THE GREEK WIRE TAPPING SCANDAL

The Greek wiretapping case of 2004-2005, also referred to as Greek Watergate, involved the
illegal tapping of more than 100 mobile phones on the Vodafone Greece network belonging
mostly to members of the Greek government and top-ranking civil servants. ... Phones of
Athens-based Arab businessmen were also tapped.
The Ericsson switches used by Vodafone Greece were compromised and unauthorized software
was installed that made use of legitimate tapping modules, known as "lawful interception",
while bypassing the normal monitoring and logging that would take place when a legal tap is set
up. This software was eventually found to be installed on four of Vodafone's Ericsson AXE
telephone exchanges.
In modern mobile telecommunication networks, legal wiretaps, known as lawful interceptions,
are performed at the switch. Ericsson AXE telephone exchanges support lawful intercepts via
the remote-control equipment subsystem (RES), which carries out the tap, and the interception
management system (IMS), software used for initiating addition of the tap to the RES database.
In a fully operating lawful interception system the RES and IMS both create logs of all numbers
being tapped, allowing system administrators to perform audits in order to find unauthorized
taps.
When one of the tapped phones made or received a phone call, the exchange, or switch, sent a
duplication of the conversation to one of fourteen anonymous prepaid mobile phones. As these
phones are not associated with a contract, retrieving details of their owners is very difficult.
About half of the intercepting phones were activated between June and August 2004. The base
stations that serviced those phones were in an area near the center of Athens.
On January 24, 2005, an intruder update of exchange software resulted in customer text
messages not being sent. Vodafone Greece sent firmware dumps of the affected exchanges to
Ericsson for analysis. On March 4, 2005, Ericsson located the rogue code, 6500 lines of code
written in the PLEX programming language used by Ericsson AXE switches.[8] Writing such
sophisticated code in a very esoteric language required a high level of expertise. Much of
Ericsson's software development for AXE had been done by an Athens-based company named
Intracom Telecom, so the skills needed to write the rogue software were likely available within
Greece.[9]

On March 7, 2005, Ericsson notified Vodafone of the existence of rogue wiretaps and software
in their systems. The next day the general manager of the Greek Vodafone branch, George
Koronias, asked for the software to be removed and deactivated. Because the rogue software
was removed before law enforcement had an opportunity to investigate, the perpetrators were
likely alerted that their software had been found and had ample opportunity to turn off the
"shadow" phones to avoid detection.[8] According to the head of Greece's intelligence service,
Ioannis Korantis: "From the moment that the software was shut down, the string broke that
could have lead [sic] us to who was behind this."[4]
On March 9, the Network Planning Manager for Vodafone Greece, Kostas Tsalikidis, was found
dead in an apparent suicide. According to several experts questioned by the Greek press,
Tsalikidis was a key witness in the investigation of responsibility of the wiretaps. Family and
friends believe there are strong indications he was the person who first discovered that highly
sophisticated software had been secretly inserted into the Vodafone network.[3] Tsalikidis had
been planning for a while to quit his Vodafone job but told his fiancée not long before he died
that it had become "a matter of life or death" that he leave, says the family's lawyer, Themis
Sofos.[4] There is speculation that either he committed suicide because of his involvement in
the tapping of the phones, or he was murdered because he had discovered, or was about to
discover, who the perpetrators were.[8] After a four-month investigation of his death, Supreme
Court prosecutor Dimitris Linos said that the death of Tsalikidis was directly linked to the
scandal. "If there had not been the phone tapping, there would not have been a suicide," he
said.[10]