19:54 GMT +314 November 2019
Listen Live
    Abu Dhabi International Airport

    Project Raven: Using US Spies and Spying Tactics, UAE Snooped on Entire World

    CC BY 3.0 / Ralf Roletschek / Entry to the Abu Dhabi International Airport
    World
    Get short URL
    0 06
    Subscribe

    Thousands of documents and emails reveal NSA surveillance techniques were central to the UAE’s efforts to monitor opponents.

    In an exclusive report, Reuters has documented the work of 'Project Raven' — an operation run by the government of the United Arab Emirates, in which former US intelligence agency staff have spied on other governments, human rights activists and even US citizens.

    The article primarily focuses on former NSA intelligence analyst Lori Stroud, the only Project operative willing to be named — eight others spoke on the condition of anonymity.

    Stroud spent a decade at the NSA, first as military service member 2003 — 2009, then agency contractor for tech giant Booz Allen Hamilton 2009 — 2014. Her specialism was hunting for vulnerabilities in foreign government computer systems — such as China's — and assessing what data could and should be stolen.

    Her glittering career at the agency would be scuppered via an intriguing chain of events, kickstarted in 2013 when she recommended none other than Edward Snowden — then a Dell technician — be promoted to her team.

    A mere two months later, Snowden infamously fled the US and passed on thousands of pages of top secret program files to journalists. Stroud and her team were unofficially blamed for enabling the massive security breach, and they became persona non grata at the agency.

    Job Opportunity

    In the wake of the scandal, Marc Baier, a former colleague of Stroud's at NSA Hawaii, offered her the opportunity to work for CyberPoint, a US contractor. She was told the job involved counterterrorism work in cooperation with the Emiratis, but little else — although she was assured the project was approved by the NSA, and accepted the offer in May 2014.

    A fortnight later, Stroud was in Abu Dhabi, one of over a dozen former US intelligence veterans working under the auspices of Project Raven — their primary task surveillance of citizens critical of the UAE's ruling monarchy. They would use techniques invented and perfected by the US intelligence community, including a resource called 'Karma', which was employed to hack into hundreds of dissidents' phones and computers. The team also investigated targets' friends, relatives and associates, placing them under close surveillance too.

    The work also involved monitoring social media for negative comments, which Stroud occasionally found difficult.

    "Some days it was hard to swallow, like [when you target] a 16-year-old kid on Twitter. But it's an intelligence mission, you are an intelligence operative. I never made it personal," she told Reuters.

    Raven's targets eventually evolved to militants in Yemen, and foreign governments including Iran, Qatar and Turkey, all bitter enemies of UAE. On top of employing their existing knowledge of intelligence tactics, the American operatives also developed new software to carry out infiltration and monitoring tasks. An Emirati operative would usually "press the button" on an attack however, in order to give the former US spy agency staff "plausible deniability".

    Moreover, using fake identities and Bitcoin, the Project anonymously rented servers around the world, allowing them to launch attacks from a network of machines that couldn't be traced back to its true origin.

    Human Wrongs

    Fake identities also played a role in the targeting of several individuals, including UK journalist and activist Rori Donaghy, who'd authored articles critical of the UAE's human rights record. The Emiratis were acutely aware spying on Donaghy could harm diplomatic relations with its Western allies, and stressed the need for extreme caution, suggesting Project operatives "ingratiate [themselves] to the target by espousing similar beliefs".

    Posing as a single human rights activist, staff emailed Donaghy asking for his help to "bring hope to those who are long suffering", managing to convince him to download software that would make messages "difficult to trace." In reality, the malware allowed the Emiratis to continuously monitor Donaghy's email account and Internet browsing. The surveillance against Donaghy remained a top priority for the Emirates until 2015, when he learned his email had been hacked.

    Prominent Emirati activist Ahmed Mansoor was another key target — he'd criticized the country's ruling elite for years over the war in Yemen, treatment of migrant workers and detention of political opponents. Evidence the Project collected on him was compiled in a PowerPoint presentation — it would later be used in a secret trial in 2017, which saw him sentenced to 10 years in solitary confinement.

    Along the way, staff were told the NSA approved of and was regularly briefed on Raven's activities — but in 2016, the Emiratis moved responsibility for Project Raven to UAE cybersecurity firm DarkMatter, but the former US spies remained. It would not be long before their mission began to involve the targeting of fellow Americans for surveillance, activity which not only raised serious ethical questions for all involved, but made their activities illegal in their home country.

    While Stroud praises the lack of "bull****" red tape" and "limitations" in her work for Project Raven, she also alleges she helped create an policy detailing how data on Americans accidentally harvested by the team's activities should be deleted, she said after its supposed implementation she kept on finding such information in the organization's data stores.

    At the same time, the Emiratis began hiding an increasing number of sections of Project Raven hidden from the view of the Americans on the team.

    Tough Questions

    In 2016, FBI agents began questioning American Project Raven employees who'd reentered the US, in particular whether they'd spied on US citizens and shared sensitive information with the Emiratis — Stroud was among them, having been approached at Virginia's Dulles airport as she was preparing to head back to the UAE after a trip home. She says she refused to tell them "jack".

    However, one morning in spring 2017 Stroud noticed a passport page of an American was in the Project system, and emailed supervisors to complain. She was told the data had been collected by mistake and would be deleted — but her concerns not allayed, she began searching a targeting request list usually limited to Emirati staff, which she was able to access because of her role as lead analyst.

    She saw security forces had sought surveillance against two other Americans, and questioned her bosses on the find — their response was a rebuke, on the basis she wasn't meant to be able to process such information. Days later, she came upon three more American names on the hidden targeting queue — all journalists.

    When Stroud kept raising questions, she was put on leave, her phones and passport confiscated. She was allowed to return to her homeland after two months, whereupon she contacted the FBI agents who confronted her at the airport. The Bureau is now investigating Project Raven's activities — but Stroud's contributions are limited in specifics, as she claims to not remember the names of the Americans she came across in the files.

    Related:

    Wife of Academic Jailed in UAE for Spying Blasts UK Gov't for 'Failing' Him
    ‘Horrifying Situation:’ UAE Charges UK Student With Spying
    Whistleblower: NSA Spying on Hacking Groups to ‘Swindle’ Congress Out of Money
    No Snowden, No NSA Files: German Enquiry Into Five Eyes Spying 'Simply Blocked'
    Tags:
    foreign spies, spying, espionage, hacking, NSA, UAE, Yemen, Iran, United States, Qatar
    Community standardsDiscussion
    Comment via FacebookComment via Sputnik