As Syria’s crackdown on protests has claimed more than 3,000 lives since March, Italian technicians in telecom offices from Damascus to Aleppo have been busy equipping President Bashar al-Assad’s regime with the power to intercept, scan and catalog virtually every e-mail that flows through the country.
Employees of Area SpA, a surveillance company based outside Milan, are installing the system under the direction of Syrian intelligence agents, who’ve pushed the Italians to finish, saying they urgently need to track people, a person familiar with the project says. The Area employees have flown into Damascus in shifts this year as the violence has escalated, says the person, who has worked on the system for Area.
Area is using equipment from American and European companies, according to blueprints and other documents obtained by Bloomberg News and the person familiar with the job. The project includes Sunnyvale, California-based NetApp Inc. (NTAP) storage hardware and software for archiving e-mails; probes to scan Syria’s communications network from Paris-based Qosmos SA; and gear from Germany’s Utimaco Safeware AG (USA) that connects tapped telecom lines to Area’s monitoring-center computers.
The suppliers didn’t directly furnish Syria with the gear, which Area exported from Italy, the person says.
The Italians bunk in a three-bedroom rental apartment in a residential Damascus neighborhood near a sports stadium when they work on the system, which is in a test phase, according to the person, who requested anonymity because Area employees sign non-disclosure agreements with the company.
Mapping Connections
When the system is complete, Syrian security agents will be able to follow targets on flat-screen workstations that display communications and Web use in near-real time alongside graphics that map citizens’ networks of electronic contacts, according to the documents and two people familiar with the plans.
Such a system is custom-made for repression, says Mark Dubowitz, executive director of the Washington-based Foundation for Defense of Democracies, which promotes tighter sanctions against Syria.
“Any company selling monitoring surveillance technology to the Assad regime is complicit in human rights crimes,” he says.
Privately held Area, which got its start in 1996 furnishing phone taps to Italian law enforcement, has code-named the system “Asfador.” The title is a nod to a Mr. Asfador who cold-called the company in 2008 asking it to bid on the deal, according to one person knowledgeable about the project. The person didn’t know Mr. Asfador’s full name, and efforts to identify him were unsuccessful. The price tag is more than 13 million euros ($17.9 million), two people familiar with the deal say.
Change Outpaces Deals
Area Chief Executive Officer Andrea Formenti says he can’t discuss specific clients or contracts, and that the company follows all laws and export regulations.
He says governments often use what is known as “lawful interception” gear to catch criminals. Without referring specifically to Syria, Formenti says political change can outpace business deals.
“You may consider that any lawful interception system has a very long sales process, and things happen very quickly,” he says, citing the velocity of Libyan leader Muammar Qaddafi’s fall, only a year after pitching his Bedouin tent in a Rome park on a visit to Italy. “Qaddafi was a big friend of our prime minister until not long ago.”
When Bloomberg News contacted Qosmos, CEO Thibaut Bechetoille said he would pull out of the project. “It was not right to keep supporting this regime,” he says. The company’s board decided about four weeks ago to exit and is still figuring out how to unwind its involvement, he says. The company’s deep- packet inspection probes can peer into e-mail and reconstruct everything that happens on an Internet user’s screen, says Qosmos’s head of marketing, Erik Larsson.
Monitoring Centers
“The mechanics of pulling out of this, technically and contractually, are complicated,” Larsson says.
The daisy chain of Western companies from the U.S. to Europe shows the route high-tech surveillance equipment takes on its way to repressive regimes that can use it against their own political enemies.
As uprisings in Egypt, Libya and Tunisia toppled Arab leaders this year, Assad, 46, has held on, deploying security forces against demonstrators protesting his rule, and defying a call by U.S. President Barack Obama to step down. Bordering Israel, Iraq, Jordan, Lebanon and Turkey, Syria has been run by Assad and his late father, Hafez, for a combined 41 years.
Captor Computers
Area is installing the system, which includes the company’s “Captor” monitoring-center computers, through a contract with state-owned Syrian Telecommunication Establishment, or STE, the two people familiar with the project say. Also known as Syrian Telecom, the company is the nation’s main fixed-line operator.
Without the Area gear, Syria’s current electronic surveillance captures only a portion of the nation’s communications, and lacks the new system’s ability to monitor all Internet traffic, say the two people who know of Syria’s capabilities through their work for Area.
Businesses that sell surveillance equipment to Syria should be held accountable for aiding repression, says Osama Edward Mousa, a Syrian blogger who was arrested in 2008 for criticizing the regime and fled to Sweden in 2010.
“Every single company who is selling monitoring technology to the Syrian government is a partner to stopping democracy in Syria,” he says. “They are a partner to the killing of people in Syria. They are helping the Syrian government stay in control.”
Syria Sanctions
The European Union has imposed a series of sanctions against Syria since May, including a ban on arms sales and a freeze on assets of people in the regime. The measures don’t prohibit European companies from selling Syria the sort of equipment in Area’s project.
The U.S. has banned most American exports to Syria other than food or medicine since 2004.
That means the U.S. government may need to determine if the shipment of NetApp’s hardware to Syria violated sanctions, says Hal Eren, a former lawyer for the Treasury Department’s Office of Foreign Assets Control who is in private practice in Washington.
“Products of U.S. origin, whether they’re exported or re- exported, are generally prohibited to Syria,” Eren says.
NetApp, which has a market value of about $15 billion and more than 10,000 employees, makes its products in countries around the globe, according to its most recent annual report.
NetApp ‘Not Aware’
“NetApp takes these matters very seriously and is committed to global trade compliance,” Jodi Baumann, NetApp’s Sunnyvale-based senior director for corporate communications, said in a statement. “We are not aware of any NetApp products being sold or having been sold into Syria.”
The NetApp deal was structured in a way that avoided dealing directly with Area, one of the people familiar with the project says. NetApp’s Italian subsidiary sold the equipment through an authorized vendor in Italy which then re-sold it to Area, the person says.
Utimaco General Manager Malte Pollmann says his company relies on Area to ensure its equipment is used and exported legally. “Area is a trusted long-term partner,” he says.
Utimaco, based in Oberursel near Frankfurt, wasn’t aware of any Syria project involving its gear and rarely knows where partners install its equipment, Pollmann says. “I wouldn’t need to know, because it’s not the duty of any of our end partners to tell us,” Pollmann says. “We don’t sell direct.”
No Information
Sophos Ltd., the Abingdon, England-based provider of security and data-protection software that controls Utimaco, referred questions to Utimaco, said Fiona Halkerston, who handles Sophos media relations at London agency Johnson King Ltd.
STE General Director Baker Baker didn’t respond to a request for comment faxed to his office.
At Syria’s embassy in Rome, a press officer said she had no information about the system and declined to comment on human rights implications of such monitoring.
Syria’s purchase of the system illustrates how authoritarian governments are using Western-produced surveillance technology to track dissidents. In Iran, a Bloomberg News investigation showed, European companies provided or marketed gear to track citizens’ locations and communications that law enforcement or state security agencies would have access to.
Tools for Interrogators
In Bahrain, interrogators of human rights activists used text-message transcripts generated by European surveillance equipment, the investigation found. Other Middle Eastern nations that cracked down on uprisings this year purchased the same gear, including Egypt, Yemen and Syria, according to the report.
In Syria, Area’s system for intercepting e-mail and Web sessions will be more intrusive than simpler equipment for blocking websites.
The U.S. is looking into reports that Syria is using technology made by Blue Coat Systems Inc. (BCSI), another company based in Sunnyvale, to censor the Internet and record browsing histories, State Department spokeswoman Victoria Nuland said at an Oct. 24 news briefing.
Blue Coat is investigating allegations its filtering gear was sold or transferred to Syria, spokesman Steve Schick says. The company doesn’t sell to Syria and prohibits its partners from selling to Syria or other embargoed countries, he says.
The State Department’s Nuland underscored the ban on virtually all U.S. exports to Syria, responding to a question about Blue Coat during the news conference.
State Department Concerned
“We are concerned about reports of the use of technology by repressive regimes in general, but Syria in particular, to target activists and dissidents,” she said.
Over the past three years, Area has been working to furnish Syria with precisely those tools.
Area, which is based in a modern office building next to Milan’s Malpensa Airport, got the 2008 phone call asking it to compete for the project as it was struggling to collect debts at home, the person familiar with the call says. Along with two Italian competitors, the company had been pressing the Italian government that year to pay overdue bills for interception work, Area CEO Formenti says.
Area won the Syria deal in 2009, two people familiar with the project say. This February, a ship carrying the computers and other equipment arrived in the Syrian port of Latakia, one of the people says.
Death Toll
With the gear in Syria, deployment of Asfador unfolded in parallel with Assad’s escalating crackdown.
The turmoil began in mid-March. Two weeks into the violence, on March 30, Italian employees of NetApp and Area exchanged e-mails in which the computer supplier gave advice to the surveillance company on how to configure equipment that had just been delivered, copies of the correspondence show.
That same day, Assad addressed Syria’s parliament, blaming the protests on a “conspiracy.” “If the battle was imposed on us today, we welcome it,” he said.
By then, more than 90 people had been killed in clashes, according to Amnesty International.
An Area schematic for “NetApp Storage Cluster B,” dated May 26, shows how the U.S. company’s stacks of disks were being wired in computer cabinets. The schematic bears the Asfador code name as well as a cover sheet titled “STE PDN Monitoring Center Project.”
Also on May 26, Syrian security forces killed at least three protesters in the Daraa governorate, bringing the death toll to more than 1,100 people.
Surveillance Room
If Area’s installation is completed as planned, Assad’s government will gain the power to dip into virtually any corner of the Internet in Syria.
Schematics for the system show it includes probes in the traffic of mobile phone companies and Internet service providers, capturing both domestic and international traffic. NetApp storage will allow agents to archive communications for future searches or mapping of peoples’ contacts, according to the documents and the person familiar with the system.
The equipment has already been set up in an air-conditioned room at a telecom exchange building in the Mouhajireen neighborhood of Damascus, where about 30 metal racks hold the computers that handle the surveillance and storage, the person familiar with the installation says. The data center has a linkup to a surveillance room one floor above, where the intercepted communications will stream to some 40 terminals, the person says.
Two people familiar with terms of the deal say that as a final stage of the installation, the contract stipulates Area employees will train the Syrian security agents who will man those workstations — teaching them how to track citizens.
To contact the reporters on this story: Ben Elgin in San Francisco at [email protected]; Vernon Silver in Rome at [email protected];
To contact the editors responsible for this story: Melissa Pozsgay at [email protected]; Gary Putka at [email protected]
