Gamma/FinFisher: No investigation into German-British software company

Public Prosecutor in Munich disregards evidence of illegal surveillance, human rights situation in Bahrain and applicable German law


12 December 2014 -Public prosecution authorities in Munich have decided not to launch investigatory proceedings against employees of German-British firm Gamma International. The European Center for Constitutional and Human Rights (ECCHR) and the British organization Privacy International submitted a criminal complaint in October 2014 calling for an investigation. The organizations have evidence to suggest that Bahraini authorities used a Gamma Trojan called FinFisher to unlawfully spy on oppositionists living in Germany and elsewhere. ECCHR will lodge an objection to the prosecution authorities’ decision. 


“The prosecution’s argument does not stand up to legal scrutiny,” says Miriam Saage-Maaß, Vice Legal Director at ECCHR. “If the authorities find the information from the Wikileaks files to be insufficient then they must conduct their own investigations!” Furthermore, the prosecution authorities have failed to take into account the situation in Bahrain. Human rights activists in Bahrain are subject to systematic surveillance, persecution and detention and repeatedly subjected to torture. “In view of the reality of surveillance in Bahrain it is absurd to claim that state authorities are not in a position to engage in hacking and violate Section 202 of the German Criminal Code prohibiting data espionage,” says Saage-Maaß.


And that’s not all: “The prosecution authorities in Munich are ignoring the current legal situation in Germany,” according to Saage-Maaß. Even the German Federal Bureau of Investigation refrained until at least 2012 from using a version of the Gamma Trojan as the software breached the “standardized terms of reference” of the German government and thus violated minimum constitutional standards.


Bahrain’s illegal computer surveillance in Germany


On 16 October 2014 ECCHR and British organization Privacy International submitted a criminal complaint to prosecution authorities in Munich against employees of German-British firm Gamma. ECCHR and Privacy International have seen files suggesting that Gamma supplied Bahrain with the surveillance software FinFisher and provided technical assistance from Germany. This allowed Bahraini authorities to use the trojan to spy on computers in Germany. “If these allegations prove to be true, Gamma employees could be guilty of aiding and abetting. Those responsible must be held accountable,” says Miriam Saage-Maaß, Vice Legal Director at ECCHR. Criminal complaints have also been lodged against Gamma in Britain and Belgium. Aside from the criminal investigation, ECCHR is also calling for political action: “German Minister for the Economy Sigmar Gabriel must finally live up to his promises and introduce effective and transparent regulations on the export of surveillance technology.”

Data from 77 computers has shown that Bahraini authorities used the trojan to spy on numerous devices in Britain as well as one computer in Belgium and one in Germany. Those targeted by the spyware in Britain included prominent Bahraini human rights activists. The identity of the victim of surveillance in Germany is not yet known.

German-British firm Gamma developed and produced FinFisher. Its promotional material shows that the software provides comprehensive access to infected computers and any data stored there. Cameras and microphones on the devices can also be tapped. According to Privacy International, FinFisher software is used in 35 countries, including Ethiopia, Turkmenistan, Bahrain and Malaysia. “Companies like Gamma do well from repressive states, but reject any responsibility for their products,” says Adriana Edmeades from Privacy International. “It is time that legal action was taken against corporations for their involvement in grave human rights violations.”

Human rights organisations file OECD complaints against surveillance firms

20 December 2013 - Privacy International, the European Center for Constitutional and Human Rights, the Bahrain Center for Human Rights, Bahrain Watch and Reporters Without Borders filed formal complaints with the Organisation for Economic Cooperation and Development (OECD) in the UK and Germany against two surveillance companies on Friday 1st February and Wednesday 6th February, respectively. The British and German OECD National Contact Points were being asked to investigate Gamma International and Trovicor respectively with regards to both companies’ potential complicity in serious human rights abuses in Bahrain. The British OECD contact point  accepted the complaint against Gamma International. The German contact point rejected the complaint on 20 December 2013. .

The complainants argue that there are grounds to investigate whether surveillance products and services provided by Gamma International and Trovicor have been instrumental in multiple human rights abuses in Bahrain, including arbitrary detention and torture, as well as violations of the rights to privacy, freedom of expression and freedom of association. They allege that there is evidence that information gathered from intercepted phone and internet communications may have been used to systematically detain and torture political dissidents and activists and to extort confessions from them. If the allegations are upheld, the companies are likely to be found to be in breach of the OECD Guidelines for Multinational Enterprises, recommendations addressed by governments to multinational enterprises that set out principles and standards for responsible business conduct.