The NYT published an article with their investigation into the Greek Predator scandal as well as the wiretapping and surveillance!
Last year, the Biden administration took a public stand against the use of spyware to target human rights activists, dissidents, and journalists, blacklisting the most notorious maker of hacking tools: the Israeli company NSO Group.
Despite public outcry against commercial spyware, which gives government entities the ability to hack into people's personal phones and collect their data, the industry continues to thrive. In fact, even the United States government makes use of this software.
The Drug Enforcement Administration is secretly developing spyware from another Israeli company, according to five people familiar with the agency's operations. This is the first confirmed use of commercial spyware by any federal government agency.
At the same time, the proliferation of spyware globally is on the rise, with newer companies—made up of veterans of Israel’s former cyber-espionage sector, including some former NSO employees—stepping up to fill the void left by blacklisted entities. This new era of companies has made once-cutting-edge technology accessible to anyone and everyone, resulting in a dramatic shift in how government spying operates.
A company that sells a hacking tool called Predator and is run by a former Israeli generalis at the center of a political scandal that has erupted in Greece over the use of spyware against politicians and journalists. The company's offices are in Greece, specifically in Athens.
The Greek government has admitted that it has licensed Intellexa to sell its Predator product in other countries – mainly in the Middle East, the Balkans and Africa (potential customers are mentioned in Armenia, Egypt, Indonesia, Madagascar, Oman, Saudi Arabia and Serbia). In addition, the New York Times obtained a business proposal from Intellexa that proposed selling its products in Ukraine – however, Ukraine rejected the offer.
Predator has been found to have been used in at least a dozen other countries since 2021, further demonstrating the lack of international regulation for such tools. Predator has been found to have been used in at least a dozen other countries since 2021, further demonstrating the lack of international regulation for such tools.
After conducting an investigation that included studying thousands of pages of documents – sealed court documents in Cyprus, secret parliamentary testimony in Greece and a secret investigation by the Israeli military police – as well as interviews with more than two dozen government and judicial officials, law enforcement agents, business executives and hacking victims in five countries, the Times has uncovered new evidence about the global spyware industry.
See also: How Sudan is connected to the Predator scandal that is shaking Greece
Sophisticated spyware tools like NSO’s Pegasus use “zero-click” technology (the user doesn’t have to click on a malicious link) to remotely extract all data from a target’s mobile phone. They can also turn the mobile phone into a tracking and secret recording device, allowing it to spy on its owner. But cheaper hacking tools without the zero-click feature also have a significant market.
Although commercial spyware is intended to hack phones used by illegal networks and groups, it has been discovered that many authoritarian regimes and so-called democracies have abused this power to spy on political figures and journalists with whom they disagree.
The Biden administration is trying to bring some peace to the global chaos, but it is struggling as the United States is instigating and causing much of this unrest – the US is playing the role of both arsonist and firefighter. In addition to the DEA — in this case, a tool called Graphite, made by the Israeli company Paragon — the CIA during the Trump purchased Pegasus for the government of Djibouti, which has been using the hacking tool for at least a year. It has also been reported that the FBI purchased Pegasus for use in its own criminal investigations – this proposal ultimately fell through.
According to the Times, the Drug Enforcement Administration (DEA) is “using every legal investigative tool available” to identify and punish the foreign-based cartels responsible for the deaths of 107,622 Americans last year.
Steven Feldstein, an expert at the Carnegie Endowment for International Peace in Washington, has tracked and documented the use of spyware by 73 countries.
“While these sanctions are a step in the right direction, some other companies have simply taken NSO’s place,” he said. “And it looks like this problem isn’t going away anytime soon.”
Arsonist and firefighter
NSO has been selling Pegasus, a spyware software that provides access to all the details of a target's phone, to law enforcement and intelligence agencies around the world for more than 10 years. The Israeli government allowed the company to export its product only if it first obtained a license from the agency.
The Israeli government was then able to exploit the countries (Mexico, India, and Saudi Arabia) that were willing to buy Pegasus, by exerting control over them.
Against digital authoritarianism, the White House warned of the dangers of spyware in its annual national security strategy outline. In response to the threats last October, the Biden administration took action, blacklisting NSO and another Israeli company – Candiru. This blocks all American companies from doing business with them.
The government is coordinating an investigation into which countries have used Pegasus or other spyware tools against American officials abroad.
See also: Wiretapping: Will the prosecution request Predator data from Amazon?
Congress is working on a bipartisan bill that would require the director of national intelligence to conduct an assessment of the counterintelligence risks to the United States from foreign commercial spyware. The bill would also give the director of national intelligence the authority to ban the use of spyware by any intelligence agency. The White House is working on an executive order with other restrictions on the use of spyware.
But there are exceptions. The White House is allowing the DEA to continue using Graphite —a hacking tool made by the Israeli-based company Paragon— in its fight against drug cartels.
A White House official, speaking on condition of anonymity, said an executive order being prepared would target spyware. The software poses “counterintelligence and security risks” if used improperly by foreign governments. If evidence of such activity is found against Paragon, the government would end its business dealings with it.
NSO’s Pegasus tool isn’t the only one that can allow access to a cell phone and its contents – so does the Graphite spyware. However, where Pegasus collects data stored on the phone itself, Graphite primarily pulls information from the cloud, after backing up data from the phone. As a result, such attempts at hacking and data theft can be harder to detect, according to cybersecurity professionals.
The DEA official said Graphite has only been used in other countries — not in the U.S. — and targeted drug dealers. The agency declined to answer questions about whether the spyware has been used against Americans living outside the United States. It also dodged questions about how the agency collected information about American citizens — whether it was text messages, phone calls, or anything else — that the agency obtained when it used Graphite against its targets.
In 2014, DEA officials met with NSO to discuss using Pegasus for their operations, but decided not to do so after the meeting ended. Vice News was the first to report the story.
Paragon sales are controlled by the Israeli government, which approved the sale of Graphite to the United States, according to an official familiar with Israel's defense export licensing agreements.
Ehud Schneorson, a former commander of Israel's Unit 8200, the equivalent of the National Security Agency (NSA), founded the company just three years ago. Little public information is available about it because it does not have a website; most of its executives are veterans of Israeli intelligence, including some NSO employees, according to two former Unit 8200 officers and a senior Israeli official.
Ehud Barak, the former prime minister of Israel, is on the company’s board of directors and “American money” is financing its operations. Battery Ventures, a Boston-based fund, lists Paragon as one of the companies it invests in.
Although the US government purchases and develops Israeli-made spyware, the Biden administration's move to rein in the commercial spyware industry has led to strained relations with Israel.
See also: Predator intercepts: Intellexa continues its business undisturbed in Greece
Israeli officials pushed to have NSO and Candiru removed from the Commerce Department's blacklist but were unsuccessful.
Amir Eshel, director general of the Israeli Defense Ministry, said Israeli officials were trying to find out what red lines on commercial spyware.
Mr. Eshel stated that despite their efforts, they were unable to convince senior government officials to address the issue or explain their position.
To prevent more companies from being blacklisted by the US, Israel’s Defense Ministry has tightened regulations on the local cybersecurity industry. This includes reducing the number of countries (37 from 110) to which these companies can potentially sell their products, according to two senior Israeli officials and an executive at an Israeli technology company. With fewer countries available as potential buyers, many Israeli spyware companies have taken a serious financial hit.
Although this change created new challenges, it also opened up new opportunities for growth.
The Predator has reappeared, ready to face any opponent!
Tal Dilian proved that to be true. Mr. Dilian, a former general in Israel’s military intelligence service, was honorably discharged in 2003after an internal investigation revealed his possible involvement in mismanagement of funds. Mr. Dilian then decided to move to Cyprus – which has become an increasingly popular destination for surveillance companies and cyber-espionage experts in recent years.
In 2008, Mr. Dilian co-founded the Cyprus-based company Circles, which used an Israeli-developed spying technology called Signaling System 7. He sold the business and went on to found other companies selling surveillance products. Mr. Dilian prides himself on hiring only the best hackers for his team, many of whom are former spyware specialists from the Israeli military’s elite cyber-espionage unit.
After the Circles sale, Mr. Dilian went quiet — for a while, at least. Then, in 2019, he gave an interview to Forbes from a surveillance truck driving through the Cypriot city of Larnaca. There, he demonstrated the truck’s ability to hack into any nearby phone and steal WhatsApp and text messages from unsuspecting targets.
Naturally, the Cypriot authorities issued a request for his arrest through Interpol, for illegal surveillance. His lawyer eventually managed to settle the incident with a fine of 1 million euros paid through Mr. Dilian's company, but he was no longer welcome to operate in Cyprus.
Mr. Dilian didn't stop there. He moved to Athens and founded Intellexa in 2020, and that's when he started marketing his new SPYWARE product, Predator.
Unlike Pegasus, which can infect a phone without the user's knowledge or action, Predator requires the target to click on something to get their phone infected.
Predator infections are spread through personalized instant messages with infected links that mimic existing websites. A study conducted by Meta on Predator found about 300 of these sites being used to infect computers.
As of spring 2020, Intellexa was based in offices along the Athenian Riviera. Based on confidential employment records reviewed by the Times, as well as staff profiles on LinkedIn, the company hired at least eight Israelis — many with backgrounds in the country’s intelligence services.
Mr. Eshel, who is responsible for spyware export licenses through his ministry, said there was little he could do to control what Mr. Dilian or other former Israeli intelligence agents were doing after they started their own businesses outside Israel.
“I am certainly disturbed by the fact that a veteran of our intelligence and cyber units, who employs other former senior officials, is operating around the world without any oversight,” he said.
Intellexa also looked at opportunities in the NSO domain. Ukraine had previously tried to acquire Pegasus, but the attempt failed after the Israeli government blocked NSO from selling to Ukraine over concerns that doing so would damage Israel's relationship with Russia.
In February 2021, Intellexa proposed using its Predator spyware to a Ukrainian intelligence agency in a nine-page document. The Times obtained a copy of that proposal, which it described as “full” and commercial in nature. This is the first time such a proposal has been made public. According to the proposal, Predator even offers 24/7 customer support via a helpline.
Intellexa offered Ukraine a basic package of 20 simultaneous infections with Predator for 13.6 million euros ($14.3 million) per year, as well as a “magazine” of 400 hacks of domestic numbers, training and support . If Ukraine wanted to use Predator on non-Ukrainian numbers, it would cost an additional 3.5 million euros per year.
A person familiar with the matter said Ukraine rejected the proposal. It is unclear why Ukraine did not want to work with Intellexa. Because it was freed from Israeli government regulations and had little to no oversight in Athens, the company was able to quickly grow its customer base.
Meta and the University of Toronto's Citizen Lab, a cybersecurity monitoring organization, detected Predator in Armenia, Egypt, Greece, Indonesia, Madagascar, North Africa, Oman, Saudi Arabia, Serbia, Central/South America, Colombia, Vietnam, the Philippines, Ivory Coast, and Germany. These locations were identified through web scans associated with servers known to be associated with the spyware.
The Greek Scandal
In recent months, Predator has rocked Greece after it was found to have been used against journalists and opposition figures. The Greek government has repeatedly stated that the spyware is illegal and that it had no involvement in its creation or use.
Despite the allegations, Greece admitted that it supported Intellexa and its spyware in a vital way: by granting the company permission to export Predator to Madagascar, whose government has a history of suppressing dissent.
Alexandros Papaioannou, a spokesman for the Greek Foreign Ministry, confirmed that a department of the ministry issued two export licenses to Intellexa on November 15, 2021. In a sign of the pressure the country is under, Mr. Papaioannou said that the ministry’s inspector general had launched an internal investigation after local press reports about the company. European Union law treats spyware as a potential weapon and calls on authorities to grant export licenses after due diligence to prevent its misuse.
Madagascar is the fourth poorest country in the world and is located off the coast of East Africa. The country is rife with corruption, especially in the mining and oil industries that bring in billions a year for companies.
In Greece, Predator is at the center of a political vortex.
The story began in April, when a Greek news outlet, Inside Story, reported that an investigative journalist’s phone had been infected with Predator. The University of Toronto’s Citizen Lab conducted a forensic investigation and found evidence to support the claim. Soon, two opposition politicians confirmed that they too had been targeted, each with their own forensic evidence to back up their claims.
All three assumed that the Greek state had ordered their surveillance and took legal action by filing lawsuits. Mr. Koukakis, an investigative journalist, is one of the three individuals who sued Intellexa.
Prime Minister Kyriakos Mitsotakis has denied ordering the surveillance of anyone using Predator and insists that the Greek government does not possess any spyware.
In August, Mr Mitsotakis’ nephew Grigoris Dimitriadis resigned from his position overseeing the national intelligence service amid a spyware scandal, although he denies any involvement. Around the same time, the prime minister fired the head of the national intelligence service.
In the same month, Intellexa laid off most of its Athens-based staff.
Mr. Mitsotakis confessed in November that someone is carrying out secret missions inside Greece with a Predator, but he does not know who it might be.
“To be clear, I never said there were no hacks or Predator software in use. What I meant was that the government never confirmed these rumors. There is a lot of illegal spyware circulating in Europe without anyone knowing who is using it,” said Mr. Mitsotakis.
Source of information: nytimes.com
