Initial PEGA report - Cyprus is an appealing destination for spy goods

by Andreas Kokkinos

A preliminary report was drawn up showing the findings that emerged just a few days after the presence of the PEGA investigation committee in our country, which aimed to investigate the interconnection of Cyprus with the production and export of malicious surveillance software.

The section that includes our country is located between pages 54 and 66, and on first reading, specific Commission reports and observations stand out. It begins by stating that Cyprus is an important European export hub for the surveillance industry and that, despite the European Union's legal framework and regulations, it is considered appealing for companies selling surveillance technologies. It goes on to say that various scandals have harmed the country's reputation, and it makes extensive mention of the black spy van case.

It also stated that Dillian demonstrated the art of surveillance in an interview with Forbes and, according to subsequent investigations, had received permission from the government to proceed with data collection via airport WiFi. According to AKEL, over 9.5 million phone devices have been illegally tapped, and the report that Cyprus has become a breeding ground for experimental surveillance is deemed critical. The geographical position of Cyprus as a crossroads of three continents is highlighted because it may be of interest to travelers passing through Cyprus from countries such as Turkey, Israel, the United States, and Russia.

Then there's talk of the close Cyprus-Greece ties in the surveillance sector because Dillian's company (Intellexa) was founded in Greece and its software (Predator) was implicated in the scandal. Surveillance software and diplomatic relations are intertwined, according to the report, with our country allegedly receiving products such as NSO's Pegasus or WiSpear spyware in exchange for licensing companies with Israeli interests in Cyprus. The legal framework is examined, with the report emphasizing Cyprus's close cooperation with Israel, and it is stated that our country consulted the US and Israel to re-establish this legal framework.

Photo from the PEGA committee's recent visit with the Parliamentary Committee on Institutions - Parliamentary Committee on Legal Affairs.

It clarifies the legal aspects governing surveillance systems by stating that if a device or machine allows interference or interception of private conversations, no one is permitted to import, manufacture, or sell such devices unless the CPS and the Police are notified and give their approval. Breach of privacy is a criminal offense, but the illegality is frequently hidden behind the "cloak" of national security. The relevant laws and regulations are currently being debated and approved in the House of Representatives.

Dillian, who has been granted Maltese citizenship and is involved in several cases in Cyprus and Greece, is one of the key figures. Dillian is linked to Avni, who obtained a Cypriot passport after investing 2. 9 million euros - with Dillian serving in the Israeli army for 25 years before starting work with surveillance software in Cyprus, and Avni serving in the Israeli Special Forces and as a special detective before founding Cypriot NCIS Intelligence Services Ltd. The two shared a building in Larnaca, and the case was closed after the police discovered privacy and personal data breaches related to Avni.  The report also claims that Avni's interactions with DISY provided an ideal environment for testing Dillian's goods.

It explains what happened after the van scandal, including how the case was resolved with an administrative fine against Dillian and the business and how the fallout led to Intellexa "moving" to Greece while he continued to reside in Cyprus. The attorney Alexandros Sinka, who the report claims played a significant role in DISY while maintaining cordial relations with Dillian and Avni, is extensively mentioned. Pegasus does not appear to have been produced in or exported from Cyprus, but the report says that this claim is not entirely accurate. While the government's denial of the statement's creation and export is incorrect, some of it seems accurate.  

According to NSO, AKEL documentation proving that Pegasus was exported from Cyprus to the United Arab Emirates on June 21, 2022, indicated that services were being provided by Bulgaria and Cyprus. Saudi Arabian customers were even shown Pegasus 3's capabilities by NSO officials; the presentation took place at a well-known Limassol hotel, and the Saudis ultimately purchased the product for $55 million.

PEGA members during their meeting with Mr. Kyriakos Kokkinos and Ms. Natasha Pilidou.

As mentioned in the final section concerning Cyprus, while there is a strong legal background in terms of data protection, surveillance, and the export of such software, in practice it is very easy to circumvent, and strong links exist between politics, security companies, and the surveillance industry. The non-explicit application of the regulations makes Cyprus an appealing destination for spy product trade/exchange. According to reports, Cyprus attracts strategic interest from countries such as Russia, Turkey, and the United States, as well as close ties of mutual interest with Israel. Export licenses for surveillance software have become diplomatic 'currency.'

[This article was translated from its Greek original]