How GCHQ stepped up spying on South African foreign ministry
UK hoped to find out everything it could about negotiating position of Thabo Mbeki's government


The then South African president, Thabo Mbeki, on a visit to Britain in 2008. Photograph: Stefan Rousseau/PA

In December 2005, there was a GCHQ meeting on a project to intensify spying on the South African foreign ministry.

The aim was to "gain access to South African MFA [ministry of foreign affairs] network", to "collect intelligence from target machines" and to "find more access points to increase reliability".

In the corporate-tinged jargon that is pervasive at GCHQ, the desired "customer outcomes" did not involve any suspected nefarious activities by South African diplomats.

This was about spying on their normal work. The objective of the operation was described as acquiring "retrieved documents, including briefings for South African delegates to G20 and G8 meetings".

It is clear that GCHQ was aiming to find out everything it could about the negotiating position of the government of President Thabo Mbeki, an independently minded swing vote on issues of global economics and finance.

Such intelligence collection was carried out under the title "transnational strategic issues" which embraced energy, economics and the environment.

It was a multipronged offensive against the South African foreign ministry under Nkosazana Dlamini-Zuma. The phone lines used by the country's high commission in London were "investigated".

The "computer networks exploitation" (CNE) team, responsible for hacking into foreign computer networks, had acquired passwords from a standing operation whose task it was to wheedle them out of target governments and agencies.

One line of approach was to dig up the old phone numbers and email addresses of the head of the cryptology department in Pretoria. The passwords were then used to hack into the online accounts of South African diplomats.

The task was complicated by the fact that the South African foreign ministry had recently upgraded its networks, but the new passwords to the system appear to have been rapidly acquired, and the CNE team set up a series of back doors into the ministry networks "to increase reliability" of the hacking operation.