Human rights campaigners have called for an investigation into the British surveillance technology company Gamma International, which they accuse of exporting controlled surveillance products without licences to regimes with dismal human rights records.
Gamma International says that its surveillance technology offers "world-class offensive techniques for information gathering" and can intercept texts, phone and Skype calls, log keystrokes and copy files.
The campaign group Privacy International alleges the equipment has been used to gather information on activists who are targeted by the repressive regimes. It wants greater restrictions on the export of surveillance products, which are increasingly being used but are increasingly used but have not had the same level of export restrictions as traditional weapons. The group has sent a 186-page report to Revenue and Customs (HMRC) alleging that the unlicensed export of some Gamma International products "would amount to criminal conduct".
"For years, British companies like Gamma International have had carte blanche to sell incredibly powerful surveillance technologies to any government that can afford them, even when they are subsequently used to target human rights defenders. Gamma International is one of the worst culprits; it does business with regimes that most companies would not touch with a bargepole," said Eric King, head of research at Privacy International.
The organisation argues that Gamma – which insists it does comply with export controls – has been exporting its products without licences in place and has called on HMRC to investigate.
In August, the Department for Business, Innovation and Skills informed Gamma International that its FinSpy products, designed to use "controlled cryptography" (software that uses high-grade encryption to protect information) required "a licence to export to all destinations outside the EU".
The department also confirmed Gamma International had submitted a control list classification (CLC) inquiry – asking if a product required a licence – for the first time in June 2012 and as of 11 September had not applied for any licences.
A department spokeswoman said products designed to use "controlled cryptography", such as FinSpy products from the FinFisher range, were controlled by EU legislation and would have required an export licence since at least 2000.
Privacy International says the rules in place were insufficient and wants controls on surveillance technology overhauled. "The fact that some controls have been in place for over a decade but appear not to have been enforced suggests the government policy on this kind of technology is patchy at best. We need to ensure all surveillance technology is properly controlled: these are digital arms and need to be treated with the same vigour as traditional weaponry," said King.
The organisation argues that Gamma had a responsibility before it was explicitly informed by the business department to check if it needed an export licence and have the necessary licences in place.
Gamma has repeatedly stated that it only supplies products and services to legitimate government organisations. In an email, a company executive, Martin Muench, said Gamma would not provide details of any applications for export licences for confidentiality and security reasons, but added that the company co-operated with the export control organisations of the UK, US and Germany.
He said there was no statutory or regulatory requirement for companies to seek a CLC but that the company had made such an application in June 2012 "after discussions with a government agency which suggested that it would be advisable … for certain products". The company was working on a code of conduct for "the industry as a whole", he said, adding that Privacy International turned down an invitation to discuss it.
Gamma was criticised after Egyptian human rights activists found documents from the company in the headquarters of Egypt's state security before the February 2011 uprising. The company later said that it had demonstrated software to the Egyptian government but "did not supply any FinFisher products to Egypt that could have been used during the movement of the opposition".
In December 2011, WikiLeaks published Gamma promotional videos showing how police could plant FinFisher on a target's computer. In September last year, the foreign secretary, William Hague, who speaks for the government on computer security issues, said exports of goods "that could be used for internal repression is something we would want to stop" but admitted the law governing software exports was a grey area.
Privacy International's document to the HMRC also alleges that Bahraini pro-democracy activists received emails containing malware that, when analysed by researchers at the Toronto-based Citizen Lab, contained "strong evidence that the malware in question was "FinSpy … distributed by Gamma International". Gamma said: "We have no knowledge of any operation involving those named in the article."
It was reported in mid-August that FinFisher products were being used by countries including Ethiopia and Turkmenistan.
The leader of the Green party, Caroline Lucas, said she had written to the government expressing her concerns. "It sends a very damaging signal when British companies are selling products that undermine democratic processes the government says it supports," she said. "I hope this process is successful and if necessary prosecutions are made in order to send a strong signal that it should be illegal to export this kind of surveillance technology to these regimes and it must be stopped."
An HMRC spokesman said: "HMRC cannot comment on individual cases. However, where we receive information of possible export licence issues we consider the facts and take appropriate action."
Case Study: Ala'a Shehabi
Ala'a Shehabi, 30, is a British-born economics lecturer, activist and writer in Bahrain. She has a PhD from Imperial College London. Her husband was a political prisoner in Bahrain but has recently been released.
She was born and raised in the UK but moved back to Bahrain, her parents' home, with her husband in 2009. With a family history in political activism – her father sought exile in the UK after speaking out against the government in the 70s – she soon because involved in the political uprising that started in February 2011. She founded Bahrain Watch, which calls for more transparent governance in the kingdom.
"There was a very charged atmosphere in Bahrain," she said. "My husband was arrested and held for 10 months and I was banned from travelling and forced to stop work."
With police filling the streets and martial law imposed dissent moved online and underground, she said. "Everyone was aware that what they wrote would be monitored so suddenly you saw all the faces disappear from Facebook, people deleting their Twitter accounts," she said. "I essentially worked on the assumption that everything I did or said was being watched."
It was soon after the crackdown that she received the first of four suspicious emails, addressed to her personally from feasible email accounts. She sent the emails to Bill Marczak, a computer science doctoral candidate at the University of California Berkeley, who went to school in Bahrain and is also a founding member of Bahrain Watch.
As Bloomberg reported in July, Marczak established the link to Bahrain by tracing the trojan's transmissions back to an internet address in Manama, Bahrain's capital. Other evidence came from the work of Morgan Marquis-Boire, a security researcher at Citizen Lab, at the University of Toronto, who analysed the infected e-mails and published a detailed report of the findings through Citizen Lab. He exacted "digital DNA", or a signature from the infected emails that bore the hallmarks of FinFisher.
Luma Bashmi, a spokeswoman for the government's information affairs authority, told Bloomberg that Bahrain had no policy of targeting political activists through surveillance technology. "Such allegations are taken very seriously and if there is any evidence that there is any misconduct in use of such technology, each case will be investigated immediately according to the laws and regulations of the Kingdom of Bahrain," she said.
Gamma Group, which makes FinFisher, said it had no knowledge of any operation involving those named in the Bloomberg article and could not comment on individual cases or clients.
Shehabi said she welcomed the step to impose some controls on the export of surveillance software, but that stricter controls were needed. "I expect this type of treatment from the Bahrain government, which is reduced to lawlessness and doesn't believe in human rights, but if they have been serviced by a British company that really angers me," she said. "There shouldn't have to be another victim like me to come along before these exports stop."
