BOULGARAKIS (Public order minister): Good day. It is the case indeed that Mr Koronias (CEO of Vodaphone), who asked, as Mr Rousopoulos suggested, to meet with the prime minister or someone that could get in touch with him -- the PM, I believe, was absent at that time in Madrid for a convention on terrorism -- had a meeting in Mr Aggelou's office with us. He informed us that in a routine control that took place on his company's software, it was realised that there was a system that was wiretapping some mobile phones. Mr Koronias briefed us in detail, which was initially difficult for us due to the level of technical details.
In brief the system was setup in the following way: The [mobile phone] companies have software that allows then to activate mobile phones. This software has different subsystems. For example, it has a subsystem to send sms messages, a subsystem for images messages, a subsystem for the voicemail etc. There is also a subsystem that deals with lawful interception. This system, that is provided by Ericsson, has either been bought nor activated by Vodaphone.
As Mr Koronias explained to us, there were some customer complaints about calls not getting through, delays or messages not getting delivered. In any case they were they were not provided with the full services they should and a routine investigation was started to look into the matter. Because they could not find out what the problem was, they asked for a control from the 'mother' company [ed: British Vodaphone] -- beyond the greek company -- that sent people here to study the matter further. During this process it was found that in some way the lawful interception subsystem had been activated, for some numbers: while those numbers were called it was active, and it was deactivating itself when the callers hand up, resulting in being invisible. In other words there was a process that was working only for some phone number, while they were talking, and after that the it was hiding itself using a special method. Every time someone would do a regular check of the system, they would not be able to detect it. Through that process it was found. The question is what phones were listened to, in what way they were doing it, and where, at the end, someone could record, if someone could record, what was going on.
As the minister told you there is a list of people under surveillance that is now being made public.
There were about 100 numbers under surveillance. They were under surveillance though Vodaphone with 14 'shadow' phones. There were 14 to 16 -- more like 14, but it is not important -- phones that were working as electronic shadows of the 100 phones. When a number was called, though the system described before, it was connected in some way with one of the shadows, that was working a bit like in duplex. Most probably the shadow using some software was performing the recoding. Using a system of redirections, in case a [shadow] phone was called twice, another out of the 14 numbers would be called, and if it was also busy another one would be called, etc. In other words this system was wiretapping those 100 numbers, redirecting them to the 10 phones, that most likely were then recorded somewhere else.
I said it as simply as I could, but the system is roughly that.
When the list was provided to us by Mr Koronias, the PM ordered to have a full investigation. In the ministry for public order was started a very difficult and very detailed investigation. Why difficult and detailed? As soon as the system came to the attention of the company, the first thing it did was to isolate it. By isolating it the system stopped. Surely in this way was stopped one of the ways, that could maybe, lead to where the phones were. It was noticed when the [shadow] phone numbers were given to us that those phones number had been called. In particular, the 14 phones that I mentioned before, while not making calls were receiving calls. Since we could not get directly to them -- since there was no more the signal that I described you before -- we had to get at them indirectly.
his was a complex and difficult task because because all those phones were pre-paid. This means that they had multiple owners in the past. To give you an example: one of those phones had received many calls. This phone has received all those calls [social network diagram of calls unfolded in the press room.] So we tried, using these calls, to get to this phone number. To find out why those calling were calling etc. This was a difficult, painful and time consuming process. Because those phones belong to someone. All those people were, after following all the legal process, were interrogated to find out the reason they called these phones. Were they calling, to listen to what the phones had been recoding using a secret pin? Was it possible for them to remotely activate some redirection?
I simply showed you one phone number but there were tens of those actions. I give you another card with phone numbers that were linked amongst them, because of the system of redirections in place. We had to study hundreds of calls that originated from phones all across Greece: on the islands, the cyclades, the dodekanese, in crete, in ebros, in thessaloniki, everywhere. Most of the phones that we could investigate -- because there were some we could not, because there were some pre-paid phones, that were calling pre-paid phones -- were people that were calling because they thought they were calling some previous owner of the phone. As you know pre-paid phones that are not used for a while, have their number returned to the company, that then gives it to someone else. Those callers thought they were calling the previous owners. And this comes out of many interviews.
In short, the whole process was painful and time consuming, and this is the reson that it took so long, because for every person interviewed we had to check that what they were saying was truthful, and cross check all the fact that were provided with what we knew. All this lead nowhere. All those calling though they were calling the previous owners.
In conclusion from the moment the phones stopped transmitting, it was difficult to determine the antena or cell they were active in, that was initially determined. And in particular it was initially determined in the wider region of the network that is serving by the following 6 mobile masts: From Lukavitos, to Mabili Sq, to the Athens Tower, and the area of the clinic 'White Cross'. Despite having a general geographic location about the masts that the [shadow] phones used, it was difficult using our systems, which are the best there are, to get a precise fix, because the phones were switched off. So no one could get close and find where the phones are. This is the reason the process took so long, and ended in the clarification of all the calls to the 14 shadow phones.
LAMPROPOULOS (Journalist): Two technical question. Mr Voulgarakis, you talked to the people that were calling [the shadow phones], did they give any information about someone picking up, who pick it up, and what are the results of the investigation of where the phones were bought? You told us these were shops in 'Ibi' and 'Nea Ionia'.
VOULGARAKIS: Mr Lampropoulos, since he is usually covering crime news, is giving us an interesting question. The first thing that surprised us when we got the list of numbers was that the call duration [from random people to the shadow phones] was in the order of seconds, which means that no one actually talked. That is the calls received by the phones in group B [the shadow phones], the phones under investigation. Phones in group A were my phone and the phone of mr Papaligouras, Mr Spiliotopoulos, etc. Those were known. The second group, that we are investigating, had calls that lasted a few seconds. One second, one and a half second. They were not normal calls. So our first hunch was that these calls were sending a code to activate a system, that would allows them to retrieve some intercepted voice data from those phones. [We thought] This was the reason there were so many calls. As a result when we approached the callers, that used the phone which called the phones, we knew how many times he had called, how much time they lasted, and the previous calls of the phone. I mean to say that there was a very big investigation.
JOURNALIST: What did they reply? What were they saying? Those 3 to 4 seconds what was happening?
VOULGARAKIS: Say they called Voulgarakis, for example, that they believed the phone belonged to, he did not pick up, and the voicemail was activated. Then the callers hang up.
JOURNALIST: In Greek or in English?
VOULGARAKIS: It was all in Greek. We also called.
JOURNALIST: Did you go to the shops in Nea Ionia?
VOULGARAKIS: We started an investigation, but there was no...(interruption into another, unrelated, question)
KYRITZIS (ed: journalist): At the long Thursday brief, the public order minister said that if Mr Koronias (ed: Vodaphone CEO) had not come to us to tell us [about the illegal wiretaps], no one would have noticed them. In the future, and when that the law about wiretaps and retention is activated, would no one notice? In which way can we be assured [that illegal wiretaps are not in place], given that the minister told us that no one would notice unless Vodaphone told us? What have you done to provide such assurances?
ROUSOPOULOS (Government spokesperson): I told you that if judged necessary we will amend the law. In any case you know that the authority (ed: the interception oversight authority) that we have mentioned so many times has the right to perform audits in mobile and fixed telecominication companies at any time it wishes. If there is a lack [in its powers] this will also be amended.
SOUGANELIS (journalist): I wanted to ask, since this scandal became public, who has the responsibility for the trustworthiness of the telecommunications concerning not only Vodaphone but also [other mobile providers] Telestet and Cosmote?
ROUSOPOULOS (Government spokesperson): I repeat that there are laws in place. There are those responsible for applying the laws. Companies themselves also have responsibilities. Those who enforce the law have obligations and rights. The interception oversight authority has also rights. If there is any legal gap we will fill it.
VLAXOS (journalist): What has the government done today, action wise, so that that not no one can evesdrop on phones?
ROUSOLOULOS (Government spokesperson): This is a very good question, despite the fact that I was also asked it on Thursday.
VLAXOS: Even if it wasn't I would still ask you.
ROUSOPLOULOS: No matter is it is good or not, repeating it seems good. Why? Because we have a situation which is not the rule. This situation is an exception from the rule. It does not mean that normally and continuously we have eavesdropping taking place or that normally communications are insecure.
VLAXOS: I agree with this. But shouldn't the government take some action?
ROUSOPOULOS: For example we have millions -- if not billions -- transactions on the planet and thousands -- maybe hundreds of thousands -- transactions in our country in telecommunications systems, like those used by the banks. It does not mean that these are breached daily. The exception has become this big issue and the people that were under surveillance, in the context of this exception.
VLAXOS: So you are telling me that there is no particular action that was taken. This is what you are telling me. Since you are not declaring it to me. I see.
ROUSOPOULOS: What do you mean by "particular action"?
VLAXOS: Let me clarify why I am saying this: Because there are surveys -- you have seen them -- that have found that the questioned citizens say, first the government has not told all the truth, and secondly that they feel insecure to speak [on the phone]. And no one is coming out to address this feeling. You are the competent minister to say "you know we have done one or teo things" to prevent someone eavesdropping on some citizens phone.
ROUSOPOULOS: Let me say it then: this was the exception, not the rule. Secondly, this exception, was made public. Third, If there are any legal gaps, we are ready to cover them. And also I will say a fourth point: there are laws -- as I told Mr KIRITSIS when he often asks -- there are rules, there are regulations in all societies that follow the rule of law and there are those that infringe them. That is the constant issue: When there is an infringement, finding those who infringe the rules. As I have said many time in this room, crime is not allowed in any civilised society, yet crimes are taking place. This is what society tries to do in any possible way. With the justice system, the police, with the investigations that -- indirectly as Mr KAKALIS said -- are done for finding crimes. With the independent authorities [ed: refers to interception commissioner]. In a number of ways society tries to protect the citizen. That does not mean that we should give the impression that the citizen is insecure, no one says that.
VLAXOS: Excuse me, Mr Spokesman, but it isn't the government that made it public. Mr KORONIAS (CEO of Vodaphone) came to tell you. None of those mechanisms worked.
That's where it ends. There are machine translation programs available for Greek into English but the above was translated by a person.
What is referred to above is that Ericsson has a "surveillance suite" of software that it can install into mobile phone networks. These were marketed variously as being useful for law enforcement (presumably wiretapping with a warrant) as well as for companies to spy on each other
. Someone who knew how to activate this Ericsson software did so inside Vodafone's network. It should be mentioned here that Vodafone could not access this software, neither to turn it on or make modifications.
This software doesn't seem to be any kind of new or cutting edge program. What makes this scandal beyond something a hacker or discontented Vodafone or Ericsson-savvy employee is the level of sophisticated in monitoring the phones as well as the numbers which were surveilled. This wasn't a random 100 phones, it was the Prime Minister, the Minister of Defense and many high-ranking officials (especially those in defense). Those numbers aren't listed in a database attached to the user's names - the government acquires whole blocks of phones en masse
and someone with very good intel figured out which one was being used by whom.
Besides government officials, Arabs in Greece as well as "anti-war protestors" were also monitored. Why someone would both feel the desire to spy on the Greek gov't as well as Arabs and anti-war protestors is yet to be determined.
So whomever is responsible for this both knew how to activate Ericsson's software, set up an auto-recording system of shadow phones and knew the numbers of which phones to tap. That's a very high level of sophistication.
Let's hope the authorities get to the bottom of this.