"A Web of Surveillance – Unravelling a murky network of spyware exports to Indonesia" 2 May 2024

An expansive range of highly invasive spyware and surveillance products are being imported and deployed in Indonesia, Amnesty International’s Security Lab said today as it released a new briefing in collaboration with media partners – Haaretz, Inside Story, Tempo, WAV research collective and Woz.

Through open-source intelligence, including commercial trade databases and spyware infrastructure mapping, the Security Lab found evidence of sales and deployment of highly invasive spyware and other surveillance technologies to companies and state agencies in Indonesia between 2017 and 2023....

...The sale and transfer of these spyware and surveillance technologies was enabled through a murky ecosystem of surveillance vendors, brokers and resellers with complex ownership structures.

The identified vendors include Luxembourg-based Q Cyber Technologies SARL (linked to NSO Group), the Intellexa consortium, Israel-based Wintego Systems Ltd and Saito Tech (also known as Candiru) and Malaysia-based Raedarius M8 Sdn Bhd (linked to FinFisher). The investigation also identified brokers and resellers based in Singapore and Indonesia....

...Highly invasive spyware tools are designed to leave as few traces as possible, making it exceedingly difficult to detect cases of unlawful misuse of these tools...[T]he research focuses on the sale and transfer of several highly invasive spyware tools...

...The number of identified sales and deployment of highly invasive spyware to Indonesia is of special concern, as there is an ongoing assault on the rights to freedom of expression, peaceful assembly and association, personal security and freedom of arbitrary detention in the country....

Amnesty International’s Security Lab requested comments and clarifications on the findings of the investigation from the twenty-one entities referenced in the investigation.

Amnesty International received responses from Candiru (referred to as Saito Tech in the research) and NSO Group (responding also for Circles and Q Cyber Technologies SARL) as well as exporting agencies Swiss State Secretariat for Economic Affairs (SECO) and Israeli Defense Exports Control Agency (DECA) which are reflected in the Security Lab briefing A web of surveillance: Unravelling a murky network of spyware exports to Indonesia.  Candiru responded to explain that the company operates under the Israeli Ministry of Defense Export Control Agency (DECA) – Export Control Law, 5766-2007. NSO Group responded to explain that it is closely regulated by export control authorities in the countries “from which they export products.”