US and UK intelligence workers hacked into Sim card maker Gemalto’s computer network and stole encryption keys used to protect mobile phone communications privacy around the world, according to a document provided by whistleblower Edward Snowden to The Intercept. The 2010 document from Britain’s GCHQ stated that GCHQ operatives, with support from the NSA, mined the private communications of Gemalto engineers and other operators in multiple countries.
The bulk theft of encryption keys allow police and other agencies to sidestep the need for a wiretap warrant, as well as unlocking any encrypted communictions that is already intercepted but unreadable. Gemalto, which produces about 2 million Sim cards a year and has the motto “Security to be Free”, counts among its clients AT&T, Sprint, T-Mobile and Verizon in the US and around 450 other operators around the world.
Executive vice president Paul Beverly told The Intercept, “I’m disturbed, quite concerned that this has happened. The most important thing for me is to understand exactly how this was done, so we can take every measure to ensure that it doesn’t happen again, and also to make sure that there’s no impact on the telecom operators that we have served in a very trusted manner for many years.”
In reaction to the news, Gemalto said "We cannot at this early stage verify the findings of the publication and had no prior knowledge that these agencies were conducting this operation." It said it is especially vigilant against hackers, and has detected, logged and mitigated many types of attempts over the years. "At present we cannot prove a link between those past attempts and what was reported yesterday. We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such sophisticated techniques."
