Belfast Telegraph

Hacking of technology an important modern tool for security agencies

There is unlikely to be any official verification of the claims of smart TVs being turned into listening devices.

But there is no doubt that hacking has emerged as an increasingly important tool for UK security agencies in recent years.

Referred to officially as equipment interference or computer network exploitation, the ability to break into computers or smartphones is seen as a crucial workaround in an era when sophisticated encryption makes it more difficult to intercept the communications of terrorists and serious criminals.

The techniques were only made public in 2015 and the Government provided unprecedented detail about their deployment by security services as it unveiled the Investigatory Powers Act, which passed into law last year.

Equipment interference can be carried out on traditional computers, tablets, smartphones and storage devices, either remotely or by physically interacting with equipment.

Operations vary in complexity, according to official documents.

At the lower end of the scale, an investigating agency may use someone's login credentials to covertly gain access to communication and other information on a device.

More complex operations may involve exploiting vulnerabilities in software to gain control of devices or networks to enable the remote extraction of communications or other information, or to monitor the user of the device.

The scale of activity covered by the Act also varies from the targeting of a single device to bulk EI, which would involve the collection of data relating to multiple devices in order to "join the dots" between fragments of information.

Officials say the tactics can sometimes be the only method by which to acquire data in national security investigations.

GCHQ conducts EI activity with a "foreign focus" to protect the UK and its interests.

In 2013, around 20% of the agency's intelligence reports contained information that derived from EI operations against a target's computer or network.

And MI5 says it needs to be able to access communications or other information in order to gain "valuable intelligence" in national security investigations.

The IP Act introduced a strengthened authorisation regime for the use of EI, including a requirement for bulk operations to be "foreign-focused" and signed off by a judicial commissioner.