Leaked files: private spying firm targets global population with illegal spyware

A Washington DC-area Anomaly 6 firm is marketing illegal spy tech that can scrape an individual’s most sensitive personal data by tracking their smartphone. The British Ministry of Defence and GCHQ are potential buyers.

Leaked documents reviewed by The Grayzone reveal how a smartphone tracking technology tramples over fundamental data protection tenets and international law, while violating the privacy of citizens across the world without their knowledge or consent. The clandestine tool can transform anyone into a potential person of interest to Western intelligence agencies, and thus a target for recruitment, surveillance, harassment, or worse.

It is likely most readers will be unfamiliar with Anomaly 6. Its spartan, single-page website is home to the company’s name, a generic email address, and general location – Fairfax, Virginia, not far from CIA headquarters –  but nothing about its services, personnel, or otherwise. By carving through layers of “anonymized” data, this little-known company unearths reams of sensitive information about any individual it chooses anywhere on Earth. 

Anomaly 6’s activities amount to a globe-spanning criminal dragnet, the reach of which could well extend further than even that of the CIA and NSA. As we shall see, its founders are extremely wary of media attention, not least because they fear the “legal basis” of their operations “is unlikely to stand-up to scrutiny” given past successful court actions against state spying agencies, such as GCHQ and the NSA. 

The company, which was founded by a pair of US military intelligence veterans, surreptitiously embeds software development kits, or SDKs, in hundreds of popular smartphone and IoT apps, allowing it to track a user’s movements and much more besides. This data is then analyzed and the results passed on to private sector and governmental clients.

One confirmed customer is US Special Operations Command Africa, which paid Anomaly 6 $589,500 in September 2020 for a “Commercial Telemetry Feed”. In April, The Intercept reported on a leaked Anomaly 6 pitch for new business, in which the company claimed to be able to simultaneously monitor roughly three billion smartphone devices in real-time.

To demonstrate its invasive prowess, Anomaly 6 followed the movements of hundreds of Central Intelligence Agency and National Security Agency employees at once via their smartphones. The anonymous source of the leaked presentation “expressed grave concern” about the legality of the company disclosing “social posts, usernames, and locations of Americans” to US government agencies.

The Grayzone can reveal that it’s not just US citizens, but the world’s entire population, in the firing line of Anomaly 6’s unblinking eye. And the company is secretly selling its hyper-invasive wares to a number of foreign governments, militaries and security and intelligence services.

Anomaly 6 claims to track US academic, hundreds of other Westerners to North Korea

One of the most unsettling Anomaly 6 files reviewed by The Grayzone is a case study, demonstrating the company’s ability to track the “movements of individuals in completely denied terrain.”  The firm identified 100,000 separate smartphone users who traveled to North Korea over a 14-month period, among them US citizens, “to show the value of our data” for both counterintelligence and source development purposes.

North Korea was chosen for the case study because it was “a very unique beast,” and “one that traditionally is extremely, if not impossible, to develop placement and access into in a consistent manner.” 

By studying these citizens’ “patterns of life,” Anomaly 6 homed in on “a very interesting use case,” in the form of one individual, a US-based nuclear physics expert, who supposedly conducted “multiple trips to North Korea” between March and August of 2019. The Grayzone has elected not to identify the academic out of concern for their security.

“Digging into this activity we see some very interesting locations visited,” Anomaly 6 remarks. 

Anomaly 6 used its spy technology to track the person of interest to Kim Il Sung’s Changsuwon Residence, a location “of note due to the fact that the area was purpose built for the former North Korean leader Kim Il Sung, grandfather to current leader to Kim Jong Un.” The area is said by the company to be replete with “security quick reaction forces, anti-aircraft artillery and missile sites, and underground facilities.”

“Access to a location such as this does not seem to be accidental and one can assume this visitor had authorization and was escorted onto such a sensitive leadership site,” Anomaly 6 states. “The above travel to an ‘underground facility’ is interesting in the fact that it also points to the other ‘random’ travel patterns in mountains in another location outside of the capital city.”

That location was likewise a suspected “underground facility” roughly 31 miles southeast of Pyongyang, “in a mountainous area.” Interest perked, Anomaly 6 then tracked this individual’s movements upon their return to the US, uncovering “some very unique insights” along the way. 

Linking the smartphone user to hotels, schools, residences, and other sites across the US, Anomaly 6 pinpointed their “most likely bed down location,” or where they sleep. Using “open source information,” the spy firm then determined who this individual was, where they worked, their address, marital status, names and photos of their children and the schools and universities they attend. 

Such insights are extremely ominous given this individual was considered a “personality of interest,” due to counterintelligence “concerns.” Anomaly 6 concluded they boasted a US government security clearance, and was therefore either traveling to North Korea “outside the security channels that they must follow,” or on behalf of the US government. Either way, the company judged that this activity deserved “further examination.” 

According to Anomaly 6, the academic’s trip posed security risks not because they were a spy, but because Chinese intelligence could employ similar spying tools to track their movements and thereby uncover “potential secret negotiations between the US and North Korea.” This, in turn, “could create tensions quickly” with Beijing, the firm fretted.

“Here we see that if a direct target is not available, there is [sic] other ancillary efforts to pursue in which to find a personality of interest,” Anomaly 6 boasted in its presentation. “The end result here is to show how quickly and deeply clients can dig into targets with very few start points or very nebulous start points and derive insights in short order.”

But what if those targets turn out to be wrong?

A stringent denial from Anomaly 6’s “person of interest”

Reached by The Grayzone via email, the academic named as a “person of interest” by Anomaly 6 insisted the spying firm got it all wrong.

“I have never been to North Korea and neither has my phone,” they stated. “You should be highly skeptical of any information saying otherwise.”

The academic was unable to explain how Anomaly 6 made such an error. “Somehow they were able to track my phone,” they said. “It seems like they would have therefore known I wasn’t in North Korea in March 2019 so there is rather inconsistent information here.”

This apparent blunder by Anomaly 6 amply underscores the potential for millions of innocent people to be surveilled and potentially compromised by government agencies on completely bogus grounds.

‘Sensitive information’ sourced, ‘actionable next steps planned’

At the conclusion of the Anomaly 6 presentation, the firm revealed that the academic was just one of “hundreds” of US citizens it claimed to have tracked on supposed visits to North Korea over the past year.  It also spied on users of “devices from other friendly countries,” including constituent members of the Five Eyes global spying network, and France and  Germany.

“This provides our intelligence services with multiple vectors in which to find those people with placement and access to denied terrain in North Korea [and] actionable start points for development of sources and cooperative actors that can be tasked to meet priority information requirements in support of the [US government] and allied efforts,” Anomaly 6 appraises.

The company can provide “unparalleled access” to private data well beyond Pyonyang. Anomaly 6 offers the same service for individuals traveling to and from, or based, anywhere “globally on demand,” with “the capacity to increase” its international reach “at any time.”

“From this example or use case, one of many which can be developed out in [sic] a similar methodology, we see how quickly sensitive information can be derived and actionable next steps planned [emphasis added],” Anomaly 6 bragged.

It is unclear for whom or what this case study was prepared, but such comments strongly suggest the prospective clients were US government entities – in particular, the CIA and/or NSA. Both are legally prohibited from, and have frequently been embroiled in controversy for, spying on US citizens. Anomaly 6’s technology would allow these agencies to sidestep such restrictions.

Fearing media scrutiny and prosecution, Anomaly 6 turns to UK military-intelligence firm

Leaked documents reviewed by The Grayzone indicate the smartphone and IoT data Anomaly 6 harvests is so precise, it can pinpoint the floor of a building where a user is located, their telecom provider, the make and model of their device, its battery level, and more. 

Unfortunately for the company, its spying services are absolutely illegal under many national and international data protection regimes.

To skirt these restrictions, Anomaly 6 turned to a British private military-intelligence firm, called Prevail Partners. This November, the Grayzone exposed Prevail’s proposal to construct a secret partisan terror army on behalf of the Ukrainian Security Service’s Odessa branch, at the behest of senior British spies.

Other leaked files reveal Prevail is acting as a cutout, secretly marketing and selling Anomaly 6 services to state and non-state customers across the globe. The minutes of a meeting between representatives of Prevail and Anomaly 6 from May this year show the latter “expressed significant concerns” about compliance with the European Union’s GDPR requirements, to which Britain remains a signatory despite its departure from the bloc.

Anomaly 6’s primary concern was that a “personality of interest” caught up in its sweeping data vacuum would submit a Subject Access Request to a company or government entity utilizing its services, “which would expose their operation and potentially lead to legal action being bought [sic] by the Information Commissioner’s Office (ICO) of a European country.”

“[Anomaly 6] feel that the legal basis under which they are processing European data is unlikely to stand-up to scrutiny and feel that this assessment is supported by case law [emphasis added],” the minutes record. “[Anomaly 6] have a low risk threshold in this area exacerbated by their recent media profile.” 

To head off the public relations and legal damage that could come with exposure of Anomaly 6’s spying program, Prevail explored schemes through which data protection laws could be dodged, including “whether a government exemption could apply.” As part of its damage control measures, Prevail contracted elite law firms like the London-based Cooley to advise them on whether and how Anomaly 6’s activities “would be defensible in a European court.”

The stakes are high for Prevail, as the company stands to reap millions as a secret liaison between Anomaly 6 and Britain’s Home Office and Ministry of Defence.

Under the terms of a contract drafted in December 2021, Prevail was granted “exclusive rights to market and sell” Anomaly 6’s wares to London’s Defence Intelligence Agency, Permanent Joint Headquarters, assorted elite military spying units, GCHQ, MI5, MI6, and security and intelligence services, and special forces, in countries including Argentina, Australia, Denmark, Malta, and the United Arab Emirates. 

Potential buy-in to Anomaly 6’s illegal and highly invasive technology by virtually the whole of Britain’s national security state means the sensitive personal information of billions of citizens could be exploited for an array of malicious purposes.

Reached by phone, Anomaly 6 sales rep Brendon Clark told The Grayzone his company’s public relations representative would call to discuss their relationship with Prevail and Britain’s military-intelligence apparatus. Days later, this outlet is still waiting to hear back.