Italy Should Investigate Hacking Team, European Parliament Member Says

The company might have violated European sanctions regime, according to the Parliament member.

|
Jul 7 2015, 5:51pm

Image: Sebastiaan ter Burg/Flickr

The controversial Italian surveillance company Hacking Team has been in "full on emergency mode" since Monday, when it woke up to the news of its own massive hack, which exposed all its internal secrets for all to see in a 400GB online data dump.

Now, the company might have to deal with some legal troubles too.

Marietje Schaake, a Dutch member of the European Parliament who's been working on surveillance tech issues for years, has raised concerns that Hacking Team might have broken European sanctions when selling its products to Sudan and Russia.

Schaake is now calling the Italian authorities to do an "urgent, thorough investigation" into Hacking Team's sales to countries outside the European Union, she told Motherboard.

In a letter to the European Commission, Schaake asked the Commission whether it believe those sales, which were exposed by leaked emails, are a violation of European sanctions against Sudan, which prohibit the sale of weapons and other technologies to the country, and technology-focused sanctions against Russia.

Schaake is now calling the Italian authorities to do an "urgent, thorough investigation" into Hacking Team's sales.

"These revelations after Hacking Team was hacked underline once more how important it is that the EU takes action to curb the trade of systems to authorities that are known human rights violators," Schaake said in an email.

Schaake has been a long time proponent of regulating the rising spyware industry, attempting to prevent companies such as Hacking Team or the British-German Gamma Group, also known as FinFisher, from selling spy tools to repressive regimes.

Hacking Team has never disclosed a list of its customers, but in the past, researchers have been able to trace its software in more than 21 countries. Now, with the leaked data, we have the full list of Hacking Team's customers.

Leaked emails showed that the company sold its Remote Control System (RCS) spyware to Sudan, despite denying it both in public and in response to a UN inquiry.

For Matt Suiche, a French security researcher who lives in the US, European authorities are not doing enough to stop what he calls the "globalization of lawful surveillance" technologies.

"Regardless of what happens to Hacking Team, there is not much hope that Western countries will stop providing surveillance softwares to what they call "unregulated" countries, even worse," he told Motherboard in an email.

In her letter, Schaake asked:

"1. Does the Commission believe Hacking Team has violated EU sanctions regimes?

2. Has the Commission been informed of any prior authorization given by the Italian authorities that would allow Hacking Team to export its products to Sudan or Russia, and is the Commission aware of a 'global authorization' that was given by the Italian authorities to Hacking Team that authorized the company to export its products freely in all countries of the Wassenaar agreement?

3. Has Hacking Team ever asked DG FPI [the body responsible for applying sanctions] any question regarding its interpretation of the EU sanctions regime against Sudan or Russia?"

Does the Commission believe Hacking Team has violated EU sanctions regimes?

2. Has the Commission been informed of any prior authorization given by the Italian authorities that would allow Hacking Team to export its products to Sudan or Russia?

3. Is the Commission aware of a 'global authorization' that was given by the Italian authorities to Hacking Team that authorized the company to export its products freely in all countries of the Wassenaar agreement?"

The European Commission now has six weeks to respond to the questions, and Schaake said she expects an inquiry to be launched.

This story has been corrected. A previous version of this article said the letter was also addressed to Federica Mogherini, the Italian High Representative and Vice President, but it was only addressed to the European Commission.