back to top
Tech

Leaked Documents Suggest Hacking Team Sold Tech To Russian Security Services

According to hacked data, the Italian company may be in violation of European Union sanctions.

Originally posted on
Updated on

A controversial Italian technology firm, Hacking Team, which sells services to help its clients spy on the internet communications of targeted people and organizations may have violated European Union sanctions by contracting with a Russian intelligence firm linked to a close ally of Vladimir Putin. That's according to information found in a massive data dump attackers claim came from Hacking Team's servers.

Hacking Team is a Milan-based surveillance technology company that sells "offensive" technology designed to give clients, mostly governments and law enforcement agencies, the ability to spy on internet users. Over the weekend, attackers published a 400 GB torrent file that included Hacking Team emails, documents, and source code. According to documents found in the release, since 2011 the company has sold $451,017 worth of technology to Kvant, a research center run by the FSB, the KGB's successor intelligence agency. The spreadsheet also includes a long list of state clients that counts repressive states like Egypt, Azerbaijan, Sudan, and Uzbekistan among apparent customers.

The breach indicates that Hacking Team may have violated an EU ban on selling "dual-use" technology with military purposes to Russian companies. Kvant last paid for Hacking Team's services last Nov. 30, according to the data — two months after the ban was established last fall when Russia fomented a war in eastern Ukraine.

"Intrusion" technology like Hacking Team's is defined as "dual-use" under a 2013 expansion of the Wassenaar Agreement, an international treaty that seeks to control their export to certain states. The treaty, whose 41 signatories include the U.S., United Kingdom, France, and Germany as well as Italy, creates a licensing regime that requires companies to seek approval before selling the technology to states with poor human rights records.

Selling "dual-use" technology to Russian military clients is banned outright under the separate EU Ukraine-related sanctions, though at least one company has appeared to flout the regulation in practice. A BuzzFeed News investigation revealed in May that technology giant Cisco attempted to sell to Russian state enterprises, including the security services, after the ban passed.

Kvant develops signals intelligence systems for Russia's security services, according to its website. The invoice in the leak lists the payee as Infotecs, a privately held company that develops cryptographic software and sits alongside Kvant on an FSB-run technical committee. The hack data lists Kvant as a client, but as "not officially supported."

Hacking Team's "offensive technology" enables clients to surveil the internet communications of targeted people by, among other things, cracking encrypted files and emails, listening to Skype calls, and remotely activating microphones and cameras.

Previously, Hacking Team has denied selling its technology to repressive regimes and insisted that it adheres voluntarily to U.S., EU, and NATO blacklists. In a leaked email from June, Hacking Team CEO David Vincenzetti sharply criticized Russia's military intervention in Ukraine. "Sanctions and diplomacy WILL NOT stop Mr. Putin," Vincenzetti wrote. "He will NEVER stop unless the West shows him that it can play hardball too."

Hacking Team has not returned BuzzFeed News' requests for comment.

This story originally cited a company named Kvant, a military radar firm that is part of giant state defense conglomerate Rostec, as Hacking Team's client. Further documents in the leak show that the company was indeed called Kvant, but is part of Russia's FSB, and not connected to Sergei Chemezov, Rostec's CEO. The FSB's Kvant would also fall under European Union sanctions suspicions.

Joe Bernstein is a senior technology reporter for BuzzFeed News and is based in New York. Bernstein reports on and writes about the gaming industry and web culture.

Contact Joseph Bernstein at joe.bernstein@buzzfeed.com.

Max Seddon is a correspondent for BuzzFeed World based in Berlin. He has reported from Russia, Ukraine, Azerbaijan and across the ex-Soviet Union and Europe. His secure PGP fingerprint is 6642 80FB 4059 E3F7 BEBE 94A5 242A E424 92E0 7B71

Contact Max Seddon at max.seddon@buzzfeed.com.

Got a confidential tip? Submit it here.