The 2015 breach of spyware vendor Hacking Team seemed like it should have ended the company. Hacking Team was thoroughly owned, with its once-secret list of customers, internal emails, and spyware source code leaked online for anyone to see. But nearly three years later, the company trudges on, in large part thanks to a cash influx in 2016 from a mysterious investor who had been publicly unknown until now.
The hack hurt the company’s reputation and bottom line: Hacking Team lost customers, was struggling to make new ones, and several key employees left. Three years later—after the appearance of this new investor—the company appears to have stopped the bleeding. The company registered around $1 million in losses in 2015, but bounced back with around $600,000 in profits in 2016.
Videos by VICE
Motherboard has learned that this apparent recovery is in part thanks to the new investor, who appears to be from Saudi Arabia—and whose lawyer’s name matches that of a prominent Saudi attorney who regularly works for the Saudi Arabian government and facilitates deals between the government and international companies.
Hacking Team sells hacking and surveillance technologies exclusively to government authorities. And it became infamous for selling its wares to authoritarian regimes such as Ethiopia, Sudan, Kazakhstan, and Bahrain, among others.
Got a tip? You can contact this reporter securely on Signal at +1 917 257 1382, OTR chat at lorenzo@jabber.ccc.de, or email lorenzo@motherboard.tv
According to financial records obtained by Motherboard, a company based in Cyprus called Tablem Limited took control of 20 percent of the equity of Hacking Team as of 2016, equivalent to around 44,000 euros (about $55,000) of the company’s total nominal share value, which at the time was 223,572 euros (around $280,000). This investment came a few months after the damaging hack, when the 15-year-old company was hitting rock bottom and its enduring survival seemed unlikely.
Hacking Team co-founder David Vincenzetti owns the other 80 percent of the company, according to the records.
WHO IS BEHIND TABLEM LIMITED?
The reason why Saudi investors, and by proxy, the Saudi Arabian government might have still been interested in Hacking Team’s surveillance technology even after the hack can be explained by the geopolitics of the region. The Saudi government is in the middle of a messy transition, and its rulers are worried about terrorism, Iran, and dissidents among their own citizens, giving them plenty of reason to seek surveillance tools.
Ever since the Arab Spring, the country’s ruling class has expanded its crackdown on freedom of expression, according to Amnesty International’s researcher May Romanos.
“What drives this crackdown is fear of dissent, fear of political opponents and fear of freedom of expression,” Romanos told me in a phone call, adding that Amnesty has heard reports of activists having their email accounts hacked.
Lucie Krahulcova, a policy analyst at Access, a digital rights NGO, told me that “there is evidence that Saudi Arabia imported internet surveillance systems capable of carrying out mass surveillance,” and Access has lobbied for stronger controls to stop European companies from exporting tech to countries like Saudi Arabia, who target journalists and human rights defenders.
“They are even more at risk when the authorities have access to technologies that can turn people’s devices into tools of repression,” she added in an email.
In November of last year, the Saudi government set up a new cybersecurity authority, and government officials have stepped up their rhetoric against dissidents and in favor of online monitoring.
“The Saudi government wanted tools to do espionage on its own citizens.”
In mid 2016, Italian media reported that several Hacking Team investors had stepped away, and that Tablem Limited had stepped in. But at that time no one knew exactly who was behind this company.
Hacking Team’s end of year statement from 2016 (the last financial cycle available online) is accompanied by a copy of the minutes of the shareholders meeting of May 8, 2017. This document, provided to the Italian government and reviewed by Motherboard, finally reveals the names behind the mysterious company.
The document mentions someone named Abdullah Al-Qahtani (spelled both that way, as well as “Alghatani” in a different section of the documents) as the director of Tablem Limited.
According to the document, Abdullah Al-Qahtani was not present for the May meeting at Hacking Team’s headquarters in Milan, but he appointed a lawyer named Khalid Al-Thebity to act as a representative of Tablem Limited. Al-Thebity is a prominent Saudi lawyer who has done work for the Saudi Arabian government for years. Though the Italian government documents name Al-Thebity as Abdullah Al-Qahtani’s lawyer, Motherboard tried multiple times to reach Al-Thebity and his law firm, Squire Patton Boggs, to discuss his involvement but received no response.
Al-Thebity’s public bio and resume, as well as quotes he’s given to other publications, suggest that he regularly works with the Saudi Arabian government to facilitate the entry of international companies into the country.
“Our strategy’s to continue to represent the government and to focus on representing major Saudi corporations,” Al-Thebity told The Lawyer magazine in a 2011 article. “We work closely with international corporations entering the market.”
Al-Thebity has “been representing the Government of Saudi Arabia on several international law matters since 1996,” reads his online bio. According to Squire Patton Boggs, his law firm, Al-Thebity has “represented the Ministry of Communications and Information Technology on the drafting of privacy and data protection legislation.”
Using open-source online information, it’s difficult to tell exactly who Abdullah Al-Qahtani is, or even where he’s from. But people familiar with Hacking Team and business records point to his association with Saudi Arabia’s government.
“The Saudi government wanted tools to do espionage on its own citizens,” said a former Hacking Team employee who asked to remain anonymous because he was still barred from talking about his ex-employer. “There’s the Saudi government behind it, the money comes from them.”
“They were on the brink of bankruptcy, and that’s when David [Vincenzetti] sold his soul to the Saudis to save the company,” he added.
Read more: The Hollowing Middle of the Surveillance Malware Market
Vincenzetti told me in a text message that he isn’t sure who Adbullah Al-Qahtani or Khalid Al-Thebity really are.
“The Saudi government is opaque even for me,” Vincenzetti told me. “I don’t have visibility in the role nor the activities of this person in Saudi [Arabia].”
He then declined to answer any further questions: “I can’t release any comment about this,” he said.
The Al-Qahtani who appears in Hacking Team’s documents is working for the Al-Qahtani Group, also known as Abdel Hadi Abdullah Al-Qahtani & Sons Co., a conglomerate based in Dammam, Saudi Arabia, according to a source who’s familiar with the Italian spyware market. Emails sent to the Al-Qahtani group bounced back.
Abdullah Al-Qahtani could not be reached for comment at the phone number listed on Tablem Limited’s public records, which notes that the company specializes in “exports.” The number appeared to belong to a company called Nobel Trust Limited, a financial consulting firm. When we called, a woman identified herself as working for Nobel Trust. When asked if we could speak with a representative of Tablem Limited, she hung up and put through a voicemail message saying Nobel Trust was closed at the moment.
SAUDI ARABIA AND HACKING TEAM
Saudi Arabian interest in Hacking Team is well documented.
Saudi government agencies have purchased Hacking Team’s spyware since 2010, according to documents leaked by the hacker who broke into the company in 2015.
H.E. Saud Al-Qahtani, the country’s royal court advisor who specializes in online surveillance, was directly in touch with Hacking Team’s top brass in 2015, according to leaked emails.
“Considering your esteemed reputation and professionalism, we here at the Center for Media Monitoring and Analysis at the Saudi Royal Court (THE King Office) would like to be in productive cooperation with you and develop a long and strategic partnership,” H.E. Saud Al-Qahtani wrote in an email to Hacking Team.
H.E. Saud Al-Qahtani is reportedly close to the controversial young crown prince Mohammed bin Salman. H.E. Saud Al-Qahtani has been accused by a prominent local journalist of being an internet troll who tries to frighten dissidents online, and he recently tweeted a veiled threat to put anyone who conspires against the Arab countries on a “blacklist.”
“The man has transgressed a lot,” Saudi writer Turki al-Ruqi, the founder of Al-Wi’am newspaper, wrote in an article last year that H.E. Saud Al-Qahtani has used hackers to target critics of the royal family. “Many of the country’s young men have been his victims.”
We were unable to establish any link between H.E. Saud Al-Qahtani and the Abdullah Al-Qahtani who heads Tablem Limited and invested in Hacking Team.
H.E. Saud Al-Qahtani was recently named head of the Saudi Federation for Cybersecurity and Programming. He did not respond to multiple requests for comment sent over the course of a week.
After the Hacking Team hack, news reports indicated that the Saudi government—through local businessmen—was interested in acquiring a majority stake in Hacking Team as early as 2013.
“They were on the brink of bankruptcy, and that’s when David [Vincenzetti] sold his soul to the Saudis to save the company.”
Then, in early 2016, there were new talks for a potential acquisition, but just like the first ones, the investment didn’t go through. Then, later in 2016, the long-time Italian investors who had shares in the company stepped out, and Vincenzetti increased his shares while also welcoming a new investment from Abdullah Al-Qahtani’s Tablem Limited.
After Abdullah Al-Qahtani’s investment, employees all of a sudden got a salary increase, which was designed to stop them from leaving the company, as many had done after the hack, according to former Hacking Team employees who are still aware of goings on at the company. In 2015, at the time of the hack, the company had 45 employees, according to an undated leaked document that lists all the company’s employees. As of September of 2017, the company has 31 employees, up from 26 at the beginning of last year, according to the financial documents.
Abdulah Al-Qahtani’s investment in Hacking Team might have been a way to go from being simple customers to having a voice in shaping the direction of the company. Hacking Team’s financial woes might have worked to the investor’s advantage, proving to be a cheap opportunity to acquire technology that still works to spy in many cases, people familiar with Hacking Team’s products told me.
The Saudi Arabia government might have seen in Hacking Team an opportunity to step up its capabilities, as other gulf states are also heavily investing in internet surveillance and hacking.
“Given how much the United Arab Emirates have invested in the technology, the Saudis wanted to do the same,” the second former Hacking Team employee told me, referring to Dark Matter, a fledgling—and controversial—Dubai-based surveillance and hacking company that’s been hiring former CIA agents and NSA hackers to bolster the country’s surveillance apparatus..
“And Vincenzetti has been good at marketing the company,” he added.
Get six of our favorite Motherboard stories every day by signing up for our newsletter.
