Tens of thousands of politicians, journalists and activists around the world were monitored using secret espionage software and the encryption of Whatsapp and Co., which is actually considered secure, was also circumvented. What does this mean for messengers – and the federal government’s surveillance plans?
It is a hack of gigantic proportions: In a leaked database of the Israeli snooping company NGO, more than 50,000 telephone numbers were found, the owners of which had been spied on, some potentially, some proven, without their knowledge – including company bosses, politicians and journalists. Even the encryption of smartphone messengers, which is considered secure, could be overridden using the Pegasus software. But what does that mean for normal users?
The hack basically sounds very creepy at first: The NGO hackers can even take over current iPhones and Android smartphones completely, including access to the camera and microphone, via an SMS that is not displayed or corrupted WiFi networks. They also get access to chats on messengers such as Whatsapp, Signal or Telegram, which are actually not transmitted via end-to-end encryption.
Protective measures overturned
The encryption is actually supposed to prevent such external access: Since the chats leave the sending device already encrypted and are only decrypted again on the receiving device, it is not possible for third parties who have access to the data stream to read the messages.
The NGO program Pegasus cancels this protective measure through full access. By accessing the readable version directly on the devices instead of the encrypted transmitted chats, he gives NGO customers full access to all chats on the device. Regardless of which messenger they were written in.
The device as a weak point
This approach is not surprising for experts. “From a researcher’s point of view, it was clear: the end device is always the greatest weak point,” explains security researcher Paul Rösler, who specializes in encryption technologies stern. “In the very well investigated encryption methods, such as the signal protocol, which comes from the messenger of the same name and is also used in Whatsapp, it is much more difficult to find an as yet undiscovered vulnerability,” he is convinced. “Smartphone systems such as Apple’s iOS are also very well secured, but also much more complex. Because they are more difficult to investigate by researchers because of their secrecy, a loophole found can be exploited by malicious actors for longer until it is discovered and closed becomes.”
For the average consumer this is rather good news. Even if it sounds paradoxical: For the average user, Pegasus will be less of a threat than a hack of the Signal protocol, for example. “A surveillance like that of Pegasus will never be a mass phenomenon,” says Rösler with certainty. “The vulnerabilities used are too valuable for that. If they were used en masse, they would be discovered more quickly and fixed by operating system developers such as Apple.”
Federal Trojan wants to weaken encryption
The researcher is all the more critical of attempts by governments to deliberately weaken the encryption, such as the federal government is planning to expand the federal Trojan. According to the will of the current government, the investigative authorities such as the Office for the Protection of the Constitution should also be able to read communications that are transmitted via encrypted messengers such as Whatsapp. A corresponding expansion was only decided in June.
In the opinion of experts like Rösler, this is not a good idea. “Secure encryption cannot be implemented if government agencies can force decryption through vulnerabilities,” he explains. “In the end, this undermines the benefits of encryption per se for all users.”
In his opinion, however, it is also likely that the federal Trojan will be accessed via the operating system. “The hurdles are simply higher with the messengers. Signal and Whatsapp are operated from the USA, Telegram from Russia. They are not under the legal influence of the German authorities. The operators of Signal, who stand for privacy on principle, would probably only laugh if they did Inquiry is coming, “believes Rösler. Forcing all messenger operators to add gaps for a company in Germany is also not very promising. “It is easier to attack the operating system directly and to have access to all installed messengers right away.”
Apparently no Pegasus in Germany
The German authorities do not seem to be using the Pegasus tool so far, this was revealed by inquiries from the “NDR”, “WDR” and “Zeit” in the federal states. Accordingly, the program was demonstrated and offered to the German authorities, but ultimately not bought. The presumable reason: The range of functions is too large, it goes beyond the strict legal requirements for state use of monitoring software.
For example, the German authorities are only allowed to monitor communication that took place after the judicial approval, but not to read older chats retrospectively. This principle is called source telecommunication monitoring, in short Quellen-TKÜ. Retrieving previous communication is also considered an online search under current law, which is, however, much more strictly regulated.
Ultimately, however, it is only a question of implementation, believes Rösler. “I can not imagine that the government is now hoping for loopholes in individual messengers. It is easier to limit the functionality of a tool like Pegasus,” he explains. “But you always have to consider the risk that the programs can actually do more. And trust that the federal Trojan, which is then deployed, does not use its full spectrum of power.”
David William is a talented author who has made a name for himself in the world of writing. He is a professional author who writes on a wide range of topics, from general interest to opinion news. David is currently working as a writer at 24 hours worlds where he brings his unique perspective and in-depth research to his articles, making them both informative and engaging.
