Advanced surveillance equipment, developed by a company controlled by the former commander of Israeli intelligence’s technology unit, was sold last year to the government of Bangladesh, official government documents and international export records show, despite Bangladesh not being on Israel’s list of countries that such technology may be sold to – and despite its consistently poor human rights record.

The equipment, which is used to intercept mobile and internet traffic, was sold to the National Telecommunication Monitoring Center, or NTMC, an arm of the Bangladeshi Interior Ministry responsible for tracking internet and social media use inside the country, as well as for online censorship and eavesdropping on citizens.

Bangladesh is the third-largest Muslim country in the world, and does not recognize Israel. The two countries have no diplomatic relations, and until 2021, all Bangladeshi passports had “This passport is valid for all countries of the world except Israel” written on them.

The Forbes report embarrassed the government in Cyprus, creating political turmoil and leading to an investigation into violations of European Union privacy laws. In the end, all the allegations against Dilian and top company executives were dropped, but WiSpear was fined one million euros (about $1.1 million) for “extracting data unlawfully” from the devices of passersby at the Larnaca Airport.

Export records show that in June 2022, a SpearHead system was delivered from Switzerland to the Bangladeshi capital of Dhaka. The supplier was Passitora, and the buyer was NTMC. The shipment, weighing 991 kilograms, included the interception system, operating software and hardware components (servers, drives, monitors, etc.) at a total cost of $5.7 million.

Passitora is part of the Intellexa Alliance, a network of companies run by Dilian that acquired an array of sophisticated surveillance technologies, including mobile phone hacking spyware, that it sells to government agencies around the world. A Haaretz investigation revealed the network and a plane linked to Dilian, which delivered advanced spying equipment to a notorious militia in Sudan in May 2022.

Sources in Israel’s cyberarms industry say the company’s operations are not overseen by the Israeli government. Amir Eshel, the outgoing Defense Ministry director general, spoke to The New York Times in December about his inability to rein in Dilian and others who set companies abroad. “It certainly disturbs me that a veteran of our intelligence and cyber units, who employs other former senior officials, operates around the world without any oversight,” Eshel said.

The Israeli Defense Ministry did not specifically address Haaretz questions on whether it oversees Passitora and the other firms mentioned in this report, and whether it approved the spyware sales to Bangladesh, and said this in response: “The Defense Ministry acts, and will act, to enforce unapproved defense exports, including services and knowhow – according to its legal authority. As a rule, the ministry does not divulge information on the defense export policy, for security, diplomatic and strategic considerations”.

The government’s preferred weapon

But official documents cited in this report reveal for the first time four other transactions for the purchase of Israeli spy technology by Bangladeshi government agencies involved in human rights violations. The technology enables them to surveil Bangladeshi citizens through their phone and to hack wireless networks and monitor internet traffic.

The companies are either Israeli or foreign with a clear link to Israel, and some of the exports are by firms registered in the Virgin Islands, Cyprus and Singapore who seemingly act solely as middlemen.

NTMC, the Interior Ministry arm that bought the SpearHead system, was formed in 2013 and deals, according to reports, with eavesdropping on opposition officials, protestors and ordinary citizens. It is the “Bangladeshi government’s largest legal interception system … that is connected with about 250 communications providers in the country,” admitted one of its former senior officials. Every provider is required to give NTMC full access to traffic on their networks.

NTMC’s Director General is Maj. Gen. Ziaul Ahsan, who previously held a series of operational and intelligence posts in the Rapid Action Battalion. A former Bangladesh army chief, Aziz Ahmed, claims that Ahsan is personally responsible for many of the disappearances that have occurred in the country.

“Today, there’s no significant political opposition in Bangladesh – the government has the will and the means to suppress its political opponents,” says Zulkarnain Saer Khan. A Bangladeshi journalist who now lives in exile, Saer Khan has exposed political oppression in his country and took part in this investigation.

“Bangladesh isn’t capable of providing its citizens with basic infrastructure, but government agencies enjoy the best modern spy technology money can buy. Draconian laws have turned it into the government’s preferred weapon for silencing and intimidating journalists, critics and political activists. Negative propaganda against the father of the nation – the father of the current prime minister – can end in 14 years in prison,” he says.

Two of Khan’s colleagues were persecuted by the authorities after they criticized the government: cartoonist Ahmed Kabir Kishore was detained for 10 months during which he was severely tortured; and the writer-journalist Mushtaq Ahmed who was arrested, tortured and died while in custody. Photographer Shahidul Alam was arrested in a similar manner after he criticized the government on an Al-Jazeera interview. He was also tortured while in detention and released after 100 days.

Training trips to Greece

In June 2021, the Bangladeshi cabinet decided to buy a “Vehicle Mounted Mobile Interceptor” spy vehicle, which is equipped with, among other things, technology to intercept mobile phone calls and text messages, locate the user and hack into wireless networks. According to an official cabinet document, two companies bid to supply the technology, and the one that was chosen was a Swiss company, Toru Group Limited.

There is no company that goes by that name in the Swiss companies registry, but a company that does have that name is registered in the British Virgin Islands. It has a Geneva address that is used by a firm that provides foreign registration services for companies.

The company’s CEO is Assaf Elias, an Israeli citizen, according to profiles on LinkedIn and Facebook. Until recently, Elias was a minority shareholder in another company registered in Britain, together with several prominent figures in the Israeli cyberoffensive industry.

Official documents from Bangladesh’s Interior Ministry reveal that the commander of the NTMC and other senior officials flew to Greece in 2021 and 2022 to train on the spy vehicle they had bought. According to the documents, the trips “were fully funded by Toru.”

By that time, Dilian had already moved his headquarters to Athens after his entanglements in Cyprus. According to past reports, the office had set aside an area with prayer mats for teams coming for training from Muslim countries like Bangladesh.

NTMC’s budget shows that the system was expected to arrive in Bangladesh in mid-2022. Shipping documents show that the system was delivered at the end of June. Two sources in Bangladesh say that a new, advanced spy van is already in service, with its surveillance tools leading to the firing of seven police officers who allegedly criticized the government on a secret WhatsApp group and communicated with figures in the BNP opposition party.

Passitora and Dilian did not respond to requests for comment. When reached for a response, Elias hung up and declined to comment.

Not just Big Brother on wheels

The cyber shopping spree didn’t end here. An official document from the prime minister’s office dating from 2019 shows that Bangladesh’s internal intelligence agency, or NSI, also bought a system for intercepting Wi-Fi communications from a company called Prelysis.

That year, four senior NSI officials went to Cyprus to inspect the system before it was shipped to Bangladesh. Cypriot export records show a July 2019 Wi-Fi interception system shipped from Prelysis to Bangladesh at a total cost of about $3 million.

Prelysis is registered in Israel and Cyprus under slightly different names. The Cypriot firm is “dormant”, while the official document from Bangladesh has the Israeli firm’s name. Its website says it is “a consultancy and integration company in the intelligence and homeland security domain.” It boasts a platform that integrates various intelligence sources, including wireless and cellular communication sensors and device location. The founder of the company and its current director, Israeli citizen Kobi Naveh, worked until 2014 at Verint.

In reply to an “Haaretz” inquiry, into whether Prelysis is overseen by Israel’s Defense Ministry and whether it OK’d the deal, Naveh said he “cannot respond”.

Israel-Singapore-Cyprus-Bangladesh

Sources in Israel’s cyber industry say Bangladesh isn’t on the list of countries that the Israeli defense establishment approves for exports of classified technology, due to concerns that it will fall into the hands of Pakistan. They say that in the past year, the list of countries approved for cyberoffensive exports has been whittled down to just 37, most of them Western democracies. The Defense Ministry consistently refuses to respond or divulge any information on the list of approved countries.

Cyprus’ export records from July 2019 show another shipment for the Bangladeshi military – this time for equipment used for the “active monitoring of mobile phones” – at a cost of $1.6 million. The supplier is Coralco Tech, of Singapore. A tender by the Bangladesh Army from 2018 shows that the military was indeed interested in systems for active and passive tracking and locating of mobile phones.

On Singapore’s companies registrar, Israeli Eyal Almog is listed as Coralco Tech’s owner. In Israel, the company is registered under the same name and address, and with the same owner. Almog’s LinkedIn page carries endorsements from his friends in the cybersecurity, defense, intelligence and homeland security communities. Some of them worked with him. One of them, a Bangladeshi national, says that as a local expert he installed various systems to intercept cellular communications and helped connect telecom providers to the NTMC’s surveillance system.

In response to this report, Coralco Tech said that “due to the nature of its deals, the company does not comment on the identity of its clients and the products that they buy. In general, all deals involving the company are fully reported while attaining the proper licenses from the regulatory bodies, including Israel’s Defense Ministry. The company sells its products after an internal vetting process that takes into account human rights violations”.

Cyprus export records reveal that another company, U-TX Technologies, provided surveillance equipment to Bangladesh. This includes a “Web Intelligence” system, valued at $2 million and delivered to NTMC in 2019; and a cellular tracking system for military intelligence, valued at $500,000, in 2021.

U-TX was set up in Cyprus by Israelis – it is registered and operates from the island. It is helmed by CEO David Heled and at least two other Israelis are managers in the company. In 2014, U-TX was purchased by Verint, which is traded on the Nasdaq and offers artificial intelligence and data-analysis technologies. Verint has also sold advanced cyberespionage tools to oppressive regimes like those in South Sudan, Uzbekistan and Kazakhstan, investigations over the past decade revealed.

In 2021, Verint spun off its security operations into a new company called Cognyte, which shares an address with Verint in Herzliya, Israel and supplies the same cybersecurity services Verint once did. U-TX operates today under the name Cognyte.

U-TX, Cognyte and Heled did not respond to requests for comment. No response about the purchase of Israeli spyware was received from Bangladesh’s Interior and Foreign Ministries.

Jurre van Bergen and Sharad Vyas of OCCRP and Zulkarnain Saer Khan took part in this investigation.