Intellexa training center in Athens. Plans for a research and development department for new eavesdropping software. Surveillance equipment that was "blocked" in Greece. The secret documents brought to light by the international Predator Files investigation with the participation of Reporters United and 14 other media outlets from around the world, prove that with the government's tolerance, the Intellexa galaxy intended to turn our country into an international hub for the European eavesdropping industry.
For a year and a half now, Maximou has been denying any relationship with Intellexa, which markets Predator. Despite the identification of EYP - Predator. Despite Dimitriadis' involvement in transactions that reach Intellexa shareholder Felix Biggio through a network of companies. Despite the export licenses for Predator from the Mitsotakis government.
Since yesterday, EfSyn and Reporters United have been publishing the Predator Files, a journalistic leak of confidential documents that reveal the investigations of the French authorities into illegal exports of surveillance systems. Among them: the Predator. The leak was made to the media outlets Mediapart (France) and Spiegel (Germany). The investigation was coordinated by the EIC (European Investigative Collaborations) network.
Support Reporters United's independent journalism here!
The main findings
The confidential documents, which come from the companies involved and the French authorities that control them, offer important findings against the backdrop of the Greek Predator Gate:
- In June 2021, French businessman Stephane Salies admitted to French authorities after his arrest that he was working on plans for a surveillance system research and development (R&D) program in Greece. Salies was the head of the French company Nexa, which since 2019 had been working closely with Intellexa to sell Predator and other surveillance software to illiberal regimes.
- On May 20, 2021, Salies informed another Nexa executive in a conversation (which was the subject of a legal wiretap by the French police) that he had surveillance equipment in Greece. The conversation concerned the export of Intellexa eavesdropping software to Madagascar, which would target mobile phones via SMS, with the aim of “intercepting telephone communications.” The Mitsotakis government would later issue two licenses to export Predator to Madagascar, according to the New York Times. (Reporters United will report in detail on this case in a subsequent report).
- In 2021, Trovicor, a Nexa subsidiary, submitted a bid to Greece to upgrade an interception system. The contract was probably never signed, as a judicial investigation by French authorities thwarted the plans of companies linked to Predator.
- A Nexa document refers to a plan to present the company's eavesdropping software to the Greek Ministry of Interior in the second quarter of 2017. (Available information suggests that the sale, for unknown reasons, did not proceed.)
- A former employee of Cytrox, the North Macedonia-based company that developed Predator, tells Predator Files that there was a center in Athens that trained agents in the use of Predator.
Predator Exporter: Plans for software development in Greece
The central hero of our story is the French businessman Salies. We will start from the end.
On June 15, 2021, French police raided Nexa's offices in Paris. They searched the premises. They arrested executives. Among them was Salies. The company's number two, Olivier Bobo. The number three, Renault Roc.
On June 15-17, Salies testifies as a suspect for “complicity in torture.” Authorities are investigating whether the exports of wiretapping equipment to Libya and Egypt led to the torture of dissidents.
In his testimony, Salies refers to the development of a new IPDR (Internet Protocol Detail Record) monitoring system, which intercepts internet browsing data.
"What is this new product called?" the authorities ask.
"We haven't found a name yet. We are thinking of doing research and development [for this] in Greece. That's why it's wrong to say that we are trying to avoid European regulations," he says, to argue that he is not avoiding the application of EU legislation.
The investigations ruined Salies' plans. However, his testimony is important. It is an admission that Nexa was thinking of doing R&D for specific eavesdropping software in Greece. Nexa, which at the same time was an irreplaceable partner of Tal Dillian, the largest shareholder of Intellexa, which was also based in Athens, with its second largest shareholder here, Felix Bigzio, who found himself in the same network of corporate transactions with Mr. Grigoris Dimitriadis, who was politically responsible for EYP, which had the same surveillance goals as Predator, which Intellexa markets with export licenses from the Mitsotakis government.
Cerebro eavesdropping system: Sale in Cairo, offer in Athens
In 2012, Salies founded Nexa. This company acquired Amesys, the company that produced the Eagle software, which was renamed Cerebro. At the same time, AMES was founded in Dubai. This company, in Salies' interests, acquired from Nexa the right to sell Cerebro, which allowed it to circumvent European legislation on export licenses.
In 2014, Nexa sold Cerebro to Egypt. In a company document seized by French authorities, we found a plan to present the eavesdropping system to the Greek Ministry of the Interior in the second quarter of 2017, during the Tsipras government. The equipment was most likely not purchased, as no contract with Greece is mentioned in Nexa's orders and invoices for the period 2014-2018, which are available to the investigation.
Nexa's interest in Greece will return in 2021, under the Mitsotakis government, as we will see below.
Nexa in the arms of Intellexa
Things are going wrong for Salies in 2017.
The French magazine Télérama reveals the contract to sell eavesdropping equipment to Egypt. Justice opens an investigation for “complicity in torture”. Salies resigns from all French companies, retaining only the position of director at AMES. In his 2021 testimony, he said that he moved to Dubai in 2018 “due to problems with the media”. However, he does not lack the good life there: Salary of 25,000 euros. Mercedes of 170,000 euros. Investments of over six million euros in real estate in Paris and Dubai.
Gradually, however, another problem emerges: Due to the development of encryption on the Internet, Cerebro is "blinded", recording a small part of the Internet traffic. It no longer sees what the monitored are seeing.
“The original idea was for the Predator training center to be in Skopje, where I would teach customers and developers how to use the software. However, the North Macedonia idea was abandoned and the center was moved to Greece.” Former Cytrox employee in Predator Files
Nexa develops the Jasmine monitoring system. It detects who a target is talking to even on encrypted apps (WhatsApp, Signal). Jasmine, however, does not see message content. Only the interlocutors. It is not enough to save Nexa.
Then Tal Dilian appears. Former Israeli intelligence agent and powerful man behind Predator.
A leaked document shows that Nexa began its collaboration with Dillian in 2018. It concerns the creation of a spy van. The van, with WiSpear WiFi technology (Dillian’s interests) and Nexa surveillance equipment, attacks targets within a 500-meter radius with Cytrox (a company belonging to the Intellexa group) spy software, without the victim having to click on a link to be trapped. The coveted zero-click is in the hands of the Nexa – Dillian alliance.
"Zero-click, that's what, I think, gives value to sales today," Rock would say in a conversation recorded by French authorities.
In February 2019, the so-called Intellexa Alliance was announced, an alliance of Nexa and companies with Dillian interests.
Earlier in 2018, two Nexa developers resigned, fearing that Cerebro would be used against homosexuals in Egypt, a country with 40,000 arrests and 1,400 killings of protesters since 2014.
However, Nexa will not back down from its next collaboration with the Egyptians under dictator Al-Sisi. On September 19, 2020, the French and Israelis start a WhatsApp group chat to prepare a Predator demonstration in Cairo.
There Salies warns of its importance: "Our client is very knowledgeable and very demanding. He insists that the demonstration must be done this week. Otherwise, we may lose the contract. The first payment is conditional on a successful demonstration.".
The French are afraid that the Egyptians will buy phones with new operating systems, which may make it difficult to trap them with Predator. "We have to do the demonstration with the phones they give us. If we prepare, the impressive effect will be lost," commented a Nexa programmer.
In the end, everything went well. On December 31, 2020, Salies wrote to his Israeli colleagues on WhatsApp with the good news: “I just received a message from our agent that [the contract] was signed.” The message was accompanied by four emojis of champagne bottles.
"Great!!! Happy New Year," Dillian replies.
Salies: Intellexa equipment in Greece
While Dilian and Biggio's Intellexa has established itself in Athens, the Nexa - Dilian alliance is developing another connection with Greece, according to a document from French authorities recorded in a conversation between Salies and Rock on May 20, 2021.
In their conversation, Nexa executives discuss an urgent sale of Intellexa eavesdropping equipment to Madagascar. Salies tells Rock that he wants the contract signed quickly so that payment can be made in May. However, he adds, “I don’t have a solution” for an immediate sale to Madagascar, “because I have a piece of equipment blocked in Greece.”.
From Salies' words it follows that the Intellexa equipment located in Athens cannot be given to Madagascar, because it is "blocked" either for use in Greece or for export to another country. In any case, Nexa, which was considering doing R&D in Greece, kept Intellexa equipment in the country.
In the Salies-Rock communication, Madagascar is referred to by the codename Loco. As French authorities later discovered, Nexa executives had nicknames for all the contracts for the export of interception equipment, often with references to chocolates: Toblerone for Egypt, Ferrero for Monaco, Bueno for Congo.
Trovicor's proposal to Greece
During its 2021 campaign to sell interception equipment, Trovicor, a Nexa-affiliated company, prepared a proposal to Greece for an interception system upgrade. Specifically, the offer, amounting to 1.785 million euros, provided for the upgrade of interception equipment from CRBO-LI (Lawful Interception) to an MCng-type monitoring center, which is a Trovicor product.
According to the company's website, "Trovicor's next-generation MCng monitoring center is an advanced tool that records, monitors, evaluates and classifies on a single platform huge amounts of communication, interaction and transaction data from fixed and mobile telephone networks and the internet.".
The relevant contract was never signed, as at the same time the French authorities were conducting investigations that ultimately led to the arrests.
Fears and frictions
Despite the profits, conversations recorded by French authorities show that disagreements are gradually developing between Nexa and Dillian, due to the high prices charged by the Israelis for the Predator.
"In this country [Israel], everyone is the same," Salies complains in a telephone conversation.
"I know what book I'm going to give you for your birthday, something that starts with the word 'mein'," Rock replies, referring to Hitler's book Mein Kampf (My Struggle).
"Every time I deal with Israelis at work, it ends badly [...] I have many Jewish friends with whom things go well, but Israelis have a bad time at work...", replies Salies.
"The case is in the hands of the independent judiciary and we have no further comment" Prime Minister Kyriakos Mitsotakis' office to Predator Files
Salies has long feared leaks to the press. On June 3, 2021, shortly before the arrests, he will tell Rock: “[A revelation] could hurt us very, very badly […] Even if in 90% of cases it is used for a good purpose, it only takes one or two missteps for the situation to backfire on us, and badly,” Salies adds.
Finally, on June 15, 2021, both were arrested. On charges of "participation in torture" due to the sale of Cerebro to Libya (2007) and Egypt (2014).
The court will drop the second case, as the investigation did not prove that dissidents in Egypt were tortured due to information obtained from Cerebro and not from another eavesdropping system. However, the first case is pending, along with the judicial investigation into the sale of the Predator to Egypt in 2020 and the export to Madagascar in 2021.
In his testimony, Salies denied any illegality: "It is beyond shocking that I am here to respond to such accusations [...] To this day I firmly believe that [the wiretapping] serves the common good, it saves lives.".
A retired Nexa programmer testified as a witness: "I lived with a burden all these years. Conscience is a huge issue […] After years, I realized that nothing will change in the legislation regarding all the surveillance tools sold in non-democratic countries.".
On May 27, 2022, Nexa was sold to the French group Chapsvision. It was later renamed RB42, announcing that it was leaving the interception sector to specialize in cybersecurity.
Intellexa training center in Athens
A former employee of Cytrox, the North Macedonia-based company that developed Predator, told the Predator Files investigation:
“In Greece, there was the headquarters [of Intellexa], but also a large training center for Predator. After Intellexa was established in Greece, I traveled to Athens, when the facilities were being set up. The original idea was for the training center to be in Skopje, where customers and developers would be trained on how to use the user interface and the software in general. However, the idea of North Macedonia was abandoned and the center was moved to Greece. There, they put a Greek Cypriot in charge. He was in charge of the project. He was the main person behind the infected messages that were sent to the targets [of Predator surveillance], as well as behind the creation of the infected links. He trained users on how to infect [with Predator] and how to use it after the [target's] mobile phone was infected, how to retrieve their messages, that kind of thing. "This person had a company in Cyprus and had helped Dilian set up some things there.".
The source adds: “I went to Athens once. At that time, the necessary equipment for the training classes was set up there: computers, mobile phones and other similar things. Rotem [ed.: Farkas, one of the founders of Cytrox] was often there. Most of the executives who worked in Skopje either moved to Greece or spent a long time in Athens. Few of us remained in Skopje.”
Nexa and Maximus' answers
We asked Maximou about the issues raised in the investigation. "The case is in the hands of the independent judiciary and we have no further comment," the prime minister's office replied.
We sent questions to Nexa's two top executives, Stephane Salies and Olivier Bobo. Regarding their involvement with Greece, they limited themselves to answering that "either there was a commercial relationship, in full compliance with all applicable regulations, or there was no contract or delivery of equipment.".
We attempted to contact Intellexa through its registered details, as well as Cytrox founder Rotem Farkas. We received no responses.
Source: reportersunited
