U of T lab the bane of Italian spyware firm

Hacking Team had been subject of numerous reports by Munk School’s Citizen Lab

A Toronto research lab has caused a lot of grief to an Italian spyware firm allegedly linked to oppressive regimes, leaked files suggest. In emails, the firm Hacking Team was forced to suspend a client after a damning report from University of Toronto’s Citizen Lab (CL), a monitor of “political power in cyberspace.”

After another report by Citizen Lab, the firm’s executives were so agitated they wanted to “hit CL hard” through litigation, though they ultimately aborted that plan.

The emails’ release was the result of an ironic turn of events, in which Hacking Team, a peddler of software that grants unauthorized access to people’s computers, was itself hacked. More than 400 gigabytes of files — equivalent to 100,000 copies of all seven Harry Potter books — were set loose this month through the firm’s Twitter account.

The Star was unable to independently verify the authenticity of the files, which detailed the firm allegedly providing surveillance to countries with poor human rights records.

The data corroborated what Citizen Lab — based at U of T’s Munk School of Global Affairs — has been reporting for years, embroiling Hacking Team in a storm of controversy.

Citizen Lab director Ron Deibert said it is “interesting” to find out his lab’s work — seven reports since 2012 — had had an impact on Hacking Team, but the contents of the leaked files were still “very discouraging.”

In March, Deibert sent an open let- ter to Hacking Team. The letter accompanied a fresh report on Hacking Team allegedly selling its technology to Ethiopia, which was said to have used it to spy on journalists.

According to leaked files, CEO David Vincenzetti forwarded it to senior members, writing, “It’s from our dearest friends at the U of Toronto.”

In the email chain, an operations manager wrote about the “dire consequences” that can be caused by “this kind of attention.”

Later correspondence confirmed that Ethiopia was dropped as a client due to Citizen Lab’s report, but not because of the alleged spying; rather, it was cut due to its “incompetent use” of the product that caused it to get caught, according to the emails.

But according to leaked emails, the firm offered to reinstate Ethiopia about two months later, with strict conditions and a bigger bill. Hacking Team spokesman Eric Rabe told the Star the firm will not speak to the validity of the leaked files, though he said the emails were “part of the discussion.”

He said the firm was unable to verify Citizen Lab’s “suspicions,” though it still suspended Ethiopia. “There (were subsequently) many ideas about whether there was some way to control the client and still provide services,” Rabe explained in an email, but added Ethiopia was ultimately not reinstated.

Vincenzetti said in a statement that Hacking Team sells only to government agencies, which use the software for fighting crime. The leaked emails revealed plans for retaliation last year against Citizen Lab after one of its reports appeared to have gone too far in the view of Hacking Team. “Question is: can we sue them?” Vincenzetti wrote in an email dated June 24, 2014, after the lab published an insider’s look into the firm’s technology through anonymously obtained files.

In the email chain, Rabe questioned the effectiveness of a lawsuit, but Eric Kuhn, the firm’s lawyer, was more bullish, replying with nearly 1,000 words recommending litigation. Kuhn wrote that choosing to “not go after” Citizen Lab would set a bad precedent and that the firm needed to discover the lab’s source so that it could plug the leak.

“By way of example, did an . . . employee provide CL with the information?” he wrote. “If so, that person needs to be fired and sued.”

But on June 30, the lawsuit was called off after executives deemed taking the matter to court would bring only “greater and wider exposure,” according to the emails.

Deibert said the lab is a research institute whose studies are objective and peer-reviewed, and he would not fear litigation even if it came.