Nov 30, 2022

On a dusty May morning in Khartoum an executive jet taxied to a halt under the blistering sun. Two jeeps with tinted windows stood ready to meet it from one of the most notorious and feared militias in the world, the Rapid Support Forces. The sleek white Cessna flew in from Cyprus and remained on the ground in Sudan’s capital for just 45 minutes, long enough to draw a disturbing line of connection between the ferocious contest for power in Sudan and a spyware scandal roiling Greece.

Details of the Cessna’s arrival, its passengers and cargo were meant to remain secret – logged in an inaccessible location, foregoing the usual procedures. The secrecy was a testament to the power of Mohamed Hamdan Dagalo, known as Hemedti, Sudan’s richest man and the owner of a private army that is the heir to the murderous legacy of the Janjaweed, infamous for their crimes against humanity in Sudan’s troubled Western region, Darfur.

According to three independent sources, the cargo was high-end surveillance technology, made in the European Union, with the potential to tip the balance of power in Sudan thanks to its capacity to turn smartphones into audio-visual informants on their owners. When news of its arrival reached Hemedti’s rivals the equipment was seen as so dangerous that an RSF commander speaking on condition of anonymity said it was smuggled out of Khartoum to the militia’s stronghold in Darfur to prevent its seizure by the army.

Sudan, Africa’s largest country prior to civil war and partition, is in fragile transition from decades of military dictatorship under Omar al-Bashir – now in prison awaiting possible extradition to the International Criminal Court. Waves of popular protests in Khartoum in 2019 resulted in a civilian council that shares power uneasily with the military.

On paper, Hemedti is second in command to Abdel Fattah al-Burhan, commander in chief of Sudan’s Armed Forces. In reality, the militia leader vies for outright control of the country. He commands Sudan’s gold industry, his soldiers fight for a price in foreign conflicts and he has forged links to Russia’s mercenary Wagner Group. Hemedti also met with Israeli intelligence twice since June 2021, with a private jet used by Mossad tracked to Khartoum. In the last year alone, RSF fighters have been implicated in enforced disappearances of protestors in Khartoum and indiscriminate shooting of civilians, including children, in Darfur.

The Khartoum flight opened a rare window on a secretive and lucrative business, linking the blood-soaked Sudanese militia to a cabal of powerbrokers in Greece, a corporate network spanning Cyprus, the British Virgin Islands and Ireland, and above all to a crisis spreading across the EU – the widespread availability of sophisticated software that can track and hack mobile phones worldwide, threatening democratic institutions and human rights defenders.

Lighthouse Reports and its partners Haaretz in Israel and Greece’s Inside Story have been investigating the activities of Intellexa, a spyware firm whose activities spread from Europe across much of the global south. Months of digging into company records and interviews with confidential sources in multiple countries uncovered a network of companies connected to Tal Dilian, a former Israeli intelligence operative, who has bought up an array of sophisticated surveillance technology and established an EU foothold in Greece and Cyprus.

The eight-seater Cessna, which plays a significant role in Dilian’s operations, was revealed by a social media post from an Intellexa engineer – a selfie showing its subject aboard a jet with a grey leather and mahogany interior that left enough of a digital trail to isolate and identify that plane. Lighthouse Reports and partners have analysed and cross-referenced hundreds of flight records, linking the plane to key locations in Intellexa’s business, and combed dozens of passenger lists, along with corporate filings, employment records and other confidential and open source data. The findings conclusively connect the plane to Dilian, his known associates and employees in his company – including to Merom Harpaz, a central figure in his business network.

Intellexa, Tal Dilian and Merom Harpaz did not respond to requests for comment. No response was received from a Rapid Support Forces media inquiries address.

In tracing the movements of the Cessna in recent months as it criss-crossed Greece, Cyprus, Israel, the Middle East and Africa, the outlines emerge of an international scandal that destabilises the countries it lands in, all the while funnelling some of the world’s most dangerous technology into the hands of some of its most high-risk regimes.

“Equipping the RSF with sophisticated surveillance technology will not only exacerbate the brutal repression and killing of Sudan’s remarkably brave protestors and squash hopes for democracy in the region,” Anette Hoffmann, senior research fellow at the Clingendael Institute, told this investigation. “Such advanced spyware in the hands of the RSF will tilt the balance of power in favour of a ruthless former militia and Russia ally, bringing Sudan one step closer to an open confrontation with the country’s armed forces and increasing the risk of civil war.”

Returning from Khartoum that afternoon, the Cessna touched down in Larnaca, Cyprus, rolling to a halt outside the headquarters of a local aviation consultancy, Pegasus Flight Centre. Less than an hour’s drive away, in an exclusive suburb of Limassol, is a luxurious villa with an enticing kidney-shaped pool which the millionaire Israeli entrepreneur, Dilian, shares with his wife, Sara Hamou, a Polish corporate offshoring specialist.

Since leaving the Israeli army’s elite Unit 81 intelligence division, which he commanded, Dilian has specialised in surveillance tools. Basing himself in Cyprus, he first built a pioneering phone tracking firm called Circles, which he sold in 2014. He also went into business with an Israeli community leader in Cyprus, Abraham Shahak Avni, part owner of Pegasus Flight Centre.