Cyber Threat Intelligence

Combating the Darkest Depths of Cyber Intelligence: The Pall Mall Process & Commercial Surveillance Vendors

Spyware is getting out of control. We need a unified process and oversight mechanism to ensure its responsible use. Is the Pall Mall Process going to be the solution?

Ayush Singh

Jul 26, 2024 • 16 min read

The Spyware Industry has recently come under massive scrutiny for its misuse and associated privacy issues. Nonetheless, this industry is vital for ensuring global security, aiding governments in identifying and thwarting threats such as terrorism, cyber attacks, and espionage, while also monitoring both authoritarian and failing states for prevention of global instability.

The Pall Mall Process tackles these challenges by uniting nations, experts, and industry leaders to create ethical guidelines and oversight mechanisms. This collaborative effort strives to ensure the responsible use of such technologies, balancing the demands of security with the global safeguarding of individual privacy.

In this article, I'll try to explain what incidents led to initiation of The Pall Mall Process, why was it necessary & how it can benefit everyone. Will try to keep this blog as simple and straightforward as I can, for the sake of all the readers. However, please forgive me if I'm not entirely successful in doing so. But yes, reading this one will take some time & before continuing further, a little bit about myself.

Hello! I am Ayush Singh. I am the CEO of A.R.P. Syndicate - A Global Cybersecurity Intelligence & Research Company with hyperspecialization in Shadow IT & Vulnerability Intelligence. Now let's move forward in this article!

ORIGINS

Since the inception of technology, leveraging exploitation of a zero day vulnerability for intrusive surveillance has often been done by Global Law Enforcement & Intelligence Agencies at their discretion. Alliances like The Five Eyes Intelligence, apart from deploying intelligence gathering tactics such as SIGINT, OSINT, HUMINT, GEOINT, etc., have also invested quite well in grooming an in-house team of researchers who identify vulnerabilities that can be weaponized to serve the means.

After the success of Operation Olympic Games, things started developing pretty violently in 2010s, which led to somewhat commercialisation & creation of this industry. Malware Intrusions started breaking records each year. Countries from all over the World started funding dedicated agencies to not just identify & eliminate these intrusions but to also build deterrence against it. That's when the term Advanced Persistent Threats (APT) started shaping the cybersecurity economy. Moreover, absence of strict laws or regulations, presence of high demand & influx of funding led to crucial aspects of cyberwarfare & cyberespionage getting commercialised.

MARKET

First, let's cover the basics. Let's suppose some government has identified a few Lockbit Ransomware operators within its territory. Instead of immediately arresting them, they choose to constantly monitor them to understand how to inflict maximum damage on their organisation. To achieve this, the Law Enforcement Agencies (LEA) must oversee the operators' internet communications. However, it is nearly impossible to completely monitor these activities without controlling the various devices these ransomware operators are using.

Commercial spyware targets highly specific individuals, often at considerable expense. Some attackers can afford to spend six figures to compromise a single target. In scenarios like the one described above, commercial spyware can be very effective.

Here’s a rough outline of how some of its most significant aspect will work:

Initial Attack Vector (IAV) Discovery: Just like any other kind of vector, this one also has two components (Targets & Vulnerabilities). The target can be anything from a simple HTTP Server to an actual individual. Likewise vulnerability doesn't essentially requires to be an extremely sophisticated work of code. It can simply be a leaked credential. But yeah for the sake of little less simplicity, let's just assume that the target is a latest iPhone. Now, the objective is to find a vulnerability, or a series of vulnerabilities, that allows total control over the iPhone without any interaction from the victim (0-click).
Vulnerability Research: Discovering such vulnerabilities can get extremely challenging and time-consuming if you don't already have one. Some prominent eastern nation-states prefer to use vulnerabilities, that got reported by their national white hat researcher, at their discretion. Others prefer to either conduct an in-house secretive research or if that's not possible, they will just buy it directly from black hat researchers. This is where the zero-day vulnerability/exploit market becomes valuable.
Exploit Acquisition: In simple terms, the zero-day exploit market lists demands for specific vulnerabilities, in this case, a zero-click Remote Code Execution (RCE) combined with Local Privilege Escalation (LPE), is required. A vulnerability researcher would submit a discovered vulnerability to the marketplace, most probably in hopes of getting paid at once, and the Law Enforcement Agency (LEA) would purchase it but will most likely pay the sum in instalments or however it's mentioned in the broker's contract.
Weaponisation: Once the vulnerability is acquired, it needs to be weaponized. This means creating an undetectable malware that can be uploaded to the target device. The malware is designed to communicate with a Command & Control (C&C) server, which allows the agency to perform operations and extract intelligence—all without being detected. To ensure that the malware doesn't trip stuffs like EDRs & similar protection, this phase can get somewhat artistic & creative in nature. Most stuffs done in this phase end up building & orchestrating something that's sort of never seen before.
Commercialisation: Most incapable & outdated Law Enforcement Agencies (LEA) will prefer that they buy the entire thing as a product/service from a company that develops this "spyware", allowing them to simply utilise the ready-made software.

With this strategy, the government chooses to monitor rather than arrest the identified operators initially. They use commercial spyware and vulnerabilities obtained from the zero-day market to covertly gain control over the operators' devices, allowing for in-depth intelligence gathering and ultimately causing greater disruption to the criminal organisation.

This is perhaps the simplest and most straightforward explanation, but in reality, such operations are conducted very opaquely, with tactics varying constantly based on numerous factors such as budget, time, target, resource availability, buyer, supplier, involved regions, etc.

Often, attributing such attacks, once detected, becomes more complex and challenging than explaining the attack itself. Take Operation Triangulation, for example. We don't know who developed the exploits, who sold them, who the targets were, or what the objectives were. It could have been corporate espionage, a government's covert operation, or something entirely different. However, as a result, we do know, with ultimate surety now, that systems relying on "security through obscurity" are never truly secure.

These types of incidents will continue and likely increase dramatically as long as governments act irresponsibly, technology vendors neglect user security, and an open market exists for such malicious activities.

PROBLEM

Now the market itself isn't the problem. But its driving factor is & a commoners' perception of cyberwarfare, cyberespionage and, in a limited sense, offensive cybersecurity is. You just can't defend against an intelligence-led intrusive offensive solution without access to the same intelligence. Simply put, defensive strategies are fundamentally flawed in itself, cause if you are really good at doing offense, you will possess the intelligence required to bypass technologies like EDR, Firewall & all that so offense always ends up being at least one step ahead of defense.

Even today, everyone is blindly investing in most cutting edge cyber security solutions, and these solutions do stop the attacks happening in volume, yes. But the primary concerning fact remains intact - The nation-state threat actor that couldn't be stopped over a decade ago, can't be stopped today either & its domestic solutions are silently sold & thriving in the global markets.

Israel has always been at top of this game, and as of 2024, ex-Israeli Special Forces Personnel are the ones leading top Israeli Cyber Security Companies are everywhere. In simpler words, military-grade cyber security capabilities have been out in the market for quite a while now, accessible to any government willing to pay for it. Provided these solutions were in limited hands being used only by governments for ensuring the national security, things should have gone pretty well like this. Governments who don't have the best cybersecurity talent, could have just some of their natural resources to get hands on this solution to ensure greater safety & security in their territories. Unfortunately, things went way beyond just that, cause after all, money rules.

Taking advantage of growing market, certain leaders, across the entire global cyber security industry, began normalising the behaviour of putting profits over ethics & honour. This brought very powerful solutions in the hands of some allegedly unworthy & irresponsible people working for authoritative regimes which resulted to its unethical & unlawful application across the globe.

RESPONSE

The route to response began on March 27, 2023, when POTUS issued the Executive Order on Prohibition on Use by the United States Government of Commercial Spyware that Poses Risks to National Security.

Later on March 29-30, 2023, United States co-hosted The First Summit for Democracy. During this summit, the governments of Australia, Canada, Costa Rica, Denmark, France, New Zealand, Norway, Sweden, Switzerland, the United Kingdom, and the United States released a joint statement condemning the misuse of commercial spyware.

On April 19, 2023, United Kingdom's National Cyber Security Centre (NCSC), released a report on The threat from commercial cyber proliferation. This report was meant for "informing readers about the threat to UK industry and society from commercial cyber tools and services" which mentioned multiple key judgements on of it being -

Commercial cyber tools and services lower the barrier to entry to state and non-state actors in obtaining cost-effective capability and intelligence they would not otherwise be able to develop or acquire themselves. This commercial proliferation will almost certainly be transformational on the cyber landscape.

Then again in November 10-11, 2023, an informal dialogue took place at The Paris Peace Forum discussing the threat posed by cyber mercenaries, including the misuse of commercial spyware, and the need for strict domestic and international controls on the proliferation and use of such technology.

Built upon that dialogue, Britain & France together convened “big tech leaders, legal experts, and human rights defenders,” and the “vendors involved in developing and selling cyber intrusion tools and services.” in a conference held at Lancaster House in London on February 6, 2024.

Harmonizing Recent Campaigns to Tame the Hacking Marketplace

Together, they signed an international agreement termed as The Pall Mall Process, which addressed not only threats from spywares but also "commercially available cyber intrusion capabilities, cyber intrusion companies, vulnerability and exploit marketplace & destructive or disruptive cyber capability".

On that same day, Google released Threat Analysis Group's (TAG) Report on How the commercial surveillance industry works and what can be done about it & US announced visa restriction policies against the ones involved in commercial spyware trade.

The most recent joint statement, released on March 18, 2024, indicated that additional nations, enterprises, and academic institutions have joined the international effort to counter the proliferation and misuse of commercial spyware.

CONCLUSION

Again, I want to make one thing very clear: there is no defense against targeted, intelligence-led cyber offensives that exploit zero-day vulnerabilities especially on undocumented targets. You can't simply defend against enemies when they alone have the Initial Attack Vector (IAV). But that can change when you have the same IAVs.

Going forward, as a nation-state, you can always acquire these IAVs for reasons such as ensuring defense against them, using them for counter-terrorism operations & in fact certain countries even hope of achieving cyber deterrence with them & end up choosing them as the primary forms of retaliation/espionage tactics, you can say.

Now, considering these two scenarios, let's see how that can go wrong. :

Purchasing IAVs: As a government, if you buy an IAV from an international seller, you can use it effectively against terrorist groups or less resourced threats. However, you can't use it effectively against another country that also bought the same tool. Both countries have the same capability, canceling each other's advantage.
Lack of Oversight: If your government doesn't oversee the international seller, you can't expect continued access to the best tools. The company may sell the same or better products to others, chasing quick and large profits. This means you lose the advantage of having exclusive, cutting-edge intelligence.

These are some basic scenarios & there are even more but these ones in particular are enough teach us two very crucial lessons:

Exclusive Intelligence is Key: Exclusive access to unique intelligence tools is essential for maintaining an edge. Otherwise, it's not "intelligence" but just "news".
Multilateral Oversight and Control: Governments need to monitor and control the international entities they rely on for such capabilities to ensure they always have top-tier tools and to prevent these tools from being widely available.

In essence, relying on international spyware companies for critical intelligence puts a country at a disadvantage. Intelligence tools must be exclusive and tightly controlled to be effective. Therefore, investing in domestic capabilities and while maintaining good relationship yet strict oversight over global vendors, despite the public opinion or official reaction, ensures a unique advantage in cyber warfare.

Moreover, these technologies can achieve great results when used for good and ethical causes & it becomes crucial to ensure that users of these technologies are fully considered and subject to multilateral oversight. Completely banning their sale is not practical & highly preposterous, as they can significantly enhance global security. That's why a policy backed by global cyber diplomats like The Pall Mall Process is necessary to ensure such advanced technology doesn’t fall into the wrong hands or get used unethically.

While concluding this article, I want to highlight the situation in India. To build cyber capabilities, India primarily relies on technology transfer from its allies. While this strategy works well for short-term success, in the long term, investing in original, in-house, and exclusive research and intelligence is essential for gaining an upper hand in cyber warfare. If you cannot quickly build and evolve upon that technology, you risk relying on outdated tech that won’t deliver the expected results.

While attending an international conference in New Delhi, I couldn't help but laugh at a delusional statement made by India’s top Cyber Security Adviser: "There is light at the end of the tunnel." For a country that prefers to spend more funds on international solutions over fostering domestic cutting-edge cyber innovation and capacity building, that light seems more like the headlamp of an oncoming unstoppable silent train, steadily advancing to obliterate everything in its path.

In my optimistic view, it's similar to how you can't control the wind, but you can always monitor and track your direction because of it, and quickly get back on course when favourable winds arrive. So, while India may not currently seem to be on the right path or making the right decisions, it will ultimately reach a position that benefits us Indians the most.

Thanks for your time. Have a good day!

Uncontrolled access to data, with no audit trail of activity and no oversight would be going too far. This applies to both commercial and government use of data about people.

- John Marlan Poindexter, Former National Security Advisor of the United States

ORIGINS

MARKET

PROBLEM

RESPONSE

CONCLUSION

Improve your skills

Confirm your email