137: Predator

Episode Summary

Executive Summary: The episode traces the rise of mercenary spyware through Tal Dillian, an Israeli ex-military cyber entrepreneur who built a global surveillance business via companies like Circles, WeSpear, Cytrox, Nexa, and Intellexa. Using investigative reporting, plane tracking, and malware analysis, it shows how these tools were sold to governments and actors linked to abuse in Greece, Sudan, and elsewhere, raising urgent questions about legality, oversight, and democratic accountability.

Main Topics: The evolution of Tal Dillian’s spyware empire (Priority: 5/5): Tal Dillian’s path from Israeli military intelligence and Circles/SS7 surveillance into Intellexa and related firms shows how cyber capabilities and corporate restructuring enabled a global mercenary spyware business. Greek surveillance scandal and Predator exposure (Priority: 5/5): Citizen Lab, Lighthouse Reports, and Greek journalists uncovered Predator infections targeting journalists, politicians, and civil society figures in Greece, intensifying scrutiny of the intelligence service and government. Sudan and the weaponization of spyware (Priority: 5/5): The episode highlights Dillian-linked surveillance transfers to Sudan and argues that hacking tools can function as weapons when used by abusive forces such as the Rapid Support Forces. Mercenary spyware industry and ISS World (Priority: 4/5): The conference circuit and broader surveillance market are portrayed as a global ecosystem where vendors sell intrusive tools with limited visibility into downstream misuse. Ethics, legality, and state power (Priority: 5/5): Repeated discussion centers on whether spyware sales are legal, who bears responsibility for abuse, and why democratic oversight and export controls lag behind the technology. Investigative methods: plane tracking, reporting, and forensics (Priority: 4/5): The story depends on coordinated journalism, mobile forensics, corporate-document analysis, and aircraft tracking to reveal hidden business and travel patterns.

Key Arguments: Mercenary spyware is not just software; it is a turnkey state surveillance capability that can enable severe rights abuses when sold without meaningful oversight. Tal Dillian appears to prioritize business over allegiance, selling to whoever can pay and moving operations across jurisdictions to avoid scrutiny. The Greek Predator scandal suggests that spyware can be used against journalists, opposition figures, and even officials, undermining democratic norms. Spyware’s ability to erase traces of infection makes accountability difficult and complicates vendor claims that they do not control misuse. Selling spyware to actors in Sudan or similar environments carries foreseeable risk of aiding violence, repression, or crimes against humanity. Export licensing and government approval do not necessarily prevent abuse; they can become part of the enablement chain. The industry’s arguments that vendors cannot control customer use are insufficient when vendors help stage domains, payloads, infrastructure, and targeting workflows. Democracies need stronger legal guardrails because the mere availability of these tools tempts governments toward illicit surveillance. International pressure and sanctions may be the only effective way to slow proliferation when local oversight is weak. Investigative journalism and technical labs are essential to exposing spyware ecosystems that are deliberately designed to be opaque.

Data Points: Age of Sam Cummings when recruited: 18 - Historical arms-dealer example used as an analogy for weapons proliferation Age when Sam Cummings left the CIA and started his business: 23 - Historical arms-dealer example used in the opening Age of Sam Cummings in the documentary: 57 - CNN vintage documentary segment Weapons stock at InterArms House: about 250,000 guns - Documentary description of Cummings’ storage facility Potential army size he could equip: 25,000 to 50,000 men - Cummings says he could equip a smaller African or Latin American state Price paid for Circles: $140 million - NSO Group acquired Tal Dillian’s surveillance company Commercial spyware package price: $8 million - Leaked document described a Predator package for ten targets and one-click infection Successful infections in the Predator package: 100 successful infections - Leaked conference document Concurrent targets in the package: 10 running at the same time - Leaked Predator package specification Time spent researching the story: over 6 months - Lighthouse Reports investigation Predator detections in Greece confirmed by Citizen Lab: at least 3 people initially - Journalist, politician, and another civil society figure Additional people named by Documento: 35 more people - Greek newspaper reporting on broader Predator infections Countries reportedly listed as Predator buyers: 8 countries - Egypt, Armenia, Saudi Arabia, Colombia, Vietnam, Philippines, Germany, and Greece Dollar amount of Middle East sales claimed by Intellexa’s parent company: $35 million - Declared by Thalestris Alternate reported sales figure over three years: close to $200 million - Other sources cited in the episode

Pivotal Quotes: "We are not the policemen of the world and we are not the judges of the world." — Tal Dillian: His defense of selling spyware to customers whose conduct may be abusive "What is so scary about mercenary spyware like Predator or Pegasus is that it offers a security service a total view into a person's private world." — John Scott Railton: Explaining why spyware is uniquely dangerous to democracy and privacy "It appears to me that sometimes when governments get this kind of capability, the temptation is just too high to use it on their wives' friends, their opposition leader." — John Scott Railton: Discussion of misuse and political abuse of surveillance power

Implications: The episode argues that mercenary spyware has become a global public-safety and democracy problem. Without stronger export controls, legal oversight, and vendor accountability, governments and abusive actors will keep using these tools to silence dissent and invade private life.