From Malpensa to Tel Aviv: Italian police use Israeli software to spy on anti-deportation activsts
Topic
Country/Region
25 February 2025
In March last year, four people were arrested after stopping a deportation flight to Morocco leaving Milan's Malpensa airport. When they got their phones back from the police, they found a strange file – one connected with spying products designed by the Israeli firm Cellebrite.
Support our work: become a Friend of Statewatch from as little as £1/€1 per month.
Image: Kārlis Dambrāns, CC BY 2.0
This text is an edited translation of a statement was originally published (in Italian) by NoCPR Torino: Da Malpensa a Tel Aviv: Come le aziende di sicurezz informatica Israeliane collaborano con le autoritá Italiane per accedere ai dispositive mobile
Mobile phone surveillance by police
Police violence is about more than batons. It also manifests itself through interference and encroachment into private life. Police have always used an odious set of tools to achieve this. They follow people’s movements and observe and listen to their daily lives.
Today, however, access by police forces and governments to confidential, detailed and sensitive information can be much more pervasive than one might imagine. The spyware system Paragon, that has recently come to light, is one example of this. The services provided by the Israeli company Cellebrite are another, albeit different, example.
We have written this text because we believe it may help people protect themselves from the pervasive surveillance by the authorities. We invite you to share it widely.
The context
The people whose phones were seized and tampered with live and organise in Turin. They struggle against administrative and criminal detention systems. For example, they take part in the mobilisation against CPRs (detention centres for migrants), ‘41bis’ (an exceptionally tough prison regime) and ‘ergastolo ostativo’, a form of life imprisonment without benefits or parole, unless the prisoner cooperates with judicial authorities.
The nature of these struggles makes unpleasant encounters with the police and their investigations, in particular those from DIGOS (Divisione Investigazioni Generali e Operazioni Speciali, the police special unit for serious and political crime), quite frequent.
We do not point this out to claim a special role in the spectacle of repression, but because we want to avoid alarmism and Orwellian paranoia about total control.
In fact, we do not think that mass surveillance is happening. Rather, those who decide to carry out struggles or even just acts of dissent may end up being caught up in these forms of espionage. Therefore, they need information that can help protect them.
The facts
On 20 March 2024, a person of Moroccan origin was due to be deported on a Royal Air Maroc flight departing from Milan’s Malpensa airport. Five people were detained for preventing the flight’s departure, four were subsequently arrested, and the police seized three smartphones from them.
The phones were first seized by the border police at Malpensa, then passed on to the prosecutor's office of Busto Arsizio, and then who knows where else before they were finally returned to Turin.
The decision to take the phones into the airport was made amidst the urgency of trying to prevent the deportation. The car carrying the anti-deportation activists arrived at the departures area of the airport exactly five minutes before the scheduled take-off time of the flight to Casablanca.
The risk assessment carried out by those in the car did not foresee that it would be so ‘easy’ to breach the airport’s security systems and reach the runway. Nor did they foresee that a European police force would use phone spying products designed by Cellebrite in Israel.
In the few seconds available, in the unpredictability of the situation and considering the need to communicate with friends, comrades and lawyers, the decision was made to take three of the six phones that were in the car.
Today we know that those three phones were spied on and tampered with by the police or their collaborators. This was done in a way that was totally hushed up, never officially communicated and without any summons for the computer expert acting for the defence lawyers.
It is difficult to assess whether in those few minutes, rushing between a car and a plane, it would have been possible – or sensible – to make a different choice. Through this short text we invite everyone to always bear in mind that there is a grey area, rather unknown to many, for the use of surveillance technologies.
The phones
The phones in question are fairly common Android phones, all three of them protected by a PIN or pattern, fairly recent, updated and with encryption enabled. When they were released by the police, two of the phones had stickers on them, with their PINs written down in pen: this was not a good start.
One of the tools used to check the devices for tampering was MVT (Mobile Verification Toolkit). This allows a consensual forensic analysis, looking for signs to indicate the phones have been compromised. In this case, no known traces were found immediately, but MVT also highlights other oddities. In this case, that was the presence of two suspicious files, located in the phones’ file systems in places where they should not have been.
The creation date of these files was after the date of the seizure, confirming that the device had been compromised by the police. This surprised us because, until not very long ago, it was considered quite complicated, and above all expensive, to overcome certain security practices.
Searches for the names of the files and their hashes (unique identifying codes) led to a recently published report by Amnesty International. The same file, with the name ‘falcon’, had also appeared on devices seized by authorities in Serbia.
This, in turn, leads to the UFED/Inseyets technology developed and sold by Cellebrite. UFED, Universal Forensic Extraction Device, allows the extraction of all data from mobile devices, such as smartphones – including “deleted” messages.
Inseyets is advertised by Cellebrite as a “purpose-built, all-inclusive digital forensics suite” that can be used with UFED. It offers: “Unparalleled access to the latest Android and iOS devices,” and: “Full file system extractions, including encrypted content.”
GrapheneOS, an open-source operating system for phones that normally use the Android software produced by Google, have published some technical details on Cellebrite’s offers to clients.
Many pieces of this story are still missing, unknown and perhaps classified. What we want to clarify is that we know for certain that Italian public prosecutors' offices and law enforcement agencies are using Cellebrite's phone-tampering technologies produced in Israel.
The Israel model and its international partnerships
Israel has always been a strategic, almost indispensable partner for the west, especially in the fields of war and security. What this story helps to outline are the consequences of a trade that has existed for decades.
It is a trade based on the development and export of security-minded and repressive technologies. This is a process which, on the one hand, features huge Israeli investments in the technological development phase and, on the other, involves substantial funding from Europe and the USA to acquire primacy and use of the finished product.
By testing many of these technologies on the Palestinian people, the “best possible version” is obtained, especially in terms of economic competitiveness on the market. Hence, this leads to the re-creation in our context of the “Israel model”: authoritarian, security-minded and based on the culture of the internal and external enemy.
Importing this model does not just imply paying increasingly accessible market costs. It also entails submission and immobility by so-called “western democracies” despite witnessing 15 months of genocide.
We hope that everyone can take from this story what they consider useful to increase their level of security, protect themselves from the eye of the state and its henchmen, and to creatively imagine their own paths of struggle. We would like this information to be widely disseminated.
FREE PALESTINE!
FREE EVERYONE!
This text is an edited translation of a statement was originally published (in Italian) by NoCPR Torino: Da Malpensa a Tel Aviv: Come le aziende di sicurezz informatica Israeliane collaborano con le autoritá Italiane per accedere ai dispositive mobile
Our work is only possible with your support.
Become a Friend of Statewatch from as little as £1/€1 per month.
Further reading
Italy has nullified the right to transparency regarding borders
The State Council has confirmed an “absolute” lack of access concerning acts related to the “management of borders and immigration”. Meanwhile, the government’s procurement worth millions of euros for Libya, Tunisia and Egypt continues.
Italian ministers should face justice for freeing fugitive war criminal, says legal complaint
A case filed with the International Criminal Court calls for the launching of investigations into Giorgia Meloni, the Italian prime minister, and two other high-ranking Italian politicians. The complaint accuses them of helping an alleged war criminal wanted by the ICC to escape from Italy to Libya. In doing so, they obstructed the work of the International Criminal Court, says the filing - a crime under international law.
Italian security decree "most serious attack on right to protest in recent decades"
A bill under discussion in the Italian senate is "the most serious attack to the freedom of protest ever waged in recent decades," says a joint statement signed by 26 organisations from across Europe, including Statewatch. The bill, targeted at the climate and environmental movements, would criminalise protest roadblocks. Other measures would increase punishments for resisting major infrastructure projects. The bill would "further criminalise and marginalise vulnerable communities, including immigrants, beggars, the homeless, Roma people, those residing in squats, and detainees," says the statement.
Spotted an error? If you've spotted a problem with this page, just click once to let us know.