“Many countries are using these technologies to put people in jail,” Israeli lawyer Eitay Mack told Committee to Protect Journalists (CPJ) in a recent video interview. Mack was describing how advanced surveillance capabilities such as those that CPJ has documented are being used to target journalists like Omar Radi and Maati Monjib, who were both jailed in Morocco in 2020.
Israeli companies like NSO Group and Cellebrite market equipment to government and law enforcement agencies to fight crime, yet as CPJ has noted, journalists are vulnerable to the same sophisticated tools if they fall into the hands of repressive governments.
NSO’s Pegasus spyware can remotely control a cell phone and its contents, while police say they use Cellebrite’s forensics products to extract the contents of devices seized during interrogation, potentially exposing journalists’ colleagues, family members and sources to monitoring or reprisals.
When Mack learns that such technology is being used to commit abuses – against journalists or others – he tries to stop its export by petitioning the Israeli Ministry of Defence. The ministry is essentially in control of the industry, he said, through its marketing and licence export regime; Mack petitions the ministry to withdraw the relevant licence.
His work has had an impact, according to the Israeli daily Haaretz: following Mack’s petitions, Cellebrite said that it would stop sales to Russia and Belarus in March 2021 and in September 2020, said it would not supply the government of Venezuelan President Nicolás Maduro despite previous sales to defence and police clients in the country.
An Israeli High Court ruling on Mack’s petition to halt the trade of arms to Myanmar in September 2017 was subject to a gag order and hasn’t been disclosed, according to Haaretz.
CPJ spoke with Mack about his efforts to stop exports of the equipment and bring transparency to an otherwise secretive industry. His answers below have been edited for length and clarity.
CPJ sought response to Mack’s remarks from the Defence Ministry, NSO, Cellebrite, and other entities named in the interview. Their replies are detailed below.
CPJ: How often do you come across journalists affected by surveillance technologies?
Mack: There’s a lot of public interest if it can be proved [that the equipment was used] against a journalist or an activist. But journalists [often] rely on people on the ground with a Twitter or Facebook account and these kinds of technologies are enabling mass surveillance. If you’re talking about NSO, their system targets [a specific] person each time. According to the company, the list of targets is a few hundred. If you’re talking about Cellebrite, Alexander Bastrykin, the head of Russia’s Investigative Committee said in 2020 that in the previous year the system was used more than 26,000 times in Russia. You connect 26,000 phones, take the information – you control the population.
CPJ: When you figure out where the technology is going, how do you try and stop it?
Mack: I file a petition to an Israeli court. My goal is to cancel the export license given by the Ministry of Defence. The international media say a lot about the companies themselves, which is very comfortable for the Ministry of Defence. But companies are like subcontractors. The agreements are made between governments and the Ministry of Defence decides which company [gets] the deal.
Even if an Israeli surveillance company wants to cancel services because it got information that the system was being used against journalists or to violate human rights, it wouldn’t be able to, because it would cause a crisis [with a] foreign government.
The Ministry of Defence has an information security unit called MALMAB that terrorises the companies to warn them against leaking and there are very few people [internally] with security clearance to access the client list. If NSO or another company says, “We are like a normal international company, we have an ethics board with the greatest minds in human rights that can check our work,” [that board doesn’t] have information about what the company is doing.
CPJ: How many companies in Israel export surveillance technology?
Mack: There’s no way to know because we only know about the companies you see in the headlines. There is digital forensics like the company Cellebrite; UAVs [unmanned aerial vehicles]; then the classic surveillance stories like the NSO Group’s Pegasus or PicSix in Bangladesh or the unknown Israeli company in Vietnam.
In 2013, I petitioned the Ministry of Defence to disclose the companies in the defence export register. They [only] gave a few numbers in 2014: there were about 80,000 export licences and 320,000 marketing licences. In Israel, there’s a unique marketing licence [that companies need to negotiate with] potential clients, then a separate export licence… [Through the] marketing licence, you are exposing your potential client [to the ministry], which can choose to give this client to another company.
I can identify rifles in pictures on social media, and depending on the model, I can estimate when it was exported, but surveillance systems aren’t physical. With NSO, we don’t know names of their clients, it’s hard to prove. Even with Cellebrite, [which] physically connects to the mobile phone, I only got to know that it [was being used] in Russia and Venezuela and Belarus because [local] authorities announced it.
CPJ: How is the industry regulated in Israel?
Mack: They keep changing the bureaucracy to make people like me waste time. In the case of Cellebrite, the Ministry of Economy should approve [civilian clients]. But they told me [its sales to Hong Kong] came under the Ministry of Defence, according to the [Defence Export Control Law] of 2007 governing defence equipment. That law is very problematic because the only limit is in case of a UN Security Council arms embargo, which is very rare. It’s why we are seeing Israeli defence exports around the world.
[In February 2021] the Ministry of Defence told me they had transferred approval from the unit for defence exports to the director of the Ministry of Defence because digital forensics [systems like Cellebrite’s] fell under a 1974 order for encrypted items. That order is much worse than the 2007 law, because it allows the director to award licences as he sees fit.
If two laws apply, why choose the older one? In my opinion, they wanted to widen the discretion [to approve] a company like Cellebrite for political and economic [reasons].
This is what I’m trying to change, to introduce a consideration of human rights and democracy. I don’t think Israeli authorities will do it on their own, and they are used to foreign criticism in international forums. It will only happen with pressure from the Israeli public.
CPJ: Why are cases you’re involved in often subject to a gag order?
Mack: In all petitions on defence exports, the Ministry of Defence asks [the court] for a gag order so that only people who are part of the proceedings are able to know the ruling. [Their] representative is not even ashamed to argue that they want the gag order because they don’t have control of the media.
It’s annoying, in 2021, that they need to keep asking. But [a gag order] has no meaning, it’s like a child putting a blanket over its head and saying it’s night. Under defamation law in Israel, you can publish information that is part of the legal process, so journalists [can report on the petitions even if they can’t report on the verdict]. And I’m allowed to say whatever I want, just not what happened inside the court.
CPJ: What should be happening internationally to improve regulation of this industry?
The global framework is already there. We should think about surveillance [the same way we] think about rifles and classic defence exports. Every time we’re talking about sanctions or an arms embargo, we should be talking about surveillance systems.
There should be more demands about the technology and how it is being used, a lot of details are still unknown. Because of NSO Group’s contradictory responses to the media, we don’t know if they are technically able to dismantle [spyware] if they have knowledge of abuse.
With Cellebrite, the problem in a legal scenario – as far as I can tell – is that the system sucks up everything, you can’t [request one] WhatsApp message. Then are [law enforcement] violating a search order, and what do [they] do with all the information?
It seems that companies – and this is also problem with the Israeli government – don’t see anything as a human rights crisis but when they have a huge PR crisis, they are ready to be more transparent.
- A Tell report/ Courtesy: Committee to Protect Journalists / Madeline Earp – Consultant Technology Editor