Journalists raise safety and confidentiality concerns as Ghana receives phone hacking tools from donors

In May 2019, senior members of Ghana’s law enforcement posed for photos with the U.S. ambassador to their country at a ceremonyExternal link in the capital, Accra. Between them they held boxes and bags, gifts from the U.S. government to Ghana which, according to one of the recipients, contained Israeli phone hacking technology.

That recipient was Maame Yaa Tiwaa Addo-Danquah, then-director general of the Ghana police’s criminal investigation departmentExternal link. In May 2020, she spoke to CPJ about how the U.S. and U.K. governments, as well as Interpol, provided Ghana’s security forces with digital investigations trainingExternal link and technology. She cited tools made by the Israel-based Cellebrite corporation – whose websiteExternal link says their technology can break locks and encryption – and two U.S.-based companies, IBMExternal linkand Digital IntelligenceExternal link.

Journalists in Ghana say they are worried about how such technology may be used against them or their sources.

Last year, CPJ documented the use of Cellebrite’s Universal Forensic Extraction Device (UFED) by Nigerian security forces, and how the military targeted journalists’ phones and computers with a “forensic search” trying to reveal their sources. Six days before the U.S. gave the same tools to Ghana, The Washington Post reportedExternal link on how police used UFED to retrieve documents from journalists’ phones in Myanmar. Amid the coronavirus pandemic, Cellebrite has pitched its technology to help authorities access devices of infected people to trace their contacts, Reuters reported in AprilExternal link.

“If a state agency can decode my system without access to my password, that is scary,” Emmanuel Dogbevi, managing editor of the website Ghana Business News, told CPJ in early July.

Dogbevi, a memberExternal link of the International Consortium of Investigative Journalists, has reported on sensitive subjects, including offshore financesExternal link and Ghana’s purchaseExternal link of hardwareExternal link from the Israel-based spyware company NSO Group. He told CPJ that many sources were already hesitant to speak for fear of being identified, and the years-long pattern of Ghanaian authorities trying to intimidate journalists left him worried he too may be targeted. “Sources send me information, send me documents. I wouldn’t want anyone to have access to that,” Dogbevi said.

Before being transferred from criminal investigations to head police welfare in January 2020, Tiwaa Addo-Danquah said she sought to strengthen prosecutions by building the police’s capacity to extract and analyze information from phones and computers. “In this [digital] era, most of the evidence are held on electronic devices…You arrest one person and the person says I’m not going to inform you [of] my accomplice. These are the tools that can help you to know who or whom that person is talking to,” she told CPJ.

A year earlier, in June 2019, officers from Ghana’s National Security Ministry arrested editor Emmanuel Ajarfor Abugri and reporter Emmanuel Yeboah Britwum, both of the Modern Ghana news website, held them for days, and searched their phones and computers in an effort to reveal their sources for a report on National Security Minister Albert Kan Dapaah, CPJ reported at the time. Abugri told CPJ his devices were taken to an “IT room” and he was forced to give the officers his passwords. “They were going into my gadgets,” he said.

The Greater Accra police command still has Abugri’s phones and tablets, while the National Security Ministry has his computer, Abugri said. (A police spokesperson, Afia Tengey, said she was unable to comment because she could not locate the case files). The experience changed the way Abugri thought about the safety of information: “Sometimes in journalism there are certain information that are very confidential to you, that you don’t want any other person to know the source…having those information on your gadgets and those same gadgets are in the hands of certain people [security forces], I feel threatened.”

Abugri suedExternal link Ghana’s national security coordinator, inspector-general of police, and attorney general claiming his arrest and detention, including alleged torture, violated his constitutionally guaranteed rights; the case is due in court July 15, he told CPJ.

CPJ’s calls to Kan Dapaah following the June 2019 arrests and in June 2020 rang unanswered. But Tiwaa Addo-Danquah told CPJ that she had at times relied on the National Security Ministry digital forensics and surveillance capacities to assist with police investigations. “If the phone is on, [based on a telephone number] they were able to tell that this person was here at this time, he moved here at this time,” she said.

Manasseh Azure Awuni, a freelance investigative journalist, told CPJ the arrests of the Modern Ghana journalists and seizure of their devices shows that journalists and sources are vulnerable. “If it has happened to some journalists, it is possible it can happen to me,” Awuni said. Awuni said he received death threatsExternal linkand was forced into hidingExternal link in 2019 because of a documentary that alleged Ghana’s ruling party operated a secret militia group. The party denied ties to the group, he said.

“It can exert a chilling effect on press freedom,” Roland Affail Monney, president of the Ghana Journalists Association, told CPJ of security forces’ capacity to break into journalists’ phones and computers.

Ghana’s police first received Cellebrite’s UFED technology from Interpol in 2017 at training for West African law enforcement in Cote d’Ivoire, Tiwaa Addo-Danquah told CPJ. The year before, CellebriteExternal link signed an agreement to provide InterpolExternal link with “digital forensic equipment [including UFED] and training services over a three-year period,” according to their websites. Interpol’s press office acknowledged in an email that has provided Cellebrite tools to some national police but did not identify which countries or otherwise elaborate.

Tiwaa Addo-Danquah said that in 2019 the U.K. trained and provided Ghanaian police with IBM i2 AnalyzeExternal link to help organize and evaluate information pulled from devices. IBM i2 AnalyzeExternal link “facilitates analysis of large volumes of data” and “uncover[s] hidden connections,” according to its website.

CPJ emailed the British High Commission in Accra requesting an interview regarding U.K. digital forensics support for Ghanaian law enforcement, but no interview was arranged before publication.

IBM’s head of communications for the Middle East and Africa, Mark Fox, told CPJ in an email that IBM had “no record of selling or providing” IBM i2 Analyze to the government of Ghana, but declined to comment on whether Ghana’s police used the technology. “[W]e carefully review potential business opportunities to ensure they do not conflict” with IBM’s principles of trust and transparencyExternal link, Fox said.

Separately, a 2019 British Immigration Enforcement document appears to showExternal linkthat the agency supplied Ghana’s Immigration Service with DetegoExternal link digital forensics equipment made by U.K.-based MCM Solutions (the document misspells the equipment as “Detago”). DetegoExternal link can “[e]xtract and seamlessly analyse data from multiple devices,” according to MCM’s website. In March 2019, MCM postedExternal link on Twitter that its staff were in Ghana “conducting an advanced [Detego] training course for a number of specialist units.”

John-Paul Backwell, MCM Solutions’ global sales and marketing director, told CPJ that the company had multiple clients in Ghana, but did not respond by publication time to a question about which security agencies had the technology. Backwell said MCM Solutions’ ambition was to have their technology “used for good” to “solve security challenges,” but acknowledged the company “cannot always control how a customer uses the software.” MCM Solutions would investigate cases where their tools may have been used against journalists, he said.

The U.S. embassy provided Ghana with Cellebrite UFED and UltraBlockExternal link, another digital forensics tool made by the Digital Intelligence corporation, in May 2019 at the ceremonyExternal link with U.S. Ambassador Stephanie Sullivan, Tiwaa Addo-Danquah told CPJ. UltraBlock is used to facilitate the extraction of information from hard drives, but does not have decryption capacity, Chris Stippich, the president of Digital Intelligence, told CPJ by phone in late June. He said company policy did not permit him to comment on Digital Intelligence’s customers.

Procurement documents reviewed by CPJ and a reportExternal link by the Nextgov news website indicate that in December 2018 the U.S. embassy in Ghana made a request to purchase UFED and UltraBlockExternal link technology. The request specified UFED be capable of “extraction” and “decoding” of major cellphone models, including Android, Blackberry, Nokia, and Huawei, as well as GPS systems like TomTom.

According to a U.S. government databaseExternal link, State Department contracts were awarded to two U.S.-based companies—BIT DIRECT INC and Lyme Computer Systems, Inc— for cyber investigations equipment for Ghana. Other contract listings indicateExternal link that in recent years U.S. embassies around the world have ordered equipment directly from Cellebrite.

CPJ’s calls and an email to Josh Longacre, Lyme Computer Systems’ CEO and president, as well as calls and a voicemail to the publicly listed number for BIT DIRECT INC, went unanswered. CPJ’s questions emailed to Cellebrite’s press officeExternal link and Masao Koda, a representative for Cellebrite’s Japan-based parent company, Sun Corporation, were not answered before publication.

The U.S. embassy in Ghana told CPJ in an emailed statement that it gave the country’s police and the Economic and the Organized Crime Office (EOCO)External link“assistance to enhance their capability in investigating cyber-related offenses” with technology and training. It said those who were trained underwent “Leahy vetting,” a reference to U.S. laws that prohibitExternal link spending on foreign security forces implicated in human rights abuses. The embassy did not directly answer CPJ’s questions specific to UFED and UltraBlock.

CPJ reached Frank Adu-Poku, executive director of Ghana’s EOCO, by phone in May 2020, but he declined to comment. Ghana immigration service spokesperson Michael Amoako-Atta told CPJ by phone that he would check for information about British support in 2019, but CPJ’s subsequent calls and text messages to Amoako-Atta went unanswered.

“Any data that is accessed by police would be done so in accordance with [the] law,” Sheila Kessie Abayie-Buckman, a spokesperson for Ghana’s police, told CPJ by phone. She said a “framework for police-media relations and safety of journalists” launchedExternal link on July 1 would help curb instances where officers seized journalists’ devices or interrogated them about their sources. Abayie-Buckman did not provide answers to emailed questions concerning police use of Cellebrite and IBM technology.

“Sometimes I think it is good for governments to have that kind of [digital forensics] tools,” Abugri told CPJ, noting that there are public safety reasons for devices to be searched. “But in a situation where people like us [journalists] are involved…those tools are not being used for their intended purpose…that is where it becomes a worry.”