UK rebukes German-British software company Gamma
27 February 2015 – British-German surveillance technology provider Gamma International infringed on its human rights obligations with products such as “state trojan” FinFischer. This was confirmed by the United Kingdom’s OECD National Contact Point (NCP) on Thursday in the final assessment of a complaint submitted by human rights groups. The NCP calls on Gamma –explicitly including other companies affiliated with the corporation – to implement effective human rights standards.
The Bahrain Center for Human Rights (BCHR), Bahrain Watch, the European Center for Constitutional and Human Rights (ECCHR), Privacy International and Reporters Without Borders in 2013 submitted a complaint at the NCP in London against Gamma, and a parallel complaint at the German NCP against Munich-based surveillance company Trovicor GmbH. The non-governmental organizations accuse the companies of sharing a responsibility for arrests, imprisonments and torture of opposition members, journalists and dissidents in the Arab Gulf state of Bahrain by supplying surveillance technology and technical support.
“The final statement of the British OECD National Contact Point confirms our complaint,” said Christian Mihr, executive director of Reporters Without Borders Germany. “At the same time the fight for substantial restrictions of exports of surveillance technology to authoritarian states must continue.” ECCHR deputy legal director Miriam Saage-Maaß added: “The decision of the British NCP is of fundamental importance! The German Gamma affiliate FinFisher Labs in Munich must also comply with it.”
The British OECD NCP criticized that Gamma did not put in place a due diligence process and did not commit to any binding standards for the observance of human rights. Moreover, the company did not cooperate with the NCP to the necessary extent. In spite of overwhelming publicly accessible evidence, Gamma refused to provide information on the sale of FinFisher technology to Bahrain. The NCP invokes that it is not equipped with investigatory powers of its own, and therefore could not confirm this specific accusation.
The German NCP, which is tied to the Federal Ministry of Economy, rejected the complaint against Trovicor in December 2013, deciding that it could “only conduct a further examination of the general risk management of Trovicor.” It considered the evidence regarding other topics of the complaint as not substantial enough to warrant further scrutiny.
“The fact that the National Contact Points in Germany and in the United Kingdom diverged in their assessments of the complaints is once again evidence of the failings in the German complaint procedure,” said Miriam Saage-Maaß. “The German NCP must be restructured to be more independent – for example by placing it, as does the UK, under the supervision of a board that appoints civil society representatives as well.”
No investigation into Gamma in Germany
Public Prosecutor in Munich disregards evidence of illegal surveillance, human rights situation in Bahrain and applicable German law
12 December 2014 -Public prosecution authorities in Munich have decided not to launch investigatory proceedings against employees of German-British firm Gamma International. The European Center for Constitutional and Human Rights (ECCHR) and the British organization Privacy International submitted a criminal complaint in October 2014 calling for an investigation. The organizations have evidence to suggest that Bahraini authorities used a Gamma Trojan called FinFisher to unlawfully spy on oppositionists living in Germany and elsewhere. ECCHR will lodge an objection to the prosecution authorities’ decision.
“The prosecution’s argument does not stand up to legal scrutiny,” says Miriam Saage-Maaß, Vice Legal Director at ECCHR. “If the authorities find the information from the Wikileaks files to be insufficient then they must conduct their own investigations!” Furthermore, the prosecution authorities have failed to take into account the situation in Bahrain. Human rights activists in Bahrain are subject to systematic surveillance, persecution and detention and repeatedly subjected to torture. “In view of the reality of surveillance in Bahrain it is absurd to claim that state authorities are not in a position to engage in hacking and violate Section 202 of the German Criminal Code prohibiting data espionage,” says Saage-Maaß.
And that’s not all: “The prosecution authorities in Munich are ignoring the current legal situation in Germany,” according to Saage-Maaß. Even the German Federal Bureau of Investigation refrained until at least 2012 from using a version of the Gamma Trojan as the software breached the “standardized terms of reference” of the German government and thus violated minimum constitutional standards.
Bahrain’s illegal computer surveillance in Germany
On 16 October 2014 ECCHR and British organization Privacy International submitted a criminal complaint to prosecution authorities in Munich against employees of German-British firm Gamma. ECCHR and Privacy International have seen files suggesting that Gamma supplied Bahrain with the surveillance software FinFisher and provided technical assistance from Germany. This allowed Bahraini authorities to use the trojan to spy on computers in Germany. “If these allegations prove to be true, Gamma employees could be guilty of aiding and abetting. Those responsible must be held accountable,” says Miriam Saage-Maaß, Vice Legal Director at ECCHR. Criminal complaints have also been lodged against Gamma in Britain and Belgium. Aside from the criminal investigation, ECCHR is also calling for political action: “German Minister for the Economy Sigmar Gabriel must finally live up to his promises and introduce effective and transparent regulations on the export of surveillance technology.”
Data from 77 computers has shown that Bahraini authorities used the trojan to spy on numerous devices in Britain as well as one computer in Belgium and one in Germany. Those targeted by the spyware in Britain included prominent Bahraini human rights activists. The identity of the victim of surveillance in Germany is not yet known.
German-British firm Gamma developed and produced FinFisher. Its promotional material shows that the software provides comprehensive access to infected computers and any data stored there. Cameras and microphones on the devices can also be tapped. According to Privacy International, FinFisher software is used in 35 countries, including Ethiopia, Turkmenistan, Bahrain and Malaysia. “Companies like Gamma do well from repressive states, but reject any responsibility for their products,” says Adriana Edmeades from Privacy International. “It is time that legal action was taken against corporations for their involvement in grave human rights violations.”