An open-source overview of the technical intelligence collection threat in Asia

Military Intelligence Professional Bulletin, April-June, 2004 by Wade C. Wilson

The technical collection threat in practically any room worldwide starts with the telephones on the desk. A standard telephone contains at least one microphone, and with a simple reengineering trick, one can transform telephone speakers into microphones as well. Consider then the number of potential microphones a modern digital telephone might have: two in the handset, two for the speakerphone, and one for the ringer. What is preventing the discussion occurring inside the room from transmitting along the telephone lines? As it turns out, not much, and if one is overseas--especially in Asia--a person should always assume that his telephone is the equivalent of a live microphone.

In the past, the hook switch of a telephone physically disconnected the wires inside the telephone that established the talk path (an electrical conduit between the handset and the other party). If an adversary wanted to "bug" the telephone, there were generally only two options available:

[] Rewire the telephone's internal network to bypass the hook switch when the telephone is not in use or "on hook."

[] Introduce another transmitter, such as a radio-frequency transmitter not dependent on the telephone internal wiring to transmit conversations outside the room.

The introduction of cheap, digital telephony did away with what little security the hook switch provided. Now the "hook switch" is nothing more than a computer-chip function that signals a disconnect procedure through digital commands. However, network administrators and hackers know bypasses they can use to turn telephones on while they are sitting idle in the telephone cradle. At the administrator's level, "clicking a button" on the main control program can activate telephones controlled by PBXs. (3) PBXs also have numerous vulnerabilities to hacker exploitations (thus the billion-dollar-a-year toll fraud problem in the United States), which make any telephone controlled by a PBX a potential threat to external exploitation as well.

Asia-Specific TECHINT Collection

The threat in Asia, however, is a little more simplistic and common than an exotic hacker attack. Many hotels in Japan, China, and South Korea have permanent wiring so that the telephones receive and transmit audio even when they are not in use. (4) In China, at least one agency of the PRC Government owns most if not all of the executive-level (three or more stars) hotels. Foreign hoteliers need government permission to build and conduct business in China, something more easily accomplished with a PRC agency pushing the contracts through the labyrin-thine Chinese bureaucratic process. Granting partial ownership to the PRC agency willing to support the project--as well as granting the government certain concessions, one of which is general oversight and liberal leave during the construction--can facilitate this process. With this power, the Chinese Ministry of State Security can lay extra wire in the hotels during construction to either permanently tie-in microphones or make plug-and-play installation as easy. (5) They can then establish permanent surveillance and technical monitoring posts near the hotel to keep track of the guests' conversations, actions, and associations. Hotels in North Korea and Vietnam most likely follow China's lead in monitoring foreigners from a largely internal security standpoint.