German spyware company FinFisher searched by public prosecutors

Public prosecutors have searched about a dozen offices belonging to the Munich-based spyware manufacturer, public broadcasting news Tagesschau revealed early on Wednesday, following criminal charges that RSF Germany and other civil society organizations filed against the FinFisher conglomerate in 2019, based on indications that it had illegally sold and exported its FinSpy intrusion software to the Turkish government. The search marks an important development in RSF’s international efforts to stop an out-of-control trade in surveillance technology that threatens the rights of journalists worldwide.

In summer 2017, FinSpy was detected on a webpage disguised as a mobilization website of the Turkish opposition movement from where it was downloaded and likely used to monitor political activists and journalists. RSF Germany filed criminal charges against the executive directors of FinFisher GmbH, Finfisher Labs GmbH and Elaman GmbH, all part of the FinFisher conglomerate, in July 2019. Public prosecutors subsequently opened an investigation into a possible violation of the German foreign trade law, which was amended in 2015 to include national licencing obligations of certain surveillance products. Breaches of the law are punishable with up to five years in prison or a financial penalty.

Over the past decade, spyware from European companies such as FinFisher (Germany), Hacking Team / Memento Labs (Italy) or Amesys (France) has appeared in authoritarian states including Myanmar, Turkey, Bahrain, and the United Arab Emirates. Most recently, Amnesty International found further evidence of the use of FinSpy software by a hacking group in Egypt. Digital surveillance in these states is often followed by arrests, torture, and other serious human rights violations.

“For far too long, FinFisher and other European spyware manufacturers have shrouded themselves in obscure company structures to avoid any legal responsibility for the human rights violations, which they facilitate”, said Christian Mihr, executive director of RSF Germany. “A successful prosecution of FinFisher’s executive directors would send an important and overdue signal that these companies must no longer act outside of the law and without care for their due diligence obligations.”

A lack of transparency regarding licences granted and denied and the manufacturers and end users involved further undermines effective oversight of this global trade by researchers and civil society actors. As part of an international civil society coalition, RSF has repeatedly called on EU institutions to strengthen the regulatory framework on export controls of surveillance technology and to include meaningful human rights safeguards within the current European reform of dual use goods.

“Ineffective regulation of surveillance technology leads to massive harm to freedom of expression and other human rights. The EU must act now and ensure transparency and accountability within this industry”, added Christian Mihr.

RSF included FinFisher in its list of press freedom’s 20 digital predators in 2020.