Greek wiretapping case 2004–05

The Ericsson switches used by Vodafone Greece were compromised and unauthorized software was installed that made use of legitimate tapping modules, known as "lawful interception", while bypassing the normal monitoring and logging that would take place when a legal tap is set up. This software was eventually found to be installed on four of Vodafone's Ericsson AXE telephone exchanges. In modern mobile telecommunication networks, legal wiretaps, known as lawful interceptions, are performed at the switch. Ericsson AXE telephone exchanges support lawful intercepts via the remote-control equipment subsystem (RES), which carries out the tap, and the interception management system (IMS), software used for initiating addition of the tap to the RES database. In a fully operating lawful interception system the RES and IMS both create logs of all numbers being tapped, allowing system administrators to perform audits in order to find unauthorized taps. To successfully wiretap phone numbers without detection, as the intruders did, a special set of circumstances had to be present. The RES had to be active on the exchange, but the IMS had to be unused. At the time of the illegal wiretaps, Vodafone had not yet purchased the lawful intercept options, meaning the IMS was not present on their systems. However, an earlier exchange software upgrade had included the RES. In addition, the intruders needed to continue to have access to the exchange software to change tapped numbers, without alerting system administrators that the exchange had been modified. Normally, all changes to exchange software would be logged. To get around this, the intruders installed a rootkit on the exchange, a piece of software that would modify the exchange software on the fly to hide all changes and, in case of an audit, to make the exchange appear as though it had been untouched. When one of the tapped phones made or received a phone call, the exchange, or switch, sent a duplication of the conversation to one of fourteen anonymous prepaid mobile phones. As these phones are not associated with a contract, retrieving details of their owners is very difficult. About half of the intercepting phones were activated between June and August 2004. The base stations that serviced those phones were in an area near the center of Athens. ==Discovery of illegal taps==

On January 24, 2005, an intruder update of exchange software resulted in customer text messages not being sent. Vodafone Greece sent firmware dumps of the affected exchanges to Ericsson for analysis. On March 4, 2005, Ericsson located the rogue code, 6500 lines of code written in the PLEX programming language used by Ericsson AXE switches. On March 7, 2005, Ericsson notified Vodafone of the existence of rogue wiretaps and software in their systems. The next day the general manager of the Greek Vodafone branch, George Koronias, asked for the software to be removed and deactivated. Because the rogue software was removed before law enforcement had an opportunity to investigate, the perpetrators were likely alerted that their software had been found and had ample opportunity to turn off the "shadow" phones to avoid detection. After a four-month investigation of his death, Supreme Court prosecutor Dimitris Linos said that the death of Tsalikidis was directly linked to the scandal. "If there had not been the phone tapping, there would not have been a suicide," he said. In November 2007, press reports in Greece quoted the Tsalikidis family attorney, Themistokles Sofos, as saying they had commenced legal action against Vodafone, "suspect[ing] he was poisoned". On March 10 Koronias asked to meet Prime Minister Karamanlis to discuss matters of national security. At 20:00 on the same day he presented the facts to the Minister of Public Order and the Prime Minister's chief of staff, and on the next day he presented them to the Prime Minister. A preliminary judicial investigation was carried out, which, due to the complexity of the case, lasted until February 1, 2006. The preliminary investigation did not point out any persons connected with the case. The investigation was hindered by the fact that Vodafone disabled the interception system, and therefore locating the intercepting phones was no longer possible (the phones were apparently switched off), and that Vodafone had incorrectly purged all access logs. Police rounded up and questioned as suspects persons who called the monitoring phones, but all callers claimed they called these phones because their number was previously used by another person. Ericsson has checked their equipment in other markets world-wide and has not found the illegal software installed anywhere else. "As far as Ericsson knows, this is a unique incident. We have never discovered anything like this before or since." Vodafone spokesman Ben Padovan said. ==Kostas Tsalikidis==

Kostas Tsalikidis (Κώστας Τσαλικίδης; July 23, 1966 – March 9, 2005) was Vodafone Greece's Network Planning Manager when he died at the age of 38 during the wiretapping case, in what appeared to be a suicide, but later was found to be a murder. Biography Kostas Tsalikidis was born on July 23, 1966. He worked for Vodafone Greece for almost 11 years, beginning as Switching Planning and Technology Manager. From 2001 until his death, he was responsible for all planning activities for the GSM, GPRS and UMTS Vodafone Panafon Core Network (Design, Architecture, Dimensioning, Ordering, Rollout, Interconnect, Optimisation). He was also responsible for all technology issues of the Core Network (GSM, GPRS functionalities implementation and Roadmap), and liaison with Vodafone Global regarding Vodafone Networks Evolution road-maps. Tsalikidis received his diploma from the National Technical University of Athens (NTUA), Department of Electrical and Computer Engineering. His specialization was in Telecommunications and dissertation topic on "Air Interface Measurements Collection for Mobile Telephony Systems." He has attended seminars at the Athens University, on Management and Business Administration, technical seminars on Telecommunications, GSM Systems, Data Networks, Transport Techniques, and a number of Skills Development seminars on Team Work, Team Building, Communication Skills, Project Management and Negotiation capabilities. Calls for reinvestigation On September 7, 2011, Tsalikidis' family and their lawyers asked for the case to be reopened, claiming that forensic medical examination results prove that Tsalikidis' death could not have been suicide. In 2017, The European Court of Justice held that the Greek authorities had not carried out an "adequate and effective" investigation to examine the causes of Tsalikidis' death and found that the authorities were in a hurry to close the supplementary investigation by simply naming the steps they had taken and citing new reports without explaining important details. In 2019, after 14 years of investigation, the alleged suicide has been pronounced a murder by the Greek Ministry of Justice. The case was closed. ==Fallout==

The investigation into the matter was further hampered when Greek law enforcement officials began to make accusations at both Vodafone and Ericsson, which forced experts on the defensive. In December 2006, Vodafone Greece was fined €76 million by the Communications Privacy Protection Authority, a Greek privacy watchdog group, for the illegal wiretapping of 106 cellphones. The fine was calculated as €500,000 for each phone that was eavesdropped on, as well as a €15 million fine for impeding their investigation. On October 19, 2007, Vodafone Greece was again fined €19 million by EETT, the national telecommunications regulator, for alleged breach of privacy rules. In September 2011, new evidence emerged indicated the US Embassy in Athens was behind the telephone interceptions. The key evidence of complicity was that out of the 14 anonymous prepaid mobile phones used for the interception, three had been purchased by the same person at the same time as a fourth one. The fourth phone called mobile phones and landlines registered with the US Embassy in Athens. With a sim card registered to the US Embassy, it also called two telephone numbers in Ellicott City and Catonsville, Maryland, both NSA bedroom communities. A criminal investigation was launched, and in February 2015, Greek investigators were finally able to finger a suspect, William George Basil, a NSA operative from a Greek immigrant background. Greek authorities have issued a warrant for Basil's arrest, who has since gone into hiding. == See also ==