Reporters United is launching today, in collaboration with 14 international media outlets, the Predator Files: A series of reports on Predator, Intellexa and the Greek wiretapping affair. The investigation is based on the leak of hundreds of documents to the French Mediapart and the German Spiegel, under the coordination of the EIC (European Investigative Collaborations) network and with the cooperation of Amnesty International's Security Lab. In Greece, it is published jointly with the Editors' Journal.
We have a request from a super-evil country and I wanted to know what options we have…
The request comes from Libya, from Haftar’s side. And I really don’t know if it’s forbidden or not…
If the press finds out, we’re dead!
The call takes place in May 2021. On one end is Stéphane Salies, head of the French company Nexa, a company that has been working closely with Intellexa, which markets the Predator, since 2019. On the other end is Nexa’s legal advisor Kai Heft. The two discuss the possibility of Nexa selling spyware to Field Marshal Haftar (who controls a significant part of eastern Libya), even though this is prohibited by European law.
This is just one of the many sales of eavesdropping equipment made in recent years by companies and individuals from the Intellexa galaxy to authoritarian regimes.
What neither Salies, Heft, nor Tal Dillian, the mastermind behind Intellexa and Salies' close associate, know at the time, is that their conversations are being monitored through a legal wiretap by the French police. This is because Nexa executives are suspected of serious crimes for selling spyware to the Egyptian regime.
See also: Predatorgate: What the SMS-traps received by businessmen, ministers and journalists said
It is the first blatant contrast to the Greek Predator Gate: In France, the police are monitoring the perpetrators of illegal wiretapping. In Greece, police officers are physically monitoring the center of Athens (report by Yannis Souliotis in Kathimerini) and digitally (text by Tasos Telloglou) the journalists investigating the wiretapping.
Prosecution for complicity in torture
Soon, in mid-June 2021 - and while the Predator is in full development in Greece, trapping sensitive targets - Salies and other Nexa executives will be arrested by the French authorities. The investigation against them is being undertaken by the Special Service for Crimes and Against Humanity, as Salies and his accomplices, high-ranking Nexa executives, are accused of "complicity in torture" due to the sale of surveillance equipment to authoritarian regimes.
The police raid the homes and offices of Nexa executives. The investigation will last two full days "due to the volume of evidence, in physical and digital form," as a French police report later notes.
(This is the second glaring contrast to the Greek Predator Gate, in the context of which no arrest or indictment of any person involved in the wiretapping scandal has been made.)
The Predator Files
The international journalistic investigation Predator Files, in which Reporters United participates, began in December 2022. It is based on a leak of confidential documents to the French Mediapart and the German Spiegel, under the coordination of the EIC (European Investigative Collaborations) network and with the technical support of Amnesty International's Security Lab. The investigation involves 15 media outlets from around the world, from Mediapart and Spiegel to the Washington Post in the US.
The Predator Files attempt to map the companies and individuals that make up the Intellexa universe, to reveal the hitherto unknown capabilities of spyware and, above all, the ways in which they ended up being sold and strengthening, with the tolerance or even the cooperation of European governments (and Maximus), the power of authoritarian regimes in the Middle East, Africa and Asia.
Today, we present some of the findings of the multi-month investigation, findings of an international nature but from which important conclusions can be drawn regarding the development of the wiretapping case within our country as well . And starting tomorrow, we will move on to the Greek findings of the investigation, findings that confirm the pivotal position of Greece and the role of the Mitsotakis government in the broader universe of Intellexa.
12 conclusions from the Predator Files
- The Intellexa galaxy is much more extensive than we had imagined. It is a network of individuals and companies based in at least 11 countries: Greece, Ireland, France, Germany, Czech Republic, Cyprus, Hungary, Switzerland, Israel, North Macedonia, United Arab Emirates (UAE).
In the graph we map the main relationships between people and companies.
- The list of countries in which Intellexa companies have sold or promoted their products is much longer, in many cases authoritarian regimes that brutally violate human rights.
Until now, we knew from the Citizen Lab report in 2021 that traces of Predator had been detected in countries such as Oman, Armenia, Saudi Arabia, Egypt and of course Greece. However, according to a new report by Amnesty International’s Security Lab , which will be published in the coming days (and which Reporters United gained access to as part of the Predator Files), evidence of Predator operations has been detected in Madagascar, Angola, Vietnam, Sudan, Indonesia, Mongolia and Kazakhstan, among others.
Additionally, Nexa documents seized by French authorities reveal that Intellexa's spyware was also promoted for sale to Malaysia, the Philippines, Mauritius, Cameroon and Iraq.
- In the Intellexa galaxy, Greece is not a distant star but is at its center, both at the operational, political (through the Greek government's export facilitations towards it) and corporate (with the participation of Greeks in the complex corporate structures) and communicational (with the coordination from Greek soil of the company's efforts to manage the crisis). We will say more about all of this in our next reports.
- Through the leaked confidential documents, Intellexa's Predator emerges as an extremely successful commercial product, which Nexa executives advertise unhindered and in many cases manage to sell to many governments around the world even when this is contrary to EU legislation.
The research reveals that each new country deal gets its own nickname. It's usually a name that refers to chocolates: The software sale to Egypt, for example, is called "Toblerone.".
- And yet, there is a fundamental difference that refutes the Mitsotakis government's narrative about the use of the Predator in Greece by private individuals: International journalistic research has so far not identified a single country, inside or outside Europe, in which the Predator was not sold (directly or through an intermediary) to state authorities or the government.
- Greece is of course not the only Western country linked to Predator, either as an importer or exporter. However, it is, to date, the only European country in which the illegal software was used for mass surveillance of ministers, military personnel, journalists, and businessmen.
- The Mitsotakis government, as we will analyze in a later part of our investigation, played a crucial role in ensuring that illegal software was exported to authoritarian regimes, indirectly contributing to the commission of serious human rights violations. In our detailed report, we will highlight the background to the export of spyware to Madagascar. We recall that, according to the New York Times, the Mitsotakis government granted two Predator export licenses to the African country in November 2021.
- For similar software exports to authoritarian regimes, as mentioned above, two of the perpetrators of the case were prosecuted in France on charges of “complicity in torture.” In Greece, to date, no person involved in the Greek Predator Gate (either as a company executive or as a public official) has been arrested or prosecuted.
- While in Greece, the system of legal connections was used (in combination with Predator, as demonstrated by the cases of Koukakis, Androulakis and Seaford) abusively and extra-institutionally as a tool for espionage against politicians and journalists, in France the legal and constitutionally guaranteed process of connections was used to dismantle the local wiretapping circuit.
- In France, too, there were political interventions by government officials close to President Macron in order to prevent the institutional clarification of the case, but this did not prevent the French police from proceeding with investigations, arrests, and ultimately prosecutions.
When French prosecutors discovered in 2020 that Nexa was selling eavesdropping equipment to Haftar, they launched an investigation into the perpetrators of the sale, as the Libyan marshal is suspected of war crimes and there is an international arms embargo on Libya anyway. However, according to the findings of the Predator Files, the investigation will be blocked after interventions by the counter-terrorism prosecutor and the French finance minister himself.
- Reporters United has obtained access to confidential technical documents leaked to France's Mediapart and Germany's Spiegel as part of the Predator Files. With the help of Amnesty International's Security Lab, we are able to document the capabilities of the products that the Intellexa group was selling – some of them with capabilities even more dystopian than those of the Predator.
These are tools so powerful that they are "fundamentally incompatible with human rights," Amnesty International concludes in its report to be published in the coming days.
- The network of countries in which Intellexa companies do business largely coincides with the states that have developed significant geopolitical alliances with Greece (France, Israel, Egypt, Eastern Libya and Haftar, Cyprus, North Macedonia, Saudi Arabia).
See also: Intellexa's Technical Analysis of Spyware PREDATOR
Conflict with Macron
Among the most important findings of the investigation is the revelation of Nexa's involvement with President Macron.
The company that sells spyware will take advantage of its privileged access to the French president. The group's number 3, Renaud Roc, participated in Macron's 2017 election campaign. Two months after the election, the General Secretariat for Defense and National Security (SGDSN) authorized Nexa to "conclude contracts [...] at a confidential defense level" with the GIC, the agency of the prime minister's office that oversees intelligence connections.
A year later, Nexa secured a direct meeting with Macron and then-presidential adviser Alexandre Benalla (the person at the center of the subsequent scandal of the same name during the Macron presidency). Nexa asked Benalla for assistance in promoting its sales to Saudi Arabia.
From Colonel Gaddafi to Marshal Haftar
Nexa sold eavesdropping equipment to Field Marshal Haftar, whose forces control eastern Libya in the context of the civil war with the official government in Tripoli. The contract was signed in 2020. Haftar has already been a close ally of the Greek government in the latter's conflict with the (pro-Turkish) government in Tripoli.
Important note: As early as 2007, Amesys, the predecessor of Nexa, had developed the Eagle eavesdropping software for Libyan dictator Muammar Gaddafi. In the relevant manual (available to Reporters United), Eagle is advertised as the world's first software that can "massively" monitor the Internet of "an entire country." (More on the case in our report on the Greek findings, on October 6)
Eagle's advertising brochure rhetorically posed the questions the software could answer: "What is the digital life of your population? Contacts, friends, suppliers, partners? Who is in contact with whom in your country?".
At Tal's chalet
But where is the real protagonist? The 62-year-old, now legendary Tal Dilian, former commander of the Israeli army's elite U 81 unit? In 2017, he received Maltese citizenship, thus acquiring a European passport.
His trail led our Swiss colleagues from WOZ newspaper to Chambery, a village near the French border. Dillian invested in a local taxi company in 2019 and two years later, the year that illegal surveillance was at its peak, a local newspaper published an article congratulating him on the birth of his son.
Our Swiss colleagues from WOZ arrived at the doorstep of Dilian’s chalet in Chambery. At the entrance, a sign greets the visitor in French: “Chez Dilian” (“Dilian’s House”). On the day the journalists visited the house, no one was there. In one of the group conversations between Intellexa and Nexa executives (the subject of a seizure by the French police), Dilian appeared with four different telephone numbers: Two numbers in Israel, one in Cyprus and one in Switzerland.
More about his contacts in our next reports.
Reporters United's upcoming reports on the Predator Files
- Greece's presence in the leak of confidential documents (both from the companies involved and from the French authorities) on the exports of Predator and other hacking software.
- The testimony of a former Cytrox employee against the backdrop of the Greek Predator Gate.
- Selling spyware to Vietnam and targeting high-profile targets in the US and EU.
- The story behind the sale of eavesdropping equipment in Madagascar.
See also: Predator inside story: SMS the key to the wiretapping investigation
Predator Files
The #PredatorFiles is a cross-border investigation involving 15 media outlets, based on confidential documents obtained by the French Mediapart and the German Der Spiegel, and coordinated by the EIC (European Investigative Collaborations) network. The investigation involves EIC members NRC, Politiken, Expresso, Le Soir, De Standaard, VG, infolibre and Domani in collaboration with the media outlets Shomrim (Israel), Die Wochenzeitung (Switzerland), Reporters United (Greece), Daraj Media (Lebanon) and the Washington Post (USA).
Source: www.reportersunited.gr
