Israeli company that deployed ‘spy van’ fined €925,000 for data violations

The personal data commissioner has fined a Larnaca-based Israeli company €925,000 for violations relating to the operation of a van capable of carrying out covert surveillance

In a statement Friday, Commissioner Irini Loizidou Nicolaidou said WiSpear Systems Ltd has paid the fine for violating the principle of lawfulness, objectivity, and transparency.

The commissioner said she had taken into account various aggravating and mitigating factors when deciding on the scale of the fine, like the company’s admission and the assurances from the Legal Service that investigators had not determined that the company had monitored any private communications.

“In my decision, I concluded that the company’s activities resulted in the collection of Mac Address (Media Access Control Address) and IMSI (International Mobile Subscriber Identity) data from various handsets as part of tests and presentations it had been carrying out without the users knowing.”

A Mac address is a unique identifier assigned to a network interface controller for use as a network address in communications within a network segment.
IMSI is a number that uniquely identifies every user of a cellular network.

These data, combined with the geographical location of a handset at different times, can identify the user, she said.

The fine does not concern potential criminal responsibility.

An investigation into the affair started in November 2019 after the owner of the company, Tal Dillian, an ex-Israeli intelligence officer, gave an interview to Forbes essentially advertising his services, which included covert surveillance and eavesdropping.

During the interview, Larnaca-based Dillian exhibited the capabilities of a van that was decked out with gear capable of hacking smart phones and intercepting electronic communications within a one-kilometre radius.

Daily Politis reported in September that no proof had been found that the van had been used to spy on people, but four people involved in the cases, including two Israeli nationals, would be facing lesser charges relating to personal data violations and offences relating to its importation into the country.

The owners had claimed the van had not been active on Cypriot territory apart from field tests and demonstration purposes using only company-owned devices and under the guidelines and acknowledgement of local authorities.

The owner’s defence had said that the authorities were kept informed each time the van was moved and revealed that senior police officers, including from the drug squad, had been onboard at times.