Egypt's purchase of hacking software documented in new leaks

‘Youth activists, political parties, human rights organisations - you and anyone they want' can be targeted by surveillance software says security researcher

A vast database of files and emails belonging to a controversial Italian digital surveillance company was leaked online on Sunday night, appearing to evidence Egypt's purchasing of spy-software.
The country's buying up of the spy-software has previously only been indicated at.
An unknown individual or group of hackers broke through the digital security of Hacking Team, and published 400 GB of client files, internal emails, contracts and financial documents. Coupled with the hacking of the company's social media outlets, the digital security community are judging that files are authentic.
The Italian company has, in recent years, attracted the criticism of rights groups and investigations by the United Nations for the sale of surveillance tools to oppressive regimes across the world.
Leaked invoices seen by Daily News Egypt, show that a local company called GNSE Group acted as a third-party, purchasing digital services from Hacking Team for Egypt's Ministry of Defence. In one invoice, dated to 26 January 2012, GNSE is shown as having purchased a "Remote Control System – Exploit Portal" costing €58,000. Another invoice shows that a contract was signed on 14 April 2015 for the Remote Control System and other service packages.
A spreadsheet of all of Hacking Team's clients and financial details leaked later suggests that Egypt has bought €737,500 worth of products to date from the company. Under the ‘opportunities' section it lists potential new deals with Egypt valued at €1,850,000.
This information matches a spreadsheet purporting to show all of Hacking Team's clients that lists a contract with GNSE for Egypt's Ministry of Defence as "Active".
The ‘Remote Control System' programme purchased by GNSE is described by the company as providing non-skilled users the ability to activate cameras, extract emails, record Skype conversations, log keyboard typing, and collect passwords on targeted devices, amongst other features. The company also says it can monitor "hundreds of thousands of targets" and is capable of being deployed to mobile devices like Apple, Android, and Blackberry.
Hacking Team however has been criticised for selling its products to companies and countries, such as Egypt, that have practiced severe and widespread violations against the rights of its citizens. An investigation by research unit CitizenLab previously claimed to have documented the sale of its software to 21 clients, nine of whom were called "authoritarian" in The Economist's 2012 Democracy Index, some of whom practiced torture, beatings, rape, and lethal violence on protesters.
The CitizenLab investigation claimed that since 2011, Egypt has used at least three commercial surveillance packages, including Hacking Team's products.
Ramy Raoof, a digital security consultant and researcher, told Daily News Egypt: "The government and security sector have been developing their tools and abilities over the past few years to practice mass-surveillance and targeted-surveillance."
Raoof said authorities have been purchasing tools like Hacking Team's RCS "for each kind and level of interception and monitoring of public and private lives".
Campaigning group Reporters Without Borders have listed the company on its Enemies of the Internet index, on account of its seemingly unscrupulous business practices.
"The tool provided by Hacking Team is suitable for targeted-surveillance and they can use [it] on any one they have [a] level of ‘curiosity' [of]: youth activists, political parties, human rights organisations, media groups and newspapers – you and anyone they want," Raoof said.
A representative from the GNSE told Daily News Egypt that they had "read all the news and are investigating the problem, we are still looking in to the incident's dimensions." However, he continued that he does not think that it is sensitive information. "We are a big company with many projects. It's not a security issue for our organisations. These are tools for protecting information." Though he did not give exact details over the nature of the contracts with Hacking Team.
Hacking Team's contracts have never been publicly announced and they have repeatedly denied selling to sour regimes, but it was believed their clients included governments such as Ethiopia, Morocco, Sudan, and the UAE, and a $2.4m deal with the US Drug Enforcement Agency.
Hacking Team have maintained they have an internal procedure to handle human rights concerns of potential clients. Sunday's leaks, however, show that the company has seemingly dealt with the world's worst human rights abuses that could put the technology to oppressive use.
Sunday's leaks also confirm the sale of their surveillance tools to Russia, Sudan, the FBI, Chile, Australia, Spain, and Iraq, and potentially British police forces, among others.
Digital security activist Christoper Soghoian reported that documents in the horde suggest that the company was "stonewalling" a one-year investigation by the UN on the sale of their products to Sudan. This included their denying the deal and suggesting that their products do not qualify as weapons and so are not prohibited for sale.
GNSE offers numerous forms of digital services, including e-security. GNSE's chairman is one of Egypt's most prominent billionaires Youssef Mansour, and the company is owned by his family's Mansour Group, which calls itself Egypt's largest privately owned conglomerate. The Mansour family are known to have close links to the Egyptian government and also to the previous regime of Hosni Mubarak.
Legally, the Egyptian government has been preparing the ground to allow for greater surveillance. Prime Minister Ibrahim Mehleb established the High Council for Cyber Security in December 2014, and in February issued a decree to form a committee tasked with considering legislative amendments to national security laws, aiming to give courts the jurisdiction to remove any online content related to terrorism. According to Raoof, in March 2015 the cabinet approved a draft bill on cybercrime "developed behind closed doors [with] nothing officially published, just a few media leaks… and it is very ugly."
Asked whether Sunday's leaks bringing in to public light the purchases of surveillance software by the Egyptian Ministry of Defence could affect their practices, Raoof felt it was unlikely . "No it won't affect it in my opinion," he said.
Speaking on the scaling up of surveillance in Egypt, Hassiba Hadj Sahraoui, then-Middle East and North Africa Deputy Director for Amnesty International, said last year: "Egypt's security forces have a track record of abuse and enjoyed virtual total impunity. Putting such equipment in the hands of unaccountable security forces is a recipe for abuse."