The House legal affairs committee on Wednesday held an in-depth discussion about the spyware case investigated by the European parliament’s Pega committee and the involvement of Cyprus in the production and distribution of software that may be used for illegal surveillance.
The group of MEPs visited Cyprus last week and on Tuesday said Cyprus had become a centre for the export of surveillance software.
The topic was presented before the committee by Akel deputy Aristos Damianou, who posed a series of questions on three main topics.
The first was the ‘spy van’ affair, which ended with a €76,000 fine imposed by Larnaca criminal court on WiSpear Systems Limited, a Cyprus-based company selling surveillance systems. Secondly, Damianou said that the government’s official position that spyware is not produced or distributed by Cyprus is “lies and deception”, as they are aware that Tal Jonathan Dilian, WiSpear Systems Limited’s director, is associated with NSO, the company that produces Pegasus spyware, and Intellexa, which produces Predator malware.
He added that there are serious police findings regarding Intellexa founder Avraham Shahak Avni.
The company was facing 91 counts across multiple charges – breaching privacy laws, attacks on information systems laws, breaching electronic communications laws, customs laws, and processing of personal data laws.
Effectively the company was accused of setting up an electronic device or system consisting of WiFi access points capable of intercepting private communications without permission.
The court cleared the company – which operates out of Larnaca – of 49 of the counts. The defendant pleaded guilty to the other 42 counts.
In his own statements, assistant attorney-general Savvas Angelides said that the investigation, which began in November 2019, required “extensive, complicated and time-consuming work” from the investigative team, precisely because of the volume, type and nature of the seized items.
He said that the evidence had undergone specialised forensic examination, both by police experts and private specialists in telecoms/networks and interrelated security matters, while the electronic data extracted was sent to a specialised Europol department for further analysis.
Angelides emphasised that from the scientific investigations that took place in Cyprus and abroad, no data was found demonstrating that the equipment was used or worked in practice to monitor or intercept any form of communication (oral or written) between users or interception of electronic files from devices.
He also said that according to examination findings, system operation was limited to automated scanning, random (non-targeted) recording and storage of the international mobile subscriber identity (IMSI) of SIM cards and the MAC address number of incoming electronic devices within system range.
In an attempt to justify the outcomes of the case, the assistant AG explained that the investigation raised complex legal and especially technical issues, and taking into account the company’s assumption of full responsibility, the punitive nature of the fine it received and its immediate payment, the fact that the systems owned by the company were operated on a trial basis without targeting specific users, the court decided to halt the criminal proceedings against the three people being prosecuted provided that WiSpear Systems Limited would admit to the charges.
He also made it clear that if there had been even a trace of evidence that involved monitoring or interception of any form of communication content, then the criteria for the course of the case would be completely different.
Damianou also said that Angelides should have recused himself from the criminal investigation, seeing that a close relative of his had business relations with people that were later investigated as part of the case, through the law office that Angelides himself had co-founded.
Responding to Damianou’s calls of a lack of objective impartiality, Angelides stressed he was not corrupt, but that he took the decision to withdraw the case based on the mechanisms upon which the legal service operates.
If naysayers want to create such obstacles in the work of officials, he said, nobody will be able to do their job.
The third issue Damianou raised was political entanglement in the case, with the MP saying that “relentless questions” arise concerning the cabinet, ruling party Disy, and its leader Averof Neophytou.
“Why did the Disy leader’s office acted as an intermediary between Dilian and the energy ministry to broker a bid in the Netherlands, and who was responsible for helping with the expansion of Dilian’s activities in Greece?” he asked.
In response to this, committee chair and Disy MP Nicos Tornaritis told reporters that no one should sacrifice the committee’s mission to pre-election expediency and that “no one should involve our country in a witch hunt”.
Damianou also asked why licences were given to NSO or affiliates to export malicious software when they knew about the manufacture and use of Pegasus, and why it became obvious regarding the manufacture, use and export of Predator software.
He also questioned why Shahak Avni was granted a firearms licence by the cabinet, and why the police and other government agencies were buying services and products from the specific companies headed by Avni and Dilian.
Addressing Damianou’s statements, police chief Stelios Papatheodorou said that the police do not have a list of companies that manufacture surveillance machines or produce dual-use software. “Our job is to proceed with a criminal investigation when we receive reports of a company committing any illegal acts.”
On whether the police had purchased products or services from Avni and Dilian’s companies, he said nothing of the sort was determined.
He also confirmed that Avni was indeed granted a firearms licence in 2016, which he kept until the appearance of the case in 2020.
Papatheodorou said that the initial recommendation of the police was that he did not need one, but that changed after he submitted additional information to the ministry.
Speaking after the session, deputy minister for research and innovation Kyriakos Kokkinos said that currently there are 30 registered companies dealing with these technologies in Cyprus, but only nine are active and under the constant supervision of his deputy ministry.
Of the nine companies, four deal with dual-use software, without that meaning that all of them are dealing with sales, although they may be dealing with a part of the development of these technologies, he said.
He noted that the structure of the companies involved in this sector is complex and therefore their supervision is difficult, adding that this is why the legal framework must be strengthened.
Kokkinos said that Cyprus, like all countries, is hospitable to high-tech companies, as long as these companies operate within the framework of national and European regulations and laws.
He also repeated what he had said to the visiting MEPs that the legal framework and supervisory mechanism for the operation of these companies were under review, and that a bill to tighten them was being prepared and expected to be submitted to parliament by the end of December.
Tornaritis echoed Kokkinos in his own statements, saying that although the framework needs to be strengthened, the companies currently operating in Cyprus are legal, and that those who are not should be brought to justice.
He then questioned whether it is within the parliament’s competence to request that the conclusions of the criminal investigations be made public, concluding that it was not.
However, he said that his party’s request was for House president Annita Demetriou to present an opinion on the matter as “the conclusion of a criminal investigation is one thing and the conclusion of an investigative committee is another”.
