How Did Russian Intelligence Eavesdrop on German Officers?

In recent weeks it emerged that four German officers, among them the Chief of the German Air Force, had been eavesdropped on by the Russians.

The roughly 40-minute WebEx call was released by Putin’s propaganda chief.

In the call the officers discuss highly sensitive matters, such as whether Germany should send Taurus missiles to Ukraine. Which targets the Taurus could potentially hit if sent to Kyiv was one of the details heard for the first time.

Another striking detail was that the Franco-British missiles are already in use in Ukraine and that British soldiers are on the ground to give the Ukrainian army technical support in using them.

The highest-ranking participant was the Chief of the Air Force, Lieutenant General Ingo Gerhartz. Another key participant was Brigadier General Frank Gräfe, who joined from a hotel in Singapore and is believed for that reason to have been the weak point that exposed the call.

The biennial Singapore Airshow usually brings together senior government, military and industry representatives. Such events are very familiar and potentially valuable targets for spies. Russian spies most likely saw the show as a major opportunity.

For a spy, eavesdropping at such meetings from a car outside the hotel or from a hotel room is very common. That is because senior officials are very hard to follow in their own countries.

Monitoring important people abroad on holiday or on duty is a routine task for the Russian secret service.

The first technical explanations of how the officers’ WebEx call was intercepted came from the German cryptographer Henning Seidler and Professor Alan Woodward of the Surrey Centre for Cyber Security.

WebEx offers end-to-end encryption options, but not every meeting or connection method is automatically end-to-end encrypted, so it would be wrong to explain the incident solely by a flaw in the application.

Considering the eavesdropping operations Russian intelligence has carried out in the past, it is thought that the interception could have been done in several different ways.

The First Possibility

The Russians may have used long-range antennas together with computer programs able to capture local network traffic.

The antenna is hidden in a car and covered with a coat so as not to attract attention. Agents stationed in a car near the targeted building can monitor phone traffic with its help.

Such eavesdropping in fact means listening to all the traffic in the area. It is a bit like throwing dynamite into a lake.

The aim of the operation is to catch the “big fish”. The Russians are no strangers to this method.

In 2018, for example, Dutch military intelligence (MIVD) caught Russian spies trying to break into the Wi-Fi network around the building of the Organisation for the Prohibition of Chemical Weapons (OPCW) using the same method.

The Second Possibility: “Wardriving”

“Wardriving” means driving around a building to detect wireless networks.

Once the target has been identified, a fake Wi-Fi network can be set up with a device called a Wi-Fi Pineapple. The victim then connects to this fake network instead of the intended legitimate one.

With such a fake Wi-Fi network, also called Wi-Fi snooping, some information about the victim’s connections can be monitored; the content of end-to-end encrypted communication, however, cannot be read simply by capturing network traffic. The tactic is both cheap and widespread.

The Third Possibility

The possibility that Russian spies slipped into the WebEx call unnoticed.

Berlin wants to rule out this theory, which has been doing the rounds, because such a possibility would raise many security concerns. In its assessments of the eavesdropping scandal, the German government says the incident was entirely due to an individual error and that the German armed forces as such were not being eavesdropped on.

One criticism is that the German armed forces have still not abandoned a “peacetime mindset”, and that the resulting complacency led to this scandal.

The Air Force has opened an investigation, and Germany’s military counter-intelligence service, the Militärischer Abschirmdienst (MAD), has begun forensic analyses. After initial checks, the German Defence Ministry announced that the incident was due to an individual error by one participant when connecting; details of the technical means the Russian side used have not been fully disclosed.