Hacking Team Emails

Hacking Team was an Italian company that sold intrusion software to law-enforcement and intelligence agencies; its main surveillance product was known as Da Vinci. Such tools exploit software vulnerabilities to give the user covert access to a target's computer or smartphone. On the night of Sunday 5 July 2015 attackers published about 400GB of the company's internal data — including emails, invoices and software source code — initially through Hacking Team's own Twitter account, which they had taken over.

On 8 July 2015 I published more than one million of the company's emails as a searchable database. Reporting focused on the client list. The Guardian reported that, if genuine, the documents indicated clients including government bodies in Azerbaijan, Kazakhstan, Uzbekistan, Russia, Bahrain, Saudi Arabia and the United Arab Emirates, and included an invoice for €480,000 purporting to come from Sudan's national intelligence service — although the company had publicly denied selling to repressive governments.

The leaked source code also allowed researchers to identify software vulnerabilities that the company's tools relied on, and software vendors moved to fix them (The Guardian). According to us, Hacking Team had first come under international scrutiny after being named in our 2011 Spy Files.

The data was first published by the attackers, not by us. The Guardian, citing Motherboard, reported that the hacker who had claimed a 2014 breach of the surveillance vendor Gamma International also claimed responsibility for the Hacking Team attack. A company spokesman confirmed the breach, telling Reuters that 'law enforcement will investigate the illegal taking of proprietary company property' (as reported by The Guardian), and the company advised customers to suspend use of its software.

Our role was to index and republish the already-public material as a searchable archive. The Guardian initially noted that it had not been possible to independently verify the documents; the company subsequently confirmed that the breach had taken place.