- Messages
- 6,642
- Reactions
- Nation of residence
-
- Nation of origin
-
Advanced surveillance equipment, developed by a company controlled by the former commander of Israeli intelligence’s technology unit, was sold last year to the government of Bangladesh, official government documents and international export records show, despite Bangladesh not being on Israel's list of countries that such technology may be sold to - and despite its consistently poor human rights record.
The equipment, which is used to intercept mobile and internet traffic, was sold to the National Telecommunication Monitoring Center, or NTMC, an arm of the Bangladeshi Interior Ministry responsible for tracking internet and social media use inside the country, as well as for online censorship and eavesdropping on citizens.
Bangladesh is the third-largest Muslim country in the world, and does not recognize Israel. The two countries have no diplomatic relations, and until 2021, all Bangladeshi passports had “This passport is valid for all countries of the world except Israel” written on them.
Passitora, a firm registered in Cyprus, is controlled by Tal Dilian, an Israeli businessman and former intel commander. Under its previous name WiSpear, it was involved in a scandal that began with a boastful interview Dilian gave to Forbes, in which he revealed the existence of the company’s SpearHead system, which includes a van equipped with surveillance equipment and tracking software, that gathers data from mobile phones via cellular and Wi-Fi networks, including encrypted WhatsApp messages, Facebook chats, contact lists, calls and text messages within a radius of about half a kilometer. A presentation on WiSpear claims the system can be used to inject spyware on computers and mobile phones within its range.
The Forbes report embarrassed the government in Cyprus, creating political turmoil and leading to an investigation into violations of European Union privacy laws. In the end, all the allegations against Dilian and top company executives were dropped, but WiSpear was fined one million euros (about $1.1 million) for “extracting data unlawfully” from the devices of passersby at the Larnaca Airport.
Export records show that in June 2022, a SpearHead system was delivered from Switzerland to the Bangladeshi capital of Dhaka. The supplier was Passitora, and the buyer was NTMC. The shipment, weighing 991 kilograms, included the interception system, operating software and hardware components (servers, drives, monitors, etc.) at a total cost of $5.7 million.
Passitora is part of the Intellexa Alliance, a network of companies run by Dilian that acquired an array of sophisticated surveillance technologies, including mobile phone hacking spyware, that it sells to government agencies around the world. A Haaretz investigation revealed the network and a plane linked to Dilian, which delivered advanced spying equipment to a notorious militia in Sudan in May 2022.
Sources in Israel’s cyberarms industry say the company’s operations are not overseen by the Israeli government. Amir Eshel, the outgoing Defense Ministry director general, spoke to The New York Times in December about his inability to rein in Dilian and others who set companies abroad. “It certainly disturbs me that a veteran of our intelligence and cyber units, who employs other former senior officials, operates around the world without any oversight,” Eshel said.
The Israeli Defense Ministry did not specifically address Haaretz questions on whether it oversees Passitora and the other firms mentioned in this report, and whether it approved the spyware sales to Bangladesh, and said this in response: “The Defense Ministry acts, and will act, to enforce unapproved defense exports, including services and knowhow - according to its legal authority. As a rule, the ministry does not divulge information on the defense export policy, for security, diplomatic and strategic considerations”.
The government's preferred weapon
Over the last decade, intelligence bodies, the police and armed forces in Bangladesh have developed a huge appetite for advanced monitoring and spy technology, according to the organization Privacy International. Official government documents prohibit accepting bids from Israel, but it appears that in the area of cyberweapons, Bangladesh is ready to make an exception to the rule. Likewise, Israeli companies are formally banned from doing business with Bangladesh, but the exceptions seem to prove there is no longer much substance behind that rule.
In 2021, Haaretz reported that the Israeli company Cellebrite had sold mobile phone hacking tools to a notorious Bangladeshi police unit, the Rapid Action Battalion, whose leaders are subject to U.S. sanctions due to its alleged role in the disappearance of thousands of people, horrific torture and human rights violations. Al-Jazeera revealed that another Israeli company, Picsix, sold Bangladesh’s military intelligence a mobile phone surveillance and hacking system for intercepting phone transmissions.
But official documents cited in this report reveal for the first time four other transactions for the purchase of Israeli spy technology by Bangladeshi government agencies involved in human rights violations. The technology enables them to surveil Bangladeshi citizens through their phone and to hack wireless networks and monitor internet traffic.
The companies are either Israeli or foreign with a clear link to Israel, and some of the exports are by firms registered in the Virgin Islands, Cyprus and Singapore who seemingly act solely as middlemen.
NTMC, the Interior Ministry arm that bought the SpearHead system, was formed in 2013 and deals, according to reports, with eavesdropping on opposition officials, protestors and ordinary citizens. It is the “Bangladeshi government's largest legal interception system … that is connected with about 250 communications providers in the country,” admitted one of its former senior officials. Every provider is required to give NTMC full access to traffic on their networks.
NTMC’s Director General is Maj. Gen. Ziaul Ahsan, who previously held a series of operational and intelligence posts in the Rapid Action Battalion. A former Bangladesh army chief, Aziz Ahmed, claims that Ahsan is personally responsible for many of the disappearances that have occurred in the country.
“Today, there’s no significant political opposition in Bangladesh – the government has the will and the means to suppress its political opponents," says Zulkarnain Saer Khan. A Bangladeshi journalist who now lives in exile, Saer Khan has exposed political oppression in his country and took part in this investigation.
“Bangladesh isn’t capable of providing its citizens with basic infrastructure, but government agencies enjoy the best modern spy technology money can buy. Draconian laws have turned it into the government’s preferred weapon for silencing and intimidating journalists, critics and political activists. Negative propaganda against the father of the nation – the father of the current prime minister – can end in 14 years in prison,” he says.
Two of Khan’s colleagues were persecuted by the authorities after they criticized the government: cartoonist Ahmed Kabir Kishore was detained for 10 months during which he was severely tortured; and the writer-journalist Mushtaq Ahmed who was arrested, tortured and died while in custody. Photographer Shahidul Alam was arrested in a similar manner after he criticized the government on an Al-Jazeera interview. He was also tortured while in detention and released after 100 days.
Training trips to Greece
In June 2021, the Bangladeshi cabinet decided to buy a “Vehicle Mounted Mobile Interceptor” spy vehicle, which is equipped with, among other things, technology to intercept mobile phone calls and text messages, locate the user and hack into wireless networks. According to an official cabinet document, two companies bid to supply the technology, and the one that was chosen was a Swiss company, Toru Group Limited.
There is no company that goes by that name in the Swiss companies registry, but a company that does have that name is registered in the British Virgin Islands. It has a Geneva address that is used by a firm that provides foreign registration services for companies.
According to a very general description on Toru’s website and LinkedIn page, the company is a “world-leading provider of Cyber Security and Defense solutions… your One-Stop-Shop which caters to all your Security & Defense needs.” But there is no indication of what sort of “solutions” the company offers, and a search of patents connected with it revealed nothing.
The company's CEO is Assaf Elias, an Israeli citizen, according to profiles on LinkedIn and Facebook. Until recently, Elias was a minority shareholder in another company registered in Britain, together with several prominent figures in the Israeli cyberoffensive industry.
Toru’s website makes no reference to the sort of spy vehicle that Bangladesh purchased from the company. As far as it is known, none of Elias’ partners in the British company make such a vehicle. The one who does make one is Dilian, owner of Passitora. Sales pitches by another Dilian firm showcased the spy van alongside the SpearHead Wi-Fi interception system, the type which according to export records was shipped to Bangladesh last June. According to three sources, Toru Group, headed by Elias, acted as a middleman for various deals with Dilian’s firms.
Official documents from Bangladesh’s Interior Ministry reveal that the commander of the NTMC and other senior officials flew to Greece in 2021 and 2022 to train on the spy vehicle they had bought. According to the documents, the trips “were fully funded by Toru.”
By that time, Dilian had already moved his headquarters to Athens after his entanglements in Cyprus. According to past reports, the office had set aside an area with prayer mats for teams coming for training from Muslim countries like Bangladesh.
NTMC’s budget shows that the system was expected to arrive in Bangladesh in mid-2022. Shipping documents show that the system was delivered at the end of June. Two sources in Bangladesh say that a new, advanced spy van is already in service, with its surveillance tools leading to the firing of seven police officers who allegedly criticized the government on a secret WhatsApp group and communicated with figures in the BNP opposition party.
Passitora and Dilian did not respond to requests for comment. When reached for a response, Elias hung up and declined to comment.
Not just Big Brother on wheels
The cyber shopping spree didn’t end here. An official document from the prime minister's office dating from 2019 shows that Bangladesh’s internal intelligence agency, or NSI, also bought a system for intercepting Wi-Fi communications from a company called Prelysis.
That year, four senior NSI officials went to Cyprus to inspect the system before it was shipped to Bangladesh. Cypriot export records show a July 2019 Wi-Fi interception system shipped from Prelysis to Bangladesh at a total cost of about $3 million.
Prelysis is registered in Israel and Cyprus under slightly different names. The Cypriot firm is “dormant”, while the official document from Bangladesh has the Israeli firm’s name. Its website says it is “a consultancy and integration company in the intelligence and homeland security domain.” It boasts a platform that integrates various intelligence sources, including wireless and cellular communication sensors and device location. The founder of the company and its current director, Israeli citizen Kobi Naveh, worked until 2014 at Verint.
In reply to an “Haaretz” inquiry, into whether Prelysis is overseen by Israel’s Defense Ministry and whether it OK’d the deal, Naveh said he “cannot respond”.
Israel-Singapore-Cyprus-Bangladesh
Sources in Israel’s cyber industry say Bangladesh isn’t on the list of countries that the Israeli defense establishment approves for exports of classified technology, due to concerns that it will fall into the hands of Pakistan. They say that in the past year, the list of countries approved for cyberoffensive exports has been whittled down to just 37, most of them Western democracies. The Defense Ministry consistently refuses to respond or divulge any information on the list of approved countries.
Cyprus' export records from July 2019 show another shipment for the Bangladeshi military – this time for equipment used for the “active monitoring of mobile phones” – at a cost of $1.6 million. The supplier is Coralco Tech, of Singapore. A tender by the Bangladesh Army from 2018 shows that the military was indeed interested in systems for active and passive tracking and locating of mobile phones.
On its now-inactive website and LinkedIn page, the company describes itself as “a global cutting-edge espionage & telecommunications technologies company for private government sectors. Delivering the highest level of professionalism and service in covert operations.” It offers "tactical and strategic" interception of cellular and Wi-Fi communications and tracking of mobile phones.
On Singapore’s companies registrar, Israeli Eyal Almog is listed as Coralco Tech’s owner. In Israel, the company is registered under the same name and address, and with the same owner. Almog's LinkedIn page carries endorsements from his friends in the cybersecurity, defense, intelligence and homeland security communities. Some of them worked with him. One of them, a Bangladeshi national, says that as a local expert he installed various systems to intercept cellular communications and helped connect telecom providers to the NTMC's surveillance system.
In response to this report, Coralco Tech said that “due to the nature of its deals, the company does not comment on the identity of its clients and the products that they buy. In general, all deals involving the company are fully reported while attaining the proper licenses from the regulatory bodies, including Israel’s Defense Ministry. The company sells its products after an internal vetting process that takes into account human rights violations”.
Cyprus export records reveal that another company, U-TX Technologies, provided surveillance equipment to Bangladesh. This includes a “Web Intelligence” system, valued at $2 million and delivered to NTMC in 2019; and a cellular tracking system for military intelligence, valued at $500,000, in 2021.
U-TX was set up in Cyprus by Israelis – it is registered and operates from the island. It is helmed by CEO David Heled and at least two other Israelis are managers in the company. In 2014, U-TX was purchased by Verint, which is traded on the Nasdaq and offers artificial intelligence and data-analysis technologies. Verint has also sold advanced cyberespionage tools to oppressive regimes like those in South Sudan, Uzbekistan and Kazakhstan, investigations over the past decade revealed.
In 2021, Verint spun off its security operations into a new company called Cognyte, which shares an address with Verint in Herzliya, Israel and supplies the same cybersecurity services Verint once did. U-TX operates today under the name Cognyte.
U-TX, Cognyte and Heled did not respond to requests for comment. No response about the purchase of Israeli spyware was received from Bangladesh’s Interior and Foreign Ministries.
Jurre van Bergen and Sharad Vyas of OCCRP and Zulkarnain Saer Khan took part in this investigation.
The equipment, which is used to intercept mobile and internet traffic, was sold to the National Telecommunication Monitoring Center, or NTMC, an arm of the Bangladeshi Interior Ministry responsible for tracking internet and social media use inside the country, as well as for online censorship and eavesdropping on citizens.
Bangladesh is the third-largest Muslim country in the world, and does not recognize Israel. The two countries have no diplomatic relations, and until 2021, all Bangladeshi passports had “This passport is valid for all countries of the world except Israel” written on them.
Passitora, a firm registered in Cyprus, is controlled by Tal Dilian, an Israeli businessman and former intel commander. Under its previous name WiSpear, it was involved in a scandal that began with a boastful interview Dilian gave to Forbes, in which he revealed the existence of the company’s SpearHead system, which includes a van equipped with surveillance equipment and tracking software, that gathers data from mobile phones via cellular and Wi-Fi networks, including encrypted WhatsApp messages, Facebook chats, contact lists, calls and text messages within a radius of about half a kilometer. A presentation on WiSpear claims the system can be used to inject spyware on computers and mobile phones within its range.
The Forbes report embarrassed the government in Cyprus, creating political turmoil and leading to an investigation into violations of European Union privacy laws. In the end, all the allegations against Dilian and top company executives were dropped, but WiSpear was fined one million euros (about $1.1 million) for “extracting data unlawfully” from the devices of passersby at the Larnaca Airport.
Export records show that in June 2022, a SpearHead system was delivered from Switzerland to the Bangladeshi capital of Dhaka. The supplier was Passitora, and the buyer was NTMC. The shipment, weighing 991 kilograms, included the interception system, operating software and hardware components (servers, drives, monitors, etc.) at a total cost of $5.7 million.
Passitora is part of the Intellexa Alliance, a network of companies run by Dilian that acquired an array of sophisticated surveillance technologies, including mobile phone hacking spyware, that it sells to government agencies around the world. A Haaretz investigation revealed the network and a plane linked to Dilian, which delivered advanced spying equipment to a notorious militia in Sudan in May 2022.
Sources in Israel’s cyberarms industry say the company’s operations are not overseen by the Israeli government. Amir Eshel, the outgoing Defense Ministry director general, spoke to The New York Times in December about his inability to rein in Dilian and others who set companies abroad. “It certainly disturbs me that a veteran of our intelligence and cyber units, who employs other former senior officials, operates around the world without any oversight,” Eshel said.
The Israeli Defense Ministry did not specifically address Haaretz questions on whether it oversees Passitora and the other firms mentioned in this report, and whether it approved the spyware sales to Bangladesh, and said this in response: “The Defense Ministry acts, and will act, to enforce unapproved defense exports, including services and knowhow - according to its legal authority. As a rule, the ministry does not divulge information on the defense export policy, for security, diplomatic and strategic considerations”.
The government's preferred weapon
Over the last decade, intelligence bodies, the police and armed forces in Bangladesh have developed a huge appetite for advanced monitoring and spy technology, according to the organization Privacy International. Official government documents prohibit accepting bids from Israel, but it appears that in the area of cyberweapons, Bangladesh is ready to make an exception to the rule. Likewise, Israeli companies are formally banned from doing business with Bangladesh, but the exceptions seem to prove there is no longer much substance behind that rule.
In 2021, Haaretz reported that the Israeli company Cellebrite had sold mobile phone hacking tools to a notorious Bangladeshi police unit, the Rapid Action Battalion, whose leaders are subject to U.S. sanctions due to its alleged role in the disappearance of thousands of people, horrific torture and human rights violations. Al-Jazeera revealed that another Israeli company, Picsix, sold Bangladesh’s military intelligence a mobile phone surveillance and hacking system for intercepting phone transmissions.
But official documents cited in this report reveal for the first time four other transactions for the purchase of Israeli spy technology by Bangladeshi government agencies involved in human rights violations. The technology enables them to surveil Bangladeshi citizens through their phone and to hack wireless networks and monitor internet traffic.
The companies are either Israeli or foreign with a clear link to Israel, and some of the exports are by firms registered in the Virgin Islands, Cyprus and Singapore who seemingly act solely as middlemen.
NTMC, the Interior Ministry arm that bought the SpearHead system, was formed in 2013 and deals, according to reports, with eavesdropping on opposition officials, protestors and ordinary citizens. It is the “Bangladeshi government's largest legal interception system … that is connected with about 250 communications providers in the country,” admitted one of its former senior officials. Every provider is required to give NTMC full access to traffic on their networks.
NTMC’s Director General is Maj. Gen. Ziaul Ahsan, who previously held a series of operational and intelligence posts in the Rapid Action Battalion. A former Bangladesh army chief, Aziz Ahmed, claims that Ahsan is personally responsible for many of the disappearances that have occurred in the country.
“Today, there’s no significant political opposition in Bangladesh – the government has the will and the means to suppress its political opponents," says Zulkarnain Saer Khan. A Bangladeshi journalist who now lives in exile, Saer Khan has exposed political oppression in his country and took part in this investigation.
“Bangladesh isn’t capable of providing its citizens with basic infrastructure, but government agencies enjoy the best modern spy technology money can buy. Draconian laws have turned it into the government’s preferred weapon for silencing and intimidating journalists, critics and political activists. Negative propaganda against the father of the nation – the father of the current prime minister – can end in 14 years in prison,” he says.
Two of Khan’s colleagues were persecuted by the authorities after they criticized the government: cartoonist Ahmed Kabir Kishore was detained for 10 months during which he was severely tortured; and the writer-journalist Mushtaq Ahmed who was arrested, tortured and died while in custody. Photographer Shahidul Alam was arrested in a similar manner after he criticized the government on an Al-Jazeera interview. He was also tortured while in detention and released after 100 days.
Training trips to Greece
In June 2021, the Bangladeshi cabinet decided to buy a “Vehicle Mounted Mobile Interceptor” spy vehicle, which is equipped with, among other things, technology to intercept mobile phone calls and text messages, locate the user and hack into wireless networks. According to an official cabinet document, two companies bid to supply the technology, and the one that was chosen was a Swiss company, Toru Group Limited.
There is no company that goes by that name in the Swiss companies registry, but a company that does have that name is registered in the British Virgin Islands. It has a Geneva address that is used by a firm that provides foreign registration services for companies.
According to a very general description on Toru’s website and LinkedIn page, the company is a “world-leading provider of Cyber Security and Defense solutions… your One-Stop-Shop which caters to all your Security & Defense needs.” But there is no indication of what sort of “solutions” the company offers, and a search of patents connected with it revealed nothing.
The company's CEO is Assaf Elias, an Israeli citizen, according to profiles on LinkedIn and Facebook. Until recently, Elias was a minority shareholder in another company registered in Britain, together with several prominent figures in the Israeli cyberoffensive industry.
Toru’s website makes no reference to the sort of spy vehicle that Bangladesh purchased from the company. As far as it is known, none of Elias’ partners in the British company make such a vehicle. The one who does make one is Dilian, owner of Passitora. Sales pitches by another Dilian firm showcased the spy van alongside the SpearHead Wi-Fi interception system, the type which according to export records was shipped to Bangladesh last June. According to three sources, Toru Group, headed by Elias, acted as a middleman for various deals with Dilian’s firms.
Official documents from Bangladesh’s Interior Ministry reveal that the commander of the NTMC and other senior officials flew to Greece in 2021 and 2022 to train on the spy vehicle they had bought. According to the documents, the trips “were fully funded by Toru.”
By that time, Dilian had already moved his headquarters to Athens after his entanglements in Cyprus. According to past reports, the office had set aside an area with prayer mats for teams coming for training from Muslim countries like Bangladesh.
NTMC’s budget shows that the system was expected to arrive in Bangladesh in mid-2022. Shipping documents show that the system was delivered at the end of June. Two sources in Bangladesh say that a new, advanced spy van is already in service, with its surveillance tools leading to the firing of seven police officers who allegedly criticized the government on a secret WhatsApp group and communicated with figures in the BNP opposition party.
Passitora and Dilian did not respond to requests for comment. When reached for a response, Elias hung up and declined to comment.
Not just Big Brother on wheels
The cyber shopping spree didn’t end here. An official document from the prime minister's office dating from 2019 shows that Bangladesh’s internal intelligence agency, or NSI, also bought a system for intercepting Wi-Fi communications from a company called Prelysis.
That year, four senior NSI officials went to Cyprus to inspect the system before it was shipped to Bangladesh. Cypriot export records show a July 2019 Wi-Fi interception system shipped from Prelysis to Bangladesh at a total cost of about $3 million.
Prelysis is registered in Israel and Cyprus under slightly different names. The Cypriot firm is “dormant”, while the official document from Bangladesh has the Israeli firm’s name. Its website says it is “a consultancy and integration company in the intelligence and homeland security domain.” It boasts a platform that integrates various intelligence sources, including wireless and cellular communication sensors and device location. The founder of the company and its current director, Israeli citizen Kobi Naveh, worked until 2014 at Verint.
In reply to an “Haaretz” inquiry, into whether Prelysis is overseen by Israel’s Defense Ministry and whether it OK’d the deal, Naveh said he “cannot respond”.
Israel-Singapore-Cyprus-Bangladesh
Sources in Israel’s cyber industry say Bangladesh isn’t on the list of countries that the Israeli defense establishment approves for exports of classified technology, due to concerns that it will fall into the hands of Pakistan. They say that in the past year, the list of countries approved for cyberoffensive exports has been whittled down to just 37, most of them Western democracies. The Defense Ministry consistently refuses to respond or divulge any information on the list of approved countries.
Cyprus' export records from July 2019 show another shipment for the Bangladeshi military – this time for equipment used for the “active monitoring of mobile phones” – at a cost of $1.6 million. The supplier is Coralco Tech, of Singapore. A tender by the Bangladesh Army from 2018 shows that the military was indeed interested in systems for active and passive tracking and locating of mobile phones.
On its now-inactive website and LinkedIn page, the company describes itself as “a global cutting-edge espionage & telecommunications technologies company for private government sectors. Delivering the highest level of professionalism and service in covert operations.” It offers "tactical and strategic" interception of cellular and Wi-Fi communications and tracking of mobile phones.
On Singapore’s companies registrar, Israeli Eyal Almog is listed as Coralco Tech’s owner. In Israel, the company is registered under the same name and address, and with the same owner. Almog's LinkedIn page carries endorsements from his friends in the cybersecurity, defense, intelligence and homeland security communities. Some of them worked with him. One of them, a Bangladeshi national, says that as a local expert he installed various systems to intercept cellular communications and helped connect telecom providers to the NTMC's surveillance system.
In response to this report, Coralco Tech said that “due to the nature of its deals, the company does not comment on the identity of its clients and the products that they buy. In general, all deals involving the company are fully reported while attaining the proper licenses from the regulatory bodies, including Israel’s Defense Ministry. The company sells its products after an internal vetting process that takes into account human rights violations”.
Cyprus export records reveal that another company, U-TX Technologies, provided surveillance equipment to Bangladesh. This includes a “Web Intelligence” system, valued at $2 million and delivered to NTMC in 2019; and a cellular tracking system for military intelligence, valued at $500,000, in 2021.
U-TX was set up in Cyprus by Israelis – it is registered and operates from the island. It is helmed by CEO David Heled and at least two other Israelis are managers in the company. In 2014, U-TX was purchased by Verint, which is traded on the Nasdaq and offers artificial intelligence and data-analysis technologies. Verint has also sold advanced cyberespionage tools to oppressive regimes like those in South Sudan, Uzbekistan and Kazakhstan, investigations over the past decade revealed.
In 2021, Verint spun off its security operations into a new company called Cognyte, which shares an address with Verint in Herzliya, Israel and supplies the same cybersecurity services Verint once did. U-TX operates today under the name Cognyte.
U-TX, Cognyte and Heled did not respond to requests for comment. No response about the purchase of Israeli spyware was received from Bangladesh’s Interior and Foreign Ministries.
Jurre van Bergen and Sharad Vyas of OCCRP and Zulkarnain Saer Khan took part in this investigation.
