Plotting the Spread of UK-made IMSI-catchers

Note: a version of this article appeared on another Medium publication in 2016; this version includes more details.

Using export license data, it’s not only possible to see which countries are likely receiving surveillance technology from UK companies, but also plot potential sales of specific items across the globe.

As an example, export data combined with a document published by The Intercept shows how one UK firm in particular received licenses to export devices capable of tracking mobile phones and intercepting text messages. Several of the recipient countries are oppressive regimes.

Last year The Intercept published a 120-page brochure from surveillance company Cobham. As well as a host of hidden cameras and other covert tools, the 2014 brochure also includes details on the “Evolve4-Nimbus,” a specific brand of IMSI-catcher.

IMSI-catchers work by impersonating cell phone towers. Nearby mobile phones connect and give up the unique identifying code attached to their SIM card, or IMSI number. Often an IMSI-catcher will downgrade target devices from one network to another with worse security protections, such as from 3G to 2G. The Nimbus — described as a “active interception solution” — can be used for “geo-locating and tracking purposes,” according to the brochure.

Image: Cobham’s Evolve-4 Nimbus. Source: The Intercept.

UK export data obtained through a Freedom of Information Act request and published by *Spy Tech Exports *explicitly details some of the Nimbus’ capabilities. Several export licenses say the Nimbus can provide denial-of-service, making phones in the local proximity largely unusable, and intercept SMS messages. The Cobham brochure says that the Nimbus did not provide capability on the LTE network at launch. But according to the export data, Cobham has likely since added this functionality; some licenses include an item described as “Evolve4-Nimbus Support for LTE protocol.”

The brochure originated within the Florida Department of Law Enforcement, according to The Intercept’s article on Cobham’s products. However, judging by the export data, Cobham may have sold the Nimbus to a slew of other international customers.

According to the data, the UK government granted exports related to the Cobham device to Algeria, Brazil, Colombia, Macedonia, Namibia, Oman, Paraguay, Qatar, Singapore, Turkmenistan, and the United Arab Emirates. Some of these, like the license to Macedonia, were for temporary exports, meaning the export was likely for a demonstration to a customer or a trade show. Other licenses were for permanent export.

Image: Data showing a granted license for temporary export of an Evolve4-Nimbus to Turkmenistan. Source: Spy Tech Exports.

The license for temporary export to Turkmenistan also mentions another Cobham IMSI-catcher mentioned in the Cobham brochure: the GSM-XPZ PV. The Nimbus licenses for Algeria, Namibia, and Qatar also include a reference to “XPZ.”

Obtaining information on the surveillance industry is often a multi-pronged process. As this case shows, figuring out more details sometimes requires combining responses from Freedom of Information Act requests with more traditional leaks.

Have a tip about spy tech exports, the surveillance industry, or anything that might be of interest to this project? You can contact the author in confidence on Signal at +44 20 8133 5190, jabber at jfcox@jabber.ccc.de, or email spytechexports@gmail.com.

Follow @spytechexports on Twitter for periodic updates on new export licenses.