The message sounded innocuous enough, like one of the many tips journalists are regularly sent. "Thanasis, have you heard about this?" When he clicked on the link in summer 2021, a small program installed itself imperceptibly on his phone. It opened the door to the spyware program Predator, a virtual beast of prey.

Suddenly, Koukakis was completely exposed, and remained so for 10 weeks. The software allowed the attackers to see where the reporter was moving, who he was talking to, who he was sending which messages to and what he was researching. Koukakis has spent years reporting on corruption, keeping a close eye on the powerful in Greece, and his work has appeared on the satellite news station CNN and in the Financial Times. Now, though, his informants were in danger of being exposed.

Gradually, it became clear that Koukakis was just the beginning. Several of the Greek journalist's colleagues were attacked, the current leader of an opposition party, and then member of the European Parliament was targeted, in addition to the foreign minister at the time and prominent business leaders.

The Hellenic Data Protection Authority has since been able to identify 92 targets. And most of them have one thing in common: They are critics and opponents of conservative Greek Prime Minister Kyriakos Mitsotakis.

The scandal became known in the media as "Greek Watergate," and Mitsotakis and his secret service came under suspicion. Despite incriminating findings, the prime minister denies being behind the attacks.

Analysts at the Citizen Lab, a research institute at the University of Toronto, discovered traces of Predator on Koukakis' mobile phone and identified other locations where it appears to have been deployed. In addition to Greece, they include Oman, Indonesia, Madagascar, Serbia and Egypt. There, too, Predator had been used to go after individuals who are a thorn in the side of the powerful.

People like Ayman Nour. The Egyptian opposition figure and former presidential candidate now lives in Turkey and runs a critical satellite television station. He was also targeted in June 2021. The perpetrators were able to secretly activate his phone's microphone and camera in addition to copying his photos, videos, voice messages and encrypted chats such as those conducted via WhatsApp and Telegram.

Spying programs like Predator help investigative authorities catch serious criminals and terrorists. But the same surveillance tools also spy on innocent people every day, says Sophie in't Veld, 60, a member of the European Parliament with a civil liberties-oriented party. No mobile phone data is safe any longer, she says, adding that "real hotspots" have emerged all over Europe for the surveillance industry - places that "support it with a reliable financial system and tax breaks." The Netherlands, France, Ireland, Luxembourg, Cyprus, Bulgaria and "many other member states help spy on people around the world," says in't Veld. "We have a real European problem here."

But who's behind it?

--------------

Now, for the first time, documents obtained by DER SPIEGEL and the French investigative portal Mediapart and shared with their partners in the European Investigative Collaborations (EIC) provide deep insight into the secret world of inventors, financiers and vendors of fearsome spy weapons like Predator. Specialists with Amnesty International assisted the reporting with technical analysis.

Particularly alarming is the realization that many of the tracks left by the unscrupulous spyware providers lead to Germany, the self-proclaimed cradle of data protection and informational self-determination. There, an extremely well-connected Hamburg entrepreneur invested in two companies involved in the scandal, and an art-loving patron from Berlin supplied significant amounts of money to support the development of the spyware.

Our reporting into the Predator Files took several months and is based on thousands of court documents, interrogation transcripts and confidential company presentations. It has revealed that European business executives have earned a fortune by equipping countries that flout the rule of law and despots with the latest surveillance tools for more than a decade.

Financed, supported and advised by people in Germany, these companies ultimately joined forces in an alliance that helped to spy on a grand scale. Known as the Intellexa Alliance, the collaboration is likely one of the most mysterious and dangerous ventures in Europe.

----------------

On the Trail of the Predator: North Macedonia, Greece and Germany

The search for the origins of Predator inevitably leads to a man who once served in a top-secret formation of the Israeli army, Unit 81. Tal Dilian, now 62, led was commander of the elite cyberunit. After some 25 years in service, his departure was less than honorable. He was accused of having enriched himself unlawfully.

Like many former Israeli military officers, Dilian then went into the surveillance business. In 2018, he discovered a startup in Macedonia, now named North Macedonia, called Cytrox. Talented programmers were working on a new spyware tool there, but the development was swallowing up enormous sums of money, and before long, the startup could no longer pay its employees. Dilian stepped in and acquired Cytrox through the company Aliada, which he headed. Together, they wanted to complete what ultimately became Predator.

---------------------

Dilian obtained the money he needed from a nondescript shopping street in the small town of Zossen, located just south of Berlin in the state of in Brandenburg. The town is home to Davidson Technology Growth Debt. Company head Eran Davidson came to Germany from Tel Aviv in 2005 to manage funds belonging to SAP founder Hasso Plattner. In 2014, he set up his own venture capital operation.

Davidson was convinced that Predator had a future and he provided the company behind the spyware program with a loan in the two-digit millions. The money came from a fund he managed.

Investors included Leo Rokeach, managing director of industrial coatings supplier Lankwitzer Lackfabrik and real estate entrepreneur Artur Süsskind. Also involved were hotel owner Michael Zehden, Rolf Christof Dienst, co-founder of the Immoscout real estate portal, and Heinrich Arnold, the former head of Deutsche Telekom's research department.

One in particular stood out: culture investor Yoram Roth. A Berlin native, Roth is the son of the late real estate mogul Rafael Roth and owns stakes in a culture magazine and a photo museum group. He also bought and renovated Clärchens Ballhaus, a traditional dance hall in the heart of the capital city.

Roth's engagement went beyond just investing money into a fund that helped finance a new spyware tool. With another $1.5 million, he also acquired a 2.5-percent stake in Cytrox's new parent company, Aliada, according to internal company documents.

------------------

In summer 2019, just a few months after the capital infusions from Germany, former military officer Dilian invited the American business magazine Forbes to Cyprus. The Israeli gave an extensive interview to the magazine's journalists, an unusual step in his industry, and then even launched into an on-camera product presentation.

Dilian wore jeans for the presentation, his collared shirt untucked. The Israeli showed the journalists a black van with tinted windows. An ambulance in a previous life, it was now crammed with servers, monitors and antennas worth several million euros: a mobile eavesdropping center.

"We will trace them, we will intercept them, we will infect them," Dilian said with a crooked smile. He then demonstrated the van’s efficacy by penetrating the Huawei mobile phone of a staged victim he had posted hundreds of meters away. The owner of the phone didn't notice anything and he didn't even have to click on a link – Predator just slipped silently into the smartphone. The approach, called "zero-click," is straight out of a masterclass of digital espionage.

Dilian was so proud of the product that he threw caution to the wind. He gushed to the Forbes journalists about all the money he was going to rake in, as much as $500 million. "Actually, maybe you don't like to know it, but somebody knows exactly where you are all the time," Dilian said.

At the time he hosted the journalists, he had just given his activities a new name, the Intellexa Alliance, a consortium of European surveillance companies seeking to supply each other and security agencies with state-of-the-art spying tools. "We work with the good guys," Dilian said of his customers in the interview. "And sometimes the good guys don't behave."

Intellexa's Shadow Men: Traveling with Germany's President

A French company with German investors was part of the core of the alliance forged by Dilian. One of the company’s founders is Stéphane Salies, 59, who once studied physics in Paris and California. One of the few available photos of him shows a friendly looking man with stubble and an unbuttoned white shirt. He comes from a family that is a dynasty of sorts in the eavesdropping business: His mother used to sell wiretapping technology to French agents. And Salies established a company called Amesys, which also supplied technologies to the French authorities, such as the Directorate General for External Security (DGSE) France’s foreign intelligence service.

In 2006, Salies sold the Eagle internet surveillance system to the regime of Libyan despot Moammar Gadhafi. The dictator and his henchmen deployed it against their own population, using it to monitor insurgents, many of whom were arrested and tortured. After Gadhafi was killed in 2011, Wall Street Journal reporters uncovered instructions from the French company for mass surveillance of mails, chats and other messages in abandoned intelligence rooms in Tripoli.

 

Two human rights organizations went on to file criminal charges against Amesys for "complicity in acts of torture." The proceedings are ongoing to this day, and Salies has denied any guilt. Internal documents that Mediapart has shared with DER SPIEGEL and EIC now show that executives pushed to quickly change the company's name because customers and banks no longer wanted to work with them. In the end, they shut Amesys down.

Top management, led by Salies, founded two new companies a short time later: Nexa Technologies in France and Advanced Middle East Systems (AMES) in Dubai, the latter only lacking two letters from the previous name. Nexa took over the Amesys product line and gave new names to the company’s offerings. Eagle, for example, became Cerebro. Employees, meanwhile, hardly had to adjust at all, with most of them simply carrying on as before. Nexa and AMES would become two of the decisive players in the Intellexa Alliance.

The French team, which had fallen into disrepute, were also looking for serious-looking business partners and investors. They found them in Germany – more precisely, in a side street of a Hamburg industrial park. From the outside, the company headquartered here looks rather inconspicuous.

The Plath Group calls itself a "Hanseatic hidden champion," a "successful company" specialized in supplying international "solutions for data-driven crisis prevention." Plath's customers include the Bundeswehr, Germany's armed forces, and Germany's Federal Network Agency, among others. The company's website states that it supports "security authorities worldwide in identifying threats before they arise."

Plath's CEO, Nico Scharfe, 52, is a tall, lean man who runs half-marathons. He has run the Plath Group, in which his family holds a majority stake, for more than 20 years. In 2014 and 2015, Plath acquired a total of 30 percent of the shares in both Nexa and AMES. The dubious involvement in Libya by Salies and his colleagues didn’t seem to bother the Hamburg-based company much.

For the French, meanwhile, Scharfe turned out to be a stroke of luck. The Hamburg businessman accompanied Frank-Walter Steinmeier of the center-left Social Democrats (SPD) on trips abroad to Brazil, Peru and Colombia when he served as foreign minister and, later, as president of Germany, to Singapore and Indonesia. Scharfe is also a very well-connected figure in Hamburg. During a visit to the company, Hamburg Mayor Peter Tschentscher of the center-left Social Democrats described Plath as "an important part of Hamburg as a center of innovation and technology."

There are only a few photos or video recordings of Scharfe in existence, not even an otherwise obligatory snapshot of him with the mayor – the kind of PR image that few choose to eschew.

Scharfe and his company also refrained from issuing press releases after purchasing the stakes in Nexa and AMES, while at the same time securing a lot of influence. Although Plath bought only a minority stake in Nexa, the company obtained two of the four seats on the supervisory board. Scharfe claimed one of the slots for himself, with another going to a confidant. On the Nexa side, they were joined by Stéphane Salies, mastermind of the Libya deal, and one of his long-time colleagues.

From that point on, apparently no more important decisions could be made without involving Plath. Executives in Hamburg had to approve practically all contracts with a value of over 200,000 euros, Nexa had to get Plath's approval for transactions with high-risk customers, and even rental contracts of over 20,000 euros had to be reviewed. Plath was also given the right to request any important company document at any time.

The Plath Group took a closer look at Nexa's export controls, with two German lawyers drafting a 17-page paper on the subject. A central point: Nexa should commit to not supplying countries subjected to an arms embargo. They also recommended that a Plath lawyer closely track all the new partner's future export processes.

Nico Scharfe, it seemed – on paper, at least – wanted to monitor the French with German thoroughness.

They Knew What They Were Doing: Dubious Predator Deals in a "Super Evil" Country

The new alliance got off to a promising start. Plath sold Nexa equipment to Jordan, Austria and Switzerland. In return, Nexa referred Plath products to the French Defense Ministry. Plath also opened doors for AMES in countries including Mexico, Mongolia, Rwanda, Venezuela and Taiwan in addition to establishing contact with Germany's federal intelligence agency, the BND.

AMES secured a major deal in early 2014. It centered on the flagship product Cerebro – the same one that Gadhafi had purchased and which, according to the product description, enabled the internet surveillance of an entire country.

Internally, the project carried the code-name "Toblerone." The client behind that alias was the Egyptian government of Abdel Fattah el-Sissi, who had seized power the year before. In the months that followed, tens of thousands of opposition supporters were arrested. The United Nations special rapporteur at the time, Agnès Callamard, even referred to the increasingly frequent use of the death penalty as "arbitrary killings" intended to break the population's resistance.

Stéphane Salies nonetheless traveled to the country several times, according to the documents, and met with military intelligence agents. Through their office in Dubai, the French ultimately earned around 12 million euros from the deal with Egypt, in addition to a highly lucrative maintenance contract that ran for several years.

Cerebro proved to be a cash cow for the Franco-German marketing alliance for a long time. The documents show that Nexa and AMES sold the technology to Kazakhstan, Singapore, Qatar, the United Arab Emirates and elsewhere. France and Monaco were also customers.

But in response to the revelations surrounding the NSA scandal involving whistleblower Edward Snowden, major providers such as Google and WhatsApp encrypted their services. On the internet, meanwhile, the more secure HTTPS standard prevailed. Over the years, Cerebro became less and less effective.

Nexa and AMES desperately needed new instruments. They appeared to find them in Tal Dalian's product range, especially in Predator. In February 2019, the companies announced the joint Intellexa Alliance – and the German Plath representatives on Nexa's supervisory board apparently did nothing to stop it.

It put Intellexa in a league with the market leader, the NSO Group of Israel, which had developed Pegasus. The alliance now had a huge portfolio of surveillance products for military and intelligence agencies.

It didn't take long before Cairo showed renewed interest. Through AMES, the Sissi regime acquired the Predator software at the end of 2020. According to the documents, the deal was with the Technical Research Department of the Egyptian secret service. The order had a total value of 9.5 million euros.

At virtually the same time, AMES landed another Predator deal, this time with Vietnam, a 5.6-million-euro contract over two years. The executives of the spyware alliance celebrated their deal in a joint WhatsApp group. "Great!!!! Happy New Year," Dilian typed on New Year's Day 2020, when the French announced the new deal with Egypt. "Woooow!!!!!" he wrote when they announced a few hours later that the communist regime in Vietnam had also procured the software. The deals were celebrated in chat with champagne bottle emojis.

The people doing business within the Intellexa Alliance didn't appear to have much in terms of scruples. That was evident in the case of Libya. Ever since Gadhafi's fall, a bloody civil war has raged in the divided country. The internationally recognized government is based in Tripoli in the west, while in the east, around Benghazi, warlord Khalifa Haftar calls the shots.

Despite the fact that Salies was under investigation for doing business with Libya and had even been arraigned and accused of "complicity in acts of torture," his company once again discussed deals with the North African state in 2017. According to an internal document, the spyware vendors were communicating with a certain Jalal Dira. His interests? Mobile phone and internet surveillance and satellite phone tapping. For which country? "Libya." Under a heading for notes, someone wrote: "Haftar."

There was another contact with "Jalal" a few months later. AMES then relayed an offer to the Haftar side relating to a spy van very similar to the one Dilian would later present to Forbes. The vehicle was equipped with all kinds of equipment from the Intellexa Alliance. AMES asked for a selling price of 9 million euros. A sales contract was indeed concluded for at least part of the equipment. At the beginning of December 2020, an employee wrote: "Down payment … is received on our account."

And what did the German controllers at Plath do?

A few days later, they posted an announcement to their homepage indicating that they had relinquished their holdings in AMES and Nexa, a move that came weeks after the deal with Haftar's people and almost two years after the Intellexa Alliance had come into being.

When it came time to ship the products, though, Salies called Plath's export law expert in May 2021. "We have a request from a super evil country, and I want to know if it is completely banned or what the options are," Salies could be heard saying in the wiretapped phone call. He said it was about Libya, the "Haftar camp."

German lawyer Kay Höft initially responded curtly: "You know, of course, that we don't do business with countries that are under an arms embargo."

Salies wasn't deterred. He proposed a complex deal involving a company in England, an intermediary firm in the United Arab Emirates and AMES – a deal he presented to the lawyer in a 16-minute conversation a few days later. This time, the lawyer was no longer quite as dismissive. If the material is "combined with other goods" after arriving in the Emirates, the end customer does not have to be disclosed to the export authorities, Höft said. He added that the goods would be given a new designation and could then continue from the Emirates on to their destination. "You can use this method at any time."

This is far from the only indication of how little the French cared about export regulations. When a customer pressed for a quick presentation of the surveillance technology, a Nexa manager wrote that the materials would have to be transported in carry-on luggage, but added: "We've done that many times before."

To initiate a business deal in Algeria, they simply redeclared a spy tool at baggage check-in as a "computer server." Internally, when they couldn't obtain an export license for Saudi Arabia, they considered flying the spyware to Kenya. From there, they could simply continue on to Riyadh. European export controls may look strict on paper, but in practice, they appear to stop very few.

Those wanting to play it safer can just establish a company outside of Europe. In a 2014 letter to a major general of the Pakistani intelligence service, Frenchman Salies wrote about what is likely the greatest advantage of AMES' Dubai branch. Because of the company's location, he wrote, "there are no lengthy export control procedures we need to follow, nor is there a risk of export permission being denied."

AMES business documents show that there were even special bonuses for employees of "four percent of the margin earned" if they made lucrative deals with three "high-risk" countries: Iraq, Afghanistan or Libya. Another document notes that "no corporate tax, no social security contributions" must be paid in the United Arab Emirates, and that there would be "no more problems with the press."

Indeed, the mere thought of critical journalists was apparently enough to reduce Salies to a panic. If the press found out about the Predator contract with Egypt, "we're dead," the Frenchman said in June 2021. Ironically, that conversation was intercepted by the French federal police force.

In the end, it was Salies' loyal clients from the French security agencies who beat him at his own game. And this despite the fact that he and his people had always made every effort to cultivate the best contacts in Paris. Those efforts even reached as far as President Emmanuel Macron, the documents show.

The Best Relationships: Why No One Stopped Intellexa from Distributing Spyware

Handwritten notes from a senior staff member suggest that Nexa had a meeting scheduled with Élysée Palace in April 2018. President Macron, his former security adviser Alexandre Benalla and a high-ranking general are listed as participants, with their phone numbers noted as well.

Perhaps the appointment helps to explain why Salies and his closest associates were able to trade in the most controversial of surveillance technologies for so long and why the Plath Group did business with him. Salies had direct access to the very highest circles and extremely lucrative orders.

A document from January 2021 lists no fewer than 18 deals being sought with the French military, the French foreign intelligence service and various Paris ministries, with a total value of around 10 million euros.

But it doesn't stop there. Macron's former security adviser Benalla, who had to leave Élysee Palace in the summer of 2018 following several scandals, then became self-employed as an "international adviser" and lent support to Nexa. The Macron confident exchanged 499 WhatsApp messages with the company's CEO in a little less than a year and a half.

In 2020, for example, Benalla arranged for the Nexa executive to meet with an apparently influential Saudi prince. The men met in the lobby of a hotel. "He's very close to MBS," Benalla crowed.

Crown Prince Mohammed bin Salman, alias "MBS," was widely considered to be persona non grata at the time. In 2018, a Saudi hit squad had killed and dismembered journalist Jamal Khashoggi in Istanbul. As would later be discovered, the mobile phones of several people close to Khashoggi had been infected with the Pegasus spyware from Israeli company NSO.

After the meeting arranged by Benalla, the French nevertheless submitted an offer to the Saudis for surveillance tools worth more than 14 million euros. According to an analysis by Citizen Labs tech experts, Riyadh used Predator too.

The German government also had few inhibitions about doing business with the Intellexa Alliance, regardless of its history. And despite clear language in the current government’s coalition agreement regarding spyware: The "exploitation of vulnerabilities in IT systems is highly problematic in relation to IT security and civil rights," the agreement reads.

When confronted with questions about the Intellexa Alliance and Predator, officials in Berlin aren’t particularly loquacious. Information about the company's contacts with the sate could harm the "welfare of the state," they claim. In response to a query by the far-left Left Party, the German government stated that the Central Office for Information Technology in the Security Sphere (ZITiS) had been "in contact with representatives of 'Intellexa' and its subsidiary Cytrox" since 2021. The goal, the government stated, is to obtain "information about the portfolio."

It's not a particularly satisfying response, however, given that internal Nexa documents show that ZITiS has been an Intellexa Alliance customer since 2019. Those documents indicate that a contract with ZITiS, which is based in Munich, is referred to by the internal code name "Bavaria" and apparently purchased two surveillance instruments from Nexa for around 1 million euros, including maintenance. When reached for comment, the German Interior Ministry said it couldn't discuss the matter "so as not to jeopardize the investigative capacity of the security authorities."

Representatives of the alliance also held talks with the German defense firm Hensoldt, despite the fact that representatives handpicked by the German government are members of the company's supervisory board. The company, which is partly state-owned, even entered into a previously unknown non-disclosure agreement with the Intellexa Alliance. Documents obtained by DER SPIEGEL show that Hensoldt wanted to discuss "possible technological integrations and development."

The five-year contract, classified as "confidential," was concluded in 2021. It states that "confidential information … subject to a national security classification …" could also be shared with Intellexa. When reached by journalists, Hensoldt explained that the exchange had ended "after a few rounds of talks" and that the confidentiality agreement had, thus, "in fact" been scrapped. The defense contractor said it had not informed the German federal government about the agreement with Intellexa or about the talks.

Where, then, does Berlin really stand? In April, 11 countries pledged in an "anti-spyware" declaration to limit the further spread of Pegasus, Predator and similar digital attack weapons.

Germany was not among the signatories.

The Latest Head in this Surveillance Hydra – and Why the Sellout of Privacy Continues

At some point, any latitude an organization may have had is used up and even the best of contacts are no longer of use. For Stéphane Salies and his team, it took quite some time before that point was reached. In 2011, investigations began into the first Libya deal with Gadhafi. In 2017, the French media reported that proceedings had also been opened into the deal with Egypt.

In response, Salies stepped down as Nexa's CEO, but he remained the head of AMES, its subsidiary in Dubai, which continued to maintain the closest ties with its French sister company.

He also changed his place of residence to Dubai. Thanks to Cerebro and Predator, he could afford a life of luxury. He once stated that he earned around 25,000 euros a month and drove a Porsche Macan and a Mercedes GT valued at around 170,000 euros. He also purchased a villa in Dubai for 1.5 million euros, in addition to his 4-million-euro estate near Paris.

But the bombshell dropped in July 2021. That's when French gendarmes searched the business offices and private quarters of Nexa executives in a raid that lasted two days "due to the amount of physical and digital data," according to the police report. Special investigators with the Central Office for Combating Core International Crimes and Hate Crimes arrested Salies. They questioned him about the role he apparently played as a henchman to despots.

Salies, though, refused to speak with investigators about that, saying that his business dealings were "confidential" and subject to "secrecy." During his interrogation, Salies claimed he had done nothing illegal. He also refused to share the code to unlock his phone and have it examined by officers.

Still, they had enough incriminating material as it was. The gendarmes took the intercepted phone call with German lawyer Kay Höft as the catalyst to investigate the dubious deal with the Haftar camp. The accusation: membership in a criminal organization. Salies maintained that the spyware had not been delivered to Libya. The United Arab Emirates responded to a query by saying that the country strictly abides by United Nations sanctions.

When contacted for comment, the Plath Group's in-house lawyer Höft told DER SPIEGEL that its questions contained a "series of false and, if reported, also reputation-damaging assumptions." He said he could not comment on the content of the reporting, as he is "subject to the legal duty of confidentiality." He suggested contacting Plath directly. But the company is keeping quiet about Höft.

The company also isn’t saying whether it has become the focus of an investigation. Nor would the Plath Group say anything about the dubious business deals engaged in by Nexa and AMES. Instead, a lawyer declared that Plath was never part of the Intellexa Alliance. The lawyer claimed the company had decided to sell its shares in Nexa and AMES in 2018. Why the company then continued to hold onto its stake for another two years despite all the scandals – they didn't say. According to the commercial register, the two Plath representatives didn't even leave the French company's supervisory board until February 2021.

Salies, Nexa and AMES sought to defend themselves in a joint statement in which they claimed they had complied with all "applicable regulations." The companies also said they had been "encouraged" by the French state to enter into some of the contracts that are now the subject of the investigation. In several cases, they claim, they had "simply followed the path taken by France of close cooperation with precisely these countries." According to the statement, all ongoing Predator contracts were terminated after the raid. They also say that Benalla had never been remunerated by Sallies or his associates for the former Macron adviser's activities.

Benalla, President Macron and Elyseé Palace declined to respond to all requests for comment.

And what do the investigations mean for Salies and his businesses? They apparently continue to operate, just under different names and in complicated new structures, just as they did at the time the Gadhafi deal blew up and Amesys in France simply became AMES in Dubai.

In February 2023, Nexa renamed itself RB 42, and it now only operates in the area of defensive cybersecurity, the company has stated. The AMES company was sold to its management. One of the new owners: Stéphane Salies.

Meanwhile, Predator continues to be used to go after people. Distribution rights for the software had already been transferred from Aliada to an Irish holding company called Thalestris in summer 2020. Andrea Gambazzi, a former banker who runs a trust company in Switzerland, acts as the main owner of the company – a classic straw man. He holds 51 percent of the voting rights personally, with the remainder held by unnamed third parties.

It was also Gambazzi who signed the confidentiality agreement with the German defense company Hensoldt. When asked for comment, the company said it had not previously conducted a review of its potential business partner.

The loan from Zossen has also now been funneled to Thalestris. Internal documents suggest that Yoram Roth's direct shareholding was also transferred to the new holding in 2020. When asked if he is still earning money from Predator today, Roth reacted with horror. "I'm shocked. I would never invest in something like that."

He claims the arrangement had been presented to him "as an investment in a tech company that would serve the security of the state of Israel." So far, he said, he has received "no return or reimbursement of any kind." He claimed that he had not been sent sufficient information on the business operations, "even after several queries." He said he had also "written off" the investment from a business perspective back in August 2021. Roth informed DER SPIEGEL that he continues to hold his shares, but only because there have been "no opportunities" to return or sell them.

Other investors wouldn't comment on the substance of the questions, with some instead asking that queries be directed to fund manager Eran Davidson. But Davidson, in turn, issued a statement saying that he also feels bound by confidentiality agreements and will not comment on the matter.

And Tal Dilian, the father of Predator and inventor of the spy van? The CEO of Thalestris is Sara Hamou, a lawyer with Polish citizenship, an expert in offshore companies – and also happens to be Dilian's girlfriend.

Hamou, Dilian and Gambazzi would not comment on the allegations.

The Fighter: "It's a Deal from Hell"

Few politicians in Europe have dealt with spyware and its providers as intensively as Sophie in't Veld. The Dutchwoman is an expert on the surveillance industry's shadow economy. She served as rapporteur on a European Parliament investigative committee triggered by the Pegasus revelations exposed by the investigative network Forbidden Stories.

The findings were alarming: They discovered that journalists, politicians and opposition figures in several European countries have been monitored using spyware. Poland, Hungary and Spain are deeply implicated in these machinations.

In't Veld has called on Tal Dilian to disclose Intellexa's activities, but she never received a substantive answer, instead becoming the target of threats from lawyers. She has also asked Greece and other countries to explain their involvement. "Some were friendly and polite and served us coffee and cookies, but we never got meaningful answers," she says.

The parliamentarian wants to keep fighting, despite the headwinds she's coming up against. In't Veld also has an explanation for the resistance she's been experiencing: All governments, even in Western democracies, are under pressure from their security agencies, which demand the purchase of the most modern spyware available, she says. Otherwise, they argue, they will lose their ability to convict terrorists and criminals in the face of encryption technologies. The makers of the spyware programs, in turn, consistently claim that they are unable to generate enough sales from these few customers alone and should thus be given the freest hand possible. "It's a deal from hell," says in't Veld. "It has never been as bad as it is today."

In't Veld is calling for effective controls to be imposed on the surveillance industry and national governments, with responsibility for that oversight to be placed at the European Union level. Europe, she argues, "must finally wake up" and stop this surveillance nightmare.

https://www.spiegel.de/international/business/the-predator-files-european-spyware-consortium-supplied-despots-and-dictators-a-2fd8043f-c5c1-4b05-b5a6-e8f8b9949978?sara_ecid=nl_upd_1jtzCCtmxpVo9GAZr2b4X8GquyeAc9&nlid=spiegel-international-21-00

 ***Spiegel Staff: Sven Becker, Rafael Buschmann, Max Hoppenstedt, Nicola Naber and Marcel Rosenbach