Surveillance-For-Hire Industry Continues To Thrive, Says Meta

Journalists, activists, and political dissenters are increasingly being targeted by ‘surveillance-for-hire’ companies, Meta has warned.

In a report, the company says it has taken down global spyware operations in countries including China, Russia, Israel, the US and India, targeting people in almost 200 countries and territories.

“We disabled their accounts, blocked their infrastructure from our platform, shared our findings with security researchers, other platforms and policymakers, issued cease and desist letters demanding that they immediately stop violating activity, and also alerted people who we believe were targeted to help them strengthen the security of their accounts,” write the company’s Mike Dvilyanski, Margarita Franklin and David Agranovich.

In one example, the company discovered a network of about 130 accounts on Facebook and Instagram linked to a known Israeli spyware developer, Candiru, which was co-founded by a former employee of the notorious NSO Group.

Many organizations, says Meta, market themselves as ‘web intelligence services’, using fake accounts and software tools to scrape information from social media and other public websites.

More than 100 accounts on Facebook and Instagram, for example, were linked to a Russia-based company called Avalanche, selling access to a platform that enables surveillance across the internet.

Data was collected from traditional media, social media networks, and other websites on behalf of customers inside and outside of Russia, targeting Vietnamese activists and environmental activists, politicians, media and NGOs in the US, Nicaragua, Russia and Ukraine.

Unfortunately, these groups aren’t always that easy to eliminate, with many of those it removed in 2021 having created new fake accounts and changed their tactics, updating their software to evade detection and setting up new domains to circumvent blocks.

In other cases ⁠— such as Indian firm CyberRoot ⁠— the organization reappears under a new brand. One of the worst offenders, CyberRoot created fake accounts tailored to win the trust of targets, impersonating journalists, business executives and media personalities. In some cases, CyberRoot also created accounts that were nearly identical to targets’ friends and family members.

“Our investigation found CyberRoot target people around the world, working in a wide range of industries including cosmetic surgery and law firms in Australia, real-estate and investment companies in Russia, private equity firms and pharmaceutical companies in the US, environmental and anti-corruption activists in Angola, gambling entities in the UK, and mining companies in New Zealand,” says Meta.

“They were focused on business executives, lawyers, doctors, activists, journalists and members of the clergy in countries like Kazakhstan, Djibouti, Saudi Arabia, South Africa and Iceland.”

Meta is calling for more cooperation from governments and industry to deal with the surveillance-for-hire threat. Governments should regulate the activities of these firms and establish accountability frameworks based on EU data protection laws, it says, and limit the export of domestic technology to the surveillance-for-hire industry.

“Because surveillance-for-hire services cast their net so wide, no single company can tackle this alone,” write Dvilyanski, Franklin and Agranovich.

“We strongly believe that we need a concerted regulatory response by democratic governments, as well as continued action by industry and focus from civil society.”