On the evening of August 13, 2015, after a day spent enjoying the Italian summer with his fiancée at a beach near Genoa, Cristian Provvisionato, a stocky 42-year-old bodyguard with an affable look, noticed he’d missed a call from his boss.
Videos by VICE
“I have an emergency. I need someone to go to Mauritania,” Davide Castro, who worked for the Italian private investigations and security firm Vigilar, told the bodyguard, according to Provvisionato.
Castro, 33, promised it would be an easy job. Provvisionato, he said, would simply have to show up to replace another Italian man who had to return home. He would later have to escort a technician from another company called Wolf Intelligence to a meeting with local government representatives to showcase a product that would allow Mauritania to spy on internet and cellphone users.
“Anyway, don’t worry,” Castro later reassured Provvisionato in an email. “I’m always here for you and you’re not alone.”
The job would pay well: 1,500 euros per week plus a 3,000 euro bonus if the sale was successful. And despite being in a little-known African country, it seemed like a no-brainer—so much so that Provvisionato’s partner recalls prodding him, jokingly saying “if you don’t go, I’ll go myself.”
Little did Provvisionato know what was promised to be an easy job would turn into a nightmare.
Read more: The Hacking Team Defectors
The Italian bodyguard found himself—apparently by accident and without any prior knowledge of it—in the middle of a shady international deal. An agreement that would turn him into a victim of the digital surveillance technology gold rush, where companies from all over the world peddle government agencies the tools to hack and spy on criminals, terrorists, and, sometimes, dissidents and journalists.
Sixteen months later, Provvisionato remains in Mauritania, held by a government upset after a multi-million dollar deal went south. Provvisionato, however, is not in an actual prison. He’s being held, not in a cell, but inside a nondescript base operated by Mauritanian anti-terrorism police. The Italian government said in a statement that he’s being “held in pre-trial detention.”
“I was in the wrong place at the wrong time,” Provvisionato told Motherboard, speaking from his room, where he’s being held awaiting trial for conspiracy, money laundering, and fraud against the state. “I got sent here with deceit. I was unaware of what was going on, and even now it’s hard to figure out what really happened.”
*
A photo of Cristian Provvisionato and Alessandra Gullo during her most recent visit to Mauritania, in early 2017. Photo: Alessandra Gullo
In the last decade, dozens of governments across the world have bought or negotiated the purchase of the sort of surveillance technology Provvisionato was sent to Mauritania to advertise. Italy’s Hacking Team, Germany’s FinFisher, and Israel’s NSO Group are just some of a handful of firms that market such wares exclusively to governments, promising them a relatively cheap and easy way to track wrongdoers and catch criminals. But in several well-documented cases, the governments of countries such as Ethiopia, the UAE, or Mexico have used surveillance tech from private companies to target dissidents, human rights activists, and journalists.
Mauritania, located on the Atlantic Ocean in Western Africa, encompasses the western boundary of the Sahara Desert, and is mostly arid. Despite being roughly as large as California and Texas combined, the country only houses around 3.6 million people, most of whom live around its capital Nouakchott and another large city, Nouadhibou.
Mauritanian President Mohamed Ould Abdel Aziz was elected in 2009, a year after he led a military coup to depose the previous president. In the last few years, Aziz’s government has used a hard hand to fight terrorists from al-Qaeda in the Islamic Maghreb and ISIS, but has also been accused of torturing prisoners and going after anti-slavery activists and bloggers. Despite being the 153rd economy in the world, according to the World Bank, it’s not surprising that Mauritania would be interested in a new wave of cheap hacking tools, given the nation’s political and security climates.
Avenue Charles de Gaulle in Nouakchott, Mauritania (Image: Bertramz/Wikimedia Commons)
While Provvisionato’s is clearly a singular case, it shows how regular people can become victims or collateral damage in the spyware gold rush—an unregulated global industry where shady governments often are the main beneficiaries, and companies have no qualms dealing with them.
“This new market of fledgling surveillance vendors operate somewhat loosely with regard to human rights, performing little or inadequate due diligence on potential clients,” said Morgan Marquis-Boire, a researcher and director of security at First Look Media, who’s been studying the spyware industry for more than five years.
By the end of 2014, a Mauritanian government representative had already contacted Hacking Team to inquire about its spyware solution, known as Remote Control System, or RCS. The deal didn’t go through, however: Ahmed Bah dit Hmeida, a counselor to the Mauritanian president, refused Hacking Team’s offer, arguing the product was “too expansive [sic],” according to leaked emails.
Undeterred, Hmeida apparently kept scouring the market and found Wolf Intelligence, a lesser-known German company trying to make its way into the surveillance market.
In a marketing brochure, Wolf Intelligence promises solutions to track suspects through their IP addresses, email, and instant messengers, as well as monitor internet activity, hack into computers and cellphones, and even launch Distributed Denial of Service (DDoS) attacks.
“What we can find for you?” the company’s brochure reads. “Terrorism, Corruption, Drug traffic, Smuggling, Child Pornography, Many more.”
Judging by its marketing material, and how sources described it, Wolf Intelligence is yet another small company trying to shoulder its way in what’s increasingly becoming a crowded spyware market.
“Wolf Intelligence are typical of the type of opportunistic spyware company that has sprung up in the wake of the demise of FinFisher and Hacking Team,” Marquis-Boire told Motherboard.
“He sells a lot of crap.”
But despite its lofty promises, Wolf Intelligence doesn’t appear to have a good reputation in the industry. The company’s co-founder Manish Kumar (who appears in this marketing video) is a “criminal of the worst kind,” according to David Vincenzetti, the CEO of Hacking Team, which dealt with Kumar years ago. Motherboard spoke with three other people who had done business with Kumar in the surveillance tech industry; none of them wished to be named out of security concerns, but all independently described Kumar as “a scammer.”
“In terms of products he sells a lot of crap,” one source said.
Kumar, who describes himself on Skype as an [sic] “expert in itsecurity and hacking with zero day exploits,” did not respond to multiple emails and phone calls requesting comment over the past month.
*
GIF by Che Saitta-Zelterman
At the beginning of December 2014, Mauritania and Wolf Intelligence agreed on a deal that would provide the government with 13 hacking and surveillance solutions for $2.5 million. In the following months, Wolf Intelligence started delivering the promised products, and receiving payments for them, according to a written statement sent to Provvisionato’s brother by Castro. According to the email that Castro sent to Provvisionato the day before he left for Mauritania, Kumar had hired Castro’s Vigilar to be the intermediary in the sales of Wolf Intelligence’s products in Europe and Africa.
Castro declined to answer a series of questions via email, arguing that the “situation forces me to collaborate exclusively with the judicial authorities in order to try to find a solution to the unfortunate situation Cristian Provvisionato finds himself in,” but not with journalists.
As insurance, Castro recalled in his statement, the Mauritanian government held the passport of Wolf Intelligence’s employees when they visited the country in early 2015. Then, on February 2, 2015, the relationship started to go sour. On that day, Hmeida threatened Kumar, asking him to deliver the 13th product for free or else he wouldn’t be able to leave the country.
According to another source, a spyware industry veteran who is familiar with logistical aspects of the sale, the deal was structured in 13 deliveries because Wolf Intelligence planned to break down its product into several different modules. The final one was an exploit to hack remotely into cellphones, likely ones running Android, according to the source, who asked to remain anonymous due to professional concerns.
But for some reason, Kumar and Wolf Intelligence couldn’t deliver that exploit. During an initial phone call, which Hmeida answered, and where we identified as journalists, we were unable to hear his voice. Since then, Hmeida did not answer multiple follow up phone calls. He also didn’t respond to two emails.
Xavier Lalanne-Tauzia/VICE
Meanwhile, Wolf Intelligence had started working with Vigilar and Castro, who even opened an affiliate company in Spain called V-Mind—short for Vigilar Monitoring Intelligence Enforcement Division—apparently just to work with Kumar. (V-Mind, according to Spanish public records, no longer exists.) Castro claims he only found out about the Mauritanian deal when Kumar asked him to send one of his employees there, but in the email he sent to Provvisionato, Castro said he had been managing “exclusively” Wolf Intelligence’s business in Africa and Europe.
In July 2015, when Kumar asked Castro to send someone from his company to Mauritania, Castro sent Leonida Reitano, an Italian citizen who claims to be an investigative journalist and an expert in open source intelligence. Reitano claimed to be an occasional consultant with Vigilar, with whom he collaborated only four times in the last three years. Reitano said in an email that he met Davide Castro at a course Reitano taught in 2014.
While there, Reitano seemed worried when he texted a friend, saying he didn’t know when he was coming back home since “it was all a bit of a mess” in Mauritania, according to a screenshot of the conversation obtained by Motherboard. (Reitano contacted Motherboard after publication to clarify that he wasn’t that worried. “That sentence actually referred to the meeting delays,” said Reitano, who did not respond to repeated requests for comment while this story was being reported.) At that point, Reitano had been in the country for three weeks and the deal still wasn’t done. In his statement, Castro claimed Mauritania had also failed to pay.
At the time, Castro was with Kumar in Valencia, Spain, according to a screenshot of a picture of the two men posted on Facebook, which Castro shared with Provvisionato’s partner to reassure her he knew Kumar well.
Davide Castro (right) posing in Valencia, Spain. with someone he claimed was Manish Kumar, but actually wasn’t.
According to Provvisionato’s family, however, Castro knew what the bodyguard was getting into, and sent him with the specific goal of liberating Reitano.
Provvisionato’s partner, Alessandra Gullo, told Motherboard that “Castro later said ‘I had to fight with my parents because I wanted to go myself. I was supposed to be there instead of Cristian.’”
“What stopped him from going?” she said.
Reitano, for his part, said he was a “victim” as well.
“It was just pure fate that it was him and not me,” Reitano told Motherboard in an email exchange, adding that he offered a report of what had happened to Provvisionato’s family “but they didn’t give a shit. So for me the matter is closed.”
Reitano declined to arrange a telephone or live interview, nor to send the report, but attacked Castro, saying he will sue him because “it would be unfair for the person who got me into this story to come out unscathed.”
Fate or not, Provvisionato flew to Mauritania’s capital Nouakchott on August 16, where Reitano and government representatives greeted him at the airport. After they took his passport, Provvisionato was driven to his rental apartment. A few days later, while Provvisionato was waiting for the Wolf Intelligence technician he was supposed to meet, he took Reitano back to the airport to fly back to Italy, as Provvisionato explained to Motherboard over the phone.
“I’m starting to smell some dirt,” Provvisionato told his brother Maurizio in a chat, according to Maurizio.
A chat transcript, which Reitano sent us after the publication of the article, reveals that Reitano and Provvisionato had been in touch while Provvisionato was waiting for the meeting in the rental apartment in Nouakchott. Reitano asked him from Italy if there were any news and from the tone of the chat, it seems like the two were friendly. Provvisionato also told Reitano that Kumar gave him the idea of going to the Italian consulate to get his passport back so that he could come back to Italy as soon as possible.
“That’s when I found out they had really fucked me.”
Then, after a few more days waiting for the technician in vain—”left at the mercy of Castro’s lies,” as he put it—Provvisionato tried to get in touch with the Italian consulate in Nouakchott, but couldn’t find anyone there. That’s when Hmeida showed up at his apartment.
“‘There’s no meeting,’” Provvisionato recalled Hmeida saying. “‘Either these people give me the product I’m waiting for or pay back my money or you won’t go back to Italy. Period,’” Hmeida said, according to Provvisionato.
“That’s when I found out they had really fucked me,” Provvisionato said.
After a call with Castro, who tried to mediate and promise he’d solve the issue with Kumar, Hmeida was still threatening Provvisionato.
“‘I hope for your sake that this is true because if these guys don’t give me the product or the money back you’ll never go back home,’” Hmeida said, according to Provvisionato.
A few days later, on September 1, in an attempt to untangle the issue, Castro met with Kumar in Milan, according to Castro’s statement. On the same day, however, three Mauritanian police agents, dressed as civilians, came to Provvisionato’s apartment and asked him to come with them, taking away his cellphone and computer.
The bodyguard didn’t offer any resistance. And the agents didn’t even handcuff him, Provvisionato told Motherboard, speaking from Nouakchott over the cellphone that the Mauritanian government gave him.
“I knew what was happening,” he told Motherboard.
*
Ahmed Bah Dit Hmeida, the Mauritanian president’s counselor who negotiated the deal with Wolf Intelligence. Illustration: Che Saitta-Zelterman
Sixteen months later, Provvisionato is still far from home, holed up inside the Police base waiting to learn his fate from the authorities.
Provvisionato, who has diabetes, said he lost 66 pounds in the first few months after his arrest, but otherwise has been treated relatively well by authorities. He has a room with three beds, though no one sleeps on the other two. Provvisionato has a stash of food brought from Italy by his family, and uses a closed box as a makeshift table, where he usually has a plate, a glass, and a crossword puzzle, according to his fiancée Gullo, who has visited him a number of times.
Gullo recalls that the first time she visited him in Mauritania, the captain at the base even reassured her that Provvisionato “was doing well,” and told her “don’t worry, he’s coming home soon.”
Provvisionato’s family believes his captors kindness is a sign the Mauritanian government is well aware that Provvisionato did not commit any crime.
“They know he’s innocent,” Provvisionato’s brother Maurizio said.
The Italian government, through its Foreign Ministry, claimed to be working on bringing the bodyguard back home. But Provvisionato’s family feels the government hasn’t done enough. The family has filed complaints through the Italian criminal courts, though these investigations are apparently still in the early stages.
In May 2016, Maurizio went to Mauritania, and along with Italy’s counselor to the Ambassador in Morocco, Paola Maria Russo, met with the government’s Minister of Justice. During the meeting, according to Maurizio, the Minister told them: “Your brother stays here until someone compensates us for the damage we suffered.”
“I don’t give a fuck about what really happened. I don’t care. I only want whoever screwed up to come here and clean up their mess.”
Meanwhile, none of the other characters in this story want to take responsibility for Provvisionato’s plight.
Kumar, who seems to be the key behind this web of confusion, did not answer any of Motherboard’s attempts to reach him, and has kept noticeably silent in the past few months, despite Provvisionato’s story getting some attention in the Italian media. In one of his only public statements on the matter, Kumar told Africa Express that Provvisionato “was unfairly arrested, because he did not commit any crime and doesn’t even know anything about the issue.”
Davide Castro also didn’t answer a long list of questions Motherboard sent him via email, and declined to arrange a phone interview.
Castro’s father, Francesco, who owns Vigilar, also declined to answer our questions, citing an ongoing court dispute. When Motherboard reached him by phone, Francesco said his son had been “swindled.”
“Vigilar has nothing to do with this. My son has suffered a huge and grave scam from these damned Indians from Dubai,” Francesco Castro told Motherboard, referring to Wolf Intelligence. “These guys [Wolf Intelligence] have turned out to be exploiters, windbags, crooks.”
Francesco, on the left, and Davide Castro, on the right, stand with a guest in a promotional photo shot at the Vigilar offices in Milan. Photo: Vigilar/Facebook
Francesco even said “there was never” a relationship with Wolf Intelligence. Yet, Davide told Provvisionato in an email that he had founded V-Mind after a series of meetings with Wolf Intelligence in Milan, Dubai, and India, and after “earning Kumar’s trust.” In the same email, Davide also added that Reitano had represented Wolf Intelligence at a South African defense conference. Davide also said that for him, Kumar was “like a brother,” Provvisionato recalled.
At this point, the true extent of Vigilar, and Davide Castro’s, relationship with Kumar and Wolf Intelligence is unclear.
Provvisionato’s family is convinced the Castros sent Cristian to Mauritania simply to get Reitano out. After his arrest, neither Davide nor Francesco Castro have called him, Provvisionato said. “Not even to apologize.”
As Provvisionato’s mother, Doina Coman, asked: “What do you call this if not a prisoner’s exchange?”
From right to left: Provvisionato’s parents Doina Coman and Carmine Provvisionato, and Provvisionato’s partner Alessandra Gullo. Photo: Lorenzo Franceschi-Bicchierai/Motherboard
In late December 2016, as citizens were rushing to buy last-minute Christmas gifts, Motherboard met Provvisionato’s partner and parents in downtown Milan. Strolling through the streets with Cistian’s family, Doina, letting out a deep sigh, said she wished her son could come home for the holidays.
Ultimately, what really happened, and who swindled whom, doesn’t matter to his family.
“In the end, I don’t even want them to tell me the truth,” Doina said. “All I want is for them to call me and tell me: ‘Your son is coming back home.’”
The full, true story of how a bodyguard became collateral in a multi-million dollar deal went wrong, spending month over month in detention, remains a mystery. The only thing that seems certain is that Provvisionato had nothing to do with it.
“The real ‘criminals’ and fraudsters are all on the loose. The only one who got scammed is the one who’s paying the price,” Provvisionato told Motherboard, referring to himself. “If this is justice…” he trailed off.
But Provvisionato doesn’t seem to care who the real criminals or scammers are.
“I think that the truth, in the end, might never come out,” he added. “I’ve always said I don’t give a fuck about what really happened. I don’t care. I only want whoever screwed up to come here and clean up their mess. Period. And I want to go home and back to my life.”
Federico Formica is a freelance journalist from Rome, Italy.
A previous version of this article identified the man posing next to Davide Castro in a Facebook picture as Manish Kumar, but that man is actually someone else. We regret the error.
This story has been updated to include comments Reitano provided Motherboard after publication.
Get six of our favorite Motherboard stories every day by signing up for our newsletter.
