by Nicky Hager*
The Government Communications Security Bureau (GCSB)'s spy base at Waihopai, near Blenheim. File photo. Photo: SUPPLIED
Comment: The US spy system hosted by the GCSB appears to be a controversial intelligence system used in global capture-kill operations, writes Nicky Hager.
The unidentified foreign intelligence operation discussed in a scathing report by New Zealand's Inspector-General of Intelligence and Security (IGIS) last week appears to be an intelligence system with a ghostly codename.
The IGIS report said the GCSB decision to host a foreign system from 2012-2020 was "improper" and that the GCSB "could not be sure the tasking of the capability was always in accordance with... New Zealand law".
The Inspector-General said: "I have found some of the GCSB's explanations about how the capability operated and was tasked to be incongruous with information in GCSB records at the time."
But the Inspector-General could not reveal details of the system to the public because they are "highly classified". The name and function of the foreign spy spying equipment, the identity of the "foreign partner agency" and the location of the "GCSB facility" where foreign equipment was hosted all remained secret.
The mystery spy equipment appears strongly to be a top secret US surveillance system that was installed at the GCSB's Waihopai base at the same time as the equipment in the IGIS investigation was installed at a "GCSB facility".
The top secret NSA spy equipment had the ghostly codename "APPARITION" and fits with all the details presented in the IGIS report.
APPARITION was owned by and controlled by the US National Security Agency - the world's largest intelligence gathering agency and head of the Five Eyes intelligence alliance that includes the GCSB.
A NSA internal report, written after the launch of the APPARITION system in 2008, said that it "builds on the success of the GHOSTHUNTER prototype... a tool that enabled a significant number of capture-kill operations against terrorists".
Capture-kill operations involve lethal attacks on targeted people using drones, bombs and special forces raids. Human rights organisations have documented numerous deaths of civilians during capture-kill operations - many of them "algorithmically targeted" by electronic surveillance systems such as APPARITION. They are also criticised as being "extra-judicial killings".
This is what the IGIS report appeared to be referring to when it said the foreign capability "clearly had the potential to be used, in conjunction with other intelligence sources, to support military action against targets". It referred to the equipment finding "remote targets" and said that GCSB staff had raised "legal and moral issues".
The 2008 NSA report explained how APPARITION targeting is done.
"APPARITION is a precision geolocation capability for targeting foreign very small aperture satellite terminals (VSAT)," it said. VSAT refers to small satellite communication systems used to access the Internet in remote places away from major Internet connections. Precision geolocation means working out the exact location of a target person. VSAT is "an important target," it said, "because VSATs are often used by Internet cafes and foreign governments in the Middle East".
The report said the APPARITION system at Misawa - a major NSA base in northern Japan - was "currently targeting VSAT terminals believed to be servicing internet cafés used by high-value counterterrorism (CT) targets in Afghanistan, Pakistan, and Indonesia, as well as non-CT targets in China."
The NSA report is dated December 2008, shortly after the first operational version of APPARITION was installed at Misawa. It said: "Plans are well advanced to install APPARITIONs... [at] FORNSAT [foreign satellite interception]... sites worldwide, including Second Party locations, in the next two years."
"Second Party" refers to the Five Eyes intelligence allies: the UK, Canada, Australia and New Zealand (the First Party is the United States). The IGIS report says the GCSB was approached in 2009, the following year, as a potential site for the foreign signals intelligence system.
A March 2012 internal "GCSB Update" records that an MOU had been signed between NSA and GCSB for hosting of the APPARITION equipment and that installation was planned for June 2012. The IGIS report uses almost exactly the same words. The location for the APPARITION equipment was the Waihopai satellite interception base.
The system works by combining two different types in intelligence: ground stations like Waihopai intercepting the satellites that relay the VSAT satellite communications for remote users; and "Overhead" spy satellites that locate the targets from far above the earth.
When combined, the report said, the intelligence systems could estimate the precise geolocations of VSAT Internet cafes and other target locations with an "average error of probability of only 0.07 nautical miles" (130 metres) - not actually very precise in a built-up area.
Another NSA report, called "APPARITION / GHOSTHUNTER TASKING INFO", describes the purpose of APPARITION as "Directed Target Development". It "provides global access for VSAT geolocation requirements initially and incorporates the use of OH [Overhead spy satellites], comsat [Waihopai-type station], SCS [secret eavesdropping units within embassies] and other access hubs."
It said: "Requests are acknowledged by Denver and scheduled via mission planning for execution."
The various NSA and GCSB reports quoted were part of the trove of top secret reports released by the US whistleblower Edward Snowden in 2013.
The APPARITION documents do not say what the NSA used the Waihopai-based APPARITION equipment to target. However GCSB used the equipment for its own targeting as well.
Another 2012 Snowden document suggests that the Waihopai base was intercepting VSAT communications in the Pacific by targeting the NSS-9 satellite, which was located at 183 degrees east. The 2012 report discusses technology changes affecting Waihopai's "South Pacific mission" including the "ViaSat Skylink VSAT links", the NSS-9 satellite. It's unclear whether this VSAT surveillance involved APPARITION.
The Waihopai station also had a system in 2012 called FALLOWHAUNT, used for collection (eavesdropping) and processing of VSAT communications. It was installed at Waihopai in November 2010. This may also be one of the surveillance systems mentioned (without naming the systems) in the IGIS report.
In 2022 the GCSB announced "Removal of Waihōpai spy base surveillance domes begins" and media reported that the "virtually obsolete" Waihopai spy domes were being dismantled.
Some people, including journalists, assumed that the Waihopai station was ceasing to be an intelligence base. However Waihopai continues to intercept a range of satellites with more modern antennas and processing equipment as part of the Five Eyes intelligence alliance.
* Nicky Hager has worked as an investigative journalist for the past 25 years, and has been a New Zealand member of the International Consortium of Investigative Journalists for 20 of those years. In 2018, Hager was part of a reference group established by the Inspector-General of Intelligence and Security.