UK spyware used against Bahraini activists – court witness

UK spy technology was used against British citizen in Bahrain, new evidence filed in a UK high court has claimed. Activists are calling for a judicial review of the UK’s failure to hold firms accountable for sales of spy software to repressive regimes.

The evidence submitted contains a witness statement from Bahraini activist and writer Ala'a Shehabi, 30. She has both Bahraini and British citizenship, and is one of the founding members of Bahrain Watch, an independent research and advocacy organization set up following a security crackdown in the country in February 2011.

Shebabi became one of the targets of the FinSpy malware emails, developed by UK firm Gamma International, the Guardian reported.

The activist claimed she received four phishing emails from what appeared to be authentic email accounts after being released after detention.

“Gamma International sells this software to foreign governments. So, we assumed and, given the circumstances in which we received the e-mails and the nature of the e-mails, this lets us to suspect this was sold to the Bahraini government. We also know that the service that receives this information from the software is actually based in Bahrain. So, the service is currently in Bahrain and it’s being updated in Bahrain, which means that this is further evidence that this is a state-controlled operation,” Shehabi told RT.

The FinSpy software reportedly allows for surveillance of emails, social media messaging and Skype calls, and can retrieve files saved on an infected computer's hard drive. It also can remotely operate microphones and cameras on computers and mobile phones.

“I have real concerns about the Bahraini regime having effective unfettered access to my computer, reading my emails and monitoring my calls. Not only is this a gross invasion of my privacy, I am concerned that it could put in danger from the Bahraini authorities myself, my family members and other activists,” she said.

In her witness statement, she claims that the first infected email was supposedly from Kahil Marzou, the deputy head of Bahrain's main opposition party. Other emails purported to have come from an Al Jazeera journalist.

“It upset me a lot, scared me and made me feel quite paranoid. I am very concerned that it appears that a product of a British company," she stressed.

The campaign group Privacy International (PI) in November reported that Gamma International is selling surveillance technology without a proper license. The technology sold is being used by 25 countries to spy on activists, who are later targeted by repressive regimes – a situation that "amounts to criminal conduct" on the part of the tech firms, the activist group said in an 186-page report it sent to Her Majesty's Revenue and Customs (HMRC).

In the spring and summer of 2012, Bahraini activists, including Shehabi, received emails containing malware. After the University of Toronto’s CitizenLab investigated the case, it found evidence connecting the malware to FinSpy.

“All this has been happening since the hiring of John Yates. And most of these companies that provide all of these technologies are British,” the activist added.

John Yates is a former assistant commissioner of the Metropolitan Police, who was hired by Bahrain to advise on police reform.

With this new witness statement, privacy rights groups are seeking to force the UK government to review exports of surveillance technology. The activists are pushing for a judicial review of the government’s apparent failure to investigate whether the sale of technology to repressive regimes is a breach of export-license controls.

In April, Privacy International filed an application for judicial review of HMRC over its role in allowing the export of advanced surveillance technology used by repressive regimes worldwide – including Bahrain – to spy on dissidents.

Privacy International’s lawsuit is over the government’s refusal to disclose whether it investigated UK-based Gamma International (GI). GI’s FinSpy software has allegedly been used by some two dozen countries worldwide.

“In the wrong hands, today’s surveillance technologies can have devastating effects, and the public, especially victims targeted by this surveillance, have a right to know what the UK government is doing about it,” said Eric King, head of research at Privacy International.

Gamma International, an Anglo-German company registered in the British Virgin Islands, denied reports it had sold to oppressive regimes, and maintained that it complies with export controls.

The UK’s Department for Business, Innovation and Skills advised Gamma International that FinSpy products have been controlled by EU legislation since 2000 and “require a license” in order to be sold outside the EU. This would require the tech firm to disclose the names of export customers.

“The use of the software seems to have no ends or any type of restrictions, so this is turning into a global phenomenon and it’s being run by the private sector. So, we are looking increasingly at the commercialization of digital surveillance, which is even scarier, because it’s very difficult to regulate,” Shehabi told RT.

Bahrain’s human rights violations

Bahrain’s human rights situation is “critical in the wake of the brutal crackdown on pro-democracy protesters that erupted in February 2011,” Human Rights Watch reported in December.

Police regularly use violence to disperse crowds of protesters, while Bahrainis, led by the country's Shia Muslim majority, are continuing to protest, demanding greater rights and freedoms from the ruling Sunni minority.

More than 80 people have died in unrest since the pro-democracy protests begun in the February 2011 uprising, with thousands arrested and imprisoned and severe violence reportedly employed during the course of the arrests. Physical and psychological torture of prisoners to sign false confessions has also been reported.

New laws were passed in Bahrain in April making it illegal to insult the country’s king and national symbols, charges that carry five-year jail sentences.