Months after being hacked and getting all its secrets leaked online, the spyware vendor Hacking Team is still in business—but struggling to survive. Now, the Italian government has dealt the embattled company another blow.
The government authority who oversees the export of "dual use" technologies, which can be used both for civilian as well as military purposes, revoked Hacking Team's "global authorization" to export its spyware at the end of March.
The Italian Ministry of Economic Development (also known as MISE) said in a press release that the company would now have to get an "individual" license. Eric Rabe, Hacking Team's spokesperson, confirmed the news on Tuesday, after the Italian newspaper Il Fatto Quotidiano first reported of the revocation.
"Yes, the global license has been suspended by MISE but Hacking Team still has approvals for all countries within the EU, and the company also expects to be given approvals for sales to countries outside the EU," Rabe said in an email to Motherboard.
"We can sell everywhere in Europe without a license. We can sell everywhere in the world but we have to ask for a license every time we sell."
Years before the hack, researchers were able to reveal some of Hacking Team's sketchier customers, such as the government of Morocco or Ethiopia, which used the company's spyware against journalists and dissidents.
A source close to Hacking Team referenced an internal email sent by the company's CEO David Vincenzetti to the staff on Monday.
"We ARE allowed to sell to any European country without any export permission. We ARE allowed to sell everywhere else given that we ask for export permission before selling," read the email, according to the source, who asked to remain anonymous.
Vincenzetti went on to reassure its employees that, in any case, this was not a new situation. In fact, between October 2014 and April 2015, the company was under the same export restrictions. At the time, Vincenzetti was worried that the Italian authorities, following the new rules imposed by the controversial Wassenaar Arrangement, an international treaty that regulates the export of dual use technologies, could hamper Hacking Team's sales.
But following an intense campaign of behind the scenes lobbying, as leaked emails show, the Italian government granted Hacking Team an individual "global authorization" to export. This, according to the ministry's website, is practically a blanket license to export across the world.
"We have already been there, we know the paperwork needed, we will carry on," Vincenzetti concluded in the email, adding that he had already contacted the company's lawyers in Rome and that he hoped to solve the situation soon, according to the source
It's unclear why the Italian authorities decided to revoke Hacking Team's license now.
MISE said in a statement sent to Motherboard on Tuesday afternoon that it was aware that in 2015 Hacking Team had exported its products to Malaysia, Egypt, Thailand, Kazakhstan, Vietnam, Lebanon and Brazil. The authority explained that "in light of changed political situations" in one of those countries, and after consulting with the Foreign Affairs, Interior and Defense ministries, Hacking Team will now be required to obtain a "specific individual authorization."
The change in political situation could refer to the recent death of the Italian researcher Giulio Regeni, who was tortured and killed earlier this year in Egypt. The country is one of the customers of Hacking Team, according to documents leaked last summer.
Another report in the printed version of the Italian newspaper Il Corriere Della Sera at the end of March also hinted that Milan prosecutors had launched an investigation to figure out whether Vincenzetti and his company had committed a crime when exporting the company's spyware. The Italian prosecutors heading this inquiry could not be reached for comment on Tuesday.
"The investigation regarding David Vincenzetti seems to be a review of past sales, all of which were conducted in accordance with laws and regulations in place when the sales were made," Rabe said in an email.
"The guy is in hot water."
"The guy is in hot water," a former Hacking Team employee told me, commenting the recent news.
Edin Omanovic, a researcher at Privacy International, a UK-based non profit that advocates for controls of surveillance technologies, applauded the decision of the Italian government.
"It was wholly inappropriate for Hacking Team to be granted a general license in the first place given the intrusiveness of the technology," Omanovic told me in an online chat. "The decision to revoke this license and subject exports to tighter scrutiny is a massively positive step for ensuring that human rights are protected."
This story has been updated to include Omanovic's comment, to correct the wording of Vincenzetti's internal email, and to add MISE's statement. Also, a previous version of this story referred to the international treaty on export controls as the Wassenaar Agreement. It's actually the Wassenaar Arrangement.