Intellexa training centre in Athens. Plans for a research and development department for new interception software. Surveillance equipment that was 'blocked' in the Greece. Classified documents unearthed by the international Predator Files investigation involving Reporters United and 14 other media outlets from around the world, prove that with government connivance the Intellexa galaxy intended to turn the Country into an international hub of the European interception industry.
For a year and a half now, Maximos has been denying any connection with Intellexa, which markets Predator. Despite the alignment of goals EEAS - Predator. Despite the involvement of Demetriades at transactions which reach Intellexa shareholder Felix Biggio through a network of companies. Despite the export licenses of the Predator from the Mitsotakis government.
Since yesterday, FFSyn and Reporters United have been publishing the Predator Files, a journalistic leak of classified documents revealing French authorities' investigations into illegal exports of surveillance systems. Among them: the Predator. The leak was made to Mediapart (France) and Spiegel (Germany). The investigation was coordinated by the EIC (European Investigative Collaborations) network.
Support Reporters United's independent journalism here!
The main findings
The classified documents, which come from the companies involved and the French authorities controlling them, offer important findings against the background of the Greek Predator Gate:
- In June 2021, French businessman Stéphane Salies admitted to the French authorities after his arrest that he was working on plans for a research and development (R&D) programme for a surveillance system in Greece. Salies was the head of French company Nexa, which since 2019 had been working closely with Intellexa to sell Predator and other interception software to illiberal regimes.
- On May 20, 2021, Salies will inform in a conversation (which was the subject of a lawful interception by the French police) another Nexa executive that he has surveillance equipment in Greece. The conversation concerned the export of Intellexa's interception software to Madagascar, which would target mobile phones via SMS, aimed at "intercepting telephone communications". The Mitsotakis government would shortly afterwards (November 2021) grant two licences to export Predator to Madagascar, according to the New York Times(Reporters United will report on this case in detail in a future story).
- In 2021, Trovicor, a company of Nexa's interest, made a bid to Greece for the upgrade of an interception system. The contract was probably never signed, as a judicial investigation by French authorities thwarted the plans of the Predator-linked companies.
- A Nexa document refers to a plan to present the company's spyware software to the Greek Ministry of Interior in the second quarter of 2017. (Available evidence suggests that the sale, for whatever reason, did not go ahead.)
- A former employee of Cytrox, the North Macedonia-based company that developed the Predator, tells Predator Files that there was an agent training center in Athens to train agents in the use of the Predator.
Predator exporter: Plans for software development in Greece
The central character of our story is the French businessman Salies. We will start from the end.
On 15 June 2021, French police officers raid the Nexa offices in Paris. They search the premises. They arrest executives. Among them Salies. The company's number two, Olivier Bombot. Number three, Renault Rock.
On the weekend of 15-17 June, Salies testifies on suspicion of "complicity in torture". Authorities are investigating whether the export of interception equipment to Libya and Egypt led to the torture of dissidents.
In his testimony, Salies refers to the development of a new IPDR (Internet Protocol Detail Record) monitoring system that intercepts internet browsing data.
"What is this new product called?", the authorities ask.
"We haven't come up with a name yet. We are thinking of doing research and development [for it] in Greece. That's why it is wrong to say that we are trying to avoid European regulations," he says, to argue that he is not avoiding the application of EU legislation.
The investigations spoiled Salies' plans. However, his testimony is significant. It is an admission that Nexa was considering doing R&D for specific spyware in Greece. Nexa, which at the same time was an irreplaceable partner of Tal Dillian, the largest shareholder of Intellexa, which was also based in Athens, with its second largest shareholder here being Felix Biggio, who was in the same corporate transactional web as Mr. Grigoris Dimitriadis, who was politically in charge of the NIS, which had the same surveillance objectives as Predator, which Intellexa traded under export licenses from the Mitsotakis government.
Cerebro interception system: sale in Cairo, proposal in Athens
In 2012 Salies founds Nexa. It acquires Amesys, the company that produced the Eagle software, which is renamed Cerebro. At the same time, AMES is founded in Dubai. The latter, which is owned by Salies, acquires from Nexa the right to sell Cerebro, which allows it to circumvent European legislation on export licences.
In 2014 Nexa sells Cerebro to Egypt. In a company document seized by the French authorities, we found a plan to present the interception system to the Greek Ministry of Interior in the second quarter of 2017, during the Tsipras government. The equipment was most likely not purchased, as no contract with Greece is mentioned in Nexa's orders and invoices for the period 2014-2018, which are available to the investigation.
Nexa's interest in Greece will return in 2021, under the Mitsotakis government, as we will see below.
Nexa in the arms of Intellexa
Things are going wrong for Salies in 2017.
The French magazine Télérama reveals the contract for the sale of interception equipment in Egypt. The judiciary opens an investigation for "complicity in torture". Salies resigns from all French companies, retaining only the position of director at AMES. In his 2021 deposition he said he moved to Dubai in 2018 "because of problems with the media". But he is not deprived of the good life there: A salary of €25,000. 25 million euros. Investments of more than six million euros in Paris and Dubai real estate.
Gradually, however, another problem appears: Due to the growth of encryption on the internet, Cerebro is "blinded", capturing only a small part of the internet traffic. It no longer sees what the people being watched see.
"The original idea was that the Predator training centre would be in Skopje, where I would teach customers and developers how to use the software. However, the idea of North Macedonia was abandoned and the center was moved to Greece. "Former Cytrox employee at Predator Files
Nexa develops the Jasmine monitoring system. It detects who a target is talking to even in encrypted applications (WhatsApp, Signal). Jasmine, however, does not see message content. Only the interlocutors. Not enough to save Nexa.
That's when Tal Dillian shows up. Former Israeli intelligence agent and the powerful man behind Predator.
A leaked document shows that Nexa starts working with Dillian in 2018. It involves the creation of an interceptor van. The van, with WiFi technology from WiSpear (Dillian's interests) and Nexa's surveillance equipment, attacks targets within a 500-meter radius with Cytrox (a company owned by the Intellexa group) eavesdropping software, without the victim having to press a link to be trapped. The coveted zero-click is in the hands of the Nexa-Dillian alliance.
"The zero-click, that's what, I think, gives value to the sale today," Rock would say in a conversation recorded by French authorities.
In February 2019, the so-called Intellexa Alliance, an alliance between Nexa and Dillian's interest companies, is announced.
Earlier in 2018, two Nexa developers resigned, fearing that Cerebro would be used against homosexuals in Egypt, a country with 40,000 arrests and 1,400 murders of protesters since 2014.
However, Nexa will not back down in its next partnership with the Egyptians under the dictator Al Sisi. On September 19, 2020, French and Israelis start a group WhatsApp chat to prepare for a demonstration of the Predator in Cairo.
There Salies warns of its importance: "Our client has deep knowledge and is very demanding. He insists that the demonstration must be done this week. Otherwise, we may lose the contract. The first payment requires a successful demonstration."
The French fear that the Egyptians will buy phones with new operating systems, which may make Predator trapping more difficult. "We have to do the demonstration with mobiles they will give us. If we make preparations, the effect of impressing will be lost," commented a Nexa developer.
In the end, everything went well. On 31 December 2020, Salies wrote to his Israeli colleagues on WhatsApp with the good news: "I just received a message from our agent that [the contract] has been signed." The message is accompanied by four emoji with bottles of champagne.
"Great!!!! Happy New Year", replies Dillian.
Salties: Intellexa equipment in Greece
While the Intellexa of Dillian and Bijou has established itself in Athens, the Nexa-Dillian alliance is developing another link with Greece, according to a document from the French authorities recorded in a conversation between Salies and Rock on 20 May 2021.
In their conversation Nexa executives discuss an urgent sale of Intellexa's interception equipment to Madagascar. Salies tells Rock that he wants the contract signed quickly so that payment can be made in May. However, he adds, "I don't have a solution" for an immediate sale to Madagascar, "because I have a piece of equipment blocked in Greece."
From Salies' words, it appears that the Intellexa equipment located in Athens cannot be given to Madagascar because it is "blocked" either because of its use in Greece or for export to another country. In any event, Nexa, which was considering doing R&D in Greece, kept Intellexa equipment in the country.
In the communication between Salies and Rock, Madagascar is referred to by the code name Loco. As the French authorities later discovered, Nexa executives had nicknames for all the export contracts for interception equipment, often with references to chocolates: Toblerone to Egypt, Ferrero for Monaco, Bueno for Congo.
Trovicor's proposal to Greece
During its campaign for the sale of interception equipment in 2021, Trovicor, a Nexa company, drafted a proposal to Greece to upgrade its interception system. Specifically, the offer, worth EUR 1.785 million, provided for the upgrade of interception equipment from CRBO-LI (Lawful Interception) to an MCng-type surveillance centre, which is a Trovicor product.
According to the company's website, "Trovicor's next-generation MCng monitoring centre is an advanced tool that captures, monitors, evaluates and classifies on a single platform vast amounts of communication, interaction and transaction data from fixed and mobile phone networks and the internet."
The contract was never signed, as at the same time the French authorities were carrying out investigations which eventually led to the arrests.
Fears and friction
Despite the gains, the conversations recorded by the French authorities show that disagreements are gradually developing between Nexa and Dillian because of the high prices charged by the Israelis for the Predator.
"In this country [Israel] everyone is the same," Salies complains in a telephone conversation.
"I know what book I'm going to give you for your birthday, something that starts with the word 'mein'," Rock replies, referring to Hitler's Mein Kampf (My Struggle).
"Every time I have to deal with Israelis at work, it ends badly [...] I have many Jewish friends with whom things go well, but bad time for Israelis at work...", Salies replies.
"The case is in the hands of the independent judiciary and we have no further comment" Prime Minister Kyriakos Mitsotakis' office to Predator Files
Salies has long been afraid of leaks to the press. On 3 June 2021, shortly before the arrests, he will tell Rock: "It [a revelation] can hurt us very, very badly [...] Even if in 90% of the cases it is used for a good cause, it only takes one or two missteps for the situation to backfire on us, and badly," Salies adds.
Finally, on 15 June 2021, they are both arrested. On charges of "engaging in torture" for selling Cerebro to Libya (2007) and Egypt (2014).
The judiciary will drop the second case, as the investigation has failed to prove that the dissidents in Egypt were tortured because of information obtained from Cerebro and not from another interception system. However, the first case is pending, along with the judicial investigation into the sale of the Predator to Egypt in 2020 and export to Madagascar in 2021.
In his testimony, Salies denied any illegality: 'It is beyond shocking that I am here to answer these kinds of accusations [...] To this day I firmly believe that [the interceptions] serve the public good, they save lives'.
A resigned Nexa developer testified as a witness: 'I have lived with a burden all these years. Conscience is a huge issue [...] After years, I realized that nothing will change in the legislation for those surveillance tools sold to non-democratic countries."
On 27 May 2022, Nexa was sold to the French group Chapsvision. It was later renamed RB42, announcing that it was leaving the eavesdropping sector to specialise in cybersecurity.
Intellexa Training Center in Athens
A former employee of Cytrox, the North Macedonia-based company that developed Predator, told Predator Files:
"In Greece there was the headquarters [of Intellexa], but also a big training centre for Predator. After Intellexa set up in Greece, I travelled to Athens when the facility was being set up. The original idea was that the training center would be in Skopje, where customers and developers would be trained how to use the user interface and the software in general. However, the idea of North Macedonia was abandoned and the center was moved to Greece. There they put a Greek Cypriot in charge. He was in charge of the project. He was the main person behind the infected messages sent to the targets [Predator surveillance], and also behind the creation of the infected links. He was training users how to do infections [via Predator] and how to use it after [a target's] phone was infected, how to get his messages, that kind of stuff. This particular person had a company in Cyprus and had helped Dillian set up some things there."
The source adds: "I went to Athens once. At that time, the necessary equipment for the educational classes was being installed there: computers, mobile phones and other such things. Rotter [ed: Farkas, one of the founders of Cytrox] was often there. Most of the executives working in Skopje either moved to Greece or spent a long time in Athens. Few of us stayed in Skopje'.
Nexa and Maximou responses
We asked Maximos about the issues raised in the investigation. "The case is in the independent judiciary and we have no further comment," the Prime Minister's Office replied.
We sent questions to the two senior Nexa executives, Stéphane Salies and Olivier Bombot. Regarding their involvement with Greece, they limited themselves to answering that "either there was a commercial relationship, in full compliance with all applicable regulations, or there was no contract or delivery of equipment".
We attempted to contact Intellexa through its registered details, as well as Cytrox founder Rotem Farkas. We did not receive any replies.
Source: reportersunited
