A Bulgaria-based company sold controversial surveillance technology to governments in countries with records of repression, enabling authorities to track mobile phones and eavesdrop on private communications, according to documents obtained by Human Rights Watch.
The surveillance firm Circles offered tools capable of spying on phone calls, messages and internet activity, according to a Human Rights Watch report published Thursday. The documents — a trove of Bulgarian export records covering sales by Circles between 2018 and 2023 — show that the Bulgarian government approved Circles transactions with law enforcement and intelligence agencies in countries including Azerbaijan, Bahrain, El Salvador, Guatemala, Jordan, Malaysia, Morocco, Panama, Serbia and the United Arab Emirates.
The findings raise fresh questions about how European Union export controls meant to curb the sale of powerful spy tools are being enforced.
Many of Circles’ customers are in countries ranked either “not free” or “partly free” by Freedom House, the nonprofit that tracks political rights and civil liberties worldwide. Human Rights Watch said the records provide evidence that European companies are still supplying surveillance capabilities to governments that could use them against critics, journalists and political opponents despite EU regulations introduced in 2021 to rein in such exports.
“Bulgaria shouldn’t be licensing surveillance exports to countries that have well-documented histories of using these tools to harm rights,” Zach Campbell, a senior researcher at Human Rights Watch, said in an interview.
Representatives for Circles didn’t respond to requests for comment. Bulgaria’s Ministry of Economy and Industry, which oversees exports in the country, also didn’t respond to requests for comment.
Circles’ technology is intended to be used for crime and terrorism prevention, according to the documents. But rights advocates say such tools can be abused in countries with histories of internal repression because they allow authorities to secretly monitor a person’s communications and movements.
The records show that Circles sold a system called Pixcell, which can intercept mobile phone calls, internet data and messages, as well as a tool called Landmark, which can be used to track the location of mobile phones.
In September 2023, Circles received approval from Bulgaria’s government to ship a system for intercepting voice calls to Morocco’s domestic intelligence agency, the General Director for Territorial Surveillance, according to the records. In Azerbaijan, the company agreed to send the country’s foreign intelligence service a system that could retrieve location information for mobile subscribers.
It also made sales to three agencies in the United Arab Emirates, including a spy agency identified in a document dated from 2019 as operating from the Aldar headquarters building in Abu Dhabi. The Aldar building has long been associated with real estate and investment firms, but it has not previously been linked publicly to a spy agency.
Government representatives in the UAE, Morocco and Azerbaijan did not respond to requests for comment.
Circles doesn’t appear to sell spyware that can be used to hack into individual phones. Instead, its technology is designed to eavesdrop on communications and track phones by intercepting data as it is traveling across telecommunication networks.
Human Rights Watch previously said in a report that at least six EU member states — including Bulgaria, the Czech Republic, Denmark, Finland and Poland — had sold surveillance technologies to customers in countries with documented histories of human rights violations, including repression of activists and journalists. The organization said its findings showed the EU’s regulations have “failed to prevent dangerous surveillance technologies getting into the hands of those with track records of using them to violate rights.”
The European Commission, the EU’s executive branch, said in a statement at the time that it “attaches great importance to the issue of cyber-surveillance items, which is why the EU has significantly strengthened export controls for such items.” Export controls, which are enforced by member states, need to be regularly updated to “adjust to evolving security risks and threats,” the spokesperson added.
Sophie in ‘t Veld, a Dutch politician who led an inquiry into surveillance abuses while a member of the European Parliament, said in an interview that the trade in the technology – and the laws regulating it – were “completely wild west.”
“We have rules on paper, but they have the status of a beer coaster,” she said in an interview.
Photo credit: Angel Garcia/Bloomberg
Related: