Built into the wall: a camera module costing barely ten euros

But what does espionage look like in practice? Sometimes it is simply a camera module costing barely ten euros behind a thermostat, sometimes a mysterious implant worth thousands. Last March a Ukrainian drone manufacturer discovered such surveillance devices in the office of their chief engineer.

The photographs in the slider show what had been built in behind a wall thermostat: a camera module costing barely ten euros. The circuit board is fixed with a screw and a glue gun. Fine for an installation that has to be quick and mechanically stable. A separate microphone is connected, plus power and network. Commercially available electronics, then, but in a place where you do not usually look.

What the camera was aimed at has not been disclosed. Nor has what the connected network cable linked to, so the network traffic may have been less covert than the placement. The reporting describes the operation as a wiretapping operation. Given the microphone that was added, audio may have mattered more than images.

Milling out a cavity like that is not exactly a silent job. That the placement happened during legitimate works, such as fitting air conditioning (and the wall thermostat), is therefore the obvious reading. That is an agent operation: someone with legitimate access, recruited and directed by an intelligence service, does the job. The reporting attributes the operation to Russian intelligence services. That is the obvious reading, but it is not empirically supported.

As the target, TechEx shows a good deal of self-reflection. On Facebook they say they find it painful, as former military personnel, to have to acknowledge that ‘old KGB methods’ were successfully applied to them. Despite security in several layers and continuous attention to the subject, they say they fell short in counter-espionage awareness. Your adversary therefore need not be an advanced great power, and even then does not always place advanced means. Sometimes the right access is enough.

After the discovery the Ukrainian services incidentally left the thing alone for a while. Instead of removing it, misleading information was deliberately fed through it.

For organisations in the Netherlands this is a fine illustration of why physical and digital security do not stand apart. The ABRO deliberately brings physical and digital security together in requirements meant to increase the resilience of suppliers on central government contracts. Because a network can be excellently secured while the route to the information simply sits behind a thermostat.

Want to know more about increasing your own resilience? Get in touch about GreyOps’ services.