Greek Ministry of Foreign Affairs secret investigation reveals spyware export licenses

So far, the main protagonists in the so-called wiretapping scandal, also known as Predatorgate, is the Greek National Intelligence Service (EYP), directly under Prime Minister Kyriakos Mitsotakis, two companies and three entrepreneurs.

The first of the two companies in the spotlight is Intellexa, founded by Tal Dilian, an Israeli-born businessman and former commander of an elite Israeli military technology unit. Intellexa markets Predator spy software - which was proven to have been used against the same targets in Greece as those targeted by EYP, i.e. people who were also under state surveillance for "national security" reasons. The second company is Krikel, a company indirectly controlled by businessman Yannis Lavranos. Since 2018, Krikel has signed seven contracts with the Ministry of Citizen Protection, six of which were classified as confidential. Krikel also participated in the provision of the legal wiretapping system that EYP bought in 2020 from the Italian company RCS Labs. Krikel and Intellexa – as revealed by inside story – have been linked through banking transactions since 2020. Besides Dilian and Lavranos, the third businessman who has been in the spotlight is Felix Bitzios, shareholder in Intellexa with 35%, who maintains relations with Yiannis Lavranos.

To date, the lines drawn by inside story investigations connect the individual stakeholders in different ways. Today we reveal the point where they all meet: Intellexa, Krikel, Felix Bitzios and of course the government, through the trusted partner of the Prime Minister, Yannis Smyrlis, former Secretary General for International Economic Affairs at the Ministry of Foreign Affairs and current general manager of New Democracy. The "meeting" point for everyone is the Ministry of Foreign Affairs and more specifically the Directorate B6, which has approved - and signed by Smyrlis – the applications of Intellexa and Krikel for the export of spyware products, submitted (some jointly) by an employee of both Y. Lavranos and F. Bitzios.

Inside story reveals today:

• The licensing of spyware exports to the authoritarian regimes of Sudan and Madagascar, as well as Ukraine, by exporters Krikel and Intellexa.
• The fact that the investigation that was started by the Ministry of Foreign Affairs in November 2022 on the exports of spyware to third countries has already been completed since the beginning of this year, and that the government is not telling the truth to the European Commission when it replies that it is still in progress.
• The shortcomings of this internal investigation by the Ministry of Foreign Affairs, since the person responsible at the time for the relevant export licensing in countries with a fairly poor score in the protection of human rights (Madagascar, Sudan), Yiannis Smyrlis, was not questioned, for unknown reasons.
• The close cooperation of individuals and companies central to the Predator spyware scandal, which has targeted journalists, politicians, business executives and others.

L.K. is one of the closest associates of Felix Bitzios. According to Efimerida ton Syntakton (Editors' Newspaper), their professional relationship dates back to 2012, when they both worked for the Libra group of shipowner Giorgos Logothetis (Libra Group has taken legal action against Bitzios and his associates since 2019 for independent matters and the relevant lawsuit is pending before the courts of Cyprus). When Felix Bitzios left the Libra group in the summer of 2019, L.K., acting as secretary, followed him. For about a year she was at the Cypriot company Layth Capital Ventures Limited, owned by Felix Bitzios. However, in 2021 she suddenly appears to be working at Krikel, a company of Yiannis Lavranos' interest. It should be recalled that Krikel, as was revealed by inside story, leases its offices in Marousi from Layth Capital Ventures, while the relations between the two companies – at least as can be seen from the transactions of Krikel's accounts in Optima Bank – date back at least to November 2019.

In December 2022, the prosecutor's investigation into the wiretapping case (whose echoes reached Limassol, where Tal Dillian, the owner of Intellexa, resides) led to L.K.'s house in the southern suburbs of Athens. The reason is that L.K. was named by Foreign Ministry officials, in the context of the prosecutor's investigation into the wiretapping, as the person who signed some of Krikel's applications for the export of "systems designed to extract data from mobile devices", as stated in the relevant documents. L.K. worked at Krikel until at least December 2022 and allegedly submitted the export requests for Sudan and Ukraine.

According to information obtained by inside story, the investigation at the Ministry of Foreign Affairs has been completed since the beginning of January 2023 and has been handed over to the Secretary General of the Ministry, Theoharis Lalakos. Nevertheless, Minister of Foreign Affairs Nikos Dendias, as well as government representative Akis Skertsos, claimed (on April 26 and 28 respectively) that "the investigation continues". The same assurance was given by the Greek government to the vice-president of the European Commission Valdis Dombrovskis, who had requested clarifications from Greece on export of the Predator spyware to Sudan. Even if we consider that the investigation has not been concluded, as Mr. Lalakos may keep it in his hands for three months, according to the internal regulation of the Ministry of Foreign Affairs, this period passed at the beginning of April (although according to some legal sources, this three months period is indicative and not binding). Foreign Minister Nikos Dendias had said in an interview with Olga Tremi on April 26 that the process has not yet been completed, which he attributed to the way the public administration operates. He said that he cannot do anything about it, as it would be considered interference.

But while Mr. Dendias attributed resposibility for licensing the software exports to the outgoing Secretary General for International Economic Affairs, Yannis Smyrlis, the former Secretary General was reportedly not questioned during the investigation by the ministry's inspector general for unknown reasons - something that shows a strange perception of accountability on the part of both those who examined him and himself. Mr. Smyrlis is the only non-administrative person involved in the licensing process. After his departure from the ministry at the end of December 2022, in the wake of the relevant publications, Prime Minister Kyriakos Mitsotakis placed him in the position of Deputy Director General of the New Democracy.

Inside story asked Foreign Minister Nikos Dendias why he stated until very recently that the investigation is still ongoing, while it has been completed since the beginning of January. The minister in his response said: "The administrative-disciplinary investigation of this particular case, of which the Αdministrative Ιnquiry is one stage, has not been completed. Both the Αdministrative Ιnquiry and the overall investigation of the case are confidential. The aim is the full investigation and determination of liability, if any is found."

The Regulation (EU) 821/2021, on the basis of which such exports are made from European Union countries, came into force on September 9, 2021. According to the legal framework, for Dual Use items, i.e. those that can be used for both military and civilian purposes, three main types of authorization licenses are provided for: Individual, National General Export and EU General Export licenses. Licenses for exports of special software are considered Individual and must be accompanied by an end-user certificate and an exporter's declaration. The European Regulation on exports of dual-use items imposes specific obligations on exporters and introduces controls to prevent the use of cybersurveillance technologies to violate human rights.

Those conducting the investigation at the Ministry had to focus on five export approvals, granted between November 15, 2021 and the end of March 2022. The first concerns Intellexa's application for a "system designed for mobile data extraction and data collection management" with a net worth of 2.7 million euros. The recipient of the system is the British company Signum Intelligence Ltd and the end user the National Anti-Fraud Agency in Madagascar. Intellexa's next application is on the same day, with the same recipient and end user, and is for another system doing a similar function ("a WiFi tracking and interception system designed to extract and analyze data from mobile devices using WiFi"). These two exports of Intellexa from Greece to Madagascar, with a total value of 2.9 million euros, were confirmed by the spokesperson for the Ministry of Foreign Affairs, Alexandros Papaioannou, to New York Times on December 8, 2022. In fact, the wording in the specific publication was that "...the Greek government admitted that it gave the company, Intellexa, licenses to sell Predator to at least one country with a history of repression, Madagascar." This means that the above descriptions of systems for extracting  data from mobile devices in the export applications are actually components of the infamous Predator spyware.

A few days after the NYT's article, the deputy head of the main opposition party SYRIZA's Transparency of Administrative Action Section, Pavlos Polakis, published on social media the relevant licensing documents, signed by the then Secretary General for International Economic Affairs, Yannis Smyrlis. A source with knowledge of the matter confirmed the authenticity of these documents to inside story.

Inside story attempted to contact Yannis Smyrlis, asking why he was not examined as part of the investigation, but without success.

The two licenses granted to Intellexa to export Predator to Madagascar were not the only ones related to the export of similar software products. Krikel also applied for and received licenses, with final destination Sudan and Ukraine.

On February 22, 2022 Krikel, through L.K., submits two applications for export licenses to Sudan for a system designed "for mobile data extraction and data collection management" and a "wifi tracking and interception system designed for deployment and data analysis of mobile devices using wifi'. The descriptions are identical to the products Intellexa requested to export to Madagascar. The products in Krikel's applications are valued at €70,000 and €5,000 respectively, the end user being the Ministry of Defense of Sudan, with intermediate recipients being two UAE companies – Toru Technologies and Octapus Information Technology Services LLC. The Toru brand is known by Intellexa 'data extraction' equipment export to Bangladesh, which was revealed in January 2023 by the Israeli newspaper Haaretz. In fact, the training of the officials from Bangladesh was to take place in Greece. This is also where the demonstrations of the products took place before the sale of the equipment proceeded.

Toru Group, according to cross-checked information, operates in various markets as an intermediary on behalf of Intellexa group of companies. As it appears from the official applications to the Ministry of Foreign Affairs, a company with a similar name (Toru Technologies) seems to have assumed a similar role for Krikel.

The fact that the companies Krikel and Intellexa are connected is not new. It was revealed for the first time by inside story in November 2022 in a report entitled "Greek State and spyware vendor Intellexa: they are acquainted after all". As we wrote at the time, "the two companies had at least one transaction in July 2020 (the same month in which the first fake domains are purchased for trapping and surveilling of targets with Predator within Greece): On July 22, 2020 a transfer of 155,000 euros appears from Intellexa to Krikel through the European Payment System (SEPA) and on the same day an outgoing amount from Krikel to Intellexa".

As reported by inside story with Lighthouse Reports and Haaretz, in May 2022, i.e. at a later time from the export licenses from Greece, Predator was found via Cyprus in the hands of one of the most notorious and feared paramilitary groups in the world, the Rapid Support Forces (RSF) led by Mohamed Hamdan Dagalo (usually referred as Hemedti), who started the recent bloodshed in Sudan.

Two sources close to the government but who were not authorized to speak and therefore spoke on condition of anonymity, said the February export from Greece to Sudan did not materialize, although the application was approved on the same day. Intellexa, they added, immediately informed the Ministry that it would replace Krikel as the exporter for this particular export. "This notification was submitted at the same time as the export license application," according to the above sources. The United Arab Emirates have traditionally supported the Rapid Support Forces and have been a key supplier of military equipment. Israel took an ambivalent stance, as its government supported the government in Khartoum, but Mossad had developed relations with Hemedti and his forces.

Krikel appeared at the Ministry of Foreign Affairs as an exporter of another identical system ("data extraction from mobile devices and data collection management"), valued at 70,000 euros, with the end user being the Ministry of Digital Transformation of Ukraine, at the request of L.K. one month after the start of the Russo-Ukrainian war, on March 24, 2022. The intermediate recipient would be the company Pegasus DWC LLC in the United Arab Emirates. The export, although approved on March 31, 2022, did not take place, as the Ukrainians for their own reasons did not take the product.

We asked Intellexa and Krikel if their exports to Sudan, Madagascar and Ukraine were completed after the Greek Ministry of Foreign Affairs granted permission, however as of the time of publication we have not received a response.

Questions about her relations with the companies Krikel, Intellexa and the businessmen Yiannis Lavranos and Felix Bitzios were addressed to L.K., which also did not respond to our request.

A source with a good understanding of the licensing procedures for the export of dual-use products stated to inside story that this responsibility belonged to the Ministry of Development until 2019. Moreover, the two employees who were charged with this responsibility at the Ministry of Foreign Affairs were seconded from the Ministry of Development. "This responsibility was placed to the Ministry of Foreign Affairs and they got the hot potato. They took advantage of the pathologies of the system." Something similar was claimed by Angelos Syrigos, Deputy Minister of Education & Religion. In a recent televised statement he stated that "it was not known exactly what the software was that had been given permission to be exported. [...] It always goes according to the declaration. When the other party describes to you what is to be exported in a different way, things are different".

(May 8th 2023: some changes on the translated text were made for clarification)