Anatel is investigating whether operators were aware of the spyware attacks

The National Telecommunications Agency (Anatel) has initiated three administrative procedures to find out whether phone operators Tim, Vivo and Claro knew about the attacks launched by the FirstMile spyware, used in the alleged scheme to illegally spy on the authorities through the Brazilian intelligence agency (ABIN). ) during the government of Jair Bolsonaro.

In a note sent to IG portal
The agency stated that the investigations prioritized, initially, “clarifying whether there was knowledge and cooperation of the service providers with the Brazilian Intelligence Agency (ABIN), and investigating any failures that could allow such unwarranted access.”

The agency also stated that it had identified, on the part of operators, the implementation of blocking solutions for this type of activity, but was investigating “whether and whether service providers noticed any attempts to improperly access information at the time they occurred.” They should have notified the agency, or if they only found out later, through press reports.”

However, the agency did not confirm whether the companies in fact did not report the attacks – a position that would impose an administrative penalty, but stated that it had requested information from the Federal Police that could contribute to the continuity of investigations.

Check out the two memos sent to iG by Anatel in full:

“Anatel has initiated administrative proceedings to investigate the facts reported in the news from the country's major newspapers about the surveillance of Brazilian citizens carried out by Abin, using spyware on the networks of Brazilian mobile service providers.

The spyware exploited the historical feature of the unified protocol for international interconnection between telecommunications service providers.

Investigations showed:

1) Abyan has not made contacts or agreements with the sponsors of this campaign;
2) That service providers have implemented network solutions with the function of preventing potential exploitation of this protocol. The implementation of this blocking solution was the result of the cybersecurity risk management process, and not a response to a specific, previously unknown situation.

The operation was carried out by the company hired by Abyan, via spyware. The investigation revealed that there was no communication or contract between the service providers and Cognyte.

Based on the information already collected, it is not yet possible to say about the data that has been explored.

Service providers reported that they had adopted solutions to prevent this type of unauthorized access, as well as conducting successful tests.

The agency specified that the new tests be conducted by a specialized and independent company.

Finally, we inform you that the agency’s investigation is still ongoing.”

“The National Telecommunications Agency (Anatel) reports that it has initiated three administrative measures based on the facts reported by the press on March 14, 2023, regarding the possible monitoring of citizens through spyware on mobile phone companies’ networks. Such measures were given priority, initially, to clarify Whether there was knowledge and cooperation by service providers with the Brazilian Intelligence Agency (ABI), and to investigate any failures that might allow such unwarranted access.

Service providers reported no prior knowledge or contact with Abyan regarding the reported facts. They also reported that they have implemented blocking solutions regarding the possibility of inappropriate access through international interconnection protocols. Furthermore, they reported that they conducted tests to ensure the adequacy of the solution.

Anatel investigates whether providers noticed any attempts to improperly access information at the time they occurred, whether they should have notified the agency, or whether they became aware of them later, through press reports.

The adoption of security solutions does not necessarily occur as a reaction to incidents that have occurred, but can also be a result of preventive measures and risk management, an obligation arising from sectoral regulations.

The service providers have provided information to the agency on this subject and a new round of tests on the adequacy of the implemented blocking solutions has been agreed.

Any finding of evidence of non-compliance with obligations leads to the opening of sanctions procedures, which respect due legal defense and contradictory procedures.

The agency states that it has requested information from the Federal Police that could contribute to the continuity of investigations.

Hey IG portal Contacted the operators, but have not yet received a response.

*The report is being updated

Read more