Snapping up cheap spy tools, nations 'monitoring everyone'

LIMA, Peru – It was a national scandal. Peru's then-vice president accused two domestic intelligence agents of staking her out. Then, a top congressman blamed the spy agency for a break-in at his office. News stories showed the agency had collected data on hundreds of influential Peruvians.

Yet after last year's outrage, which forced out the prime minister and froze its intelligence-gathering, the spy service went ahead with a $22 million program capable of snooping on thousands of Peruvians at a time. Peru — a top cocaine-producing nation — joined the ranks of world governments that have added commercial spyware to their arsenals.

The purchase from Israeli-American company Verint Systems, chronicled in documents obtained by The Associated Press, offers a rare, behind-the-scenes look into how easy it is for a country to purchase and install off-the-shelf surveillance equipment. The software allows governments to intercept voice calls, text messages and emails.

Except for blacklisted nations like Syria and North Korea, there is little to stop governments that routinely violate basic rights from obtaining the same so-called "lawful intercept" tools that have been sold to Western police and spy agencies. People tracked by the technology have been beaten, jailed and tortured, according to human rights groups.

Targets identified by the AP include a blogger in the repressive Central Asian republic of Uzbekistan, opposition activists in the war-ravaged African nation of South Sudan, and politicians and reporters in oil-rich Trinidad and Tobago in the Caribbean.

"The status quo is completely unacceptable," said Marietje Schaake, a European Union lawmaker pushing for greater oversight. "The fact that this market is almost completely unregulated is very disturbing."

The Verint documents that AP obtained in Peru, including training manuals, contracts, invoices and emails, offer more detail than previously available on the inner workings of a highly secretive industry.

"There is just so little reliable data on this," said Edin Omanovic, a researcher at Privacy International, a London-based advocacy group. "These commercial tools are being used in a strategic and offensive way in much the same way that military tools are used."

The scope and sophistication revealed in the Peru documents approximates, on a small scale, U.S. and British surveillance programs catalogued in 2013 by former National Security Agency contractor Edward Snowden. That trove showed how the U.S. government collected the phone records of millions of Americans, few suspected of crimes. Even after some reforms, there is still much to be done in the U.S. and abroad to rein in Big Brother, privacy advocates say.

Reached at Verint's corporate headquarters in Melville, New York, an assistant to CEO Dan Bodner said the company would have no comment. "We typically don't comment to reporters," said Barbara Costa.

Verint and its main competitors hail from nations with well-funded spy agencies, including the United States, Israel, Britain and Germany, and have operated with limited oversight.

With more than $1 billion in yearly sales, Verint is a major, longtime player in an industry whose secrecy makes its size difficult to quantify. Verint Systems Ltd., the subsidiary that sold the surveillance package to Peru, is based in Herzliya, Israel, outside Tel Aviv.

In regulatory filings, the parent corporation boasts upward of 10,000 customers in more than 180 countries, including most of the world's largest companies and U.S. law-enforcement agencies. The company says its products help businesses run better and "make the world a safer place." In 2007, Verint provided Mexico with a U.S.-funded, $3 million surveillance platform aimed at fighting drug cartels.

Surveillance sales account for about a third of its business. However, the company discloses little about those products, which it says collect and parse massive data sets to "detect, investigate and neutralize threats."

It also does not identify its law enforcement and intelligence agency clients, but the AP independently confirmed through interviews and documents that it has sales in countries including Australia, Brazil, the United States, Mexico, Colombia and Switzerland.

About half of Verint's surveillance dealings are in the developing world, said analyst Jeff Kessler of Imperial Capital in New York.

The Peru installation — known as Pisco, a nod to the local brandy — illustrates how the private surveillance industry has piggybacked on multibillion-dollar government research in the West. Many security experts who honed their skills in Israel's military have gone to work in the private sector, effectively putting their tech chops at the service of less sophisticated nations for a fraction of the cost.

Like spy tools wielded by larger nations, Pisco lets officials "intercept and monitor" satellite networks that carry voice and data traffic, potentially putting private communications of millions of Peruvians at risk.

A software manual offers step-by-step instructions on how to intercept those communications with Verint equipment: Connect to a satellite, identify the callers, then "open a voice product" — their jargon for a phone call.

Next on the flow chart:

"Voice is heard."

___

'PINPOINT NEW TARGETS OF INTEREST'

Since the early 2000s, Verint and top competitor Nice Systems have sold mass surveillance products to the secret police in Uzbekistan, according to extensive research by Mari Bastashevski for Privacy International, a London-based advocacy group. She found the companies also sold such systems to neighboring Kazakhstan, also a tightly governed nation.

Israeli technicians from both companies have rotated in and out of Tashkent, the Uzbek capital, for tech support and maintenance, Bastashevski found. Nice Systems sold its surveillance business to Israeli defense heavyweight Elbit Systems last year.

That equipment has let Uzbek secret police quickly locate and arrest people who discuss sensitive information on the phone or via email, dissidents say.

"The authorities' main weapon is people's fear," said Tulkin Karayev, a Sweden-based exile. "Freedom of speech, freedom of expression — all this is banned."

Asked by the AP whether Nice Systems' sales had enabled political repression, Elbit spokeswoman Dalia Rosen would not comment. "We follow the leading standards of corporate governance and focus on ethical behavior in our business dealings," she said.

Over the past two decades, Uzbekistan has "imprisoned thousands to enforce repressive rule," Human Rights Watch reported last year. The price of dissent is arbitrary detention, forced labor and torture, the group said. A report submitted to the U.N. by three rights groups deemed torture by the secret police systematic, unpunished and encouraged.

Three years ago, metal worker Kudrat Rasulov reached out to Karayev from Uzbekistan via Facebook seeking advice on how he could help promote free expression in his country. The exile said he suggested that Rasulov, now 46, write critical commentary on local media reports. Rasulov's weekly reports were then published online under a pseudonym. Rasulov thought he was being careful. He created a new email account for every article he sent, and the two men discussed the articles over Skype. But after six months, Rasulov was arrested. He is serving an 8-year-prison sentence for subversion.

Karayev believes Rasulov was undone by surveillance, and Human Rights Watch agreed. The court's sentence found he was convicted based in part on his Skype communications and contact with Karayev, the group said in a report.

"They were reading Skype. They were listening to his phone calls. That's the way they build their cases," said Steve Swerdlow, the report's author.

In Colombia, Verint has racked up millions in sales. As recently as 2015, U.S. customs officials funded maintenance for a wiretapping system, according to government contracts. Nearly a decade ago, its products were abused by officials who were later sacked for illegal eavesdropping, senior police and prosecutors told the AP at the time, speaking on condition of anonymity because they were not authorized to speak publicly about the matter.

Like the United States, most countries require court orders to use the technology. But where rule of law is weak, abuse is not uncommon.

The Caribbean nation of Trinidad and Tobago saw a government fall after a wiretapping scandal involving Verint-supplied equipment. In 2009, a total of 53 people, including politicians and journalists, were illegally monitored, according to a former senior security official who asked not to be named for fear of reprisal. The Verint equipment remains operative, though now a court order is needed to use it.

One piece of the Verint product mix that Trinidad and Tobago bought is Vantage Broadway. A promotional brochure published by Israel's defense ministry for a 2014 trade show in India describes it as data-analysis and pattern-seeking software. It pairs with a product called Reliant to "intercept, filter and analyze huge volumes of Internet, voice and satellite communication." The package Peru bought includes both Reliant and Vantage, documents show.

The little regulation that exists in the commercial mass-surveillance trade falls under a non-binding international arms export-control regime called the Wassenaar Arrangement. In December 2013, it was amended to add monitoring products like Reliant and Vantage and "attack-ware" that breaks into smartphones and computers and turns them into listening posts.

The United States has not ratified the amendment; the federal Commerce Department proposed rules that raised objections in Silicon Valley. Israel says it is complying, and the European Union ratified the update. But Schaake, the EU lawmaker, said its 28 member states act independently and "technologies continue to be exported to countries that are known human rights violators."

Surveillance technology from Israel, meanwhile, is being used in South Sudan, where a 2 ½-year-old civil war has claimed tens of thousands of lives, a panel of U.N. experts reported in January. U.N. and human rights groups say the government deploys it to track down, jail and torture dissidents and journalists.

The ability of South Sudan's intelligence agency "to identify and illegally apprehend individuals has been significantly enhanced" through the acquisition of "additional communications interception equipment from Israel," the U.N. experts wrote.

They did not name the suppliers, and a government spokesman declined to discuss the issue. While there is no direct evidence that Verint is a supplier, an AP reporter confirmed the names of two company employees on a flight in May from Ethiopia to the South Sudanese capital of Juba. Typing on a laptop, one was working on a presentation that named the three telecoms that operate in the country.

Verint did not respond to questions about whether it supplied surveillance technology to South Sudan.

An activist jailed for four months in Juba said his interrogators spoke openly about tapping his phone, played recordings of him in intercepted phone conversations and showed him emails he had sent. He spoke to the AP on condition he not be identified, saying he fears for his life.

Joseph Bakosoro, a former South Sudanese state governor who was also held without charge for four months, said his interrogators played for him a voicemail that had been left on his cellphone. They claimed it was evidence he backed rebels.

Bakosoro said the voicemail proved only that he was being bugged.

His interrogators didn't hide that.

"They told me they are monitoring me," he said. "They are monitoring my phone, and they are monitoring everyone, so whatever we say on the telephone, they are monitoring."

___

'WHO WILL GUARD THE GUARDS?'

Three years after Peru acquired the Verint package, it's not yet up and running, Carlos Basombrio, the incoming interior minister said just before taking office last week. "When it becomes operative, it will be used against organized crime (in coordination) with judges and prosecutors."

Located in a three-story building next to the country's DINI spy agency, Pisco sits on a Lima military base off-limits to the public. It can track 5,000 individual targets and simultaneously record the communications of 300 people, according to agency documents, with eight listening rooms and parabolic antennae affixed outside to capture satellite downlinks.

Control of Pisco was shifted to the national police after the spying scandal that crippled the intelligence agency. Verint sent Israeli personnel to train Peruvian operators, adding eight months of instruction at the host government's request, records show.

One major eavesdropping tool has, however, been active in Peru since October. It can physically track any phone in real time using geolocation. Under a July 2015 decree, police can locate phones without a court order, but would need one to listen in.

Government officials wouldn't offer details on what software was being used to track cellphones. But two months before the decree, DINI officials said payment had been authorized for a Verint geolocation product called SkyLock. That software enables phone-tracking within the country, and a premium version can pinpoint any mobile phone in most countries.

All four Peruvian phone companies agreed to cooperate on geolocation, signing a pact with the government the details of which were not disclosed.

Civil libertarians consider warrantless geolocation a dangerous invasion of privacy, especially in a nation with pervasive public corruption. Peru's incoming congress is dominated by Fuerza Popular, a party associated with imprisoned former President Alberto Fujimori. He ran one of the most corrupt Latin American regimes in recent history.

In July 2015, the Verint surveillance platform got caught in the chaos of Peruvian politics.

Word of the purchase was leaked, triggering a government audit. The Miami-based Verint vice president who made the sale, Shefi Paz, complained about the phone companies' apparent foot-dragging in emails and letters to DINI officials. They weren't making themselves available for meetings.

"Verint should not have to suffer from political delays," Paz wrote. Reached by phone, Paz declined to comment.

The eavesdropping products Verint and its peers sell play an important role in fighting terrorism, said Ika Balzam, a former employee of both Verint and Nice. That is a common industry claim, echoed by politicians.

And yet, Balzam acknowledged, there are no guarantees that nation-states won't abuse surveillance tools.

"There is a saying," Balzam said: "'Who will guard the guards?'"

___

Associated Press writer Frank Bajak reported this story in Lima and AP writer Jack Gillum reported from Washington. AP writers Maria Danilova in Washington; Josef Federman in Jerusalem; Jason Patinkin in Juba, South Sudan; Tony Fraser in Port-of-Spain, Trinidad and Tobago; Jamey Keaten in Geneva and Kristen Gelineau in Sydney contributed to this report.

___

Frank Bajak on Twitter: https://twitter.com/fbajak

Jack Gillum on Twitter: https://twitter.com/jackgillum