill and Josh Begley at The Intercept, classified files supplied by Snowden, including one GCHQ document from 2010 in particular, show how US and UK intelligence together conspired to compromise the SIM card maker.

One slide contained in the document showed that the GCHQ got inside of the manufacturer’s network, then stealthily installed malware that is believed to have opened up access to the SIM card maker’s entire computer system.

By possessing a copy of the encryption keys, US and UK intelligence agencies are believed to be able to crack into any affected communication, allowing authorities to eavesdrop internationally and on a mass scale without serving search warrants to local telecoms or requesting assistance from host countries.

“Once you have the keys, decrypting traffic is trivial,” Christopher Soghoian, the principal technologist for the American Civil Liberties Union, told the magazine.