Turkey - Surveillance - FinSpy

Munich-based tech company FinFisher is dissolved after investigations

FinSpy: Police use German spyware © FinFisher marketing video
FinSpy: Police use German spyware © FinFisher marketing video

Turkey - Surveillance - FinSpy

Munich-based tech company FinFisher is dissolved after investigations

Turkish police can surveil cell phones with a few clicks, thanks to FinSpy software “made in Germany.” In March 2022, FinFisher, the manufacturer of the spyware, had to file for bankruptcy following a criminal complaint by the Gesellschaft für Freiheitsrechte (GFF), Reporter ohne Grenzen (RSF Germany), the blog netzpolitik.org and ECCHR.

Since July 2019, the Munich Public Prosecutor’s Office has investigated the conglomerate FinFisher, to which FinFisher Labs and Elaman also belong. Already in October 2020, the Public Prosecutor’s Office authorized the search of FinFisher offices in Germany and Romania. The investigations into company directors are still underway – but the companies no longer exist. The Munich Public Prosecutor’s Office announced that it has seized the accounts of the companies, and FinFisher has had to cease its business operations.

FinFisher allegedly sold FinSpy to the Turkish government without the authorization of the German federal government. The consequences of the use of surveillance software by repressive states are clearly visible in cases concerning Syria or Bahrain: digital surveillance is often followed by imprisonment and torture. Yet, software companies tend to deny any responsibility for their role in human rights violations.

Case

When FinSpy malware infiltrates a cell phone, it assumes complete control of the device. The individuals whose cell phones are monitored using FinSpy can be located at any time, their telephone conversations and chats recorded, and all data from their devices harvested. FinSpy first appeared in Turkey in the summer of 2017 on a fake version of a mobilization website for the Turkish opposition. The software was disguised as a downloadable app recommended to participants in anti-government demonstrations.

The alleged illegal export of surveillance software to the Turkish government is particularly concerning given the repression of journalists and oppositional voices in Turkey. After a failed coup attempt in June 2016 by factions within the Turkish military, more than 50,000 people were arrested, nearly 140,000 people were fired from their jobs, and hundreds of media organizations were closed.

Context

In order to prevent the sale of surveillance technology to repressive regimes in such countries as Turkey, Syria and Bahrain, Europe-wide licensing requirements were established in 2015 for exports to countries outside the EU. Nonetheless, updated versions of FinSpy Trojan software continue to surface in Turkey, Egypt and Myanmar.

The violation of these licensing requirements is a prosecutable crime. However, in reality, most companies are able to operate globally without interference, as the current legal situation in Germany and Europe has rendered efficient criminal prosecution nearly impossible. Despite this success in the case of FinFisher, the law is still in need of urgent changes.