Bahraini protester sprays anti-government graffiti. Photo by Eman Redha. Copyright: Demotix

Leaked internal documents allegedly belonging to UK-based surveillance software company Gamma International suggest that Bahrain's government has used the technology to spy on activists, politicians and members of a government commission investigating human rights abuses. 

On Aug. 3, an anonymous Twitter account @GammaGroupPR began publishing the 40 gigabytes worth of information, which indicated the company's staff were communicating with a customer in Bahrain from 2010 to 2012 about its FinFisher spy software. Rights group Bahrain Watch analyzed a list of 77 computers infected with the spyware to identify the people who were targeted. 

Two members of the king's Bahrain Independent Commission of Investigation (BICI) appear to be among those targeted. The government's bloody crackdown against a popular uprising, now in its third year, spurred the creation of the fact-finding mission, which concluded authorities have practiced systematic torture against dissidents, carried out extrajudicial killings and committed other serious offenses, including the demolition of places of worship.

KMA is assumed to be judge Khaled Moheyuldin Ahmed, a member of the commission who is now employed by the Bahraini government. Sources confirm that Ahmed was using a Sony VAIO laptop (see above chart) during the time he worked with BICI, which coincides with the dates of infection. The other target who shares the same operation code is named Douglass and is believed to be Douglas Hansen, another member of the BICI.

The leak contradicts Gamma's earlier denials that it doesn't sell its products to Bahrain. It also adds credence to suggestions of wrongdoing by London-based NGO Privacy International, which sent multiple inquiries to the UK's customs department, asking whether the department was investigating Gamma's export of spy technology to repressive regimes. After their requests went unanswered, they took the company to court. In May of 2014, the UK High Court ruled that the customs department acted unlawfully and “irrationally” in refusing to answer the NGO's inquiries.

In Bahrain, activists have long accused the Bahraini government of breaching their privacy. A government order mandating a record be kept of all emails sent and received was issued in 2009.

Human rights lawyer Mohamed Altajer told Bahrain Watch that his computer was compromised after he watched a CD sent to him. The CD contained private footage of Altajer and his wife, taken without their knowledge. The group believes the CD also held the spyware and thus infected his computer. Supporters believe the CD was sent to blackmail him into ending his work defending Bahrainis arrested and tortured for their role in the anti-government protests. Many others have said their photographs that were confiscated during police raids have turned up on porn sites and been distributed across social media.

The Intercept quoted Altajer saying he was “happy” the story had been made public. “These dirty people who videotaped me…now they are naked, now they are exposed before the world.”

I asked Mr. Matar Matar from the opposition political society Al Wefaq, who is a target of the spyware, to comment. He said the matter could be brought before British court:

The political influence on the judiciary System in Bahrain doesn't provide any space to protect activists from surveillance. But this is an opportunity to move in legal action in UK courts. Now Al Wefaq is in a better position to call HM Revenue & Customs, UK’s tax authority, to investigate in the illegal export of a hacking software for non-free regimes with a dark record of serious human rights violations. How come such a software is licensed to a regime which is considered be the third worst and 5th most declining regime in freedom house report.

By UK law, Gamma must apply for country-specific licences in such cases and it doesn't seem it did and Al Wefaq is harmed by this violation. UK’s High Court already slammed the UK’s tax authority for hiding details about this issue. And this is the time for all those who were harmed by this violation to sue Gamma.

Spyware aside, Mr. Matar Matar says the government lost civil society's trust long ago:

Karim Fakrawi, co-founder of Al Wefaq, was beaten to death in custody. During martial law, I was arbitrary detained with my colleague Jawad Fayrozz. Also the government revoked the citizenship of two former MPs from AlWefaq. They both are living in exile in addition to another 3 other MPs. In addition to that, five elected members municipality council have been dismissed. And currently Al Wefaq is on trial for it to be suspended and three senior leaders are awaiting trial. Under these circumstances, the struggle with the regime is much beyond the surveillance.

BICI was established based on a royal decree. The fact that it was spied on might suggest testimonies were tailored to mislead the commission. Gamma also says it only sells the FinFisher technology to governments and law enforcement, indicating that the spying is done with the knowledge of officials.

Digital security group Internet Protection Lab reported the spying went beyond political activists and bloggers to possible financial espionage.

While the UK government tracks and arrests malicious hackers at home, these leaks suggest that it continues to allow the sale of surveillance technology to Bahrain. And it welcomes members of their widely criticized security apparatus to get training in the UK. In the past, Bahraini authorities have arrested local bloggers such as Takrooz, thanks to their use of similar spy technology. Many more might be in danger. While a court ruling could help limit the Bahraini government's access to surveillance technologies in the future, its affects on human rights defenders may be felt for many years to come.

An earlier version of this post mistakenly named Douglas Hansen-Luke as one of the people believed to be listed in the records of Gamma International leaked online. It is Douglas Hansen who was part of the Bahrain Independent Commission of Investigation.