The Netherlands 306. The 2017 coalition agreement of the Dutch government states that the Dutch police is not allowed to acquire spyware from providers that provide their products to “dubious regimes”, later specified as “countries guilty of grave violations of human rights or international humanitarian law”. Before any acquisition of spyware, the Dutch police has to ask the provider whether it has provided to EU- or UN-sanctioned countries and performs a check if the country where the provider is based has an export control regime where human rights are assessed in the export license procedure. This assessment is repeated periodically. It should be noted that this restriction only seems to apply to spyware acquisitions by the police. The intelligence services are not explicitly mentioned. According to the government, the police does use hacking software since 2019, although the authorities do not mention which type.587 It would appear that NSO Group and its spyware product Pegasus do not meet the above mentioned standards, in any case not before the tightening of the export regime of Israel in December 2021.588 No insight is given into the expenditure by both police and intelligence services for the purchase and use of the spyware system. 307. It should be noted that from November 2014 to December 2016, NSO Group was able to operate thanks to two companies, Shapes 1 BV and Shapes 2 BV, established in the Netherlands, in the sectors of “financial holdings” and “engineers and other technical design and advice.” Both were liquidated again after two years in operation.589 308. On 4 October 2022, it was revealed that in November 2019 the Dutch Ministry of Defence was about to sign an agreement with WiSpear, the company owned by Tal Dilian, which had earlier acquired Cytrox, the manufacturer of Predator spyware. WiSpear had won a tender of the Dutch Ministry. It does not become clear from the mail exchange if it concerns Predator or another product. From disclosed emails exchanged between the Cypriot Ministry of Energy, Commerce and Industry and WiSpear, it becomes clear that a representative of the Dutch Ministry of Defence had contacted the Cypriot Ministry of Commerce to obtain assurances about WiSpear on 13-15 November 2019, only days before the “spy van” story of Dilian broke. Dilian informed the representative of the Cypriot Commerce Ministry that he appreciates her immediate assistance in the matter as the expiry of the timetable for contract signatures is approaching”.590 It is not clear whether or not the contract was signed and any spyware was provided to the Dutch Defence Ministry. 309. On 2 June 2022, the media reported that the AIVD (General Intelligence and Security Service) used Pegasus when it assisted the police in tracking down a suspect of serious crime, Ridouan T.591 The Dutch government refused to comment. This is a remarkable case that merits closer attention. The leaks took place at a time when Pegasus and NSO Group were under a lot of public criticism, and the blacklisting by the US Department of Commerce hurt them financially. The Dutch success story of catching one of the nastiest criminals in years, was a welcome positive message. The media report is based on statements by four sources within the AIVD. Their motive for leaking is not mentioned in the report. Nor does there seem to be 587
https://www.rijksoverheid.nl/documenten/kamerstukken/2022/06/23/ntwoorden-op-kamervragen-over-het-gebruikvan-hacksoftware-zoals-pegasus-in-nederland 588 https://www.gov.il/en/departments/news/mod-tightens-control-of-cyber-exports-6-december-2021 589 Amnesty International, Operating from the shadows: inside NSO Group’s corporate structure, https://www.amnesty.org/en/documents/doc10/4182/2021/en/ 590 https://oparatiritis.com.cy/2022/10/04/e-mail-wispear-disy-netherlands/ 591 https://www.volkskrant.nl/nieuws-achtergrond/aivd-gebruikt-omstreden-israelische-hacksoftware~b05a6d91/
80
