A Cyprus lawyer is embroiled in a legal battle with an Israeli high-tech firm that produces smartphone hacking technology used by some governments to spy on their citizens.
When mysterious operatives lured two cybersecurity researchers to meetings at luxury hotels over the past two months, it was an apparent bid to discredit their research about an Israeli company that makes this spyware.
The Associated Press reported similar undercover efforts targeting at least four other individuals who have raised questions about the use of the Israeli firm's spyware.
The four others targeted by operatives include three lawyers involved in related lawsuits in Israel and Cyprus alleging that the company, the NSO Group, sold its spyware to governments with questionable human rights records. The fourth is a London-based journalist who has covered the litigation.
Two of them — the journalist and Nicosia-based lawyer Christiana Markou — were secretly recorded meeting the undercover operatives; footage of them was broadcast on Israeli television.
All six of the people who were targeted said they believe the operatives were part of a coordinated effort to discredit them.
"There's somebody who's really interested in sabotaging the case," said one of the targets, Mazen Masri, who teaches at City University, London and is advising the plaintiffs' attorney in the case in Israel.
Masri told AP the operatives were "looking for dirt and irrelevant information about people involved."
The targets told the AP that the covert agents tried to goad them into making racist and anti-Israel remarks or revealing sensitive information about their work in connection with the lawsuits.
NSO has previously said it has nothing to do with the undercover efforts "either directly or indirectly”.
The undercover operatives' activities might never have been made public had it not been for two researchers who work at Citizen Lab, an internet watchdog group that is based out of the University of Toronto's Munk School.
In December, one of the researchers, John Scott-Railton, realised that a colleague had been tricked into meeting an operative at a Toronto hotel, then questioned about his work on NSO.
When a second operative calling himself Michel Lambert approached Scott-Railton to arrange a similar meeting at the Peninsula Hotel in New York, Scott-Railton devised a sting operation, inviting AP journalists to interrupt the lunch and videotape the encounter.
Masri's revelation prompted a flurry of messages to others tied to litigation involving NSO. Masri and Scott-Railton say they discovered that Markou, a lawyer representing plaintiffs in a related lawsuit against NSO-affiliated companies in Cyprus, had been flown to London for a strange meeting with someone who claimed to be a Hong Kong-based investor.
Around the same time, Masri found out that a journalist who had written about NSO was also invited to a London hotel — twice — and questioned about his reporting.
The undercover agents got a little further with Markou, the lawyer who is pursuing the Cypriot case against NSO-affiliated entities.
Her lawsuit draws heavily on reports by Citizen Lab that found that NSO spyware had been used to break into the phones of the Mexican activists and journalists who are the plaintiffs in both cases.
Markou told the AP she was approached over email by a man who presented himself as Olivier Duffet, a partner at Hong Kong-based ENE Investments.
Duffet was ostensibly interested in inviting Markou — a leading data protection and privacy lawyer — to give a lecture at a conference.
Markou said she proposed discussing the lecture over Skype, but he insisted on an in-person meeting in London, eventually flying her out, putting her up in a fancy hotel and chatting for a little more than an hour.
Most of the discussion revolved around the proposed lecture — but then Duffet suddenly pivoted to the NSO case, asking her whether she felt the lawsuit was winnable and who was funding it.
Markou said she "gave either incorrect answers or expressly refused to answer" because she found his questions suspicious.
Who hired the undercover agents remains unclear, but their operational and digital fingerprints suggest they are linked, said AP.
The six operatives all began approaching their targets around the same time with individually tailored pitches.
Their bogus websites followed the same patterns; all of them were hosted on Namecheap and many were bought at auction from GoDaddy and used the Israeli web design platform Wix. The formatting of the websites was similar; in at least two instances — MGP and Lyndon Partners — it was identical. Even the operatives' email signatures were the same — consisting of three neatly packed, colorful lines consisting of a phone number, web address and email.
The operatives' LinkedIn pages were similar, too, featuring men in sunglasses shot from a distance, facing away from the camera, or at unusual angles — a tactic sometimes used to frustrate facial recognition algorithms.
