Skip to main content

A slide from a leaked top-secret presentation shared by Communications Security Establishment of Canada with its allies. The document says France’s intelligence services may be behind an e-mail spying operation that was aimed at Iran's nuclear program but also ensnared other targets, including a francophone Canadian media outlet.

Source: Le Monde

France's intelligence services may be behind an e-mail spying operation that was aimed at Iran's nuclear program but also ensnared other targets, including a francophone Canadian media outlet, says a report in the French newspaper Le Monde.

Relying on a document leaked by the former intelligence contractor Edward Snowden, the newspaper said Canada's electronic spying agency uncovered the French spying software in November 2009.

The document leaked to Le Monde is a slide presentation with the logo of Communications Security Establishment of Canada (CSEC), the secretive Ottawa-based agency that tracks foreign computer, radio and telephone communications. It is classified top secret.

Story continues below advertisement

Prepared in 2011, the document was shared with other members of the Five Eyes, CSEC's alliance with counterparts from the United States, United Kingdom, Australia and New Zealand. A copy given to the U.S. National Security Agency would have been among those leaked by Mr. Snowden.

The spyware, which CSEC analysts code-named Snowglobe, collected its victims' e-mails.

It was detected in targets in Canada, Spain, Greece, Norway, Ivory Coast and Algeria.

But the target appeared to be primarily in Iran, focusing on the country's foreign ministry, the Atomic Energy Organization of Iran, the Iran University of Science and Technology and two Tehran schools heavily involved in nuclear research, Malek-E-Ashtar University of Technology and Imam Hussein University.

There was few other details about Snowglobe's objectives outside Iran.

Under the headline "Victimology: Global," the document lists one possible target among the Five Eyes country: "possible targeting of a French-language Canadian media organization."

No further specifics are provided on the Canadian target.

Story continues below advertisement

The slide speculates that the French eavesdroppers targeted Greece because it is "possibly associated with [the] European Financial Association," and they were interested in Algeria and Ivory Coast because they are former French colonies.

The memo outlines circumstantial evidence that led CSEC to conclude that Snowglobe was a French intelligence operation.

The program doesn't fit a "cybercrime profile," CSEC said.

Also, CSEC analysts noted that the spyware's programmer left his or her username amid the computer coding: "Titi," a French diminutive or "colloquial term for a small person."

Furthermore, the program's internal name was "Babar," an elephant character in a popular French children's book.

The slide presentation concludes with the revelation that CSEC has now detected a more sophisticated version of the software, dubbed Snowman, which its programmers haven't yet been able to crack.

Story continues below advertisement

Le Monde cited anonymous French diplomatic and intelligence sources saying that France used to have to rely on the United States and Israel for its insights about Iran. However, between 2006 and 2010, French signals intelligence agents developed a computer-spying capacity that now allows them to trade sensitive information with their American, British, German and Israeli counterparts.

Report an error Editorial code of conduct
Comments

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • All comments will be reviewed by one or more moderators before being posted to the site. This should only take a few moments.
  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed. Commenters who repeatedly violate community guidelines may be suspended, causing them to temporarily lose their ability to engage with comments.

Read our community guidelines here

Discussion loading ...

Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.
Cannabis pro newsletter