Cyprus’ spy van case too close to the bone

A police investigation in Cyprus has concluded there was no proof of illegal phone tapping in the spy van case, but prosecutors are still going after the main suspects on lesser charges despite reports of alleged contacts in the past with local officials.

About a year after Cyprus police prepared a report on the country’s high-profile spy van case, state prosecutors have filed a case in a Larnaca court against two Israeli nationals, former intelligence officer Tal Dillian and businessman Shahak Avni as well as two individuals in their employ.

According to local media, charges include privacy breaches -referring to the collection of data without permission- and technical violations with the state accusing the main suspects and their company of importing spy equipment and falsely declaring them as weather equipment.

The case that came to be known as “spy van” refers to the high-tech surveillance vehicle known as the SpearHead 360, which made global headlines after allegations against Cypriot-registered Israeli firms pointed to accusations of spying on local citizens and politicians using Wi-Fi installations near airport terminals.

Dilian has vehemently denied ever spying on citizens and further criticized politicians and authorities for carrying out an investigation without properly understanding the technology.

It all began after allegations emerged in Fall 2019 following a Forbes video earlier that summer about a super-pimped-out ride in Larnaca, a converted ambulance truck with state-of-the-art spy gear that could hack into smart phones, steal content, and spy on people's locations.

But according to daily Politis, Cypriot officials had known earlier about the suspects and the spy van, including at least two officials, a drug squad officer and a law enforcement officer stationed at KYP central intelligence service.

The main suspects maintain they sold tools to governments and law enforcement agencies, without naming any of them, but insist they never engaged in covert surveillance except only for demonstration purposes in Larnaca.

“We are not the policemen of the world and we are not the judges of the world,” Dilian said during a Forbes interview.

Cypriot police have officially declined to comment on past surveillance tactics. But in the aftermath of the spy van revelations, officials had flatly dismissed any suggestion that any law enforcement unit had been a client or officers had used unlawful methods.

Local media have also implicated Avni with Italian firm “The Hacking Team” that was shut down after it was hacked back in 2015, prompting former KYP director Andreas Pentaras to resign.

Pentaras stepped down in the aftermath of a scandal after it emerged that the Republic of Cyprus had been a client of Hacking Team. Local media said KYP had purchased Galileo, one of Hacking Team’s surveillance systems, which could be installed on a computer or mobile phone without the user’s knowledge and used to monitor the device or Skype calls, text messages, and emails.

An official statement from the government later acknowledged the remote attack vectors purchased by KYP from Hacking Team compromised the data-protection rights of its citizens.

Politis also pointed to a business relation in the past between Avni and the brother of deputy attorney general Savvas Angelides.

Angelides, who previously served as defence minister under the current administration, has told Politis he had no knowledge of any relation between Avni and his brother, with the latter telling the newspaper that a business venture almost ten years ago to open a spy shop in Nicosia was a flop and he never crossed paths with the Israeli businessman ever again.

Police, who have been heavily criticized over their handling of the case as well as lacking experience, have sought expert advice to determine whether or not confiscated equipment and data they collected from the spy van contained any evidence of unlawful activities.

An independent investigator who was appointed in the case, attorney Elias Stefanou, was asked by retired attorney general Costas Clerides to investigate whether any offences were committed under the privacy laws of the Republic, including constitutional violations over the rights of citizens to a private life.

It remains unknown whether evidence of possible privacy breach has been found besides a 29-page document reportedly making references to a list of over a million email addresses stored during Wi-Fi scanning outside Larnaca International Airport.

Dilian has said the company has proof that its operations were geared toward prospective buyers, who could be foreign governments according to media reports.

A preliminary hearing has been scheduled for next month.