Original URL: http://www.theregister.co.uk/2010/06/29/spy_ring_tech/

Russian spy ring bust uncovers tech toolkit

Feds flush flame-haired femme fatale

By Christopher Williams

Posted in Government, 29th June 2010 12:43 GMT

The FBI's case against an alleged deep cover Russian spy ring relies heavily on surveillance of their use of ad hoc Wi-Fi networks, bespoke software, encryption and the web.

After a counter-espionage operation lasting several years, 10 people were accused on Monday of being covert agents of the SVR, Russia's foreign intelligence service. An 11th alleged member of the network - dubbed the "Illegals" programme by investigators - remains at large.

[A man has been arrested - see update at the end of this article.]

Anna Chapman, from her Facebook page

The criminal complaints against the group highlight their dependence on internet technologies.

Testimony from FBI agents describes how 28-year-old Anna Chapman (pictured) allegedly kept discreet appointments with a Russian government official at Manahattan coffee and book shops. Without making overt contact, she would allegedly communicate with her handler over an ad hoc Wi-Fi network.

"Russian Government Official #1 was across the street from the book store, carrying a briefcase," an unnamed FBI agent says in the complaint.

"I observed Chapman pull a laptop out of the tote bag. Chapman stayed in the book store for approximately thirty minutes; Russian Government Official #1 was in the vicinity of the book store (but outside) for approximately twenty of those thirty minutes."

Chapman allegedly kept 10 such appointments on Wednesdays between January and June this year. On nearly every occassion the FBI observed the same two MAC addresses communicating via ad hoc Wi-Fi.

Surveillance agents nearby used "a commercially available tool that can detect the presence of wireless networks" to witness the creation of the ad hoc networks. NetStumbler is probably the most popular example of such software.

"Law enforcement agents were able to detect a particular MAC address - MAC address A - at the time that Chapman was observed powering on her laptop computer," the complaint says.

"Law enforcement agents were also able to determine that the electronic device associated with MAC address A created the ad hoc network."

Chapman's fellow defendant, Mikhail Semenko, is accused of similar data exchanges with another Russian government official in Washington DC.

On one occasion in April, the Russian government official, who was based at the UN, rumbled his surveillance team, according to the court documents. He returned to his office and only one of the usual MAC addresses, allegedly belonging to Chapman's laptop, was observed trying to communicate.

On Saturday last week she handed the laptop to an undercover FBI agent, "so that it could either be fixed, or sent back to Moscow". An hour after the meeting she allegedly bought a Motorola phone and international calling card under the name "Irine Kutsov" of "99 Fake Street". The following day, last Sunday, she didn't turn up to another scheduled meeting with the undercover agent.

The complaint against the other nine defendants - eight of whom are accused of posing as bogus married couples - further describes the alleged spy ring's technical methods.

The Illegals were given a steganography program by the SVR's Moscow Centre, it says. The software is not commercially available, and investigators discovered the alleged spies held copies of it by clandestine searches of their properties. Going back to 2005, the FBI obtained warrants to make forensic copies of hard drives and other digital media at several locations across the US.

A New Jersey search uncovered a network of websites, from which the alleged spies had downloaded images.

"These images appear wholly unremarkable to the naked eye," the complaint explains.

"But these images (and others) have been analyzed using the steganography program. As a result of this analysis, some of the images have been revealed as containing readable text files."

Over one hundred such hidden messages were found in the New Jersey search.

Similarly, a search in Boston led to websites carrying steganographic messages. The texts had also been encrypted, and both the Boston and New Jersey hard drives required a 27-character password.

The Illegals are also accused of receiving data from Moscow through "brush pass" meetings. On June 6 this year, a Russian official "surreptitiously gave cash and a flash memory stick to Richard Murphy" at White Plains train station in New York.

"As Russian Government Official #3 and Murphy passed one another on the stairs, Murphy held out his backpack and Russian Government' Official #3 placed the Shopping Bag that he had been holding into Murphy's backpack," the complaint explains.

Earlier this year Murphy had allegedly been summoned to Moscow Centre, with instructions to buy an Asus Eee PC 1005HA-P with cash, and bring it with him. He returned to the US in March, and handed the apparently modified or switched laptop (the complaint notes it had a different serial number) over to Michael Zottoli, one of his fellow defendants, based in Seattle. According to a message to Moscow recovered from the New Jersey hard drive, the new machine was needed "due to [Zottoli's] laptop "hanging"/"freezing" before completion of the normal program run".

According to the FBI, over several years the Illegals used all these technical resources and techniques to deliver sensitive intelligence about US nuclear weapons, economics and Washington DC gossip to Moscow. Today Russia's foreign ministry said the charges levelled at the group were "contradictory" and it was seeking more information.

There are copies of the criminal complaints against all the defendants here. ®

Update

Police in Cyprus said they today arrested the 11th suspect, Christopher Metsos, at Larnaca Airport, trying to board a flight to Budapest. He has been released on bail pending extradition to the US.