Bahrain dictatorship’s British computer spyware

This video is called Finspy Hijacks Activist Computers – Are You Being Monitored?

From Bahrain Watch:

Top Bahraini Company Infected with Government Spyware Sold by UK Firm in Apparent Politically Motivated Targeting

Posted March 13, 2013 by & filed under Spy Watch.


Twitter: @bhwatch

March 13, 2013


Company Declines to be Identified, Citing Potential Reprisals

[Manama] During the course of recent investigations, Bahrain Watch determined that a computer inside a top Bahraini company was infected with spyware operated by Bahrain’s government. The spyware, known as FinSpy, is sold exclusively to government law enforcement and intelligence agencies by UK firm Gamma International. The company believed that it would suffer reprisals if we identified it as a victim by name, or mentioned its line of business.

The infection was detected using a tool developed by Bahrain Watch to search for FinSpy. Bahrain Watch conducted a limited distribution of the tool inside Bahrain. The tool identified FinSpy samples on the computer.

The infection at the company predates a campaign against Bahraini activists in April and May of 2012. The company was found to be infected with a version of FinSpy that identified itself as FinSpy v4.00. The campaign against activists used a version of FinSpy that identified itself as FinSpy v4.01. Both versions communicated with the same server inside Bahrain. Unfortunately, Bahrain Watch is unable to release the FinSpy v4.00 sample or hash, as these would likely identify the company. The use of two different FinSpy versions calls into question Gamma’s claim that Bahrain is using a “stolen demonstration copy” of FinSpy, and instead suggests that Bahrain is receiving updated spyware from Gamma. It also calls into question Bahrain’s recent claim that it did not purchase any spyware from Gamma International.

The infected computer inside the company contained information that could be used to observe or manipulate the company’s day-to-day operations. Bahrain Watch shared relevant data about the infection with Citizen Lab, who conducted an analysis.  The analysis could not establish whether any of this information was stolen from the computer. The infected computer was running a fully functional and up-to-date version of a top-10 commercial anti-virus product, which was incapable of detecting the infection.

The method of infection could also not be established. Activists targeted in April and May of 2012 received e-mails with attachments that contained FinSpy. However, the user of the infected computer inside the company did not recall receiving any suspicious e-mails. The user checked all of his or her online accounts, and did not find any suspicious links or e-mails around the date that the spyware was prepared for targeting. It is possible that an agent with physical or remote access to the computer installed FinSpy. Bahrain Watch understands that FinSpy can also be installed via an exploit injected into internet traffic using another Gamma product known as FinFly.

Bahrain Watch believes that there was no legal justification for the targeting of this company. “The infection of this company is consistent with a pattern of politically-motivated targeting, rather than legitimate criminal investigations,” said Bahrain Watch member Bill Marczak. “That the company is not even willing to identify itself as a victim speaks volumes about Bahrain’s political climate,” he added.

Bahrain Watch emphasizes that the Government is still using FinSpy, and advises netizens to be cautious. Ongoing state sponsored spying in Bahrain target entities and associates thereof that are perceived to express political opinions. These cyber attacks are not exclusive to pro-democracy activists — pro-government entities are targeted as well.

If you believe you have been targeted in an electronic attack by the Government of Bahrain, or any other GCC government, please contact Scans conducted last month indicated that Bahrain and Qatar were actively using FinSpy. A server was detected on Batelco IP, and on an IP in Qatar,, part of a range of sixteen addresses registered to “QTel – Government Relations.” The range also contains the website A FinSpy server was also previously found in the UAE.

2 Years After Invasion to Crush Uprising in Bahrain, Saudi Arabia Helps Fuel Conflict in Syria: here.

Protests in Bahrain on Anniversary of Saudi Intervention: here.

28 thoughts on “Bahrain dictatorship’s British computer spyware

  1. Pingback: Bahrain regime’s toxic teargas, film | Dear Kitty. Some blog

  2. Pingback: Bahrain regime tortures again | Dear Kitty. Some blog

  3. Pingback: Medical ethics conference impossible in dictatorial Bahrain | Dear Kitty. Some blog

  4. Pingback: Bahrain dictatorship and Martin Luther King | Dear Kitty. Some blog

  5. Pingback: Irish doctor resigns in dictatorial Bahrain | Dear Kitty. Some blog

  6. Pingback: Disgraced Conservative Liam Fox helps Bahrain dictatorship | Dear Kitty. Some blog

  7. Pingback: Bahrain dictatorship’s United States politicians’ support | Dear Kitty. Some blog

  8. Pingback: Bahrain dictatorship police attacks women with grenades | Dear Kitty. Some blog

  9. Pingback: British teachers support Bahraini freedom movement | Dear Kitty. Some blog

  10. Pingback: Bahraini pro-democracy activist interview | Dear Kitty. Some blog

  11. Pingback: Ecclestone, Cameron support Bahrain dictatorship | Dear Kitty. Some blog

  12. Pingback: Bahrain dictatorship persecutes doctors | Dear Kitty. Some blog

  13. Pingback: Bahrain dictatorship and Manchester United football | Dear Kitty. Some blog

  14. Pingback: Bahrain dictatorship attacks woman | Dear Kitty. Some blog

  15. Pingback: Bahrain dictatorship censors British journalists | Dear Kitty. Some blog

  16. Pingback: Bahrain dictatorship attacks May Day march | Dear Kitty. Some blog

  17. Pingback: Bahrain dictatorship’s British spyware, update | Dear Kitty. Some blog

  18. Pingback: Bahrain dictatorship’s whitewashing with Bell Pottinger public relations | Dear Kitty. Some blog

  19. Pingback: British government, corporation help Bahrain dictatorship’s spying on its people | Dear Kitty. Some blog

  20. Pingback: Bahraini arrested for tweeting, with help of British spyware | Dear Kitty. Some blog

  21. Pingback: German spyware corporation helps Bahrain dictatorship | Dear Kitty. Some blog

  22. Pingback: Bahrain dictatorship entraps Zello Due app users | Dear Kitty. Some blog

  23. Pingback: Qatar dictatorship police kills Indian fisherman | Dear Kitty. Some blog

  24. Pingback: Bahraini dictatorship’s hacking of computers in Britain | Dear Kitty. Some blog

  25. Pingback: Bahrain dictatorship and its British-German Internet spyware | Dear Kitty. Some blog

  26. Pingback: Corporate spyware sales to dictatorships | Dear Kitty. Some blog

  27. Pingback: Cybersecurity corporation spying on Black Lives Matter movement | Dear Kitty. Some blog

  28. Pingback: UAE people spied upon by government, foreign corporations | Dear Kitty. Some blog

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.