This Company Has Sold £1 Million Worth of Cellphone-Spying Devices to UK Police

IMSI catchers are the worst kept secret in the UK. For years, evidence that police forces are purchasing these devices has trickled out, but law enforcement agencies have never publicly acknowledged their use of the devices, which simulate cell sites and in some cases can intercept phone calls and text messages.

Several companies that stock IMSI catchers have sold products to UK police forces according to public records, but one firm in particular stands out. Cellxion sold over £1  million ($1.2 million) worth of covert communications data capture (CCDC) equipment—the UK government's term for IMSI catchers—to the Metropolitan Police Service (MPS).

Cellxion, from Surrey, England, specialises in "cellular intelligence and geo-location tools for law enforcement and military users," a Cellxion brochure, obtained and then published by activist group Privacy International, reads.

Formed in 2004, Cellxion quickly faced competition in the IMSI catcher market. MMI Research, another UK surveillance company, accused Cellxion of building IMSI catcher technology while infringing a patent. Eventually, Cellxion won that case on appeal.

But Cellxion has maintained strong ties with other surveillance firms, selling their products to middleman companies. In 2009, a company called Datong tried, and failed, to export a piece of technology that fitted the description of an IMSI catcher to an unnamed Asian Pacific country. Using the Freedom of Information Act, Privacy International found that the name of the denied product was Optima—a specific tool sold by Cellxion.

Optima was a GSM and 3G based IMSI catcher, capable of tracking a phone's location, and intercepting phone calls and SMS messages. But that was years ago: The company likely has developed more advanced features since then. According to a 2015 email included in Italian surveillance company Hacking Team dump, Cellxion may have an IMSI catcher that can inject code using 3G, and in the company's annual report for 2015, Cellxion writes "Thanks to the foresight of planning an upgradeable and flexible platform we are still at the forefront of addressing the technical and operational needs of our customer base."

According to LinkedIn profiles, staff from other UK surveillance firms have gone on to work at Cellxion, and the company also employs ex-law enforcement officials. One Cellxion staffer is a former project leader from the Serious Organised Crime Agency (SOCA), a non-defunct law enforcement body that was the precursor to the country's National Crime Agency (NCA), roughly equivalent to the FBI in the US.

And most notably, Cellxion is popular with UK police forces. As The Bristol Cable reported in October of last year, Avon & Somerset contracted with Cellxion between 2015 and 2016. Public records show West Midlands Police also paid Cellxion a number of times, including for training. According to a 2015 Freedom of Information request, the Ministry of Defence has a small number of contracts with Cellxion, but the Ministry withheld details of the contracts in full. As mentioned, clearly one of Cellxion's major customers is the MPS, which paid Cellxion over £1 million for CCDC equipment. (Motherboard filed a Freedom of Information request for this contract in September 2016; the MPS has repeatedly neither confirmed nor denied it holds any relevant records).

According to Cellxion's 2015 annual report, "market share within key law enforcement customers increased again this year, cementing the company's position within the UK market place."

In November of last year, the UK introduced a controversial new surveillance law called the Investigatory Powers Act. As part of that, UK police forces can now officially use "equipment interference", a term that certainly covers computer hacking. But Eric King, a visiting lecturer in surveillance law at Queen Mary University of London, told Motherboard in an email that it may also cover IMSI catchers.

"It is mostly likely—despite IMSI catchers not being expressly referred to—that it's these sections that will authorise their deployment and provide safeguards against abuse," he wrote.

At an evidence session regarding the then-draft surveillance law in December 2015, Detective Superintendent Paul Hudson, who leads the MPS' Technical Surveillance Unit, said that "a majority" of cases he dealt with included the use of equipment interference.

But it's not just UK forces that are purchasing Cellxion's goods. The company's annual report adds that Cellxion has seen increased sales in European, North American and Middle Eastern Markets. Cellxion was one of the companies included in a dataset obtained by Motherboard showing a host of IMSI catcher firms had been granted licenses to export their products to oppressive regimes, including Saudi Arabia, the United Arab Emirates, and Turkey.

Cellxion did not respond to a request for an interview.