Predator wiretapping and surveillance: insidestory.gr . reveals new evidence showing how the company that markets illegal surveillance software took advantage of the critical time that the Mitsotakis government allowed to waste, while ensuring its stay in the country
Everything was going smoothly until the afternoon of April 10 for the employees and the Israeli head of Intellexa’s office in Hellinikon. The next morning, the inside story would reveal the first confirmed illegal surveillance of a European citizen’s communications with Intellexa’s proprietary Predator spyware – the victim was business and financial reporter Thanasis Koukakis.
In other words, Intellexa employs a single executive, whose duties include human resources management – in a company without people, at least not on the payroll.
In the seven months that have passed since the first revelation of the inside story, the people we know to have been targeted with Predator so far include – in addition to Thanasis Koukakis – the current PASOK president and MEP Nikos Androulakis, the former SYRIZA minister Christos Spirtzis and two EYP employees, who, as they have reported, were found in disfavor within the service. An investigative committee later, we have not learned any useful information about who is ultimately using Predator in Greece (and against how many and whom) – if not the government or a third party on its behalf (something it strongly denies).
During the same critical period, the government majority, the Greek judiciary and the independent National Transparency Authority (under Angelos Binis), which closely investigated the Koukakis case and the companies directly or indirectly involved in his surveillance, have missed significant opportunities to provide documented answers about who or who are behind the illegal spyware surveillance in Greece. On the other hand, the company Intellexa, which markets Predator, seems to have not let a moment go to waste and has taken measures since April to “seal itself”.
Jeroen Lenaers, chairman of the PEGA Committee set up in the European Parliament to investigate the use of spyware in EU member states, will visit Greece in early November and seems to fully understand the risks posed by the Greek side’s stance. “There are concerns about the ability and willingness of national authorities to investigate quickly and thoroughly. With each passing day, the risk of evidence disappearing or being destroyed increases,” he wrote in a September 28 letter to Europol.
Today we present new information about the moves the company made to protect itself, while the issue of legal and illegal surveillance is in the spotlight, taking advantage of the space and time it was given.
The government agreement – Intellexa
One piece of reliable information that is important and in light of which this report should be read is that, despite the contrary reports that circulated in the previous days on the Greek internet, Intellexa came to Greece to stay, based on an agreement that was reached between the government and the company about a month ago, as reported in the inside story by a source with close knowledge of what is happening in the company.
The Koukakis period: April – July 2022
Immediately after the revelation of the illegal surveillance of Koukakis, in April 2022, the Greek and foreign employees of Intellexa stopped going to the company's offices in Hellinikon every day for work and started working remotely. This is decided by the company's leadership and Tal Dillian, who is in Athens on April 12, 2022, one day after the publication.
A few 24 hours later, and while Reporters United's revelation about the legal connection of Thanasis Koukakis' phone by the EYP has intervened, in a period prior to his infection by Intellexa spyware, employees of the company who have been working there for a long time are ordered to empty the two basements of the servers that were installed there. According to some information, part of this equipment was moved to a place in the northern suburbs and it is unknown whether it still remains there. Despite the disruption in its offices, the company is continuing to recruit normally.
On April 18, 2022, Intellexa hires a senior software engineer, a software programmer in early May, and two more specialized personnel are hired in June (Python Back End Developer and System Integration Engineer). At the end of July, two more people of Israeli origin are added to the payroll. One of the two employees is in our country many weeks before starting work, having already completed her paperwork so that she can work for the company from November 2021. In the meantime, and while the inside story report is progressing, investigations are beginning into whether there is a source within the company that is leaking internal information.
Adding up the permanent staff that Intellexa started to employ since the end of 2020 (two people) with the 2021 hires and the new additions of 2022, the number of employees in July amounts to 20 people of Greek and Israeli nationality. Most of the hires were made in 2021, approximately 10 people. This is the year in which the mobile phones of Koukakis, Androulakis, Spirtzis and the two EYP employees (as the latter have reported) received targeted messages containing malicious links from falsified websites that have been linked to Predator. According to data available to inside story, 2021, i.e. the first full year of operation in Greece, was a good year for the company's revenue. Intellexa SA and two related companies [Apollo Technologies, Hermes Technologies] were established in March 2020 [in October 2020, Feroveno Limited was also established here]. For the 2020 fiscal year, Intellexa, Apollo Technologies and Hermes Technologies recorded a cumulative turnover of €1,512,125. In 2021, Intellexa SA alone recorded gross revenues of €5.5 million, up from just €778,000 in the March-December 2020 period.
On June 6, the sole advisor-manager of the companies Intellexa, Apollo Technologies and Hermes Technologies revoked all the power of attorney and any power of representation granted to a lawyer from Kolonaki. According to information from Inside Story, the rupture occurred when – after the first publications about Predator – the lawyer requested information about the sales contracts that the company had concluded.
On July 7, the shareholders of Intellexa, Apollo Technologies and Hermes Technologies decided to transfer the registered office of the companies, which was registered at the address of the accounting office of Elias Kyriakidis in Kifissia – the accountant had expressed his desire to move away. Intellexa’s new registered office is located in Chalandri, where the new accounting and consulting firm with which the company now collaborates is located. The other two (Apollo and Hermes Technologies) moved their registered office to Maroussi, to an address where a company offering tax domicile and professional address services is located. Feroveno also declares as its registered office the address where Intellexa’s offices in Elliniko operated.
The Androulakis period
On July 26, Nikos Androulakis goes to the Supreme Court Prosecutor's Office to file a complaint against anyone responsible for the attempted infection of him with the Predator spyware. The attempt was certified by the European Parliament's technical service, which checked his mobile phone. Somewhere around here, Intellexa stops hiring.
With a delayed posting to the Cyprus Registrar of Companies, published on August 4, 2022 (one day before it became known that the current president of PASOK, Nikos Androulakis, in addition to being targeted with Predator, was also in the crosshairs of the EYP), it is confirmed that businessman Felix Bitzios, who owned 35% of Intellexa since May 2020 through the Cypriot Santinomo, which was 100% owned by him, had transferred Santinomo to Thalestris, the Irish parent of Intellexa, and in fact 18 months ago, on December 18, 2020. This transfer, as the inside story has written, does not appear in the financial statements of the purchasing company, while Felix Bitzios continued to appear as the Beneficial Owner of the Cypriot Santinomo
August, although particularly dense in developments regarding the surveillance case (among others, the secretary general and nephew of the prime minister, Grigoris Dimitriadis, and the commander of the EYP Panagiotis Kontoleon have resigned since August 5), seems to be inactive for Intellexa, a company that has been hiring almost every month since March 2021. And suddenly, in the midst of the political confrontation and in view of the parliamentary committee of inquiry into the illegal interceptions (with Intellexa's spyware) and the legal connections by the EYP (with the invocation of national security reasons as an excuse for lifting the secrecy), on August 31, 2022 the company appears to be laying off all of its staff, a total of 18 people, except for the HR manager who leaves ten days later. On the same day, the inside story, in a report titled "The two key companies for the Parliament's investigation into wiretapping", which referred to Krikel (of Lavranos) and Intellexa, publishes [at 6:30 in the morning] details about the composition of Intellexa's staff: detailed data on the number of employees at the company, the hirings and resignations to date, as well as the proportion of Greek and Israeli employees.
At noon on August 31, the European Parliament's PEGA committee, which investigates the use of spyware in EU member states, announces its decision to hold an extraordinary hearing in Brussels on September 8 on Greece and Predator.
The company's management's idea is for its Greek project to remain a "Sleeping Beauty" for a while. According to a source close to the company, operation was impossible after what happened in August "as there was a fear that its accounts would be frozen and it would not be possible to make payments" (ed.: however, no such evidence of a "freezing" has emerged). Also, the vast majority of those laid off, even though almost two months have passed since the termination of their employment contract with Intellexa, appear on their LinkedIn to still be working for the same employer.
"There was a crazy, paranoid fear that there were leaks within the company, which intensified after the beginning of August. The decision to terminate the contracts – compensation was paid normally and more than enough – was made on a 'watch and see' basis, there was no final decision to close the company," says a former Intellexa employee, who wishes to remain anonymous.
In September and October, five new employees are added. The four, which involve technically qualified personnel, last only one day without any apparent explanation. The fifth newly hired employee, who seems to be the only one remaining in the company with a dependent employment relationship, takes on the position of HR manager. In other words, Intellexa employs a single executive, whose duties include human resources management – in a company without people, at least not on the payroll.
