Black Code: Inside the Battle for Cyberspace

by Ronald J. Deibert

  How to explain this paradox? There are places in the world where the darker sides of human nature seem to roam free: Mogadishu, Grozny, Ciudad Juarez, Karachi, to name a few. Here, life can seem tenuous and cheap, the hallmarks of civility and the social glue that Westerners take for granted illusive. Violence is pervasive, and gangsters fill the void left by the absence of legitimate public authority. In Chechnya, a nation of roughly 1.3 million, there are eighty-four murders a day. The UN ranks Somalia 181st out of 194 countries for life expectancy, a mere forty-eight years. But while the bursting cities of the developing world – flush with favelas, with streets that reek of diesel and are littered with garbage, with omnipresent poverty and crime just around the next corner – may seem inhospitable to the digital world, they are not. Although the digital divide still exists, it’s shrinking, fast: cheap and easy-to-use means of communication are as irresistible here as anywhere on Earth, and as digital networks approach 100 percent saturation in the global North, the South and East have become the next frontiers of rapid expansion. Somewhat counterintuitively, the persistent chaos, corruption, and crime might facilitate, rather than retard, their wider development.

  While these new digital natives love their smartphones and apps as much as the rest of us, the uses to which they are often put are dramatically different, and this difference is affecting cyberspace itself. If cyberspace in the 1990s was a result of the collective dreams of Silicon Valley upstarts, today it is increasingly the unfulfilled aspirations of teenagers growing up in the endless grey apartments of Moscow, the cramped cubicles of Guangzhou, the teeming slums of Rio de Janeiro that are its principal drivers. It is a Western conceit to think that just because we invented the technology its uses will conform to our original design. As Somalia and many other cases show, human ingenuity is never so predictable, nor is the path of social evolution so linear.

  • • •

  There are at least three reasons for Somalia’s robust cellular infrastructure, all of them directly related to the disastrous civil war. When the country’s central government collapsed, so did “rent seeking,” a term coined by the economist Anne Krueger in 1974 to describe the actions of companies and/or governments to extract revenues by using their positions of market authority to raise prices (“rents”). State-owned telecommunications companies have been particularly prone to rent seeking: artificially inflated rates applied to long-distance calls have been used by governments the world over to extract revenues for the state. In developing countries, the situation was dire. For decades – with the exception of those countries that underwent privatization in the 1990s – laws were passed to keep out competition because the telecommunications sector, it was argued, constituted a “natural monopoly.” In Somalia, when the central government collapsed, so did the underpinning for regulations, approvals, permits, and taxes, and into this void leapt private telecommunications entrepreneurs.

  A second reason involves the competing armed factions and tribal groups. Although viciously competitive, the one thing that all of them could agree on was the need for a working telecommunications infrastructure. Militants needed a functioning Somali-wide cellphone system to operate their enterprises, issue threats through text messaging, make payments for drugs and weapons, and coordinate their tribal factions. Mobile phones were also less easy to intercept than land lines and provided a degree of anonymity, as the phones and their SIM cards could be recycled and exchanged. With disposable phones and SIM cards, there is not the same registration process that fixes one individual to a specific phone (in the way that there would be with a land line), making tracking of communications more of a challenge (though not impossible). Some Somalian cellphone companies are rumoured to be tied to militant factions, in particular one of the biggest providers, Hormuud, and the al–Qaeda–linked Somali jihadist group al-Shabaab. (The latter has a curious relationship to telecommunications: it has accused those who use cellphone scratch cards of being un-Islamic.)

  Hormuud, it turns out, profits when attacks are on the rise in areas that al-Shabaab controls. When fighting erupts, people are afraid to go out and call friends and relatives at home or abroad to reassure them about their safety. In al-Shabaab–controlled areas, young men and women are forbidden from socializing, and tend to text each other instead. With danger lurking outside, people stay in and use their phones. The thriving mobile banking service is also partly a function of the perennial violence in Somalia: being able to make purchases, deposits, and transfers electronically is much safer than carrying hard currency in a place where theft and kidnapping are daily occurrences. In all, Somalia’s functioning telecommunications system defies conventional political economic theory: a public good that works without a central authority and that provides a degree of security.

  Finally, as the country was being devastated from the inside out, Somalis fled to other parts of the world in droves, and there is now a huge Somali diaspora population in Europe and North America. As a rule, Somalis abroad tend not to forget their friends and relatives, and Somali cab drivers, nurses, teachers, engineers, and so forth routinely send remittances to their home country through the informal hawala banking network. Estimated at $1 billion annually, remittances are critically important to the Somali economy, representing as much as 50 percent of GDP, making Somalia the fourth most remittance-dependent country in the world. Somalia has no central bank, nor many functioning commercial banks, and thus hawala firms are the only real vehicles of economic exchange and income for many households and businesses. Telecommunications is essential to hawala networks.

  How does it work? A Somali in, say, Toronto visits a local hawala broker, a hawaladar, and gives him an amount of money destined for a relative in Mogadishu. The hawaladar, in turn, communicates this transaction to a Somali-based hawaladar, who brokers the deal and keeps track of the amount, usually by email or Skype. The transactions are entirely based on trust and the promise of repeat business. A small percentage fee is charged to the sender, who authorizes the transaction by communicating a password to the intended receiver. For years, the hawala network relied on telephone land lines and telegraphs, but today it is the Internet and devices used to connect to the Internet, like cellphones, that are central to hawala exchanges. Indeed, the final part of the transaction is almost always done online, and one of the primary uses of cellphones in Somalia is mobile banking.

  • • •

  In 2012, when the U.S. attempted to shutter hawala financing because of suspicions it was funnelling funds to al-Qaeda, the sanctions had a direct impact on Somali communications and inadvertently helped to establish one of the biggest cellphone providers, Hormuud. One of the owners of Hormuud, Ahmed Nur Ali Jim’ale, was also once a part-owner of the al-Barakat money transfer company targeted by U.S. and UN sanctions. Prior to setting up Hormuud, Jim’ale ran both al-Barakat and its subsidiary, Barakat Telecommunications, and he and both companies were placed on the Special Designated Terrorist Group list by the UN Security Council in 2001. In response, Jim’ale was part of a group that founded Hormuud Telecom in April 2002.

  Ten long years later, Jim’ale and the entire al-Barakat conglomerate were finally removed from the list of al-Qaeda-related terrorist organizations. But a separate UN Security Council committee then put Jim’ale on a new list, one that imposed a travel ban and froze his assets, the suspicion this time being that he was an arms trafficker. In its decision the Security Council noted that “Jim’ale established ZAAD, a mobile-to-mobile money-transfer business and struck a deal with Al-Shabaab to make money transfers more anonymous by eliminating the need to show identification”; that his company, Hormuud, is “one of the single largest financiers of Al-Shabaab”; and that Hormuud “cut off telephone service during Al-Shabaab attacks against pro-Somali Government forces.” Regardless of whether and to what extent Jim’ale and Hormuud have ties to al-Shabaab – or, in the past, had ties to al-Qaeda – the case shows the depth and complexity of Somalia’s cellphone system. A country wracked by
civil war for over two decades nonetheless has extraordinarily sophisticated and innovative online banking and cellphone services: so sophisticated that the security-obsessed are watching, watching closely.

  • • •

  The Somalia case defies conventional wisdom about technical innovation in failed states. Precisely because of Somalia’s chaotic and violent character, along with its people’s adaptive culture of trust and information sharing, an efficient cellphone infrastructure took root and flourished. It also demonstrates how the evolution of cyberspace is highly contingent on local circumstances. How and to what end a cellphone is used in Manhattan or Berlin can be entirely different from how it’s used in Mogadishu or Lagos, or the countless other cities of the global South and East from which the majority of future digital natives will emerge.

  We may not know exactly what the impact of the next billion users is going to be, but one thing is certain: they’re coming online fast. According to a 2011 International Telecommunication Union (ITU) report, developing countries increased their share of the world’s Internet users from 44 percent in 2006 to 62 percent in 2011. Asia alone now has nearly half of the world’s Internet-using population, with North America and Europe combined at less than one-quarter. The gap in penetration rates between the developed and developing world – how much of their respective populations are online – is also closing. New broadband penetration in the North is down to about 5 percent a year, the ITU report states, while in the South the annual growth rate is 18 percent. At the same time, only roughly one-quarter of the developing world was online by the end of 2011 : that is, there is a still a huge percentage of the population yet to be connected there, and connect they will.

  Some of the fastest growth rates in social media usage are in the Middle East and North Africa, no doubt inspired by the prominent role played by Facebook, Twitter, et cetera during the Arab Spring. According to the Arab Social Media Report series, which counts users of social media in the Arab World, the number of Facebook users nearly tripled in one year, from 16 million in June 2011 to 45 million by June 2012. Egypt alone constitutes one-quarter of all Facebook users in the region, and Arabic is the fastest-growing language used to communicate on Twitter. The 2011 Arab Social Media Report revealed that there were sixty-seven tweets a second in the Arab region.

  The vast majority of Internet users in the global South and East are young. The market research firm Nielsen found that Chinese between the ages of fifteen and twenty-four are the heaviest mobile Internet users, with 73 percent of them reporting having used mobile Internet connections in the last thirty days, compared with only 48 percent of their U.S. counterparts, and 46 percent in the U.K. Youth comprise approximately 70 percent of Facebook users in the Arab region, and the UN estimates that the number of youth living in developing countries will grow by 90 percent by 2025. (Over 65 percent of the Middle Eastern and North African population is under thirty-five.) Young people are early adopters everywhere, but in the developing world they face much higher rates of unemployment – as high as 25 percent in the Middle East and North Africa. The combination of youth, unemployment, and radicalism is a well-documented concern, one that some analysts (such as the former managing director of the International Monetary Fund, Dominique Strauss-Kahn) have called a “time bomb” that will soon ignite. To this mix we must add another ingredient: instant connectivity to global computer networks.

  Net-savvy, disenfranchised youth fuelled the protests that swept across the Middle East and North Africa during the Arab Spring, toppling dictatorships that most thought were immovable, but there is a more discomforting scenario, especially as the dust settles and the “youth bulge” looking for jobs grows restless. Just as Willie Sutton famously remarked when asked why he robbed banks – “because that’s where the money is” – the temptation to breach servers that host valuable data thousands of kilometres distant but only a mouse click away might be irresistible to scores of computer-literate unemployed youth from Rio, Rangoon, or Marrakesh.

  Perhaps the most noteworthy fact is that the fastest growth rates are occurring among the world’s failed and most fragile states. In the ITU’S 2009 Information Society Statistical Profiles, the ten countries that saw the fastest Internet user growth rates over the previous five years were Afghanistan, Myanmar, Vietnam, Albania, Uganda, Nigeria, Liberia, Sudan, Morocco, and D.R. Congo. (Afghanistan topped the list with growth in Internet users of 246.6 percent from 2002 to 2007.) The fastest growth rates in mobile cellular subscriptions over five years occurred in some of the world’s poorest and most conflict-prone states: Guinea-Bissau, 230.2 percent; Afghanistan, 184.6 percent; Nepal, 172.2 percent; Ethiopia, 128. 1 percent; Chad, 94.5 percent; Angola, 80.9 percent; and Burkina Faso, 60.7 percent. These statistics are almost certainly underestimations of the actual number of users connecting to cyberspace in these countries (gathering statistics in zones of conflict and in failing and fragile states being inherently difficult and almost always unreliable), but what we do know from field research in the global South and East is that users there improvise in ways that numbers do not capture: one or several families may share an Internet connection, or regularly use a shared Internet connection point at a café or corner store; cellphones may be shared between several people, multiplying the actual users represented by a single data point. Granted, many of these countries are starting out from a baseline of practically no connectivity whatsoever, but this does not change the fact that they are migrating online and into cyberspace at a furious pace, and in a context of chronic unemployment and minimal government control.

  What to expect from these next billion users is hard to say, but innovative uses of cellphones, Internet cafés, satellite uplinks, and websites in the global South and East challenge our assumptions of the type of social effects spawned by cyberspace. The domain may be liberating, but liberating for what, exactly? Over the past ten years of research, much of which I have spent on journeys in poor, less developed regions of the world, I’ve often had a Wizard of Oz feeling of “not being in Kansas anymore.”

  • • •

  In many parts of the developing world, the separation between organized crime and the state is blurred, meaningless really. Public officials use their offices for graft, or employ criminal groups to exercise paralegal authority. It should come as little surprise, then, that the levers of power in such places are used to control cyberspace.

  The most striking examples come from the former Soviet Union, a ring of nations forcefully unified under Stalin’s regime and sharing its legacy of controls: Russia and the “stans” (Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, Turkmenistan), Ukraine, Belarus, Georgia, Moldova, Azerbaijan, and Armenia. Whereas in others parts of the world cyberspace controls are exercised through technical means like filtering software, in these countries smashed windows, threatening phone calls in the middle of the night, broken bones, arrests, even murder are the not-so-subtle means of shaping the communications space. In Uzbekistan, the regime of President Islam Karimov has long used severe punishments to create a chilling effect on dissent: for instance, two political prisoners accused of belonging to an Islamic extremist group were executed by being boiled to death in 2002. Vladimir Putin’s regime and others like it govern through a combination of intimidation and exploitation, making the boundaries between what is legal or criminal largely abstract, irrelevant in practice. Their political control strategies often veer into outright thuggery, and some organized crime groups might be better described as informal agencies of the state: political authorities regularly use their services to quell unrest or to further kleptocratic ends. Such stone-age techniques have been applied in the digital arena with nearly gleeful indiscretion by Eurasian countries.

  Over the years, researchers in the region with whom we collaborate (often at great risk to them) have uncovered countless anomalies that point directly to the vested interests of entrenched authorities: the disabling of access to opposition websites leading up to critical elections
; tampering and manipulation of DNS records to favour local, approved websites over international ones; political bloggers arrested on trumped-up charges of copyright violation or possession of child porn; brazen murders of critics of the regime. In one horrifying episode that caused me deep personal grief, a young Kyrgyz journalist named Alisher Saipov with whom Citizen Lab had collaborated was murdered in the middle of a busy street in Osh, shot several times after what many believe was a $10,000 bounty put on his head by Uzbek security services (Saipov had written articles critical of Uzbek authorities). While reading the news of his death on Radio Free Europe’s website, I noticed that his Skype account, over which he and I had communicated, turning green, signalling that he was online. I was even more taken aback when a chat message popped up: “Professor Deibert, how are you today?” I did not answer, knowing that it was not Alisher, who would never have addressed me in such formal terms. Citizen Lab researchers set up a honeypot computer, to lure whoever had Alisher’s computer and Skype account into contacting us, perhaps giving away who was behind his murder. I opened his Skype chat window and sent a message with the honeypot link, asking the person on the other end to check it out. I never got a reply.

  Sometimes the controls used in cyberspace in the former Soviet Union have little or nothing to do with politics; instead, they are just about personal financial gain. In the course of our research, we regularly came across locally hosted versions of websites masquerading as Google, wherein the domain name system would redirect requests for the legitimate Google site to one that was a reasonable facsimile in order to capture advertising revenues. In Uzbekistan, three of four ISPs uniformly blocked access to content, while the fourth was entirely filter free. Further field research uncovered that the owners of the fourth ISP were connected to the family of Uzbek president Islam Karimov, and were operating a filter-free service to capture revenues.