Shipping records reveal that a lesser-known affiliate of the hack-for-hire company NSO Group supplied equipment in 2020 to Uzbekistan’s national intelligence agency (SGB), often referred to as a “secret police” force with a record of brutality and oppression.
NSO Group creates hacking tools that governments around the world have purchased to ostensibly monitor terrorists and other criminals. However, the tools have often been used by autocratic regimes to spy on journalists and dissidents.
The Pegasus project, an effort by a consortium of journalism outlets led by Forbidden Stories, detailed a leak of 50,000 phone numbers allegedly selected for surveillance by NSO Group clients. That list included hundreds of government officials, journalists, activists, military officials, and others who were selected for hacking.
Now, it can be revealed that NSO Group’s affiliate, Circles, did business with Uztelecom in 2020, and shipped equipment “supplied for SGB,” the acronym for the Uzbekistan State Security Service.
Forensic News believes in transparency in the journalism process. Go behind-the-scenes to see how this story was created with the Stone video bibliography:
Forensic News reviewed a bill of lading between a Circles subsidiary called MS Magnet Solutions and Uztelecom from August 2020 indicating that the cyber espionage firm sold hard drives to the autocratic state.
Like NSO Group, Circles sells tools that can pinpoint the exact location of a user and extract huge amounts of information from the target’s phone.
MS Magnet Solutions, controlled by Circles in Cyprus, appears to have sent hard drives to the telecommunications company for the ultimate use of the SGB. Though the total sale is reported to only have been for $980, the record establishes a business relationship between the two entities.
The SGB and Uzbekistan’s law enforcement, in general, have a record on human rights filled with instances of torture, political persecution, and other dictatorial measures.
In 2004, the U.S. State Department noted that Uzbekistan’s state security services, “routinely tortured, beat, and otherwise mistreated detainees to obtain confessions or incriminating information.”
One year later, the Uzbek security forces shot and killed hundreds of unarmed protesters. An independent report from the Office for Democratic Institutions and Human Rights described the scene,
“It started to rain heavily, and some witnesses also describe the shooting as a rain of bullets. Another witness described that there was blood everywhere, ‘it was raining and the blood was running down the street.’ When the security forces would shoot, people would lie down trying to protect themselves. The shooting would begin again when people stood up. This sequence was repeated several times.”
In recent years, new Uzbek leadership has promised to reign in the state’s security forces, but little substantive progress has been documented. “During 2020,” Human Rights Watch stated, “there were reports of torture and ill-treatment in prisons, most former prisoners were not rehabilitated, journalists and activists were persecuted, independent rights groups were denied registration, and forced labor was not eliminated.”
The Circles partnership with the SGB is sure to raise fresh concerns about NSO Group’s continued work with authoritarian regimes.
NSO Group did not respond to a detailed list of questions for this report.
NSO Group statements
Exclusive documents obtained by Forensic News also suggest that NSO Group is misleading the public about its global operations.
The new documents raise serious questions about NSO Group’s official responses to investigations conducted by Amnesty and others and expand on the understanding of the global nature of NSO Group’s business.
A report from May 2021 by Amnesty, Privacy International, and The Centre for Research on Multinational Corporations (SOMO), revealed a much fuller picture of NSO Group’s corporate structure than previously publicly known.
However, Forensic News compared answers (p.81-86) given by Chaim Gelfand, NSO Group’s Vice President of Compliance, to three human rights groups with documents from countries around the world and found that Gelfand was misleading at best in at least three answers.
All of the dubious statements made by Gelfand concerned NSO Group’s affiliate, Circles, which is based in Cyprus and Bulgaria and is owned by the same parent company as NSO Group.
Forensic News has also identified previously unreported companies located in Hong Kong, Taiwan, and the British Virgin Islands connected to Circles.
Unlike NSO Group, Circles receives export licenses for its hacking tools from the governments of Bulgaria and Cyprus, two countries far less regulated than Israel. One source with direct knowledge of the Pegasus project confirmed to Forensic News that the leaked list of phone numbers was strictly limited to NSO Group customers and was not connected to Circles in any way.
Business accounts from Cyprus show that the Circles branch there brought in approximately $37.6 million in revenue in 2016, the most recent year with accounts filed. In Bulgaria, Circles reported revenue of about $12.4 million in revenue from customer contracts in 2019.
- “CT-Circles Technologies Ltd. is not part of the Group. We do not have any details regarding this entity.”
NSO Group, via Gelfand, asserts that they don’t have “any details” about a company called Circles Technologies Ltd, in Cyprus. Multiple data points, however, suggest that this claim is false.
Chiefly among them are documents acquired from Cyprus that prove that Circles Technologies was owned by an NSO Group holding company called IOTA in 2014 and 2015. Gelfand, it should be noted, confirmed that IOTA is “part of the Group…”
It is unclear why NSO Group could not recall “any details” about a company that it previously owned.
Additionally, leaked emails and other documents that appeared in the outlet Al Araby show that Circles Technologies received payments for hacking tools in 2014, further indicating that NSO has details about this entity.
The documents from Cyprus show that after most of Circles Technologies assets were transferred to a separate entity controlled by NSO Group, the company was sold to a limited partnership in the British Virgin Islands (BVI), Grifindail LP.
Forensic News attempted to learn the identity of the owner of Grifindail, and although the documents for Grifindail were not filed privately as most in the BVI are, the sole managing partner was another BVI shell company whose documents are private.
- “The Group has no companies located in Cayman Islands or the British Virgin Islands.”
As documented above, Circles Technologies was sold in 2015 by an NSO Group holding company to a chain of companies in BVI, and some evidence exists that suggests that NSO Group maintained control of Circles Technologies after the ownership transfer.
Archived job postings from August 2015, months after the ownership change, indicate that the company was still hiring for Circles Technologies.
Though the company transferred nearly all of its assets prior to the sale, corporate accounts show that Circles Technologies had approximately $290,000 in the bank by the end of 2016. The identity of the persons behind Grifindail LP in BVI being unknown, it remains unclear if NSO Group maintained control of Circles Technologies after the share transfer or if they sold the company to an outside party.
- “The Bulgarian companies provide, on a contract basis, research and development services to their respective Cypriot affiliates and export the network products for governmental use.”
NSO Group asserts that the Bulgarian companies, most notably Circles Bulgaria, export their cyber surveillance products “for governmental use.” Incorporation documents for Circles Bulgaria, however, state that private clients are accepted.
“The Company has the following scope of activities: development and marketing of software and hardware, consultations and development of products in the area of computer technology, software and telecommunications for private, government and non-government organizations…”
An analysis of corporate records connected to Circles in various jurisdictions done by Forensic News reveals an even fuller picture of the global reach of the cyberespionage firm after reports by the Citizen Lab and Amnesty identified Circles clients and business entities.
The records identify Taiwan and Hong Kong as countries previously unconnected to Circles.
In Taiwan, a company called Ming Taian Technology Co., Ltd was incorporated in June 2018 with the shareholder listed as the aforementioned MS Magnet Solutions, a Circles subsidiary. Information in the Taiwanese business registry indicates that the stated activity for the company was “telecommunications equipment retail business,” though the company was dissolved just six months after its incorporation.
463 miles away in Kowloon, a neighborhood of Hong Kong, Circles has owned LI-Trade Company Limited since at least 2013. Earlier company accounts indicated that LI-Trade was a “software developer” in China, but Circles claimed in more recent years that the company was dormant. In August 2021, LI-Trade filed for dissolution.
Another connection to Hong Kong lies in the leaked documents showing the sale of tools to the UAE. In the invoice obtained by Al Araby, Circles is shown to be banking at HSBC’s branch in Hong Kong.
The newfound information on the global reach of Circles adds to the growing scrutiny of NSO Group. Federal investigators in the United States are reportedly examining NSO Group’s dealings, Israeli authorities “inspected” the company’s offices in July, and multiple other countries, including France, have opened their own probes.