IEEE Spectrum July, 2007 - 17

and were built around proprietary hardware
and software. Though these computers are
smaller nowadays, the system's basic archi-
tecture remains largely unchanged.
Like most phone companies, Vodafone
Greece uses the same kind of computer for
both its mobile switching centers and its
base station controllers-Ericsson's AXE
line of switches. A central processor coordi-
nates the switch's operations and directs the
switch to set up a speech or data path from
one phone to another and then routes a call
through it. Logs of network activity and bill-
ing records are stored on disk by a separate
unit, called a management processor.
The key to understanding the hack at the
heart of the Athens affair is knowing how
the Ericsson AXE allows lawful intercepts-
what are popularly called "wiretaps."
Though the details differ from country to
country, in Greece, as in most places, the
process starts when a law enforcement offi-
cial goes to a court and obtains a warrant,
which is then presented to the phone com-
pany whose customer is to be tapped.
Nowadays, all wiretaps are carried out
at the central office. In AXE exchanges a
remote-control equipment subsystem, or
RES, carries out the phone tap by moni-
toring the speech and data streams of
switched calls. It is a software subsystem

typically used for setting up wiretaps,
which only law officers are supposed to
have access to. When the wiretapped
phone makes a call, the RES copies the
conversation into a second data stream
and diverts that copy to a phone line used
by law enforcement officials.
Ericsson optionally provides an inter-
ception management system (IMS), through
which lawful call intercepts are set up and
managed. When a court order is presented
to the phone company, its operators initi-
ate an intercept by filling out a dialog box
in the IMS software. The optional IMS in
the operator interface and the RES in the
exchange each contain a list of wiretaps:
wiretap requests in the case of the IMS,
actual taps in the RES. Only IMS-initiated
wiretaps should be active in the RES, so a
wiretap in the RES without a request for a
tap in the IMS is a pretty good indicator
that an unauthorized tap has occurred. An
audit procedure can be used to find any
discrepancies between them.
It turns out Vodafone had not purchased
the lawful intercept option at the time of the
illegal wiretaps, and the IMS phone-tapping
management software was not installed
on Vodafone's systems. But in early 2003,
Vodafone technicians upgraded the Greek
switches to release R9.1 of the AXE soft-

4 Mar Ericsson informs Vodafone
of the existence of rogue software.
4 Mar Shadow phones make no further calls.
7 Mar Vodafone locates the rogue software.
8 Mar Vodafone extracts a list of logged phone
numbers from MEAKS.
8 Mar Vodafone Greece CEO Giorgos Koronias
orders removal of the rogue software.

MAR

MAy

JUl

9 Mar Costas Tsalikidis, head of
network planning of Vodafone Greece
is found hanged in his apartment.
10 Mar Koronias briefs Giannis
Angelou, director of the prime
minister's political office.
10 Mar The Greek presidential
decree specifying lawful intercep-
tion procedures takes effect.
16 Mar Vodafone sends e-mail to
Ericsson asking for the return of all
exchange backup data.

iT Took guile and some serious program-
ming chops to manipulate the lawful call-
intercept functions in Vodafone's mobile
switching centers. The intruders' task
was particularly complicated because they
needed to install and operate the wiretap-
ping software on the exchanges without
being detected by Vodafone or Ericsson
system administrators. From time to time
the intruders needed access to the rogue
software to update the lists of monitored
numbers and shadow phones. These activi-
ties had to be kept off all logs, while the
software itself had to be invisible to the
system administrators conducting rou-
tine maintenance activities. The intruders
achieved all these objectives.
They took advantage of the fact that the
AXE allows new software to be installed
without rebooting the system, an impor-
tant feature when any interruption would
disconnect phone calls, lose text mes-
7 Apr ADAE publishes its second
interim report on the case.

Jul Vodafone, follow-
ing its data retention
policies, destroys the
visitor sign-in books
at one exchange
facility.
Jul Vodafone
upgrades two of the
access servers, wiping
out access logs.

Koronias

ware suite. That upgrade included the RES
software, according to a letter from Ericsson
that accompanied the upgrade. So after the
upgrade, the Vodafone system contained the
software code necessary to intercept calls
using the RES, even though it lacked the
high-level user interface in the IMS nor-
mally used to facilitate such intercepts.
That odd circumstance would turn out
to play a role in letting the Athens hackers
illegally listen in on calls and yet escape
detection for months and months.

SEP

8 Mar The govern-
ment security agency,
ADAE, presents its
first interim report
on the case to the
Parliament Committee
on Institutions and
Transparency.
23 Mar ADAE performs
a simulation of the
rogue software.

31 Oct Vodafone
places an order
with Ericsson for LI
software.
18 Nov Ericsson
delivers LI soft-
ware to Vodafone.

NOV

JAN

2006
1 Feb Public prosecutor
of the Supreme Court
finishes the preliminary
investigation.
2 Feb The government
provides details of the case
in a press conference.
2 Feb Criminal prosecution
for the violation of commu-
nications privacy and pos-
sibly spying is ordered.

MAR

Voulgarakis

MAy

NOV

14 Dec ADAE fines Vodafone
€76 million (US $99.4 million).

Tsalikidis
ClOCKWISE FROM TOP lEFT: ERICSSON; KOSTAS TSIRONIS/AP PHOTO; MICHAEl BROWN/ISTOCKPHOTO; ADAE;
VODAFONE; lOUISA GOUlIAMAKI/AFP/GETTy IMAGES; AFP/GETTy IMAGES; ANDREy PROKHOROV/ISTOCKPHOTO

www.spectrum.ieee.org

July 2007 | IEEE Spectrum | NA

http://www.spectrum.ieee.org

Table of Contents for the Digital Edition of IEEE Spectrum July, 2007