GCHQ
Page 51
Perhaps the most historic change for GCHQ in the early 1990s was the loss of its listening station in Hong Kong, which, but for a brief interruption during the Second World War, had been there since the early days of GC&CS. This was triggered by the impending transfer of Hong Kong to Chinese rule. Washington viewed Hong Kong as an irreplaceable watchtower on China. For years British diplomats had complained that Britain was collecting more intelligence about China than it could possibly need, and had asked why this target was so important. The underlying rationale was exchange with the Americans. Hong Kong was the single most valuable British collection station to NSA, providing offset in an otherwise unbalanced Anglo-American intelligence relationship.29
Notwithstanding the fact that NSA knew the British would have to leave in 1997, it had poured huge investment into British sigint at Hong Kong. In 1982 the GCHQ station at Little Sai Wan, which had depended on listeners with headphones, had been closed down and replaced by a new operation at Chum Horn Kok, on the south side of the island, which monitored satellite activity.30 This new station was initially given the code name ‘Demos-1’.31 The problem with the location was accommodating the massive dishes – there were eventually five – on what was a narrow shelf of rock overlooking the South China Sea.32 Chinese agents took a close interest in the station, so there were tight procedures whereby a ‘cleared expatriate’ supervised the moving of classified waste to a vast ‘Refudoc’ incinerator in the main building. The burn bags full of top-secret sigint material were huge, standing three feet high and weighing about thirty pounds.33
Despite the problems of its precarious site, Demos-1 had continued to grow during the 1980s. A further programme code-named ‘Demos-4’ provided yet more enormous dishes to capture civil traffic from China’s growing network of communications satellites, and also telemetry from missile tests. Perched on top of a cliff, this was an astonishing feat of civil construction, five years in the making. Elaborate earthworks and retaining walls were required to prevent the whole facility slipping into the sea. Roy Chiverton, one of the senior staff in GCHQ’s F Division, was exasperated by the complexity of the project: ‘The situation changes so frequently…I keep tearing up drafts.’ He added, ‘I am not deterred – but my wastepaper basket gets fuller.’34 The vast dish antennae, constructed to the latest NSA design, were supplied by Lockheed from its Sunnyvale facility in California.35 Much of the equipment was very delicate, and it was susceptible to damage in transit, prompting officials to refer scathingly to what they called ‘crushed dish syndrome’.36 Nevertheless, when the Chum Horn Kok station was finished, John Adye, who became Director of GCHQ in 1989, wrote to the site engineers praising their efforts. Building had continued in bad monsoon weather, and he added that he had seen ‘some horrific photographs of a mechanical excavator poised on the edge of a very steep slope’. He conveyed GCHQ’s sincere thanks to all who had contributed to a project on which ‘a great deal depended’.37
The investment was repaid with excellent intercepts of Chinese military traffic that revealed, for instance, Beijing’s thinking around the time of the Tiananmen Square massacre in June 1989.38 Yet even while this new station was being completed, the British were reminding NSA that their time on Hong Kong was running out. Odom had suggested that Britain should try to keep control of the Commander British Forces HQ building in Hong Kong even after handover, because it was by far the best medium-wave sigint collection site in the territory. However, despite concerted pressure from the Americans, the British were ‘unenthusiastic’ about this idea.39 NSA and GCHQ had already begun to ponder future alternative sites. Odom noted in his ever-present daily logbook: ‘Hong Kong – where to move our gear?’40
At midnight on 1 July 1997 the colony of Hong Kong was finally returned to China, signalling the end of Britain’s ninety-nine-year lease on the New Territories. All the intercept equipment had already been moved to Geraldton, a DSD site in Western Australia. It was hoped that the loss of interception from Hong Kong would be partly offset by a sophisticated monitoring operation against the new Chinese Embassy in Canberra. The West had devoted enormous attention to state-of-the-art surveillance of this new diplomatic complex, and the resulting intelligence ‘take’ was so great that there were often thirty transcribers in the Australian capital processing it, a miniature version of the team recruited to translate the Berlin tunnel material in the 1950s. Secret collection from the Chinese Embassy included not only sound, but even video footage. This opened a priceless window on Chinese communications, which had always been very hard to break. However, just like the Berlin tunnel, the duration of this operation was short, and to the fury of GCHQ and its allies the operation was blown by the Australian press in 1995.41
Hong Kong also illustrates the shift towards using sigint against organised crime after the end of the Cold War. During the last days of the colony the Royal Navy was part of an Anti-Smuggling Task Force that was struggling to keep up with the extremely fast boats used by local criminals who were stealing luxury cars on the streets of Hong Kong and shipping them to mainland China. Once in China, the smugglers were paid for the cars in heroin, which they then brought back for sale in the colony. Boarding the vessels of the smugglers, which could achieve seventy miles per hour, was dangerous, and the crews were often armed with automatic weapons, so the Task Force decided to try sigint. Using two well-trained sigint operators with the latest frequency scanners, it was able to tune in to the smugglers’ radios and locate the point of exchange. The Task Force swooped on the quiet dock where the smugglers were offloading forty-five pounds of heroin in return for a BMW 7 series that had been stolen off the streets of Hong Kong only that day.42
After the handover of Hong Kong, China remained an important intelligence target. Some Western sigint agencies exploited the growing volume of container shipping that thronged Chinese ports and proceeded along China’s major waterways for perhaps a thousand miles inland by installing remote collection equipment deep in the bowels of the vessels of friendly container companies, timed to begin recording once the ship came close to China. The more sophisticated versions beamed their ‘take’ up to overhead satellites for rapid exploitation.43
In Europe, too, the iconic watchtowers were tumbling. One very public manifestation of the end of the Cold War was the closure of the vast Teufelsberg station overlooking Berlin, after thirty years of operation.44 Yet at GCHQ there was no rapid shift of resources away from Russia, merely a gentle drift of numbers towards K Division, which handled non-Russian sigint.45 This was understandable, since for the first time in decades Russia was now a promising intelligence target. In the early 1990s the market was being flooded with would-be KGB defectors hoping for a comfortable resettlement package in the West. Amid this embarrassment of riches, it was sometimes hard to know which ageing KGB men should be taken onto SIS’s dwindling payroll. Britain’s ability to absorb defectors, rehabilitate them and offer them a pension, as had been done with Oleg Gordievsky in the 1980s, was very limited. Nevertheless, one defector was judged of sufficiently high value to make such an investment worthwhile. This was Colonel Alexander Simakov, a missile specialist who had worked in mission control for every ballistic missile test the Russians had conducted between 1984 and 1990. In 1991 he had introduced himself to a British Army sergeant running in the Moscow marathon, and through this chance contact had been put in touch with SIS. Simakov was the human end of all the missile telemetry that GCHQ and NSA had been assiduously collecting from locations such as Turkey and Cyprus for almost half a century. ‘The guy’s a goldmine,’ remarked the SIS rocket specialists. ‘We’ve got to get him residency here.’ Simakov defected in 1992, and was soon providing a full rundown on Russia’s new strategic command bunker. The opportunity to marry up sigint with human agent material was electrifying: SIS officers enthused, ‘We’ve hit the jackpot.’46
With the end of the Cold War, the world was positively crawling with redundant intelligence officers of every hue, offering their services for a
fee. In Russia, many former KGB officers drifted off into private security work or organised crime – the two spheres often overlapped to an alarming degree. Other parts of the world saw intelligence officers setting up private military companies that were active in Africa, and would become prominent in the Middle East after the 2003 invasion of Iraq. In Britain too, the long years of the Cold War, together with an extended struggle against organisations like the IRA, meant that many had been trained in the dark arts of telephone interception and bugging. Their services were now available for hire. By the early 1990s this was having an impact on public life in Britain, largely through the growing use of freelance interception and other forms of privatised intelligence-gathering by tabloid journalists. One of the targets of this new privatised sigint activity was the royal family.
In the first weeks of 1990, Cyril Reenan, a retired bank manager, parked outside Didcot railway station not far from his house in Abingdon, a quiet town in Oxfordshire. In his spare time Reenan was an amateur eavesdropper who used a radio scanner to listen in to all types of radio transmissions, including mobile phones, for his private amusement. At his home he had arranged an old 1960s-style reel-to-reel tape recorder next to his scanner to capture anything interesting that he overheard. He believed he had captured an extremely intimate conversation between Diana, Princess of Wales, and James Gilbey, a childhood friend who owned a Lotus car dealership and was heir to the Gilbey’s Gin fortune. He was now about to hand the tape over to the Sun newspaper.
The tape was not published by the Sun until August 1992. Gilbey initially insisted the story was false, but the paper took the remarkable step of setting up a dedicated phone-line which allowed callers to hear the whole tape at a cost of 36 pence per minute. In fact this was not the whole tape, since even the Sun had blushed at certain sections of the recording, and had edited some passages out. Diana offered a lengthy description of her treatment at the hands of the royal family, and detailed what she considered to be the Queen’s condescension and pity towards her. Gilbey referred to the Princess alternately as ‘Darling’ or ‘Squidgy’. The latter name, used fifty-three times during the conversation, was soon adopted by the press, which routinely referred to the affair as ‘Squidgygate’.47
Through the early 1990s, interest in the tapes was sustained by the so-called ‘War of the Waleses’ during which the Prince and Princess of Wales battled for public sympathy. This included the leaking of material to trusted journalists, and finally entire television programmes. Each week the tabloids offered new revelations, including accounts of the Princess’s depression and failed suicide attempts. Increasing attention was given to Charles’s long-standing relationship with Camilla Parker-Bowles, which many journalists had known about, but which now entered the public domain. The growing public interest prompted the Sunday Times to ask a company of surveillance specialists called Audiotel International to analyse the Diana tape obtained by the Sun. They quickly realised that this was not a conversation that could have been recorded on a simple radio scanner in the manner recounted by Cyril Reenan.
First of all there were what Audiotel called ‘data bursts’, or ‘pips’, which were indicators used for charging a call. This seemingly innocuous fact was important, since these ‘pips’ are not broadcast over the radio system that carries mobile telephone calls, but are filtered out at the local exchange. This, and the fact that two other amateur scanners had also recorded the conversation, suggested strongly that the tape had been recorded by professionals and then rebroadcast, whereupon it was picked up by Reenan. Within a few days the Sunday Times asked a second set of audio experts retained by Sony International to examine the tape. They agreed that this was not a conversation captured by a scanner, partly because scanners usually capture only one half of a conversation clearly. More importantly, there was a ‘hum’ in the background, which they noted was the usual effect of trying to record a telephone conversation via a direct physical tap on a landline.
Given that Gilbey was speaking from a mobile telephone, this pointed strongly to the possibility that a professional telephone tap had been secretly attached to Diana’s landline inside Sandringham. The experts believed that the doctoring of the tape constituted a crude attempt to make a tap on a landline sound as if it was an intercepted mobile telephone call. A little later there was further confirmation when Cellnet, the company that supported Gilbey’s mobile phone, revealed that the sensational press stories had triggered an internal investigation, as the company feared that its security had been breached. It too concluded that this was a professional tap on a landline. Tellingly, all the amateur listeners who intercepted the call on their scanners, heard it several days after the real call was actually made.
This information was dynamite, since many believed it pointed to the involvement of the intelligence and security services. However, the Home Secretary, Kenneth Clarke, denounced the idea as ‘extremely silly’, since tapping was rigidly controlled, and insisted that he was ‘absolutely certain’ that this had nothing to do with MI5, SIS or GCHQ. Instead, he blamed the newspapers, which he suspected of freelance interception. The annual report of the Interception Commissioner, Lord Bingham of Cornhill, also implicitly cleared the agencies. However, the Chairman of the Broadcasting Standards Authority, Lord Rees-Mogg, expressed a different view. He wondered whether the tapes were the result of a legitimate monitoring operation that was part of the protection of the royal family, adding that once the sensational recording had been made, it was almost inevitable that it would be leaked. At first glance this seemed an absurd suggestion, but few members of the public were aware of the security services’ intense anxiety about the threat from the IRA. Elaborate measures had been taken to protect prominent people, including senior officials, after the assassination of the Conservative MP Ian Gow by the IRA in July 1990, including the setting up of a new central unit focused on personal security. Fantastically complex monitoring equipment and alarms had been installed in the homes of VIPs by a veritable army of technicians, some of whom were from the police and security services and some of whom were contract workers. The same was true of the royal palaces, and this surge of technical protection had provided endless opportunities for freelance activity.48
The Queen was particularly disturbed by the ‘Squidgygate’ affair, because she immediately recognised what it meant for the security of all royal communications. Accordingly, in January 1993 she requested that the authorities carry out an internal investigation to find the culprits. At this point there was a flurry of meetings and correspondence involving the heads of both GCHQ and MI5. However, Kenneth Clarke was highly reluctant to initiate an inquiry, for fear of what might be uncovered, and was anxious that its findings would themselves leak, triggering another round of scurrilous stories.49 The person most affected by the ‘Squidgygate’ affair was Diana herself, who became increasingly obsessed with the threat of audio surveillance. This extended beyond the telephone, and there was constant fear of bugs all over her apartments. In 1993 she arranged for a team of communications security experts recommended to her by the Duchess of York to sweep her rooms at Kensington Palace for bugs. They arrived disguised as carpet-fitters and searched for hidden microphones, but were denied access to the main telephone exchange.50 By this point, tapes of conversations between Prince Charles and Camilla Parker-Bowles had also surfaced, and the Cabinet Secretary Robin Butler suggested having all the royal premises checked for evidence of interference with landlines.51
Since her tragic death on 31 August 1997, Princess Diana’s fears of more widespread monitoring have partly been confirmed. A news agency submitted a Freedom of Information Act request to NSA for all its documents on Diana. Although NSA took the standard approach of sigint agencies, refusing to declassify so much as a page, it did admit that the US government had a dossier of over 1,056 pages on the Princess. This included thirty-nine NSA documents, some of which were transcripts of telephone calls. Most of these would have been collected as the result of her work over
seas for various charities, including against landmines in Africa, which would have resulted in her being flagged up in channels which NSA routinely monitors. The American journalist Gerald Posner was later allowed to hear extracts from NSA recordings of an intercepted phone call made by Diana to a friend in the Brazilian Embassy in Washington.52
More than a decade later, the matter was still a live public issue. In January 2008 Diana’s former bodyguard, ex-policeman Ken Wharfe, told the formal inquiry into her death that he believed the tapes had been deliberately broadcast by GCHQ in the sure knowledge that radio hams would pick them up. However, he conceded that he had absolutely no evidence of GCHQ involvement. Later, John Adye, Director of GCHQ between 1989 and 1996, testified that there had been no monitoring of Diana by GCHQ, and certainly no warrant. He added that audit trails at GCHQ were sufficiently good to identify unauthorised monitoring. Adye was of the opinion that the recording of the telephone conversations was possibly a criminal activity – in other words, freelance bugging by an illegal agent. However, this raises the awkward issue of how such individuals gained physical access to some of the most sensitive areas of the royal palaces. The most likely explanation remains a rogue individual working in a security capacity who enjoyed legitimate access to Sandringham.53
By the early 1990s there was a general shift towards the tighter regulation of intelligence. A key driving force here was the European Convention on Human Rights. The Swedish security service had recently been criticised by the European Court, because the agency had no legal existence and little oversight. This triggered a headlong rush towards regulation right across Europe. More importantly, it generated cultural change. During the Cold War the agencies had thought of themselves as ‘secret services’ which could get away with their operations because nobody saw them. A symptom of this was GCHQ’s improbable attempt to pretend that its vast installations and worldwide activities did not exist. Now, however, they were obliged to conceive of themselves as intelligence services with a legal identity. They had less to fear from exposure, since all they had to do was show that their activities were proportionate. Civil rights campaigners found this a continual source of disappointment. Having presumed that more regulation would mean more restrictions on the secret state, they soon discovered that this was permissive legislation. Being ‘legit’ often meant that the agencies could carry out even more operations.54