“Wiretap — $9,000”. How the “black market for data” works and how to protect your privacy?

“Embarrassing questions” about the security of personal data.

Mobile operators, banks, online stores and taxi services today know more about us than we can imagine. We voluntarily give up our personal data in exchange for the modern benefits of civilization.

Using taxi apps, food delivery services, internet banking and everything else without which life in society is now unthinkable, we share our personal details, information about our contacts and information about our lifestyle, after which we stop controlling what happens to this information next.

The state collects even more data about us. Among other things, it has the power to restrict citizens’ right to the privacy of calls and correspondence.

All of this information, from bank account statements to phone wiretaps,  can be freely bought on the “black market,” thanks to corrupt employees of commercial services and government agencies. This opens a wide field of activity for journalists, hackers, fraudsters or representatives of the criminal world. 

The editorial team of TK Media looked into how the “black market for data” works and what needs to be done to protect the right to privacy in the digital age. 

They say bank and service employees can sell my data to third parties. Is that true?

Data from court registries and numerous online ads indicate that this practice exists. A Nova Poshta employee can sell your personal details (your address, phone number or service usage data) to fraudsters for 100 to 500 hryvnias, while a bank manager can pass on your personal details or account statement to a criminal for a fee of 500 hryvnias to 300 dollars, depending on the data requested, the client’s identity and the associated risks.

In addition to targeted requests about specific individuals, databases of customer personal data from banks, online stores, mail services, trading platforms and even government bodies can be bought online.  That is why you should not be surprised that taxi services and online stores know your phone number, bombarding you with advertising SMS spam, and why Mikhail Poplavsky invites you to his anniversary concert.

The cost of a database depends on the number of customers, how up to date it is, the seller’s ambitions and the buyer’s ability to pay. In general, one database can be bought online for prices from 1,000 hryvnias to several hundred dollars. There is no need to go to the DarkNet for this: personal data is sold in numerous Telegram chats. 

Anyone who has access to your personal data can sell it, provided it has value to someone and people are willing to pay for it. Any public company or organization, even one with the most sparkling reputation built by marketers, is a brand, a virtual image behind which stand ordinary people. 

Your personal data is handled by low- and mid-level managers who hold low-paid positions in the corporate hierarchy, which makes them easily tempted into extra earnings that require no significant effort. All of this, together with existing demand, creates fertile ground for trade in personal data to flourish.

I don’t want any outsider to study my account transactions. How can this be prevented?

At the moment you share your personal data with a service or use its services, you should bear in mind that your data and usage history may be passed on to third parties.

In some cases, it will indeed be harder for fraudsters to obtain your data. 

For example, if you are a VIP client of PrivatBank, an ordinary manager will not be able to access your profile and statements. Only a VIP-branch manager or an employee of the bank’s Security Service can access your data, which significantly complicates things for fraudsters unless they have the right “contact” in the organization, raises the cost of the job for the client, and carries more risk for the bank employee. 

It is also important to note that data trade flourishes in large banks and retail chains — PrivatBank, Oschadbank; less so in small banks. The reasons are clear: the more clients there are, the more data there is, and the faster a “market” forms around it. 

Who else can sell my data, and who buys all of this at all?!

Anyone who has access to databases containing valuable information. A police officer can sell data from the ARMOR and NAIS databases — besides personal details, they may contain your history of offenses and prosecutions, or information about vehicles and license plate checks. A border guard with access to the GART database can sell the history of your trips abroad — when, how, with which passport, with whom and in which direction you left Ukraine. A person with access to the civil registry office (ZAGS) database can sell information about your relatives and family members. A tax office employee can sell data about your income, as can an employee of the Pension Fund. A bank manager can sell your personal details and statements with all account transactions. An SBU employee can sell “traffic” records of connections linked to your phone number or even wiretap it for money, while a security official with access to the “Smart City” database can track your movements by car in real time through the city camera system.

There are many possible people who might be interested in your personal data: in the most harmless case, these could be investigative journalists who want to find out where you fly, obtain your official income figures through tax officials’ data, or the personal details of your relatives to check the real estate or cars they own. Your private life may also interest a jealous spouse who wants to check your expenses, call list, or get data on your locations to make sure you really went on a business trip to Dnipro and didn’t fly to Bali with a lover.

In less pleasant cases, these could be fraudsters collecting your personal data for a scam; debt collectors studying your financial situation and intending to intimidate your relatives; or representatives of the criminal world who see you as a potential victim. 

What all the people listed above who might be interested in your data have in common is that they are definitely not your well-wishers.

You said even SBU employees may trade my data. What is a “mobile phone traffic”?

Any organization, whether a private bank, a large online store or a state special service, is made up of living people with their own desires, ambitions, vices and shortcomings. That security officials may abuse their official position by selling information to commercial structures is shown by open court registry data and reports from law enforcement agencies themselves. For example, security officials recently reported the detention of a group of people, including active SBU employees, who traded in subscribers’ mobile connection data. According to published investigation data, two months of “wiretapping” one number cost 9,000 dollars. In July, the State Bureau of Investigation reported the detention of an SBU employee who, according to the investigation, sold “traffic” of mobile connections for 2,500 to 5,000 hryvnias per statement for one number. Despite regular news of enterprising security officials being detained, offers to buy a statement for a number or to put a phone number under “wiretap” can be found on the black data market. The problem is clear: low salaries for law enforcement officers, the opportunity (access to information) and demand (willingness to pay) for it on the market.

The “traffic” of a mobile number, or a call detail record, is data on the list of your connections (incoming/outgoing messages and calls) as well as data on your location (connections to cell towers) for the requested period — usually 6 months — and the phone’s IMEI. In addition, the call detail record allows you to see statistics on the most frequently dialed contacts, which makes it possible to build a picture of your connections. Once the numbers have been attributed to real people (establishing who owns each number), the holder of this information gets a picture of your connections, information about your movements and lifestyle (for example, where you sleep and where you spend your working hours). People interested in you may want information for a specific period: to find out where you were at a particular time or who you spoke with on certain dates. Periodic raids by security officials on sellers of secrets affect prices in the short term, but the cost quickly “rolls back.”

Wait, what are you saying? I know that the privacy of calls and correspondence is guaranteed by the Constitution, and that only a court can authorize access to my conversations.  How can a judge grant permission if I have not committed any crime?

The human factor is the main vulnerability of any system. A small number of investigating judges, overloaded with work and reviewing dozens of motions a day, who are limited to 24 or 72 hours (the deadline by which a judge must consider a motion under criminal procedure law) are physically unable to examine a motion properly. Under such conditions, consideration and granting of an investigator’s motion is largely a formality: it would be naive to think that a judge will analyze the motion, personally attribute phone numbers to real people, establish their owners and look into their connection to the specific criminal case. Most likely, the judge will simply grant the motion, issuing a ruling copied by an assistant from a flash drive brought by the prosecutor. 

Security officials themselves can “insert” the required phone numbers into other people’s criminal cases: this often involves criminal proceedings classified as “terrorism,” “treason,” “financing of terrorism” and other cases related to public or state security.

Inserting unrelated numbers or even specific people into a convenient case is a common practice. For example, adviser to the minister on occupied territories Yuriy Grymchak was detained on suspicion of fraud in the case of the beating of Tetiana Chornovol in 2014. The reason: the Special Investigations Department of the Prosecutor General’s Office lost the right to investigate new criminal cases after 2018, but did not want to hand over the high-profile case to the State Bureau of Investigation. 

In addition, mobile operators themselves often pass statement data to law enforcement without a court decision.

So can they listen to my conversations? Who needs my conversations and why?

Your conversations can be monitored by law enforcement agencies that have the right to obtain information from transport telecommunications networks (until recently this right belonged only to the SBU and the Interior Ministry, and after the adoption of bill 1009 it also went to the NABU and the State Bureau of Investigation), or by other persons with special equipment.

If your number is placed on “two” (wiretap), interested parties can obtain audio recordings of your phone calls, read text messages and do so in “real time.” 

Sometimes the main value may lie not in your phone calls but in your messenger correspondence or email contents. A “wiretap” can help gain access to your email or your Facebook account, if the tapped phone number is linked to them. In that case, your ill-wishers can carry out a “password reset” via the “forgot password” button and “restore” access to the account in your name, “confirming identity” by entering the one-time code sent by the email service or social network to your mobile phone number. Such operations often happen late at night, when you are asleep and suspect nothing: during that time your enemies can gain access to the account, make an archive of correspondence and perhaps even make a public statement on your behalf.

Online fraudsters are also interested in intercepting SMS messages, because SMS two-factor authentication is often set up as a means of identity confirmation on various cryptocurrency exchanges. In the US, many crypto entrepreneurs have fallen victim to such fraudsters, with losses from money stolen from crypto wallets estimated in the tens of millions of dollars. However, in the US fraudsters do not use the services of special services but rather deceive employees of mobile operators, restoring their victims’ phone numbers using social engineering methods. 

Another popular type of fraudster activity is porn blackmail. Fraudsters hack user accounts on social networks and iCloud, selecting careless victims with low account security, and then blackmail them by publishing intimate correspondence or explicit photo or video content. However, SMS interception is neither the only nor the simplest way to hack an account.

That sounds frightening. How can I protect my email and social network accounts if receiving SMS on a phone number is not a reliable method?

To protect your data, it is worth following several rules.

Link your email, Facebook, Instagram and Twitter accounts, and messenger accounts to a new phone number. This phone number should be known only to you — do not tell it to friends, colleagues or relatives. Do not use it in everyday life or leave it as a contact when using other services — banks, taxis or shops.

Do not insert the SIM card with the secret number into your phone, which is your main device. By the IMEI of your phone, security officials can find out all the phone numbers whose SIM cards were ever inserted into the device. This way your phone number becomes known, and all the effort you put in will be pointless.

Do not top up your secret number through online banking from your account. This way the operation will remain in your bank transaction statement, and all the effort will be pointless. It is better to do this with a one-time top-up card (remember the ones you scratch with a coin?) or through an iBox terminal. In the latter case, do not log in to the terminal or confirm your identity by entering your main phone number.

Buy a simple cheap push-button phone and dispose of it after use, or buy a phone with a zero IMEI for permanent use (such solutions can be found online or at radio markets). Remember that phone numbers used in messengers should be updated at least every six months to avoid unpleasant situations: operators sell inactive numbers to new customers.

Set up two-step authentication in the settings of your email, social networks or messengers. Do not use receiving an SMS on your phone number as two-step authentication.

Install Google Authenticator — an app that generates one-time passcodes which must be entered as two-factor authentication each time you sign in from a new device. This way an attacker cannot access the account unless they have physical access to your device.

Another method of “physical” protection — tokens. A token is a cryptographic key used to authenticate and identify the owner. To confirm identity, it must be inserted into the device. Tokens can easily be bought from numerous online stores, and set up as an authentication method in your email or social network settings.

Google, Facebook and Apple also offer confirmation through your main device as two-step authentication — this means that when a login attempt is made, you receive a notification about it with the option to tap “yes” or “no.”

And how do I protect my main phone number? The one I give to banks and use for personal purposes.

Protecting your personal phone number linked to online banking is worth taking care of at least if the fate of your bank savings matters to you. 

In August, the cyber police reported the detention of a group of people who stole money from the bank accounts of Ukrainians. According to the investigation, fraudsters bought databases of bank customers’ phone numbers on the black market, then made SIM card duplicates through the “number recovery” service at mobile operators’ service centers. 

After obtaining a copy of the SIM card, the fraudsters logged into the victim’s online banking and transferred money to their own accounts (incidentally, a bank card registered to a front person can easily be bought online for a fee; people in need of money sell their passport data and open bank accounts in their own name, after which intermediaries resell them online). Most victims were holders of payroll cards — teachers, medical workers and social sector employees. In total, according to law enforcement, fraudsters stole about 1.5 million hryvnias.

Such schemes became possible because of weak security protocols at mobile operators, which allow a phone number to be restored without proper confirmation of the number owner’s identity. To create a SIM duplicate, depending on the rules of the particular operator, the fraudster must name the last three most frequent incoming/outgoing calls and the amount of the phone number’s last top-up. 

Data on your incoming/outgoing calls can be provided by a call detail record for the phone number, which can also be bought on the black market, and the amount of the last top-up can be found out by topping up the phone number yourself through a terminal.

You can protect your phone number from being duplicated by third parties. To do this, your phone number must be a contract number.

In that case, to create a SIM duplicate, the applicant will have to present a passport and go through identity verification. Of course, there is a chance that attackers could forge your documents or bribe a service center employee, but as a rule fraudsters look for “easier prey” and avoid high-complexity tasks, while “your person in the service center” would very likely be held liable for handing a SIM duplicate to an outsider, which could potentially lead to the exposure of all participants in the conspiracy. 

1. Get a contract number at your operator’s service center;
2. Disable SMS identity confirmation in your banking settings.

Is intercepting a message the only way to hack an email account?

One of the most common methods of hacking email is “phishing.” There are different types of phishing, differing in methods, style and approach. The aim of a phishing email is to get your attention, make you click a link or open an attached document, and then enter your mailbox password, handing it over to the attacker. In addition, by downloading a file, your computer can be infected with malware. 

Give your password to a fraudster yourself? It may seem beyond the realm of possibility, but everything depends on the quality of the message. The quality of phishing depends on the skill of the specialist. The better the specialist has studied the target, the greater the chance they will find the right approach. For example, you are under investigation and receive an email from an investigator with a summons for questioning. Or a colleague sends a work report with a document title that raises no suspicion. Or you are a journalist and receive an email with a lawsuit filed in the name of a figure in your articles. Phishers often forge the sender’s address, creating a similar email account that differs by one letter; but modern technology even allows the sender’s address to be completely spoofed.

I communicate on Telegram; it is the most secure messenger, which does not share my data with the special services of any state. So I am calm about the privacy of my correspondence.

Despite Telegram’s obvious competitive advantages over other messengers, it has its drawbacks. For example, Telegram is nearly the only popular messenger that syncs your chat history (except secret chats) when you log in from a new device. That means that if your ill-wisher gains access to your account by intercepting the SMS with the login code, upon logging in they can access your entire message history. 

At the same time, Telegram really is the most secure of the popular messengers, if you follow certain security rules:

1. Discuss delicate topics only in one-on-one secret chats;
2. Set a self-destruct timer for messages (1 hour/1 day/1 week);

By setting up a cloud password, you can protect your account from unauthorized interference. This way, even if someone intercepts the SMS with the login code and successfully passes the first stage of authentication, they will be asked to enter an additional password that you set in advance. If the other person does not know the password you set, they will not be able to access the account.

Of course, you may argue, citing Signal or Wickr as messengers with what you consider the best security system, or you may be a fan of playing chess in a messaging app, but the truth is that very few people in Ukrainian realities use them, and forcing every interlocutor to install, register and figure out the messenger you choose is unlikely to be convenient for both of you.

If attackers have intercepted the SMS with the code-password, can they bypass the additional password in Telegram?

Telegram allows you to “reset” the cloud password. This option is provided in case you really forgot the password but need access to your account. Telegram will ask you to confirm your identity by receiving a one-time access code at the email address specified when setting up the cloud password, which in turn is a window of opportunity for attackers.

To avoid trouble, create and specify, when setting up the cloud password, an email address created specifically for this purpose. No one else should know about this email account: that is, you should not use this mailbox for other purposes, conduct correspondence with it or give it out using other services (for example, as a contact address with bank employees, or to register with Glovo or Uber).

And what if my phone is snatched from my hands?

The precautions described protect you from remote intrusion into your accounts, but information of interest to your enemies may physically be on your device. Therefore, it is possible that your adversaries may decide to take your phone physically. This can be done by law enforcement, conducting a search of your home, car or office, as well as by robbers lying in wait for you in a dark alley in the evening. To secure your phone, it is worth following these rules.

1. Turn off phone unlock via Face ID or fingerprint. Technological progress allows us to unlock a phone with a glance or a touch of a finger, but don’t doubt that security officials will readily use this by holding the phone to your face or forcibly pressing your finger to the Home button. Use a regular passcode;
2. Set the device to automatically erase after 10 incorrect passcode attempts;
3. Set additional passcodes for each messenger. Telegram, WhatsApp and Line allow this. Unfortunately, the Facebook and Instagram messengers do not. Minimize communication in unprotected messengers to discussing the weather outside the window;
4. Do not take screenshots of correspondence. If you need to take a screenshot of a conversation, do not keep it on the device for long;
5. Discuss delicate topics in Telegram secret chats with a message self-destruct timer. Telegram lets you set a message self-destruct timer for one hour, one day or one week;
6. Make a habit of clearing correspondence and unnecessary photos once a month. Set a calendar reminder so you don’t forget;
7. All important memorable photos, documents, intimate photos of former partners, or your personal ones, and anything not meant for other eyes, are best stored in a reliable cloud service whose account is not linked to your main email or phone number. Do not keep data that could compromise you on your main device for long;
8. Keep notes and personal records in services that allow an additional passcode to be set for access. For example, this could be Evernote. The standard Notes app on iOS also allows an additional passcode to be set.

Great, I’ve done everything you said: set additional passcodes and turned off Face ID! Now, if security officials take my phone, they won’t be able to unlock it?

That depends only on you. It is important to remember that security officials will not rack their brains trying possible six-digit combinations; they will work with people who know the right answer to the question they are interested in. You have made considerable efforts, building your line of defense, setting traps and creating a digital outpost, but the main vulnerability of your protection strategy is you and the people around you. You will be told that you are obliged to provide the passcode to a law enforcement officer, you will be pressured, threatened and even subjected to physical force to extract the right answer from you. Security officials will escalate the situation and increase pressure, selecting methods that may work.

Blogger and former adviser to the Minister of Information Policy Oleksandr Baraboshko was detained in November 2018 by military prosecutors in a restaurant. While the security officials were taking him home for a search, they tried to get the password to his iPhone, since FaceID had been disabled on the device. For every wrong answer he was struck on the head. The next day the Pechersk District Court sent the blogger to the Lukyanivka detention center with an alternative bail of 3.5 million hryvnias. To obtain the phone password, the security officials agreed with the detention center administration to place the blogger in a so-called “pressure cell,” where for several days inmates, in exchange for perks from the detention center administration, beat the phone password out of the blogger. The methods and persistence depend on how much your enemies are interested in the information on your device.

One more question. If I conduct business correspondence in a messenger linked to a foreign number and use a pseudonym, can law enforcement prove that I was actually the one using this account?

Yes. For example, if during an authorized search, in the presence of witnesses, your phone with the messenger installed and your pseudonym account open is seized. Another option is if one of your interlocutors or colleagues gives testimony and confirms to investigators that it was really you who used this account. In that case it will be “your word against the witness’s,” and the weight of the prosecution’s version will depend on the number of witnesses giving similar testimony and the context of the correspondence. The admissibility of the evidence collected and the grounds for suspicion will be assessed by the court. However, security officials are often interested not in proving your guilt but in gaining access to your corporate secrets.

To avoid unpleasant incidents, it is worth following these rules:

1. Try to avoid addressing people by name and do not share personal data: scans of passports or personal documents;
2. Conduct conversations on sensitive topics in secret chats with a message self-destruct timer set;
3. Some messengers allow messages to be deleted from both your device and the interlocutor’s device. It is worth using this function periodically;
4. Try to conduct conversations as if someone third is listening.

I have many work group chats. I take care of protecting my accounts, but how can I be sure my colleagues do the same? Some correspondence is not meant for other eyes.

Keeping personal correspondence private, like safe sex, is the responsibility of all participants. You cannot be 100% sure that your interlocutor is not passing screenshots of your conversations to third parties, or that the password to his email is not his child’s birthday, which, without a shadow of doubt, would be as sweet as it is careless.

From our youth we know that unprotected sex carries risks, but who said that careless behavior on the internet or unprotected channels of information exchange do not have consequences? As with threats of venereal diseases in less developed countries, your company can be saved from unpleasant consequences only by systematic educational and awareness work — that is, only by you as the company head, since without an understanding of strategic threats and political will from above, there will be no one to set a course toward self-education. 

Only introducing corporate security standards and systematic employee training can mitigate the risks.

Conduct an inventory of processes, determine how information is exchanged, and calculate the risks. Make it a game: imagine you are a corporate raider, a prosecutor or an unscrupulous competitor who needs to “hack” your company. How would you do it? What vulnerabilities do you see? Which buttons would you press? What would be the breach in your company’s defenses?

1. Set aside a day and inventory your personal and work accounts;
2. Identify the main communication channels;
3. Identify risk zones;
4. Work on eliminating them.

Following these recommendations can help avoid unpleasant problems in the future.

In addition to introducing information security rules for employees, a system of monitoring and verifying compliance is also needed. Your employees and colleagues may disregard the rules in place out of stupidity, carelessness, or thinking they don’t apply to them. As a result, other people’s negligence and disregard for management’s instructions can put you and your business at risk.

If you own a business of any size and turnover, your company should have a technical specialist whose competence should be slightly more than the ability to install Windows, update Office or install an antivirus (though the latter is important too). This could be a system administrator, or a head of network security department — you can come up with any fancy title that suits your taste and satisfies your employee’s ambitions. The specialist’s responsibilities should include corporate data security, threat monitoring and preventing data leaks. Your data should be stored on your own server, which should not be physically located in the office. Someone copied corporate files to a flash drive? Infected a computer with a virus? Your security staff should know about it. Technical specialists should work in-house, but should avoid socializing with colleagues to prevent personal relationships from developing. 

It is also worth taking care of the physical security of the office by periodically checking work premises for bugs and wiretaps. You may think your premises are a fortress, but if a wiretap is found in the office of the head of the Anti-Corruption Prosecutor’s Office, the chairman of the District Administrative Court or the director of the State Bureau of Investigation, how are you any better?

It is better to have a good security protocol for your company than to read a search or detention protocol.

Okay, all this is very interesting, but I don’t think it concerns me. I’m far from politics and big money; I’m just a corporate lawyer/manager/accountant/PR specialist/secretary/driver/guard/sysadmin.

This is a common misconception. Everyone has at some point found themselves in conflict situations, and everyone, over the course of life, has acquired a number of ill-wishers, opponents or enemies. You don’t have to be a politician, journalist, activist or businessman to have ill-wishers; you don’t have to be wealthy for fraudsters to take notice of you; you don’t have to be a criminal for law enforcement agencies to become interested in you.

It may be not you but the people you communicate with who interest security officials or fraudsters. For example, your company’s management, business partners, clients, close friends, or a distant relative who has become the object of attention of interested parties. The personal correspondence of an accountant and the gossip of a secretary with colleagues about the bosses can tell more about the real object of attention than the person themselves. 

Volodymyr Koval