Data Centres in developing economies are being exploited by Foreign Government Interests. States in developing economies cannot defend their data due to the monopolisation by global superpowers of the requisite skills, capital and intellectual property.
Our aim for the Gateway of Troy Project is to raise awareness of the issues developing economies face and to support them to build capability to secure their citizen's data. This will protect vulnerable data and personal information.
Gateway of Troy (Coming Soon)
Gateway of Troy (Context Case Studies)
In Addis Ababa, the headquarters of the African Union spied on by Beijing
A year ago, the computer scientists of the building, built in 2012 by the Chinese, discovered that all the content of its servers was transferred to Shanghai.
At the African Union (AU) headquarters in Addis Ababa, elevators still speak Mandarin, and plastic palm trunks are branded with China Development Bank. New buildings under construction by companies from Beijing or Hong Kong surround the modern glass tower offered in 2012 by China to Africa. It is there that should take place on Sunday 28 and Monday 29 January, the 30 th summit of the pan-African organization.
Controls are strict to enter this building where ministers and heads of state meet twice a year to discuss the continent's major issues. Yet there is an invisible security threat ignored by most leaders and diplomats, but which is of great concern to some senior AU officials.
In January 2017, the AU's small IT cell discovered that its servers were strangely saturated between midnight and 2 a.m. Offices were empty, activity dormant, but data transfers were peaking. A zealous computer scientist therefore looked into this anomaly and realized that the internal data of the AU was massively hijacked. Each night, the secrets of this institution, according to several internal sources, ended up stored more than 8,000 km from Addis Ababa, on mysterious servers hosted somewhere in Shanghai, the Chinese megalopolis.
The new building, “China's gift to the friends of Africa” , was donated just six years ago. It was fully equipped by the Chinese. The computer systems were delivered turnkey. And Chinese engineers have deliberately left two loopholes: digital backdoors which give discreet access to all of the organization's internal exchanges and productions.
According to several sources within the institution, all sensitive content could have been spied on by China. A spectacular data leak, which would have spread from January 2012 to January 2017. When contacted, the Chinese mission to the AU did not respond to our requests.
In Addis Ababa, new buildings are emerging every week, usually built by Chinese. Simon Davis / Department for International Development “It went on too long. Following this discovery, we thanked, without causing any scandal, the Chinese engineers present at our headquarters in Addis Ababa to manage our systems, confided on condition of anonymity a senior AU official. We have taken some measures to strengthen our cybersecurity, a concept that is not yet in the customs of officials and heads of state. We remain very exposed. "
Since then, the AU has acquired its own servers and declined China's offer to configure them. On the ground floor of the glass tower, in a room that goes unnoticed, is a data center which concentrates a good part of the information system of the organization. All electronic communications are now encrypted and no longer pass through Ethio Telecom, the public operator of Ethiopia, a country renowned for its cyber surveillance and electronic espionage capabilities. From now on, the highest officials of the institution have foreign telephone lines and more secure applications.
During the 29 th AU Summit in July 2017, new security measures have been proven. Four specialists from Algeria, one of the institution's biggest financial contributors, and Ethiopian cybersecurity experts inspected the rooms and found microphones placed under the desks and in the walls . “Nothing to do with being listened to by the Chinese, loose the head of diplomacy of a great African power. They at least never colonized us, supported the independence struggles on the continent and help us economically today. "
A new IT architecture, independent of the Chinese, has also been deployed. Like this videoconferencing system, developed by internal IT teams and used by heads of state, which works by cable and no longer over Wi-Fi. Thus, the few diplomats and heads of state cautious can continue to use their jammers of waves without hindrance.
The African Union is satisfied with only 10 million dollars (8 million euros) of budget allocated to IT. With the exception of the World Bank, which paid for part of the new data center, foreign partners show little interest in financing a cybersecurity agency. “It suits everyone that it is a colander, deplores an official already present at the time of the Organization of African Unity (OAU, 1963-2002). We let ourselves be listened to and we say nothing. The Chinese are there twenty-seven hours a day, planted lots of microphones and cyber spy tools when they built this building. And they are not alone ! "
According to documents extracted by Le Monde , in collaboration with the site The Intercept , from the archives of the former consultant of the American National Security Agency (NSA) Edward Snowden, the antennas of the British secret services (GCHQ) have not spared the AU. Between 2009 and 2010, several officials saw their calls and emails intercepted, such as Boubou Niang, then special advisor to the UN and AU mediator in Darfur (Sudan).
Some Western powers favor human intelligence over the AU. Like the French intelligence services which, in addition to their technical espionage devices, have tried to convince heads of state from the French-speaking area to inform them behind the scenes of these summits. To the point of having tried to "recruit" those who have acceded to the rotating presidency of the AU or to the head of the Commission, according to several of them, annoyed by this approach considered "humiliating" .
The Pan-African organization has always been particularly attached to the defense of sovereignty and territorial integrity, two principles which appear in the constitutive act of the AU. However, due to a lack of resources and awareness of Heads of State and most of the officials, Pan-African digital territories remain at the mercy of foreign spy services.
"Here, it is security" Inch Allah "! » Quips a senior official. Attributed to China, the huge infiltration operation of computer systems, lasting five long years, nevertheless reminded some senior AU officials that it may be time, while the reform of the EU is being discussed. institution during this January summit, to secure their cyberspace.
Huawei data centre built to spy on PNG
By Angus Grigg Australian Financial Review
-Aug 11, 2020 – 12.00am
Chinese telecommunications giant Huawei built a data centre in Papua New Guinea, which exposed secret government files to being stolen, according to a report that catalogues Beijing's efforts to spy on the Pacific nation.
The report, provided to the Australian government, noted outdated encryption software was deployed by Huawei, while firewall settings were insufficient for a centre designed to store the entire data archive of the PNG government.
"It is assessed with high confidence that data flows could be easily intercepted," said the 2019 report on PNG's National Data Centre.
"Remote access would not be detected by security settings."
The Huawei data centre began operating before the APEC leaders meeting in PNG. Mark Schiefelbein
The US and its allies, including Australia, have become increasingly wary of China seeking to extend its influence among developing nations in the Pacific by extending cheap loans for major projects.
The report on Huawei is the first to document its complicity in Beijing's cyber espionage activities, after more than a decade of rumours and pointed remarks from security agencies.
The Port Moresby data centre was funded through a $US53 million development loan from China's Exim Bank and became operational in 2018, before PNG hosted that year's APEC leaders meeting.
Litany of flaws
The report noted the layout of the data centre did not match the intended design, opening up major security gaps.
"Core switches are not behind firewalls. This means remote access would not be detected by security settings within the appliances," it said.
In a statement, Huawei said: “This project complies with appropriate industry standards and the requirements of the customer.”
The report was commissioned by the National Cyber Security Centre of PNG, which is funded by the Australian Department of Foreign Affairs and Trade.
It was written by a cyber security contractor hired by DFAT and the report was then handed to the Australian government.
DFAT declined to comment.
In cataloguing major security flaws, the report, which ran to 65 pages in its original form, said the algorithm used for encrypting communications was considered "openly broken" by cyber security experts two years before being installed in Port Moresby.
The Huawei firewalls in the data centre reached their "end of life" in 2016, two years before the facility was opened.
While the report suggests a deliberate effort by Huawei to deploy lax cyber security, it noted this plan was partially thwarted by the centre quickly falling into disrepair, as insufficient money was set aside for maintenance and operations.
This resulted in many PNG government departments not moving their data into the centre as planned.
The lack of an operating budget meant basic functions such as software licences had expired, while batteries had degraded and were not replaced.
To get the data centre up and running again, Port Moresby sought financial assistance from the Australian government, a request that resulted in the report being commissioned.
Canberra has so far declined to provide funding to upgrade the centre and the report noted that a "full rebuild" would be required to modernise the facility.
This has left PNG with a $US53 million debt to the Chinese government, via Exim Bank, and a data centre that is barely operational.
Lack of funding
China's support for a data centre in PNG, using Huawei technology, was first mooted in 2009 during a visit to Beijing by former prime minister Sir Michael Somare.
The following year, Exim Bank, which is charged with implementing Beijing's trade and strategic objectives, agreed to provide the loan.
But it would take until 2014 for then prime minister Peter O'Neill to launch the project at a ceremony in Port Moresby, where he thanked China and praised Huawei.
"Let me take this opportunity to thank the government of China in making available the concessional facility of $US53 million through the Exim Bank," he said.
The data centre was part of a so-called Integrated Government Information System (IGIS), which planned to link 57 sites in Port Moresby and five regional centres.
As part of the project, the chief secretary of each PNG government department was instructed to move all data into the new centre.
A lack of funding meant only a handful of government agencies moved data into the facility and by early this year PNG was calling the project a failure.
A report completed this year by think tank The Australian Strategic Policy Institute found China had provided $US147 million for digital projects in PNG including the national data centre, the national broadband network and a biometric identity card.
Australia remained the largest donor in the 12 years to 2019 with $262 million provided for digital projects in PNG.