The Global Spyware Market Index

The following table shows the five largest spyware companies based on the number of suspected customers.

Details of our full findings are available on this Google data sheet.

FinFisher GmbH / Gamma Group

Location: Germany (Previously UK & Germany)
Number of suspected customers: 33
Client regime type: 6% full democracies

FinSpy is a highly intrusive spyware suite initially manufactured by UK headquartered Gamma Group. Production of the spyware shifted to FinFisher GmbH in 2013, a Germany-based company.^[4]

Since its inception, the company has sold invasive surveillance tools to governments and state agencies around the world. Once infected, a victim’s device is silently monitored in real time allowing the end-user to intercept communications, access private data, monitor geolocation, and record audio and video.

The company gained notoriety when it was revealed that the company had sold FinSpy to the Egyptian government’s State Security Investigations Service.^[5] The intelligence body was known for committing egregious human rights abuses during Hosni Mubarak’s rule. Since then, researchers have documented the repeated abuse of the company’s spyware against activists and political opponents in authoritarian countries such as Ethiopia, Turkey and Uganda.

In 2019, Reporters Without Borders alleged the company was responsible for enabling Turkish authorities to target journalists and opposition voices in the country.^[6] The following year, the company’s headquarters were raided by police after it was reported that the company had been exporting its technology without the relevant licences.^[7]

Circles

Location: Israel
Number of suspected customers: 25
Client regime type: 12% full democracies

Circles is a lesser-known company in the surveillance industry. According to a recent report by the University of Toronto’s Citizen Lab, it has sold its equipment to at least 25 countries including several countries with poor human rights records such as Nigeria, UAE and Vietnam.^[8]

Leaked documents show the system is designed to exploit telecommunication protocol vulnerabilities.^[9] Customers can also purchase a separate system called “Circles Cloud”. This tool allows users to connect to telecommunication companies’ infrastructure around the world.

Such attacks are known as Signaling System 7 (SS7) Attacks.^[10] They allow an end-user to capture information including voice calls, messages and live location information.

The researchers also found that the government agencies connected to the Circles’ technology have a history of exploiting digital surveillance methods for human rights abuses. Such wide-reaching surveillance continues an established pattern of international intimidation, where dissidents and exiled citizens fear for their safety irrespective of which country they are in.

NSO Group

Location: Israel
Number of suspected customers: 23
Client regime type: 10% full democracies

Founded in 2010, the Israel-based NSO group has built a reputation for providing one of the most “sophisticated pieces of cyber-espionage software” ever seen.^[11]

The company’s most well known software, Pegasus, is capable of covertly tracking every detail of a target’s digital activity, giving the user access to a target’s camera, files and even encrypted messages. The malware is traditionally delivered via a carefully designed phishing message, although details of “zero-click exploits” have recently emerged.^[12]

The company is renowned for selling its technology to governments globally and its spyware has been frequently linked to human rights abuses in countries including Mexico, UAE and Rwanda.^[13]

Despite the numerous lawsuits^[14] and investigations surrounding the use of Pegasus against human rights activists, journalists and dissidents, NSO still claims that its technology is sold to carefully vetted customers intended to fight terrorism and crime.^[15]

In one of the biggest revelations to date, an internal investigation by WhatsApp revealed 1,400 devices had been infected with Pegasus in 2019.^[16] NSO Group is part-owned by London-based investment firm, Novalpina Capital. The transaction valued NSO at $1 billion in 2019.^[17]

This table shows the countries with the most extensive and varied spyware arsenals based on the number of different vendors from whom they are reported to have purchased technology.

Details of our full findings are available on this Google data sheet.

UAE

The United Arab Emirates is reported to have purchased spyware from Candiru, Circles, FinFisher, Hacking Team and NSO Group. The country even has its own bespoke hack-for-hire team from cybersecurity firm DarkMatter, which uses a cutting-edge hacking platform known as Karma.^[18]

The Emirates were Hacking Team’s second-biggest clients, behind only Morocco, reportedly paying the company more than $634,500 to target 1,100 devices with spyware in 2015.^[19] Moreover, leaked contracts suggested a total licensing fee of at least $18 million for NSO Group’s surveillance software.^[14]

The rise in surveillance technology in the Middle East has had serious implications for pro-democracy activists in the region. Ahmed Mansoor, a prominent human rights activist, has reportedly been repeatedly targeted with spyware. Researchers found that his devices had been digitally targeted with technology made by FinFisher, Hacking Team and NSO Group over recent years.^[20]

Political espionage has also been a dominant driving force behind the UAE’s use of spyware. The Emirati target list has reportedly included Saudi Arabia’s Prince Mutaib bin Abdullah,^[14] Lebanon’s Prime Minister Saad Hariri^[21] and Sheikh Tamim bin Hamad of Qatar.^[22]

Mexico

Over the past decade, Mexico has become renowned for its use of spyware. We found Mexico to be one of the countries with the most spyware tools in their arsenal, only second to the UAE. Authorities in Mexico are reported to have access to tech made by Ability Inc., Circles, and NSO Group as well as Hacking Team and FinFisher.

Mexico have reportedly been NSO Group’s biggest customer, spending $80 million on their surveillance technologies between 2011 and 2017.^[23]

NSO’s products have reportedly been used against some of the country’s most outspoken human rights lawyers, journalists and anti-corruption activists. In 2020, Mexico was deemed the most dangerous place for journalists by the Committee to Protect Journalists, with nine journalists killed last year alone.^[24]

It has even been suggested that the authorities with access to spyware may end up supplying it to organized crime groups. According to a statement provided by a Mexican official to the Cartel Project, “The police who have the technology would just sell it to the cartels.”^[25]

Morocco

Digital attacks have been symptomatic of a larger trend of increasingly repressive governance in Morocco.^[26] A 2015 leak of Italian spyware vendor Hacking Team’s emails revealed that the Moroccan government had spent close to $4 million on the company’s Remote Control System (RCS) software.^[27]

“Surveillance in Morocco is carried out in an open and brazen way… Surveillance is a type of punishment. You can’t behave freely. It is part of their strategy to make you suspect you’re being watched so you feel like you’re under pressure all the time.” – Abdessadak El Bouchattaoui, Moroccan Human Rights Defender^[28]

A 2020 report by Amnesty International revealed a sustained campaign by the Moroccan government to spy on prominent journalist and activist, Omar Radi, using NSO Group’s Pegasus.^[29] The revelation came just days after NSO had pledged to prevent its products being used to target human right defenders.

The following table displays the types of individuals targeted with spyware and the countries where they were located at the time of attack.

Details of our full findings are available on this Google data sheet.

Activists & Dissidents

It is of little surprise that human rights defenders, activists and dissidents are the most frequently targeted group given the repressive governments who have purchased the technology. These individuals are vital in promoting freedom of expression and democratic ideals, something many repressive regimes would rather silence than listen to.

Omar Abdulaziz

Omar Abdulaziz is a prominent pro-democracy Saudi activist who resides in Canada.

According to a lawsuit filed by Abdulaziz, the Saudi royal court allegedly had access to Jamal Khashoggi’s communications with Abdulaziz as they’d installed NSO’s spyware on his phone.^[30]

The exploit was later confirmed with “high confidence” by research group Citizen Lab.^[31] They identified the end user as an operator linked to the government of Saudi Arabia. The spyware attack on Abdulaziz took place in summer of 2018, just months prior to the assassination of Khashoggi in the Saudi consulate in Istanbul.

Maati Monjib and Abdessadak El Bouchattaoui

Two human rights defenders from Morocco were reportedly targeted with NSO Group’s Pegasus spyware, according to a 2019 report by Amnesty International.^[32] The findings detail the two victims as Maati Monjib, a historian and activist advocating for freedom of expression, and Abdessadak El Bouchattaoui, a human rights lawyer.

Monjib has faced repeated reprisals from the Moroccan state. In 2015 he was accused of “endangering state security” under Article 206 of the Penal Code and most recently has been sentenced to 1 year in prison on charges of money laundering.^[33] Bouchattaoui similarly faced imprisonment in 2017 after his vocal criticism of the use of excessive force by authorities during the 2016/2017 popular uprisings which led to the arrest of 400 protestors.^[34] He has been living in exile in France since 2018.

Political Figures

Political figures have frequently found themselves entangled in political cyber-espionage campaigns in countries were political debate is stifled or seen as a threat to the authoritarian status quo.

Faustin Rukundo, Frank Ntwali & Placide Kayumba

According to a 2019 Financial Times report, three prominent Rwandan opposition party members were revealed to have been targeted with NSO Group’s Pegasus spyware.^[35]

Rukundo and Ntwali are both members of the of the Rwanda National Congress, an exiled opposition group, while Kayumba is a Belgium-based member of Rwanda’s FDU-Inkingi opposition coalition. Under the current presidency of Paul Kagame, critics of the government or ruling party of the Rwandan Patriotic Front have often been reported as missing or dead in unexplained circumstances around the world, with three colleagues of Kayumba’s FDU-Inkingi group disappearing in 2019 alone.^[36]

“It’s a grave violation… All of my colleagues at the centre of the part are monitored and threatened on a daily basis with assassination, disappearance, imprisonment.” – Placide Kayumba

Roger Torrent

Roger Torrent and at least two other pro-independence Catalan politicians were reportedly targeted with NSO’s Pegasus spyware in what was believed to be the first use of spyware to target a political figure in a European democracy.^[37]

The Spanish Interior Ministry, National Police and Civil Guard claim that they never hired the services of the NSO Group, while the Spanish Intelligence agency commented that it “always acts in clear accordance with the law”.^[38]

Journalists

Journalists are frequently targeted due to their role criticizing governments with poor human rights records.

“The reckless and abusive use of commercial spyware to target journalists, their associates, and their families adds to the numerous and growing risks that journalists worldwide now face,” said Ron Deibert of Citizen Lab.

“Thanks to companies like NSO Group, unscrupulous dictators and autocrats now have a powerful tool to aid in their sinister aims to stifle dissent and quell controversial reporting.”^[39]

Ben Hubbard

In 2018, New York Times correspondent Ben Hubbard received a suspicious text message.^[40]

He was working and reporting from Saudi Arabia when he received a text that read, “Ben Hubbard and the story of the Saudi royal family.”

Later, researchers at Citizen Lab determined that the text included an exploit link for Pegasus. He was the first American journalist to have been targeted with the technology. Fortunately, Hubbard did not open the link and was therefore not affected.

Alejandro Santos

In January 2020, it was reported that the Colombian military had purchased an invasive spyware tool from Mollitiam Industries, a Spanish cyberintelligence firm.^[41]

The company was listed as one of Reporters Without Borders’ 20/2020 list of press freedom’s digital predators after it was alleged the military have used the tool to “spy on supreme court judges, politicians, journalists and journalists’ sources”.^[42] The targets are said to include Alejandro Santos, the editor of the news magazine, Semana.