Finnish intelligence identifies Chinese state-linked group behind cyber-attack

Finnish Parliament

FINLAND’S INTELLIGENCE AGENCY HAS identified a hacker group with ties to the Chinese state as the culprit of an attack of “exceptional” magnitude and intensity that targeted the Finnish Parliament last year. The attack was reported in December 2020, but had been going on for several weeks prior to being discovered by the information security department of the Eduskunta (Parliament of Finland).

Finland’s National Bureau of Investigation (NIB) said at the time that the attack had compromised parts of the Parliament’s internal communication system, including a number of Parliamentary email accounts. Some of these accounts belonged to members of Parliament, while others belonged to members of staff, according to the NIB.

Little became known about the attack in the months after the incident was first reported by Finnish media. But on Thursday the Finnish Security and Intelligence Service (SUPO) issued a press release about the incident. It said that the attack was likely part of a state-sponsored cyber espionage operation. It also identified those responsible for the attack as Advanced Persistent Threat (APT) 31. The SUPO report did not name the state that sponsored the attack. However, several private computer security firms have linked APT31 with the Chinese government.

The SUPO report stated that the attack on the Finnish Parliament was neither random nor experimental. On the contrary, it was aimed at acquiring specific information stored at the Parliament’s computer servers. Although the motive for the attack is still being investigated, it is possible that it was part of an effort “to gather intelligence to benefit a foreign state or to harm Finland’s interests”, said SUPO. The spy agency added that it would not provide further details about the case while it remains the subject a criminal investigation.

Author: Joseph Fitsanakis | Date: 19 March 2021 | Permalink

Finnish reporter destroys computer with hammer to protect spy source

Helsingin SanomatAn investigative journalist in Finland, who recently co-authored an exposé of a Finnish intelligence program targeting Russia, destroyed her computer with a hammer, prompting police to enter her house on Sunday. The journalist, Laura Halminen, co-wrote the exposé with her colleague, Tuomo Pietiläinen. Titled “The Secret Behind the Cliff”, the article appeared in the Saturday edition of the Helsingin Sanomat, Finland’s highest-circulation newspaper. It reveals the existence of a sophisticated electronic interception station in the northern suburbs of Jyväskylä, a city of about 140,000 people that is located in central Finland. Based on classified documents dating as far back as 1999, the article claims that the Finnish intelligence services have operated the top-secret program in Jyväskylä for years. It focuses on monitoring the maneuvers of Russian military units stationed around the St. Petersburg area, allegedly by tracking electromagnetic radiation emissions.

Over the weekend, the Finnish government reacted angrily to the Helsingin Sanomat report, accusing the newspaper of “revealing the content of highly classified documents” that are “critical to the [country’s] security and may cause grave damage to it”. The government, however, argues that the newspaper revealed without proper authorization the contents of classified military documents that were marked TOP SECRET, which is a crime under Finnish law. But the newspaper’s editors argue that the public has a right to know about the surveillance project. The dispute between the newspaper and the government reached new heights on Sunday evening, when a team of police officers arrived at the home of Helsingin Sanomat journalist Laura Halminen. The newspaper claims that the police raided Halminen’s house in connection with the Jyväskylä revelations. According to the Helsingin Sanomat the reporter said she destroyed her computer in order to safeguard information relating to future articles. However, there are some who believe that she destroyed the computer in order to safeguard the identity of the source of the information that led to Saturday’s exposé. However, argues that they intervened only after Halminen destroyed her home computer with a hammer, creating a fire and prompting an emergency response by the fire brigade. Police officers who arrived with the fire brigade called for reinforcements after they began to suspect that Halminen may have been trying to destroy evidence connected with a criminal investigation.

Helsingin Sanomat editors claim that police left Halminen’s house after confiscating the remains of her damaged computer, several mobile phones, an iPad, and over a dozen USB flash drives. The newspaper’s editors said that the raid on the reporter’s home was “uniquely exceptional” in the history of journalism in Finland, and claimed that the police did not present Halminen with a search warrant prior to raiding the premises. But Police authorities argue that Finnish law allows them to conduct warrantless searches for national-security-related cases, and that their actions were observed by an appointed lawyer. The lawyer took possession of all evidence removed from Halminen’s house, to ensure compliance with Finnish law. The government has since said that it will launch a criminal probe to find out the source of the leak to the newspaper.

Author: Joseph Fitsanakis | Date: 19 December 2017 | Permalink
IntelNews thanks AiT, N.H. and A.S. for their help in ensuring the factual accuracy of this report

German spy agency tapped Finnish phone lines in early 2000s

FinlandGerman intelligence, possibly with the collaboration of the United States, monitored communications lines connecting Finland with at least five countries in the early 2000s, according to leaked documents. The documents, aired this week by Yle Uutiset, the main news program of the Finnish Broadcasting Company (Yle), is based on information contained in “leaked German intelligence documents” that were first made public in May 2015. As intelNews reported at the time, the intelligence collection was described as a secret collaboration between Germany’s BND (Bundesnachrichtendienst) and America’s National Security Agency (NSA). According to Austrian politician Peter Pilz, who made the initial allegations, the BND-NSA collaboration was codenamed EIKONAL and was active from 2005 to 2008. Pilz said at the time that many European phone carriers and Internet service providers were targeted by the two agencies. Belgium and Switzerland have already launched investigations into EIKONAL.

Now new information provided by Yle seems to show that the secret BND-NSA collaboration targeted Finnish communications as well, focusing on at least six separate communications transit lines. The lines are believed to carry telephone call and possibly Internet traffic from Finnish capital Helsinki to a number of cities in France, Belgium, Hungary, Luxemburg, and China, said Yle Uutiset. Although the targeted lines are known to carry telephone and Internet traffic, it is unknown at this time whether EIKONAL targeted both kinds. But Yle said the interception lasted for most of the first part of the 2000s and involved large amounts of communications data.

The station contacted Tuomas Portaankorva, Inspector General of SUPO, the Finnish Security Intelligence Service. He told Yle that, speaking broadly, he was not surprised to be told that Finnish telecommunications lines had been monitored by foreign intelligence agencies, Western or otherwise. He went on to caution that, even though Finnish lines had been targeted, it was not possible to conclude that Finland was indeed the target of the surveillance operation. Yle also spoke to Vesa Häkkinen, spokesman for the from Finland’s Ministry of Foreign Affairs, who told the station that SUPO, and not the ministry, was the proper official body to be consulted about EIKONAL. “If there is reason to suspect that these actions were directed at the Finnish state”, said Häkkinen, “we would undertake appropriate action”.

Author: Ian Allen| Date: 20 January 2016 | Permalink | News tip: Matthew Aid

News you may have missed #743 (espionage edition)

Vladimir LazarBy IAN ALLEN | intelNews.org |
►►Denmark professor jailed for spying. Timo Kivimäki a Finnish professor of international politics in Copenhagen, Denmark, has been sentenced to five months in prison for spying, following a trial held behind closed doors, from which even the verdict was not released. Several Russian diplomats left Denmark after the start of the spy case and, according to Danish media, Kivimäki’s lawyer, Anders Nemeth, had attempted to have them return to act as witnesses.
►►Retired Russian colonel convicted of spying for US. A Russian court has ruled that retired Colonel Vladimir Lazar spied for the US, and sentenced him to 12 years in prison. Lazar will be sent to a high-security prison and stripped of his military rank, the Federal Security Service said in a statement. Prosecutors said Lazar purchased several computer disks with more than 7,000 images of classified maps of Russia from a collector in 2008 and smuggled them to neighboring Belarus, where he gave them to an alleged American intelligence agent.
►►India arrests military intel staffer for spying. The soldier, identified only as Shivdasan, worked for the Indian Army’s Technical Support Division, which is a newly founded unit within Indian Military Intelligence. He was reportedly trapped by the Indian Directorate of Revenue Intelligence in an elaborate operation that involved a “double agent” and a relative of the soldier in Dubai.

News you may have missed #740

Timo KivimäkiBy IAN ALLEN | intelNews.org |
►►Denmark professor accused of spying challenges court secrecy. Timo Kivimäki, a Finnish humanities professor at the University of Copenhagen, is accused of spying for the Russians and is being tried at the city court in the Danish city of Glostrup behind closed doors, meaning no information about the trial, including the precise charges, can be disseminated. But following demands from both Kivimäki’s lawyer and the Danish media, he has been granted permission to appeal against the decision to hold the trial in secret.
►►Analysis: CIA’s links with Hollywood are longstanding. Some US officials are suggesting that the producers of a new motion picture, which deals with the raid that killed al-Qaeda founder Osama bin Laden, received “extremely close, unprecedented and potentially dangerous collaboration” from the Obama administration, and particularly the US Intelligence Community. In light of this, a well-researched article in The Los Angeles Times reminds readers that the close connection between the movie industry and the US military and intelligence community goes back decades. The US military has been using movies to drive up recruitment since the 1920s; and the CIA these days even posts potential movie story lines on its website.
►►CIA funds helped launch literary journal. The Paris Review has been hailed by Time magazine as the “biggest ‘little magazine’ in history”. At the celebration of its 200th issue this spring, current editors and board members ran down the roster of literary heavyweights it helped launch since its first issue in 1953. Philip Roth, V. S. Naipaul, T.C. Boyle, Edward P. Jones and Rick Moody published their first stories in The Review; Jack Kerouac, Jim Carroll, Jonathan Franzen and Jeffrey Eugenides all had important early stories in its pages. But as American novelist Peter Matthiessen has told interviewers –most recently at Penn State– the journal also began as part of his CIA cover.

Scandinavian phone company helps ex-Soviet republics spy on citizens

TeliaSonera CEO Lars NybergBy JOSEPH FITSANAKIS | intelNews.org |
A highly profitable cellular telecommunications company, which is jointly owned by a Swedish-Finnish public-private consortium, is enabling some of the world’s most authoritarian regimes to spy on their own citizens, according to a new report. TeliaSonera AB, the dominant telephone company and mobile network operator in Sweden and Finland, is currently active in nearly 20 countries around the world. In 2011, it posted a net profit of nearly $3 billion, 25 percent of which came from the company’s operations in countries of the former Soviet Union. They include some of TeliaSonera’s most lucrative franchises, such as Geocell in Georgia, Kcell in Kazakhstan, Ucell in Uzebekistan, Tcell in Tajikistan, and Azercell in Azerbaijan, among others. But a new investigation by Sweden’s public broadcaster, Sveriges Television AB  (SVT), accuses TeliaSonera of knowingly giving some of the world’s most oppressive governments the means to spy on their own citizens. The report, which is available online in English, effectively states that TeliaSonera is directly complicit in some of the world’s most severe human rights abuses. The accusation is bound to cause embarrassment among senior officials in the Swedish government, which owns nearly 40 percent of TeliaSonera’s stock. The SVT investigation singles out Uzbekistan, Belarus and Azerbaijan, where TeliaSonera operates monopoly cellular networks on behalf of the state, “in exchange for lucrative contracts”. While running the networks, TeliaSonera allegedly grants local intelligence agencies complete and real-time access to the all telephone calls, pen-register data, and content of text messages exchanged by users. This, says the SVT report, has in turn facilitated several arrests of pro-democracy activists and political dissidents in countries like Belarus and Azerbaijan. Read more of this post

Denmark university professor faces charges of spying for Russia

Timo KivimäkiBy JOSEPH FITSANAKIS | intelNews.org |
Authorities in Denmark have charged a university professor with assisting “foreign intelligence operatives”, believed to be Russian. Professor Timo Kivimäki, a conflict resolution expert, who teaches international politics at the University of Copenhagen, is accused of “providing or attempting to provide” information to four Russian government officials on several documented instances between 2005 and 2010. The indictment claims Kivimäki, who was born in Finland, intended to give the Russians “information relating to individuals and subjects connected with intelligence activities”. The charges were filed after a lengthy investigation, launched in 2009 by the Danish Security and Intelligence Service (PET) in cooperation with Finland’s Security Intelligence Service (SUPO). The university professor spoke to leading Finnish newspaper Helsingin Sanomat and admitted that he carried out contractual “consulting work” for the Ministry of Foreign Affairs of the Russian Federation, for six years. He said he was paid approximately €16,000 (US$20,000) for his services, but denied that he knowingly contacted Russian intelligence operatives in the course of his consulting duties. According to Kivimäki, the Russian officials he interacted with appeared to be “diplomats, not spies”. He also pointed to the fact that none of the Russian officials he worked with as a consultant were apprehended or expelled by Danish counterintelligence, as is customary in such cases. Despite its relatively small size, Denmark had its share of international intelligence activity during the Cold War. During that period, PET amassed detailed files on approximately 300,000 Danish citizens considered to be “leftist sympathizers”. More recently, in November of 2010, media reports from Denmark suggested that the US embassy in Copenhagen maintained a network of local former police and intelligence officers, who were conducting “illegal systematic surveillance of Danish citizens”. Read more of this post

News you may have missed #691

Thomas DrakeBy IAN ALLEN| intelNews.org |
►►NSA whistleblower says Obama worse than Bush. Thomas Drake, the whistleblower whom the administration of US President Barack Obama tried and failed to prosecute for leaking information about waste, fraud and abuse at the National Security Agency, now works at an Apple store in Maryland. In an interview with Salon, Drake says the Obama administration is “expanding the secrecy regime far beyond what Bush ever intended”.
►►Australian spies reportedly buying computer bugs. The Australian government is buying computer security weaknesses found by hackers before they are sold on the black market, as part of its defense strategy, according to an Australian security consultant who wishes to remain anonymous. He says while the government won’t admit it, buying vulnerabilities is an obvious part of “gathering intelligence”.
►►Refugees in Finland face spying threats. Foreign governments and groups are carrying out more spying on refugees and dissidents living in Finland, according to SUPO, the country’s security intelligence service. SUPO issued a report last week contending that while the Scandinavian country isn’t seeing an increased threat of terrorist acts on its soil, it still faces several terror-related challenges. One of them is “regular” surveillance activity by foreign intelligence services operating within Finland, whose aim is spy on their home countries’ dissidents and develop links with other refugees and expatriates.

News you may have missed #623

Erkki Tuomioja,

Erkki Tuomioja,

►►Finnish FM washes hands of CIA flights. Erkki Tuomioja, the Finnish foreign minister, said last week that Finnish officials had no means to investigate allegations that a number of CIA prisoner flights touched down in Finland during the so-called war on terrorism. Tuomioja urged human rights groups to take action instead.
►►Australian defense documents stolen by foreign intelligence. A report has revealed that secret documents of Major-General John Cantwell, Australia’s most senior commander in the Middle East, were stolen by a foreign intelligence service last year. The documents were apparently in an encrypted drive stored in an aide’s backpack –contrary to protocol– and was thought lost when a large amount of luggage went missing for several days from Islamabad airport.
►►US soldier arrested by FBI counterintelligence. William Colton Millay, of Owensboro, Ky., was arrested last week at Joint Base Elmendorf-Richardson in Anchorage in an investigation conducted by the US Army and FBI. For now, both agencies are withholding information about the spy case. But an Army spokesman said that Millay did not leak or send information using the Internet and did not harm US security.

News you may have missed #611

Kalevi Sorsa

Kalevi Sorsa

►►Diplomat says Finland’s ex-prime minister was Stasi agent. Finnish former diplomat Alpo Rusi said last week that Kalevi Sorsa, Finland’s longest serving prime minister, who led the country in the 1970s and 1980s, is on a secret list of 18 high-profile Finns with links to the Stasi, East Germany’s Cold-War security service. West German intelligence handed the file to its Finnish counterpart in 1990, but the Finnish Supreme Court ruled last year that the list would not be made public.
►►Nazi criminal spied for West Germany. A wiretap operation conducted in the early 1960s by the CIA against the BND, West Germany’s foreign intelligence service, revealed that the BND employed a senior Nazi war criminal, Franz Rademacher, to spy for it in Syria, CIA records show.
►►US government aims to build ‘data eye in the sky’. Social scientists are trying to mine the vast resources of the Internet — Web searches and Twitter messages, Facebook and blog posts, the digital location trails generated by billions of cell phones to “predict the future”.

Western companies help Bahrain spy on democracy activists

NSN Logo

By JOSEPH FITSANAKIS | intelNews.org |
While Western governments preach to the world about the benefits of democracy, Western companies supply some of the most detestable dictatorial regimes with surveillance technologies for use against pro-democracy activists. One example in point is the repressive government of Bahrain, which, according to Amnesty International, is responsible for some of the most extensive human rights violations anywhere in the Middle East. Bahrain is the kind of place where even medical professionals who treat people wounded by police or soldiers in demonstrations are charged with “incitement”. Despite the fervor of the pro-democracy movement that has risen as part of the Arab Spring, the oil-rich royal clique that rules the nation has managed a series of debilitating hits against the reformists. The success of the crackdown is largely due the use of sophisticated telecommunications surveillance systems that allow Bahraini authorities to spy on cell phones and social networking platforms used by members of the pro-democracy opposition. Who supplied the Bahraini dictators with this equipment? Step forward German engineering conglomerate Siemens AG, and Finnish multinational Nokia. An article published this week in Bloomberg’s Markets magazine, fingers the German company as the primary supplier of telecommunications surveillance systems to the Bahraini royals. The latter rely on contracts with Nokia’s Trovicor GmbH subsidiary to maintain the sophisticated software and hardware. Bloomberg says it was notified of the Nokia Siemens Networks (NSN) partnership by two unnamed insiders, “whose positions at the companies gave them direct knowledge of the installations and the sale and maintenance contracts”. Read more of this post

Former Finnish diplomat reveals she worked for the CIA

Marja-Liisa Linkoaho

Linkoaho

By JOSEPH FITSANAKIS | intelNews.org |
A Finnish diplomat in Cold-War East Germany has revealed how she was recruited by the US Central Intelligence Agency in the 1960s, shortly after the construction of the Berlin Wall. Marja-Liisa Linkoaho spoke to the Sunday edition of Finland’s Helsingin Sanomat newspaper, and admitted that she worked for American intelligence. She did so despite representing Finland, which was notably pro-Soviet during the presidency of ‘neutralist’ Finnish statesman Urho Kekkonen. She told the paper that, in 1961, at age 27, she became an assistant at the Finnish trade mission in East Germany, which at the time served as Finland’s de facto embassy in the communist country. The trade mission was headed by Consul General Olavi Wanne, and was centrally located on Mauerstrasse, within walking distance from the border between East and West Berlin. In August of 1961, less than three months after Linkoaho moved to East Germany, the country’s government, under Walter Ulbricht, took the decision to begin the construction of the Berlin Wall. However, as a foreign diplomat, Linkoaho was able to travel freely between East and West Germany despite the construction in Berlin of the heavily policed partition barrier. Several months later, Linkoaho borrowed a sum of money by one of her Finnish co-workers at the trade commission, which she used to purchase a German-made Volkswagen Beetle, from an American car dealership in West Berlin. However, shortly after she returned to East Berlin with her new car, it was stolen. Interestingly, Linkoaho said that, soon after the theft of her car, she was contacted by the CIA and asked to work for them as an agent, in return for money and a new car. The Finnish former diplomat told the Helsingin Sanomat that she had been contacted by the CIA “a few times before”, but had politely declined the Agency’s offers for work. This time, however, she needed the money, and the car, so she took up the offer. Read more of this post

News you may have missed #547

Imtiaz Ahmad

Imtiaz Ahmad

By IAN ALLEN | intelNews.org |
►►Finland cancels visa of ex-KGB general. We reported recently on the case of Mikhail Golovatov, a former commander of the Soviet KGB’s Alpha Group, who is wanted in Lithuania for alleged war crimes against the country’s secession movement in the early 1990s. Last week, Austria arrested Golovatov, but released him 24 hours later, claiming that his Lithuanian-issued European arrest warrant was “too vague” to justify his continued detention. There are now reports that the Finnish embassy in Moscow has annulled the Schengen visa it had previously issued to the former KGB officer. In a statement, Finnish officials said they would not have granted Golovatov a visa in the first place, except there had been “a spelling mistake in Golovatov’s first name”, which made them think he the applicant was not General Golovatov of KGB fame. Hmmm…. ►►Georgian ‘spy photographers’ to be released. In a bizarre twist to the ‘photojournalist spies’ saga in Georgia, the government has announced that the three will be released under an agreed plea-bargain deal, because they had given the authorities “information of particular importance for national security” about Russian intelligence operations in Georgia. The three have allegedly “revealed the identities of Russian spies working in the country as well as the names of their Georgian collaborators and cover organizations operating on behalf of Moscow”. The three, Zurab Kurtsikidze, Irakli Gedenidze and Giorgi Abdaladze, are all professional photojournalists, who are accused by Tbilisi of spying for Moscow. ►►Pakistani ex-spy director says US owes Pakistan. Imtiaz Ahmed (often spelled Ahmad) is the former Director General of Pakistan’s main domestic intelligence agency, the Intelligence Bureau (IB). In a recent interview, he accused the United States of using the ‘war on terrorism’ as a strategic pretext for capturing energy resources and limiting China’s economic growth. He also said that the US owes the Pakistani intelligence agencies, because without them it could not have accomplished its task in the Afghan war against the Soviet Union. IntelNews readers may remember the last time Ahmad had made headlines, when he revealed a series of CIA operations against Pakistan’s nuclear program.

News you may have missed #497

  • Interview with Finnish ex-counterespionage officer. Finland’s Helsingin Sanomat has published a very interesting interview with Hannu Moilanen, who recently retired as a senior officer with SUPO, the Finnish Security Intelligence Service. Among other things, Moilanen says SUPO considered the CIA “the bad boys” of the Western bloc during the Cold War, because the Americans would not always disclose to SUPO the identities of CIA officers stationed in Finland, as they were supposed to.
  • European Union sent intelligence officers to Libya. But the EU’s Joint Situation Centre denies they were spies. “They were technical specialists who went to help with satellite phones and that type of thing”, said JSC Director Ilkka Salmi.
  • Talks aimed at mending rift between CIA and ISI. The CIA has agreed to reveal more about its operatives and their activities in Pakistan, and pledged expanded cooperation on drone strikes, US and Pakistani officials said. Meanwhile, however, the drone strikes on Pakistani soil appear to be continuing.

Scandinavians launch probes into US spying activities

Scandinavia

Scandinavia

By JOSEPH FITSANAKIS | intelNews.org |
Norway, Sweden and Denmark have launched official investigations into media reports that accuse US embassies in Scandinavian countries of operating illegal intelligence gathering networks. The issue first emerged last Wednesday, when a report by Norway’s TV2 channel alleged that the US embassy in Oslo maintained a network of around 20 local former police and intelligence officers, who were conducting “illegal systematic surveillance of Norwegian citizens”. According to TV2, the surveillance network was tasked with collecting visual and physical intelligence on individuals “thought to pose a threat to American interests”. The US Department of State responded to the allegations by arguing that the US embassy had “fully informed” the Norwegian authorities of the surveillance activities. But Norwegian investigations expressed fears that the intelligence collection, which dates back to 2000, may constitute a violation of Norwegian diplomatic legislation, and have launched an investigation into the affair. Read more of this post

%d bloggers like this: