Undercover spy exposed in NYC was one of many

LONDON (AP) – When mysterious operatives lured two cybersecurity researchers to meetings at luxury hotels over the past two months, it was an apparent bid to discredit their research about an Israeli company that makes smartphone hacking technology used by some governments to spy on their citizens.

The Associated Press (AP) has now learnt of similar undercover efforts targetting at least four other individuals who have raised questions about the use of the Israeli firm’s spyware.

The four others targetted by operatives include three lawyers involved in related lawsuits in Israel and Cyprus alleging that the company, the NSO Group, sold its spyware to governments with questionable human rights records. The fourth is a London-based journalist who has covered the litigation.

Two of them – the journalist and a Cyprus-based lawyer – were secretly recorded meeting the undercover operatives; footage of them was broadcasted on Israeli television just as the AP was preparing to publish the story.

All six of the people who were targetted said they believe the operatives were part of a coordinated effort to discredit them.

Lawyer Alaa Mahajna poses for a photo on Mount Scopus, overlooking Jerusalem, on February 9. – PHOTOS: AP
The exterior of the address 3 Pedder Street, Central in Hong Kong on February 4. The building was supposedly the home of ENE Investments, but an investigation by The Associated Press has found that the firm is little more than a front for an elaborate undercover operation targetting security researchers, lawyers and a journalist

“There’s somebody who’s really interested in sabotaging the case,” said one of the targets, Mazen Masri, who teaches at City University, London and is advising the plaintiffs’ attorney in the case in Israel.

Masri said the operatives were “looking for dirt and irrelevant information about people involved”.

The details of these covert efforts offer a glimpse into the sometimes shadowy world of private investigators, which includes some operatives who go beyond gathering information and instead act as provocateurs.

The targets told the AP that the covert agents tried to goad them into making racist and anti-Israel remarks or revealing sensitive information about their work in connection with the lawsuits.

NSO has previously said it has nothing to do with the undercover efforts “either directly or indirectly”. It did not return repeated messages asking about the new targets identified by the AP. American private equity firm Francisco Partners, which owns NSO, did not return a message from the AP seeking comment.

The undercover operatives’ activities might never have been made public had it not been for two researchers who work at Citizen Lab, an Internet watchdog group based out of the University of Toronto’s Munk School.

Last December, one of the researchers, John Scott-Railton, realised that a colleague had been tricked into meeting an operative at a Toronto hotel, then questioned about his work on NSO. When a second operative calling himself Michel Lambert approached Scott-Railton to arrange a similar meeting at the Peninsula Hotel in New York, Scott-Railton devised a sting operation, inviting AP journalists to interrupt the lunch and videotape the encounter.

The story drew wide attention in Israel. Within days, Israeli investigative television show Uvda and The New York Times identified Lambert as Aharon Almog-Assouline, a former Israeli security official living in the plush Tel Aviv suburb of Ramat Hasharon.

By then, Scott-Railton and the AP had determined the undercover efforts went well beyond Citizen Lab.

Within hours of the story’s publication, Masri wrote to the AP to say that he and Alaa Mahajna, who is pursuing the lawsuit against NSO in Israel, had spent weeks parrying offers from two wealthy-sounding executives who had contacted them with lucrative offers of work and insistent requests to meet in London.

“We were on our guard and did not take the bait,” Masri wrote.

Masri’s revelation prompted a flurry of messages to others tied to litigation involving NSO. Masri and Scott-Railton said they discovered that Christiana Markou, a lawyer representing plaintiffs in a related lawsuit against NSO-affiliated companies in Cyprus, had been flown to London for a strange meeting with someone who claimed to be a Hong Kong-based investor.

Around the same time, Masri found out that a journalist who had written about NSO was also invited to a London hotel – twice – and questioned about his reporting.

“Things are getting more interesting,” Masri wrote as the episodes emerged.

Like Almog-Assouline, the undercover operative the AP exposed in New York, the covert agents who pursued the lawyers made a string of operational errors.

The attempt to ensnare Alaa Mahajna, the lead lawyer in the Israeli suit, was a case in point.

On November 26 last year, he heard from a man who said his name was Marwan Al Haj and described himself as a partner at a Swedish wealth management firm called Lyndon Partners.

Al Haj offered Mahajna an intriguing proposition. Al Haj said one of his clients, an ultra-rich individual with family ties to the Middle East, needed legal assistance recovering family land seized by Jewish settlers following the 1967 Arab-Israeli war.

“I believe you may be a good fit for this challenging task,” Al Haj wrote.

The request made sense. As a human rights lawyer based in Jerusalem, Mahajna has defended Palestinian activists and others at the receiving end of the Israeli government’s ire. But Mahajna became suspicious as he tried to learn more about the case. Al Haj was cagey about his client and seemed unwilling to provide any paperwork, Mahajna told the AP.

“Not even the basic stuff,” Mahajna said. “Usually people flood you with documents and stories.”

Mahajna said he was unsettled when Al Haj suddenly offered him an all-expenses-paid trip to London; no one had even asked him whether the case had any hope of success.

“At some point it was abundantly clear that this is not a bona fide approach,” Mahajna said. Ten days later, Masri, the legal advisor in the Israeli lawsuit, received an email offering him a place on the advisory board of a Zurich-based company called APOL Consulting.

Masri became sceptical after he checked out the company’s website. Consulting firms typically trade on their employees’ intelligence and skill, so Masri expected the company’s site to prominently display the names, headshots and qualifications of its staff.

“Here (in their website), there wasn’t even a name of one human,” he said.

When Masri turned down the position on APOL’s board, the representative who’d contacted him – a man who called himself Cristian Ortega – pressed Masri to see him in London anyway.

“I would consider it a privilege to have a chance to meet you in person for a friendly chat,” Ortega said in a January 7 email. “No strings attached of course.”

Masri said that by then he and Mahajna had come to believe that Ortega and Al Haj were fictions and that their companies were imaginary.

But they didn’t yet know how widespread the covert operations were.

The undercover agents got a little further with Christiana Markou, the lawyer who is pursuing the Cypriot case against NSO-affiliated entities.

Her lawsuit, like Mahajna’s, draws heavily on reports by Citizen Lab that found that NSO spyware had been used to break into the phones of the Mexican activists and journalists who are the plaintiffs in both cases.

Markou told the AP she was approached over email on December 21 last year by a man who presented himself as Olivier Duffet, a partner at Hong Kong-based ENE Investments.

Duffet was ostensibly interested in inviting Markou – a leading data protection and privacy lawyer in Cyprus – to give a lecture at a conference. Markou said she proposed discussing the lecture over Skype, but he insisted on an in-person meeting in London, eventually flying her out, putting her up in a fancy hotel and chatting for a little more than an hour.

Most of the discussion revolved around the proposed lecture – but then Duffet suddenly pivoted to the NSO case, asking her whether she felt the lawsuit was winnable and who was funding it.

Markou said she “gave either incorrect answers or expressly refused to answer” because she found his questions suspicious.

Yet another target, Eyad Hamid, a London-based journalist who wrote a story about NSO, said he was also invited to a London hotel on two separate occasions to discuss his coverage of the Israeli company.

The purported company used in the operation targetting him was Mertens-Giraud Partners Management (MGP), which was described as a Brussels-based wealth management firm.

Neither MGP – nor any of the other companies – truly existed.

The AP’s searches of the Orbis database of some 300 million companies, local corporate registries and trademark repositories, turned up no trace of a Swiss firm called APOL, a Swedish company called Lyndon partners, a Belgian company called Mertens-Giraud or a Hong Kong-based firm named ENE Investments.

Local phone books didn’t carry listings for a Zurich-based man named Cristian Ortega, a Hong Kong-based man named Olivier Duffet or anyone in Sweden bearing the name Marwan Al Haj.

There was no hint of APOL when the AP visited its supposed office not far from Zurich’s central train station; tenants said they’d never heard of the company. It was the same story in Hong Kong; a management representative at the Central Building, where ENE Investments was supposedly located, said he didn’t know anything about the company. An AP journalist wasn’t able to speak to anyone at Mertens-Giraud’s alleged office on Brussels’ Rue des Poissoniers; the entire building was boarded up for renovations.

At the modern office block in downtown Stockholm where Lyndon Partners claimed to have its headquarters, service manager Elias Broberger said he could find no trace of the wealth management firm.

“It says they are located here,” Broberger said as he examined Lyndon Partners’ professional-looking website. “But we don’t have them in any of our systems: not the booking system; not the member system. We don’t bill them; they don’t bill us.

“I can’t find them.”