Mr. Eric Rabe
Hacking Team (HT S.r.l.)
Via della Moscova n.13
20121 - Milano
Italy
Re: Hacking Team Practices in Ethiopia
Dear Eric:
I’m writing to follow up on our previous reporting on Ethiopia and in light of the recent breach of Hacking Team’s servers.
As you may recall, Human Rights Watch first wrote to Hacking Team in February 2014 regarding research conducted by Citizen Lab that revealed several attempts to compromise the computers of Ethiopian Satellite Television Service (ESAT) employees using Hacking Team’s Remote Control System.[i] In your response, you stated that when questions about the proper use of Hacking Team tools are raised with you, you investigate according to your Customer Policy. You also stated that under the company’s policies, you may suspend support for your product if misuse is found.
We wrote to you again in March 2015 regarding follow-up research by Citizen Lab.[ii] Their research showed that even after our concerns had been brought to your attention and our findings on Ethiopian government abuses against opposition politicians, journalists, and activists had been published in our 2014 report, "They Know Everything We Do": Telecom and Internet Surveillance in Ethiopia, the government had continued to use Hacking Team technology to target ESAT employees.[iii]
We have reviewed the Hacking Team data that has been released online. The leaked materials provide no indication that Hacking Team took any meaningful steps to investigate abuse by your client, the Ethiopian Information Network Security Agency (INSA). The materials also do not show that the firm took any meaningful steps to stop any of the agency’s abuses that were committed with the technology and training Hacking Team provided. Instead, emails show that the firm was actively pursuing new contracts with INSA at the time of the breach.
We plan to put out a statement on the issues raised above. We would welcome a response from Hacking Team, which we will reflect in our reporting. Please reply by August 4, 2015 to ensure we can reflect your response in our reporting.
Sincerely,
Cynthia Wong
Senior Internet Researcher
Human Rights Watch
[i] Human Rights Watch Letter to Mr. David Vincenzetti and Mr. Valeriano Bedeschi, Hacking Team, February 13, 2014. See Human Rights Watch, “They Know Everything We Do": Telecom and Internet Surveillance in Ethiopia, March 25, 2014, Appendix 2: Company Correspondence, https://www.hrw.org/report/2014/03/25/they-know-everything-we-do/telecom-and-internet-surveillance-ethiopia#e8e565.
[ii] Letter from Human Rights Watch to Hacking Team, “Re: Update on Sale and Use of Hacking Team Solutions in Ethiopia,” February 25, 2015, https://www.hrw.org/news/2015/02/25/letter-hacking-team-re-update-sale-and-use-hacking-team-solutions-ethiopia.
[iii] Human Rights Watch, “They Know Everything We Do": Telecom and Internet Surveillance in Ethiopia, March 25, 2014, https://www.hrw.org/report/2014/03/25/they-know-everything-we-do/telecom-and-internet-surveillance-ethiopia.
