How the BND monitors Communication in Austria
[Editor’s note: This article was originally published on the web site of the FM4 radio channel of the Austrian Broadcasting Corporation. We have translated the text in order to make the content accessible for our English-speaking audience.]
How the BND monitors communication in Austria
At the most important connection to the Frankfurt node DE-CIX data streams from Austria are copied in their entirety to lines of the BND. Selected results of their evaluation are returned by the BND to the Austrian Army Intelligence Office in Vienna.
by Erich Moechel for fm4.orf.at
The reaction of the Austrian government regarding the publication of a list of targets of the German Federal Intelligence Service (BND) in Austria has caused surprise and amusement amongst intelligence experts. The general tenor: Either the Austrian government really has no idea how the data exchange between German and Austrian intelligence services works, or this is a domestic political manoeuvre.
Really affected were the domestic intelligence services that via the BND gain insights of Austrian networks, to which f.ex. the Army Intelligence Office (HNaA) itself has no access. The communication of the Austrian targets is tapped at glass fibres with a throughput of up to 100 Gigabit/sec at the Frankfurt node DE-CIX. There is no reason to put a stop to this, because the BND has a legal mandate for tapping the targets, while the HNaA in Austria has none.
Crime Scene Frankfurt Internet Exchange
At the world’s largest Internet node located in Frankfurt the networks of international data transporters converge, one of which is the A1 Telekom. Via the DE-CIX, Internet traffic, telephone calls and metadata are forwarded to other carriers, so it deals primarily with foreign communication. On the left the graphic shows the headquarters of A1-Telekom (AS8562), already the second node (AS8447) is located at Frankfurts Internet Exchange.
The basic graphics are from the US carrier Hurricane Electric, the retro spooks were implanted by Pia Reiser (FM4).
The tip of the bold arrow marks roughly the tapping point of the BND, because that’s where all outgoing data of the A1-Telekom as well as all incoming data pass through. Only after this point, depending on their destination, the data will be split up among other carriers that are in the domain of other intelligence services. Two of AS8447’s highest-throughput connections lead to the networks of US carriers NTT America (AS2914) and Level3 (AS3356). These lines are filtered by the NSA, whose machines, thereby, receive all communications of the Austrian surveillance targets with their counterparts in the USA.
How fibre optic monitoring works
The third throughput-strong connection leads to the network of the Swedish carrier Telia (AS1299) where they also tap and evaluate the data, since the Swedish military secret service FRA has the necessary license for tapping since 2008. So there are several secret services interested in the data streams from Austria, but only the German BND has access to all data that is delivered from the A1 network in Frankfurt. However, the data streams are tapped and filtered by the same method everywhere.
The entire fibre optic line is copied via a so-called splinter to a second fibre strand. In a nutshell, at ultra-fast switches only transport-related, meaning irrelevant data are sorted out, and the relevant data are split among server batteries ,depending on their protocol (email, http, VoIP, etc.), and stored there. Only then the “selectors” of the respective secret services appear on the scene, these are telephone numbers, e-mail addresses, chat IDs, etc., which are assigned to the surveillance targets.
The data economy of the secret services
The intercepted data are used to extract insights that, however, will not remain in the sole domain of the respective intelligence. The secret services connections among each other are much closer than is commonly assumed, mainly for technical-practical reasons. As shown in the example above even the overpowering NSA has to rely on cooperation if it wants to access certain, for example Austrian, data sets. In fact, a good part of intelligence data economy consists of barter transactions with other secret services.
Only those who have enough intercepted records themselves will also receive data from intelligence partners. On behalf of the Austrian Army Intelligence Office this fact is presented in a slightly roundabout way: “The HNaA … has to procure and prepare security-related information on regions and actors that affect the national security of Austria and thus the EU and present it in the form of situation reports and situation lectures to the highest political and military leadership of the republic.” “In addition to the “essential users” of Austria, the HNaA also provides the “EU Military Staff with needs-based news”.
“The governments indignation is ridiculous”
That’s why the Graz intelligence expert Siegfried Beer described the public indignation of the Federal Government regarding the BND’s tapping activity of Austrian data sets in several interviews as “ridiculous”. As a former foreign minister, now Federal Chancellor and top recipient of the secret briefings of the HNaA, Sebastian Kurz should know how closely BND and HNaA are connected and how the data exchange between the secret services generally works. Already in 2015, as foreign minister, Kurz discussed this very topic with his German colleague Frank-Walter Steinmeier several times in detail. Since then, the BND’s tapping of lines from Austria DE-CIX, including a few monitoring targets, which are also on the list, is already known in this country.
Selectors have increased at least tenfold
That said, the research of the colleagues of “Der Standard” and “Profil” should by no means be degraded. Although what Michael Nikbakhsh and Fabian Schmid have unearthed dates back to the early days of fibre optic surveillance and already ended in 2006. However, these are selectors that directly refer to surveillance targets. And one’s own selectors are among the best-kept secrets of any secret service. Even to friendly services insight is usually granted only on an ad hoc basis and in selective extracts.
Insofar, this list is quite a rarity and it also allows for conclusions about today. If there were about 2,200 selectors by 2006, then there are at least 10 times as much in 2018. With the rapid growth in mobile communications and data traffic overall, the numbers of selectors are also growing. What’s more, Vienna is considered the world capital of espionage, because there are already as much as 18.000 accredited diplomats only located in this city. Therefore, the number of selectors now used by the BND for Austria could very well be in the mid to high five-digit range. By the way, the Frankfurt Internet Exchange has filed a lawsuit against the data-tapping machine, which is now on its way to the Federal Constitutional Court.