The original version of this article appeared on Mada Masr.
The Egyptian government wants to develop aggressive new mass surveillance tools targeting social media and other online communication in Egypt. A request for proposals issued by the Ministry of Interior and leaked to Egyptian press outlets last week revealed a far-reaching (though somewhat vague) list of aims for a new and “improved” technical surveillance apparatus. This simple Q & A summarizes the key issues and challenges that Internet users in Egypt must contend with in the face of existing and future surveillance tactics.
1. When we talk about “digital communications privacy”, what do we mean?
Privacy has many faces. We use various means to communicate — mobile phones, computers and the Internet — just as we send letters to postal addresses. Letters are private: No one should open them or prevent them from reaching their destination, or prevent senders from sending them or receivers from receiving them, or change their content. Just as postal services are used to send letters from one party to another, communications service providers (such as mobile companies, Internet companies or social media companies) should provide services without looking at the content of their users.
2. What guarantees do we have that companies will respect our privacy?
Every company has privacy policies. Such policies include what kind of data a company needs to collect from users in order to offer them a service, what data a company doesn't have the right to have, where the collected data will be stored, for how long, and who has the right to see it — and so on. Apart from company policies, the state should also have laws protecting citizens’ data, regulating the collection and storage of this data and establishing a general framework for companies. These laws should be passed through Parliament with the participation of all relevant stakeholders, such as companies, political parties, human rights organizations, technology experts, academics and journalists.
3. How does Egypt's Ministry of Interior approach digital surveillance?
Since 2008, as digital rights researchers and activists, we have gathered technical evidence, testimonials, documents and other material proving that the Ministry of Interior is monitoring on citizens in a number of ways. For the Ministry of Interior to be able to monitor online activity, there has to be collaboration with the communications sector, such as mobile and online communication platforms. There are also certain things that the Ministry of Interior needs in order to carry this strategy, chiefly software and tools from foreign companies working in the field of surveillance. In 2011, after State Security was stormed, documents were found that showed minutes from a meeting of the Ministry of Interior with mobile and Internet service providers in Egypt, concerning a joint surveillance plan. Other documents show technical pitches from surveillance companies. These have contributed to evidence of censorship and surveillance by the Ministry in collaboration with companies both inside Egypt and through the acquisition of foreign software.
4. What kind of software is the Ministry of Interior using?
According to the documents that emerged after the State Security headquarters were stormed, the Ministry has been in contact since 2009 with a company called Gamma International regarding software it was developing named FinFisher. Research conducted in the last four years shows that Egypt has been using various software products, including Bluecoat, which was installed in August 2012 and RSC, which was in use between March 2012 and October 2013.
5. What does this software do?
The Ministry of Interior has used this software to monitor Internet activity and users [ar]. Email accounts (hosted by different companies such as Hotmail, Yahoo or Gmail) and Skype calls are an example of Internet activity monitored by the Ministry. The software can penetrate laptops, control them from afar and access personal items, such as pictures, videos and files. It can also see passwords and operate cameras and microphones in laptops remotely.
6. How much does this software cost and how does the Ministry of Interior cover such costs?
This software is very expensive, costing millions of pounds. For example, the Gamma International software was over LE2 million. This is paid for by Egyptian tax payers.
7. So, since this software has been around for a while, what’s new?
Such software has helped the Ministry to monitor citizens using the Internet as well as their computer activity in general. However, we learned recently that the Ministry intends to monitor, collect, and classify public content. So the Ministry wants to observe Facebook, Twitter, YouTube and online newspapers. Moreover, the Ministry intends to monitor more recent mobile applications such as Whatsapp and Viber.
8. What's the problem here?
There is no problem with any entity observing public content, since it is available for everyone. The problem is that the Ministry of Interior, in its tender guidelines, requested software that doesn’t just observe public content, but private content too, such as communication on Whatsapp and Viber. Since this communication takes place in a closed, non-public format, the Ministry of Interior would have to hack these applications or monitor all mobile phone activity in order to obtain the information it wants. In explaining the reason for needing such software, the Ministry offered broad justifications, such as “preserving society's morals and traditions.” These statements have nothing to do with terrorism, which is the conventional excuse used by states to legitimize surveillance.
9. But the Ministry of Interior said it wants the software to protect Egypt from terrorism and other risks.
Of course, the Ministry’s role is to protect Egypt from terrorism and other risks. But the software it is requesting may not achieve this. The software’s primary function is to look for terminology that violates morality or falls outside the context of tradition, according to the Ministry. This has nothing to do with terrorism and is a rather elusive aim. There are no regulations or criteria that guarantee that the Ministry of Interior won't misuse this software to monitor and punish people for moral violations or based on suspicion rather than evidence.
10. So should we be for or against monitoring?
There has to be clear, agreed upon criteria for practicing and implementing monitoring. There should be a law addressing these critical human rights issues. And there should be an independent authority overseeing the implementation of this law. Monitoring should follow evidence and should not be conducted as a precaution. Monitoring should take place over a limited period of time and focus on a specific set of issues or individuals posing a legitimate threat to safety.