Since 2015, the UK government has granted over 100 export licenses for "off the air" interception devices such as IMSI-catchers, figures show.
The data, compiled by activist group Privacy International and shown to Motherboard, highlights that the majority of applications to export these surveillance technologies to regimes such as the United Arab Emirates and Saudi Arabia were granted.
"Such technology can be used to indiscriminately track and spy on vast amounts of people in a specific place, for example at a demonstration," Edin Omanovic, research officer at Privacy International, told Motherboard in an email. "Without safeguards, an accountable security sector, and a strong legal framework in place, such technology can be used to undermine human rights and democratisation, and in such circumstance it should certainly not be being exported. It is therefore extremely worrying that countries with records of gross human rights abuses appear in the records."
Most granted licenses were for Indonesia, which had 19, followed by Qatar and Singapore
UK companies have successfully applied to export interception tools to countries such as Turkey, Turkmenistan, Russia, Bangladesh and China. The data lists 64 different recipient countries. In all, 113 applications were successful, according to the data provided by Privacy International.
Most granted licenses were for Indonesia, which had 19, followed by Qatar and Singapore, with 17 and 16 licenses respectively.
Five applications—one each to Ethiopia and Iraq, two for Pakistan, and one for an unknown country—were denied. However, not all applications for export licences to these countries were unsuccessful: six others were granted for Pakistan, and one for Iraq, for example.
The Wassenaar Arrangement requires companies to apply for a license to ship certain products. According to the Strategic Export Control Lists published by the UK's Department of Business, Innovation and Skills (BIS), those include "interception equipment designed for the extraction of voice or data, transmitted over the air interface," and equipment "designed for the extraction of client device or subscriber identities," such as IMSI numbers—a unique number used to identify individual SIM cards, and hence users.
IMSI catchers, sometimes known as Stingrays, work by mimicking cell phone towers in order to trick nearby phones to connect to them. Although the capabilities of different brands and models vary, some can intercept text messages or listen in on calls.
The BIS started publishing specific data around the exportation of off the air interception devices in 2015. The data compiled by Privacy International goes up to March of this year.
"For a year and three months, we've been able to see what the UK has allowed to get exported, or what they've licensed for," Omanovic said in a phone call. This data has been integrated into Privacy International's Surveillance Industry Index, a public, searchable database for tracking surveillance companies, which was launched on Tuesday.
According to the Campaign Against the Arms Trade's (CAAT) website, which has re-purposed data from the BIS in an easier to read format, the potential deals total up to nearly £32 million in value. In March, licenses totaled over £5.5 million.
There are caveats with the data, however. A successful application for exportation does not necessarily mean that a sale took place. And some of the licenses are for temporary exports—that is, for taking a device to tradeshow or to demo a product. It's also not clear how many companies made these applications, as they aren't named. Only one—Datong, from Leeds—is included in the list, because it was previously named by The Guardian.
"The UK is one of the most transparent countries in this area, but still needs to improve urgently. We need to see all countries publish meaningful reports about their licensing data, which also include information about end users and exporters," Omanovic said.