In 2012, Citizen Lab, a think-tank operating out of the Munk School of Global Affairs at the University of Toronto, came across evidence suggesting that Gamma International, a multinational technology corporation with offices across the world, sold a form of malware called FinFisher to Bahrain. Bahraini activists, amongst others, were seriously concerned: FinFisher gives its operator complete access to a target’s computer and mobile phone. That kind of technology in the hands of a state like Bahrain, with its record of human rights abuse, would put at risk a great many people’s lives.
So, in 2012, on the basis of Citizen’s Lab research, Bloomberg News asked Gamma whether they had sold the technology to Bahrain. Martin Muensch, who works at Gamma, and whom the company credits with having invented the technology, publicly and emphatically denied the allegations: Gamma, he said, had never sold FinFisher to Bahrain.
In August of this year, materials were anonymously published online which suggest that, at the very time Gamma was denying that it had sold FinFisher to Bahrain, not only had Gamma already made the sale to Bahrain, but it was also actively engaged in providing the Bahraini authorities with extensive technical assistance and advice about the malware. Included within the material published online are highly confidential Bahraini government records. Those records include the names of surveillance operations under which people were being targeted, the network identifying names of targets’ computers, as well as targets’ computer user names, and internal and external IP addresses. The material also includes service logs, showing Bahraini authorities seeking technical support in fixing bugs and using the technology more effectively.
FinFisher is a form of malware (malicious software) which allows a user to remotely infect computers and other devices such as mobile phones, access and monitor all data and communications, impersonate the real owner to send messages in their name, and even to remotely switch cameras and microphones on to allow for surveillance of the movements of a targeted person. All the while, the malware remains undetected. So pernicious is this technology that it is capable of self-deleting, removing all trace of itself.
A Citizen Lab map showing FinFisher's proliferation around the world. Click to enlarge. Flickr/Joshua Roberts. Some rights reserved.
The materials published online suggest that Bahrain was using FinFisher to conduct surveillance of targets not only in Bahrain, but in the UK and in other countries as well. Basically, Gamma—which has an office in the UK—in helping the regime to perfect their use of the technology, was assisting the regime to more effectively monitor individuals including pro-democracy activists, human rights lawyers and other prominent opposition leaders, at home and abroad.
With this new evidence, Privacy International, together with Bhatt Murphy Solicitors, lodged a criminal complaint on Monday 13 October 2014 with the National Cyber Crime Unit (NCCU) of the UK National Crime Agency on behalf of three former Bahraini nationals who were forced to flee Bahrain because of political persecution and now reside in the UK. We drew the NCCU’s attention to the evidence published online, and we allege that the state of Bahrain has broken British laws prohibiting unauthorized computer surveillance, and that Gamma was additionally and separately liable for having aided and abetted Bahrain’s unlawful surveillance of the three complainants, all pro-democracy activists.
Putting a face to the targets of surveillance
The three pro-democracy activists are Jaafar Al-Hesabi, Moosa Ali and Saeed Al-Shehabi. They have each shown extraordinary courage in their fight against the repressive Bahraini regime.
First arrested in Bahrain in 1995 for producing pro-democratic newsletters, Jaafar was detained and tortured for three days. Once released, he fled to Qatar where he learned that his friends and associates had been arrested, tortured and sentenced to long jail terms. He then fled to the UK where he sought asylum, and where he is now a permanent resident.
In 2010, following the widowing of his mother, and indications of some political reform in Bahrain, Jaafar returned to Bahrain to visit his mother and accompany her on the hajj pilgrimage. On their return to Bahrain from the hajj, and whilst in the company of his mother and two children, Jaafar was once again detained by the Bahraini authorities—this time for more than six months. Whilst detained, he was subject to torture and other inhumane and degrading treatment. He was beaten until he bled, electrocuted, and for the first three weeks of his detention was required to stand constantly, leading to sleep deprivation and hallucinations. They threatened to rape his family members, and he was forced to listen to other political prisoners be tortured.
During this period, the Bahraini authorities told him they been monitoring him in the UK for five years. He was one of the lucky ones, released due to mounting pressure during the Arab Spring, whereupon he returned to the UK. Since his return, Jaafar has suffered from anxiety and depression.
Moosa was first arrested and tortured at the age of 14 for protesting in favour of equal employment rights for all Bahrainis. Despite his detention, he continued to protest; he was detained a further seven times. He was tortured each time. He too was beaten until he bled, electrocuted, and told that his family members, including his sisters, would be raped. During one period of detention, when he was still only 14 years old, he was moved out of the cells for political prisoners and placed with adults in cells, which, he was told, included people charged with rape and murder, and in which drug use was rampant. After coming to the UK he continued to protest the Bahraini government in front of their embassy in London. In 2009, following one such protest, Moosa was set upon and attacked by a group of men and warned by them not to protest in front of the Bahraini embassy again.
Saeed is one of the most prominent members of the pro-democracy opposition movement exiled from Bahrain. He has been sentenced in absentia by the Bahraini authorities to numerous terms of life imprisonment for his activism. In 2009, around the same time that Moosa was attacked on the street, Saeed’s house in the UK was fire-bombed.
But for the publication of Gamma's secret documents, then, Jaafar, Moosa, and Saeed would probably have never known that they were being surveilled remotely by a regime they had once fled.
Profiting off surveillance in the UK
Upon learning that their persecutors were still monitoring them, in the very place they had sought safe haven, Jaafar, Moosa, and Saeed were devastated. While they had their suspicions previously—noticing strange messages they had supposedly sent to their contacts—the scope and extent of the surveillance was shocking and deeply distressing. Obviously they are frightened for themselves and their own families, but their greatest concern is what the Bahraini authorities, by infiltrating their networks of contacts and reading their communications, might now know about the pro-democracy movement generally, and about specific colleagues back on the front line in Bahrain. Jaafar, Moosa, and Saeed have had to cut off communications with contacts in Bahrain for their own safety, and, necessarily, that means scaling back their own activism here in the UK because of concerns that any online discussions they provoke could draw more unsuspecting activists into the Bahraini state’s gaze.
The cases of these activists vividly demonstrate just how damaging state surveillance can be. Not only does it affect those directly targeted, exposing their private lives and making a mockery of the supposed safety of exile, but, by forcing those activists to censor their own communications with their fellow activists, surveillance has a chilling effect of vastly greater proportions. The information-sharing, creativity, and solidity of those who advocate for democracy in Bahrain has been shaken by the surveillance of Jaafar, Moosa, and Saeed. Civil society in Bahrain is weaker as a result, and reform looks further off than ever.
To date, the UK government has made no comment on the actions of the Bahraini authorities, or the allegations of Gamma’s involvement. The surveillance the Bahraini authorities carried out on computers located within the UK is unlawful. Even domestic law enforcement bodies in the UK need warrants to carry out the type of monitoring that the materials published online suggest the Bahrainis have undertaken .
But Bahrain did not carry out this surveillance alone, and that is why the complaint targets the assistance provided by Gamma. The evidence demonstrates that the relationship between corporations, which provide sophisticated surveillance technologies and repressive government worldwide, is much closer than a mere financial transaction. For a surveillance technology company to be actively lending its expertise to unlawful surveillance by repressive states is deeply troubling. The historic excuse of multinational corporations who supply technology and arms to repressive regimes—that they don’t control what the states do with their products—will no longer wash. Companies like Gamma have grown rich from the sale of these surveillance technologies, and the time has come to hold them accountable for their enabling of state repression.