A rock was lifted, and the ugly truth is still squirming out. Among the many stories about unlawful surveillance and targeting of human rights defenders circulating now, we feel it’s critically important to bring one particular development to light.
We have been tracking the Israeli spyware company NSO Group ever since discovering that its technology is being used to infiltrate the private communications of public advocates, journalists, research scientists, and political dissidents. While our friends at Citizen Lab have been on the case for some time, we first saw direct evidence of illegal spying in a Digital Security Helpline case involving Mexican public health advocates. The New York Times picked up the story, and the scandal has continued to escalate, with Citizen Lab revealing more and more victims. Human rights experts at the United Nations have now called on the Mexican government to lead an independent and impartial investigation.
There’s just one problem. Despite all of this, no one has been held to account in Mexico, nor has there been any kind of remedy for the people impacted. As we write, NSO Group and its owner, private equity firm Francisco Partners, continue to pursue profit on human rights violations across the globe.
Therefore, it is clear that our work is not over. Access Now is continuing to pry back as many stones as we can to show the public what’s really happening under the cover of corporate promises and deflections. One discovery that we have made is that there may have been connections between NSO Group, U.S. authorities, and members of the Trump Presidential campaign. This includes possible dealings between NSO Group and former U.S. national security advisor Michael Flynn.
Below is what we know about what is going on between the spyware company, the U.S., and Turkey. We think you will agree that NSO and Francisco Partners must go beyond pat answers and public relations one-offs. They must act immediately to stop NSO’s products from being used to violate human rights and its own stated ethical standards.
United States: NSO’s connection with former U.S. national security adviser Michael Flynn
It now appears that NSO’s involvement in North America extends past its relationship with the Mexican government, into the U.S. As we mention above, NSO is currently held in majority by California-based Francisco Partners. Our research shows that there was also a connection between NSO and former U.S. national security advisor Michael Flynn.
Flynn was forced to resign as a White House national security advisor after it was revealed that he had misled Vice President Michael Pence in conversations about his interactions with Russian Ambassador Sergey I. Kislyak. In May 2017, reports also began to emerge that Flynn had worked for Francisco Partners, NSO’s owner, during the 2016 U.S. presidential campaign. According to financial disclosures released in connection with the investigation of the interaction with Kislyak, Flynn began to work with the firm early in that year.
Specifically, in May 2016, Flynn began receiving payment for his work on the advisory board of OSY Technologies, a development branch of NSO Group based in Luxembourg. According to the trademarks they have registered, OSY develops, “Downloadable computer software in the field of communication surveillance for use in tracking law enforcement targeted individuals…” The same financial disclosures show that Flynn earned $40,280 for his work with OSY. Additionally, “The month before Flynn joined the advisory board of OSY Technologies, NSO Group opened up a new arm called WestBridge Technologies, Inc., in the D.C. region.”
Turkey: Flynn, money laundering, and spyware?
Flynn was suspected of accepting laundered money to lobby on behalf of the Turkish government during the same period. The financial disclosures reveal that Flynn had signed a contract with Turkish businessman Ekim Alptekin on August 9, 2016, “for which he was paid $530,000, and included research into Erdoğan’s nemesis, the U.S.-based cleric Fethullah Gülen.” In June, 2016, Alptekin’s Dutch consulting company, Inovo BV, became the sole representative of one of the three companies with the rights to drill in the Leviathan oil field, Ratio Oil Exploration. According to Alptekin, Flynn was being paid, “to produce geopolitical analysis on Turkey and the region…” for Ratio’s “…investment in Turkey.” Alptekin said “less than $100,000” of the money to Flynn came from Ratio Oil, and that the remainder came from himself. However, the House Oversight Committee determined that, “Flynn’s company, Flynn Intel Group, also received $530,000 for work it did last fall — at the height of the campaign — that benefited the government in Turkey.”
On election day in the U.S., Flynn wrote an opinion piece for The Hill, titled, Our ally Turkey is in crisis and needs our support, in which he commended Erdoğan’s regime, and challenged the actions of his political opponent, Fethullah Gülen. Alptekin had previously, “..commissioned Flynn to produce research and talking points that could be used in the lobbying war against Gülen…One is a 27-page report dated Nov. 4, 2016, called ‘Facts Bearing on the Problem and the Gülen Ecosystem,’ which focuses on ways to change the narrative and image of Gülen in the U.S…”
For us it is interesting to note that Turkish authorities use technology developed by Procera Networks, another spyware company owned by Francisco Partners. Procera brokered a deal with formerly state-owned Turk Telecom communications service to employ a deep packet inspection tool to monitor customers’ internet usage, including private IP addresses and history of website visits. In April 2016, senior engineers at Procera began to abandon the company, fearing that the tools they had developed were being used by the Erdoğan regime to violate the privacy of Turkish citizens, including by stealing passwords from unencrypted traffic. It is notable that Flynn’s involvement with both Francisco Partners and Turkish authorities coincides with this period of turmoil at Procera. Since resigning as a national security advisor, Flynn has not assisted in the operations of any of the agencies from his past work, according to our research.
Things could get even shadier
Flynn’s resignation did not mark the end of interactions between NSO Group and the Trump Administration. Internal Drug Enforcement Agency emails, released in early August, detail meetings between Westbridge – NSO’s new arm in Washington, D.C. – and the DEA’s Office of Special Intelligence. We fear further complications in the development of America’s surveillance infrastructure.
In short, it looks as though powerful interests in the U.S. may be aligned with NSO Group, despite the fact that the company’s products are being used to surveil activists and violate human rights.
NSO and Francisco Partners must come clean now
When we learned that The Blackstone Group, one of the world’s largest investment firms, considered becoming part-owner of NSO Group, we joined civil society in condemning that investment. We also launched a successful petition to demand that Blackstone drop plans for the purchase, which they did, according to a Reuters article on August 15. This investment directly conflicted with the firm’s own public support of human rights and commitment to transparency, and we commended Blackstone’s withdrawal. Yet another United States firm, Francisco Partners, has not forfeited its claim in NSO, and refuses to comment on any human rights abuses connected to the Israeli company’s products.
If NSO Group wants to demonstrate that its business is built on ethics and the company respects human rights, it has to do more than issue statements to that effect. We also believe that it is well past time for Francisco Partners to respond publicly regarding its investment in NSO Group, and explain how it will prevent further human rights abuse using NSO tools. We’re waiting.