London - The revelation that the Swiss company Crypto AG has been selling digital technology to more than 120 national governments and supplying intelligence on those buyers to its secretive owner—the USA’s CIA—raises serious concerns, warns ImpACT International for Human Rights Policies.
“This frankly means that activists and political dissidents around the world are at risk,” says the London-based think tank. “And it should make us all wonder about the extent to which intelligence agencies use private businesses as ‘fronts.”
The Washington Post announced the finding following a joint investigation with the Rundschau news program on the German-language public television channel SRF, the German television channel ZDF. The found that the Central Intelligence Agency had built back doors into the platforms so it could easily decode messages and spy on foreign governments. These governments used Crypto AG products to encrypt communications for their military, diplomats and spies. Among Crypto AG’s clientele were Iran, India, Pakistan and the Vatican.
This violation reflects significant weakness in the role of legislative bodies in enforcing rules related to public and private respect of individuals' privacy
U.S. and German intelligence agencies have used the Swiss company's encoding devices to spy on other embassies, leaders and activists since 1971, enabling them to collect confidential information.
According to the Post report, Crypto AG sold the devices to more than 120 governments worldwide, and the CIA and Germany's BND cracked the codes of these devices to intercept thousands of messages. Since World War II, Crypto AG has been a pioneer in selling encryption devices, making millions of dollars.
The German Federal Intelligence Service (BND) terminated such espionage in 1993, but the United States continued until at least 2018, according to the investigation.
For decades, Crypto AG’s conduct has violated the Swiss constitution, which states in Article 13 that "every person has the right to privacy in their private and family life and in their home, and in relation to their mail and telecommunications" and that "every person has the right to be protected against the misuse of their personal data."
ImpACT International warns that this violation reflects significant weakness in the role of legislative bodies in enforcing rules related to public and private respect of individuals' privacy and in exerting control over the treatment of sensitive and personal user information. Privacy violations expose activists and dissidents to often life-threatening dangers.
The London-based think tank applauded the Swiss government's investigation of Crypto AG’s ties to the CIA and BND and its decision to revoke the firm's export license.
“This is a step in the right direction, but is not enough,” says ImpACT International. adding that a parliamentary commission of inquiry should be formed to hold accountable all those involved in the practices, including officials who were aware of the espionage but did not intervene.
ImpACT International for Human Rights Policies further calls for legislative amendments to ensure public and private companies' respect of individuals' privacy. There also must be proper oversight of the way companies deal with sensitive and personal information, with closure of any loopholes that can be exploited by intelligence services. Finally, there should be more effective global mechanisms to protect human rights defenders.