Our investigation reveals troubling security and privacy breaches affecting TOM-Skype—the Chinese version of the popular voice and text chat software Skype. It also raises troubling questions regarding how these practices are related to the Government of China’s censorship and surveillance policies.

The questionable security practices of TOM-Online led to the disclosure of millions of records containing personal information regarding mobile phone accounts, SMS messages, and the usage of TOM-Skype. However, this disclosure also confirms that TOM-Skype is censoring and logging text chat messages that contain specific, sensitive keywords and may be engaged in more targeted surveillance.

These findings raise key questions. To what extent do TOM Online and Skype cooperate with the Chinese government in monitoring the communications of activists and dissidents as well as ordinary citizens? On what legal basis is TOM-Skype capturing and logging this volume and detail of personal user data and communication, and who has access to it?

Update: 15 August

The engagement is entering a new phase where events in cyberspace are less likely to affect the military and diplomatic endgame. As the conflict on the ground moves to a diplomatic phase the debate among experts continues: were the attacks in cyberspace part of deliberately planned campaign, or did they happen spontaneously, inspired by events?

The cyber aspects of the Russian Georgian conflict may not look like any existing doctrine of information operations or psychological warfare, but they have proven effective at achieving similar outcomes. In this respect, the Georgian-Russian cyberwar may go down as "the $40 dollar a day solution" to computer network-based psychological warfare.

Meanwhile, in cyberspace the engagement continues to expand in scope. Commercial-grade denial of service attacks against Georgian sites have been joined by a new wave of attacks prompted by Russian on-line patriots. Web 2.0 sites are now affected as well as several Ukrainian media sites running stories critical of pro-Russian activities in cyberspace.

Stories the IWM are following include:

Georgian filtering of Russian media sites explained. Inaccurate and inflammatory reports by Russian media sites are apparently behind the decision by major Georgian ISPs to implement limited Internet filtering. The limited filtering of Russian media sites appears to be part of the government's declared state of emergency. At least two Georgian ISPs have implemented limited filtering this week as a "defensive measure" aimed at protecting the population and reducing the potential for panic during a time of national crisis. One of the two ISPs, the Georgian Research and Academic Network (GRENA), connects many of the country's schools. [The IWM's sister project, the OpenNet Initiative continues to monitor the situation.]

Script kiddies and on-line partisans join the campaign against Georgian websites. The Russian "patriotic" hacker site stopgeorgia.ru , for example, provides anyone connected to the Internet with the opportunity to launch denial of service attacks against Georgian websites.

Georgian government websites remain under attack. The website of the President of Georgia remains under heavy denial of service despite being moved to a service provider in the United States.

The information War goes Web 2.0. Global Voices reports that Information attacks have spread to ICQ and social network sites that are being targeted with pro-russian messages.

[Updated] Active route hijacking by Russian hackers, redirecting traffic to Russian telecom operators. If confirmed it would suggest that Russia ISPs are capable of enforcing an information blockage against a “cyber-locked” Georgia. This now appears implausible, IWM has been unable to verify the evidence provided

[Updated] Employment of “military” bot-net to attack critical Georgian government websites and routers. IWM can confirm that commercial bot-nets linked to known “black net” providers (possibly, Russian Business Network) are responsible for the most serous attacks against Georgian government websites that occurred after 8 August.

[Updated] Attacks on Russian media sites. Several leading Russian media sites, including Izvestia and RAI Novosti, were inaccessible on 11 August due to massive denial of service attacks. These attacks continue, and IWM is working with its partners to confirm the probable source and whether they conform to any known bot-net profile

[Updated] Attacks against regional new portals continue. In addition to the previously reported attacks against the Azeri news sites, Day.Az and ANS.Az, several Ukrainian websites (delo.ua and vosvoboda.info) have now been affected by denial of service attacks allegedly by pro-Russian hackers

[updated]Cyber-sniping -Targeting of cell phones in Ossetia. Georgian forces allegedly used EW to strike at targets using cell/sat phones in Ossetia causing casualties among journalists and reporters. Several additional reports are now carrying the same story.

IWM is working on a chronology of the cyberwar, and our technical tests are ongoing . A bulletin and report is forthcoming – so stay tuned!

IWM welcomes guest editorials on these questions or others related to the conflict. Please send your requests to boris at secdev.ca.

Media contacts – please send request to: media-cyberwar at secdev.com