Italian Spyware Company Execs Arrested After Company Employees Spied On Innocent Citizens

from the power-and-responsibility-once-again-decoupled dept

Any tool that gives people access to tons of personal data will be abused. Law enforcement databases are routinely misused by government employees. Ring — law enforcement’s favorite consumer home product — collects tons of data about its customers and this data has been inappropriately accessed by Ring employees.

The perfect storm of illicit surveillance and snooping comes from companies that sell spy tools to law enforcement but retain control of the servers where the personal data and communications are stored. An Italian developer, Diego Fasano, followed up his successful medical records app with something far more troubling: law enforcement spyware deployed with the aid of service providers.

The concept behind the company’s product was simple: With the help of Italy’s telecom companies, suspects would be duped into downloading a harmless-seeming app, ostensibly to fix network errors on their phone. The app would also allow Fasano’s company, eSurv, to give law enforcement access to a device’s microphone, camera, stored files and encrypted messages.

Fasano christened the spyware “Exodus.”

The software was popular. Prosecutors all over Italy bought Fasano’s product. So did Italy’s NSA, L’Agenzia Informazioni e Sicurezza Esterna. There’s no telling how much the government slurped from targets’ phones over the years, but one prosecutor discovered the truth about eSurv’s operations on accident. The information harvested by investigators wasn’t walled off from the internet, only accessible by the prosecutor’s office. It was accessible to anyone with the right credentials, stored thousands of miles away.

The Naples prosecutor began a more in-depth probe—and found that eSurv had been storing a vast amount of sensitive data, unencrypted, on an Amazon Web Services server in Oregon.

The data included thousands of photos, recordings of conversations, private messages and emails, videos, and other files gathered from hacked phones and computers. In total, there were about 80 terabytes of data on the server—the equivalent of roughly 40,000 hours of HD video.

This meant eSurv employees — at least the “Black Team” running eSurv’s “Exodus” project — could also access these recordings. There’s no evidence (yet) that they did or that this very valuable stash of law enforcement intel was ever exfiltrated by hackers. But the fact remains law enforcement agencies did not have control of their harvested surveillance.

This would have been a tempting stash of personal info for eSurv employees to dip into. But they didn’t. They didn’t have to because they were already deploying their malware to intercept communications and exfiltrate data from Italian citizens who had been tricked into installing eSurv’s malicious, telco-miming apps.

In one instance, the Black Team hacked the phone of a 49-year-old woman from Crotone, a port city on the coast of Calabria, according to the prosecutor’s filings. The team collected the woman’s personal text messages to family and friends, and covertly recorded more than 3,800 audio clips using her mobile phone’s built-in microphone, chronicling the woman’s life and interactions as she went about her daily business, the filings say.

In all, the Black Team spied on more than 230 people who weren’t authorized surveillance targets, according to police documents. Some of the surveillance victims were listed in eSurv’s internal files as “The Volunteers,” suggesting they were unwitting guinea pigs.

A court has already stated the company’s product was “designed and intended.. to operate with functions that are very distant from the canons of legality.” That should be an indictment of the law enforcement agencies who purchased it as well, but somehow it isn’t. The proper paperwork may have been filed and approved by judges, but the spyware relies on cell service providers deceiving customers so malware can be implanted through fake apps.

If the company has abused it tools, it’s safe to say some of eSurv’s customers have as well. For now, it’s only eSurv’s principals being investigated. But it does highlight the danger this malware poses, even when it’s supposedly only being used for good.

Filed Under: , , , , ,
Companies: esurv

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Italian Spyware Company Execs Arrested After Company Employees Spied On Innocent Citizens”

Subscribe: RSS Leave a comment
ECA (profile) says:


you think about the STAR ID system..For your ID and drivers license.
DMV/DOT used to throw pictures away(strange aint it). But after 911, they started keeping them and NOW have computer systems to hold all this data..
Now they can get 60-80% of the USA into a data base.
Who gets access?
Thats a good question, as its from 9/11, means DHS and all its agencies get it..

...ROG,SIFIED says:

they all do it

re: least the "Black Team" running eSurv’s "Exodus" project

Proof or GTFO, right? We all know they are good natured white hats.

Yet all those biblical/Torah names for software exploits should raise red flags for rational people, right?

Proof, or GTFO!

All big tech, military contractors and esp. Mossadi jihadis who are moled into Silicon Valley are running blackops teams, and its good to shed light on the breadth of their depravity, targeted at individuals around the globe.

Talpion/IDF/Mossad is settling Silicon Valley and its now full of Silicon Wadi mossadis.

Squad 8200 is Installing Backdoors in Silicon Valleyas companies
like Carbyne911, and Facebook, et al all employ Mossad on their boards, and outsource blackops to Israel.

Sure, no grand,conspiracy just moooooove along, folks, NTSH

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...