How a hacker for El Chapo illustrates ‘existential’ counterintelligence threats

In 2018, an assistant legal attaché with the FBI was meeting with sensitive sources in Mexico City. The attaché was working the high-profile “El Chapo” drug cartel case.

As the attaché traveled the streets of Mexico City, a hacker working for the cartel was watching their every move. The hacker had compromised the attaché’s cell phone and was able to see their phone calls, as well as their geolocation data.

The hacker also accessed Mexico City’s camera system, using it to follow the attaché through the city and identify who they met with.

The cartel used that information to intimidate and even kill sources and cooperating witnesses.

That stunning story was revealed publicly for the first time in an audit released by the Justice Department’s inspector general late last month. The highly redacted report evaluates the FBI’s efforts to address so-called “ubiquitous technical surveillance.”

That’s a jargon term for the world of smart phones, online data, interconnected technology and, increasingly, artificial intelligence. It can create a detailed and continuous portrait of anyone’s life.

And it’s something the FBI and the government writ large is struggling to address as a major counterintelligence and security challenge.

“How do you handle it when something is ubiquitous, when it’s everywhere and growing?” Eric O’Neill, a former FBI counterintelligence agent, said in an interview. “Part of that is being smart, but I just don’t see a really great solution to an issue that will just become broader and and more ubiquitous. If you want to say that, then that’s something that can ever be contained, not in our society. You go off grid. That’s basically the only way.

According to the DoJ audit, some within the FBI and partner agencies like the CIA have described the threat of ubiquitous technical surveillance as “existential.”

And it’s not just a threat to intelligence and law enforcement agents operating in foreign countries.

The 2024 National Counterintelligence Strategy highlighted the proliferation of commercial tools that can be used to conduct surveillance and collect vast amounts of data on individuals inside the United States.

The strategy warns that foreign intelligence agencies are using advanced cyber tools, biometric devices, unmanned systems, spyware, and AI to disrupt U.S. infrastructure, industries and institutions.

“Such technology is easy to use, less expensive, and more available commercially, bringing it within reach of even relatively unsophisticated FIEs,” the strategy states. “The exponential pace of technological change complicates efforts to develop and maintain adequate defenses.”

As one of the lead agencies for counterintelligence, the FBI plays a key role in thwarting adversarial surveillance.

But the Justice Department audit found the FBI’s efforts to identify vulnerabilities and mitigate technical surveillance were “inadequate and lacked a “long term vision.”

O’Neill says the spy tradecraft around commercial technologies is quickly evolving, especially with advancements in artificial intelligence and biometric identification.

“The FBI can sometimes be slow to react to these new changes in technology,” O’Neill said. “That was certainly case when I was in the FBI. I was always beating my head against a wall for their their lack and movement and computerization and deploying technologies.”

Spyware guidance lagging

Hacking technologies, such as spyware, are also increasingly accessible to less sophisticated foreign intelligence agencies and criminal groups alike. Spyware has reportedly been found on the phones of U.S. diplomats and White House officials in recent years.

But some lawmakers are concerned the FBI isn’t taking the threat of spyware seriously enough.

Senator Ron Wyden (D-Ore.), in a June 30 letter to FBI Director Kash Patel, urged the bureau to update its cybersecurity guidance for Senate staffers and other high-level government officials.

Wyden says the FBI’s current recommendations, such as not clicking on suspicious links or rebooting your phone regularly, isn’t enough to protect high-value targets from foreign spies using advanced cyber tools.

Evan Dornbush, a former computer network operator at the National Security Agency, says basic cybersecurity advice — such as not clicking on questionable links — is still valuable.

But advanced spyware, which can infect phones without any user interaction, requires a more sophisticated approach.

“It’s nice to have these campaigns of like, don’t click that link,” Dornbush said. “The reality is, no one’s clicking the link, because there’s no link to click anymore. Simply receiving a malicious message or a malicious phone call or being on the same radio network as your attacker could, could be enough to get you compromised.”

Wyden’s letter highlights several ways the FBI could update its defensive cyber guidance to federal officials. They include:

Enabling opt-in anti-spyware defenses in Apple’s iOS and Google’s Android phone software
Using ad blocking
Disabling ad tracking IDs
Opting out of commercial data brokers

“Our adversaries have upped their game, and we must up our defenses,” Wyden concludes in his letter.

But Dornbush says if you’re a government official who would be targeted by spyware, you should already assume your phone is infected and act cautiously.

“The state of the art, particularly for mobile malware, from an end user detectability perspective, it’s hard to find that stuff like you,” he said. “I consider myself fairly expert in a lot of cybersecurity concepts. I have no idea if my devices are compromised. . . . It is quite difficult to detect the the malware once it’s there. That’s why the focus is on preventing it from getting there in the first place.”

Deep-fake defense

Even common phishing attacks are now being supercharged by artificial intelligence. Last week, the State Department warned U.S. diplomats that Secretary of State Marco Rubio and possibly other officials had their voices impersonated in messages using AI.

The scam messages were sent by text, Signal and voicemail.

Steve Povolny, senior director of security at Exabeam, says deepfake audio and video messages are becoming increasingly sophisticated thanks to widely available AI tools.

But Povolny says technical defenses against deepfakes are struggling to keep up.

“There are companies out there that are trying to do this,” he said. “I would say there I’ve seen some that are even marginally successful at it. But the reality is, we’re getting to a point where the technology is outpacing the ability to detect them, and at some point, I don’t think technology is going to be the singular way that we rely on as a defense against these types of attack.”

State Department officials have reportedly said the Marco Rubio deep fake voice was relatively unsophisticated and didn’t result in any compromises.

But Povolny says the types of attacks are likely to become more pervasive and more realistic.

“This is not a one off,” he said. “This is going to be the future of how attacks work and how they become more and more effective. And we’ve got to have corresponding controls to deal with that.

Experts say defending against modern counterintelligence and security threats also requires a proactive approach. When it comes to ubiquitous technical surveillance, O’Neill pointed out that it’s important to understanding the intelligence goals of foreign spy agencies and other groups.

“The science of countering the intelligence goals of foreign intelligence services who want to do us harm, a big part of that is understanding the ways that criminals and spies are using UTS,” he said. “Understanding how the adversary is using UTS against us is this is the number one way to start defending against it.

Organizations like the National Counterintelligence and Security Agency have released a steady stream of bulletins warning about issues like the online targeting of current and former government employees.

But whether it’s data tracking, spyware or deep fakes, a lot of the responsibility for defending against those types of attacks rests on how individuals set up their personal smart phone or look for subtle differences in the voice message they just received.

In response to the DOJ inspector general audit on ubiquitous technical surveillance, the FBI says it’s expanding training to help agents navigate the potential threats.

But even that has constraints. Auditors found many advanced UTS courses remain optional for FBI agents and are unable to serve many students due to resource constraints.

The FBI Directorate of Intelligence told auditors they requested more funding to expand the number of UTS courses over the next two years.

But according to the report, higher-level FBI officials denied those requests.