According to the paper, police and PST deliberately ignored a requirement that they should inform the country’s telecoms authority before setting up ’IMSI catchers’, which mimic mobile base stations, allowing their operators to intercept and eavesdrop on mobile phone calls made nearby.
The newspaper last December identified a series of “fake base stations” outside Norway’s parliament, outside its government headquarters, and outside the residence of the prime minister, using a German CryptoPhone 500 to identify them.
It now appears that many, if not all of the devices, were set up by Norway’s own security services.
However the law from 2013 which authorized the country’s security services to use such devices, explicitly stipulated that the security services should first inform the National Communications Authority (Nkom).
Norwegian Justice Minister Anders Amundsen, in a letter to the Justice Committee of the Norwegian Parliament, confirmed that neither the PST nor the police had contacted the Authority when using the base stations.
"Police use of ‘mobile-regulated zones’ was not notified to the National Communications Authority (Nkom)," he wrote.
Bård Vegard Solhjell, leader of Norway’s Socialist Left Party said the report was “very surprising”.
“Both parliament and the government considered the interest of confidentiality before the law was passed,” he said. “PST cannot simply choose not to follow a law, even if they disagree.”
Einar Lunde, the director in charge of networks at Nkom, told the newspaper that in 2014, the authority received just one notification that an IMSI catcher had been set up, and that came from the National Security Authority, not from PST or the Police.
“For the whole of 2014, we received just one notification that mobile regulated zones had been introduced,” he said.
However, since Aftenposten’s December report, he said the agency had seen a sharp increase in notifications from the authorities.
“We see that there has been an improvement since the New Year,” he said. “We are now seeing more reporting.”