Newly released e-mails from Hacking Team, the now-embattled Italian spyware firm that sold what it claims is lawful intercept software to companies and governments, definitively show that it sold its Remote Control System surveillance software to the Federal Security Service of the Russian Federation (FSB), the successor agency to the KGB.
Officially, Hacking Team sold its wares to a company called "Advanced Monitoring," whose corporate parent has a license to work with the FSB, as recently as August 28, 2014. That would put the Italian firm in violation of the July 31, 2014 European Union regulation that forbids selling such technology, whether directly or indirectly, to the Russian military.
It also seems odd that Hacking Team would sell on one side of the Atlantic to Western agencies like the US Army while also selling to the FSB. In its most recent human rights report, the United States Department of State refers to Russia as a "highly centralized, increasingly authoritarian political system."
The report also notes, "There were allegations government officials and others engaged in electronic surveillance without appropriate authorization and entered residences and other premises without warrants."
Hacking Team still refuses to say exactly when or why its relationship with its Russian customers stopped.
"As we have said repeatedly over the last week or more, Russia is not a client any longer," Eric Rabe, a company spokesman, told Ars on Thursday. "They were separated at the decision of Hacking Team. I am not discussing the details of this (or other) client arrangements we may have had."
When Ars specifically asked when its relationship with the FSB terminated, Rabe evaded the question. "Hacking Team has no clients in Russia," he said.
Russian nesting dolls
Back in April 2011, Hacking Team’s Marco Bettini, a sales manager, wrote to Adam Weinberg, the chief technology officer at Nice Systems in Israel, saying:
Please let me be very open to you with regard to FBS [sic]. We got in touch with FSB in September 2010 through a Russian Governmental R&D Institution which is acting as a local partner. They visited us last week and they confirmed their interest in our solution. We have provided them with a demo version of our product and they are presently testing it. They are looking forward to setting up a large pilot project in order to test our product in real-life investigation scenarios with multiple targets.
It should be said that we have never worked with this Russian local partner before; on the other side, we consider you are a most trusted and reliable partner and we definitely want to improve our business relationship.
It should also be said that FSB is an extremely large organization with many different departments which seldom talk to each other.
That exchange concluded in December 2012 with Massimiliano Luppi, a key account manager, writing to a sales director at Nice Systems, saying, "Yes we did [sell to the FSB]."
The middleman, the "Russian R&D" institution, is likely Kvant (Google Translate), which describes itself as a government research institution.
Hacking Team sold to Advanced Monitoring, which calls itself a "Russian company that provides services in the field of information security." Advanced Monitoring is a subsidiary of another Russian company called Infotecs.
The LinkedIn page of Alexey Kachalin, the chief operating officer (COO) of Advanced Monitoring, shows that he is also the project manager at Infotecs.
This seems to suggest that Hacking Team sold to Advanced Monitoring, which then sold to Kvant, which in turn presumably provided the software to the FSB.
Irina Yuldasheva, an Infotecs spokeswoman, did not respond to Ars' direct questions about the nature of its relationship with Advanced Monitoring or the FSB but did send this statement:
The Infotecs company confirms entering into a contract with the Italian company Hacking Team for purchase of [Remote Control System]. Infotecs, as a developer of information security tools including those intended for iOS and Android mobile platforms, is seriously concerned about negative consequences of using systems similar to RCS against the interests of their customers, among which there are many Russian state organizations and structures. Acquisition of RCS and examining functioning principles of this solution helped to improve the Infotecs' level of expertise in the field of practical information security and increase security level of its own ViPNet products.
The acquired RCS system was not operated by Infotecs for its intended purpose and was not serviced in [sic] Hacking Team, as demonstrated by the data disclosed from the archives of Hacking Team.
When Ars followed up to ask if Hacking Team never delivered on this deal, Yeldasheva said, "Yes." However, this claim seems odd given that dealings with Infotecs go back three years.
Reached by phone, Kachalin was circumspect. "Infotecs possess the most up-to-date information," he said. "What information you got from them, it's the most you can get. If you are trying to find something that oppresses freedom of speech, it is not the case. We are working in the field of analysis. Anything that we do is about technology only."
He declined to answer specific questions about the arrangement with Hacking Team, but he did say Infotecs was a licensee to the FSB and that this license was posted on its site. (Ars found this license on a cached version of Infotecs' site, which expired on May 31, 2015. A current version of the site has a dead link.)
"We will be violating NDA, and NDA is an international matter," Kachalin said. "Please be polite enough to us to not violate NDA. I'm not sure what obligations are still under NDA of our companies. So it's covered by this NDA and I have no idea why should I play with this matter trying to dodge one NDA or another NDA, I am still an employee of my employer. I'm not sure about expiration dates on them. It could be used against us, not by FSB, but in [the] market. This matter is regulated by law. All our contracts are legal, all our relations are legal, cleared by both sides, both governments, so I'm not sure what's wrong with that."
Kachalin said that the leaked e-mails have had no impact on his company's business, and yet at the same time he seemed very concerned that this could damage Infotecs' and Advanced Monitoring's reputation.
"If you show good intentions but not pushing employees of the companies to problems, it would be nice from you," he said. "It could make some impact on our business and our operations and I'm not sure it would be ethical from your side to push it. Being ethical by digging into stolen data is hypocrisy, in my view. If you want to be fighting for ethics and freedom I think it's correct to be ethical and pay respect to other people's freedom as well."
When Ars presented this to Keir Giles, a longtime UK-based Kremlin watcher and fellow at Chatham House, he said that such sales to the FSB are "significant and unsurprising."
"Analyses of Russian offensive and espionage cyber capability habitually refer to the FSB's willingness to outsource, whether to criminal structures within Russia or to the commercial sector," he wrote by e-mail."But given the natural secrecy surrounding these processes, actual evidence of how this works—and with whom—has always been very rare. In fact, even the linking of the 2007 cyber offensive against Estonia to Russian state direction relied on stolen and leaked e-mail correspondence, rather than anything arrived at through open sources. So the emergence of this sales channel for the FSB augmenting its capability is not exactly news, but is an important step forward in validating our understanding of the Russian state cyber landscape. Which, in effect, means the FSB."
When Giles looked at Kachalin’s LinkedIn profile, and particularly his decade-long affiliation with the Mathematics and Cybernetics Laboratory at Moscow State University, he concluded that Kachalin must have strong ties with the FSB.
"[My conclusion is] that if [Kachalin’s] not ex- or serving FSB himself, he will move in the same circles and be in the right place to be in business with them," the Kremlinologist added.
So much for EU regulations…
As Member of European Parliament (MEP) Marietje Schaake pointed out earlier this month, as a European company, Hacking Team’s sale is seemingly in direct violation of EU Council Regulation 833/2014, a measure passed in the wake of the Russian invasion of Ukraine.
That regulation specifically prohibits:
[providing], directly or indirectly, technical assistance or brokering services related to dual-use goods and technology, or related to the provision, manufacture, maintenance and use of such goods or technology, to any natural or legal person, entity or body in Russia or for use in Russia, if the items are or may be intended, in their entirety or in part, for military use or for a military end-user
Under Russian law, the FSB is considered a branch of the military.
"The Hacking Team revelations confirm the damaging impact of the rapid development of a vast market in surveillance, intrusion and information extraction systems," Schaake told Ars. "It clearly requires better measures to ensure transparency, accountability, and effective regulations."
It seems clear that Hacking Team's dealings go beyond business and delve into the personal as well.
In December 2014, CEO David Vincenzetti wrote to Enrico Frizzi, a colleague at Bulgari, the Italian jewlery company.
Vincenzetti was responding to something Frizzi forwarded on from Goldman Sachs, entitled "Top of Mind: 2014 update, and a peek at 2015," which included references to Russia.
The CEO replied to Frizzi, in Italian:
Conditions are perfect [for going to Russia]. Now you can harness the power of Russia in full. I'll tell you one thing. Years ago, I was in Moscow for 28 straight days for a job. The ruble was at 40 against the dollar, people were suffering. I turned away beautiful prostitutes that every night approached me at the hotel, and I was staying at the Metropol, next to Red Square. When a pimp's car stopped at traffic lights and a few girls, very young and beautiful, entered in the car until it [the car] wasn't quite full: three or four [girls] in general, and they cost $10 each. Now these things should be valid at the power 4 [x^4]. It's time to go to Moscow cousin, first stop: Nightfly night club & restaurant. [You should] go there for dinner. :->
reader comments
38