Elaman and Gamma: what's selling and who's buying in Indonesia?

Last year, UK-based surveillance company Gamma TSE sold the Indonesian military US$ 6.7 million worth of equipment as part of the military's weapons modernisation effort. As early as 2005, Indonesian officials were soliciting the advice of a close partner of Gamma, Germany-based Elaman, to create technical surveillance unit (TSU), according to a white paper published as part of the WikiLeak SpyFiles and found in the Surveillance Industry Index. 

Gamma and Elaman are corporate partners that have developed some of the most intrusive surveillance products commercially available. These include the FinFisher suite that has been used to target activists' communications devices globally including in Ethiopia and Bahrain. So what exactly what have they supplied to the Indonesian government?

Since the Indonesian military does not publish spending data, and the UK and German export control regimes do not require companies to disclose the content of their sales in such cases, we do not know. What we do know is that Indonesian government, like many, is buying equipment from companies that sell some of the most invasive products available with little oversight.

A surveillance 'Circle of competence'

Headquartered in Munich, Elaman sells surveillance equipment ranging from communications monitoring centres to specialist cameras and body-worn call interception devices out of its Jakarta office. It is also a distributor and close partner of the UK-based surveillance consortium Gamma Group. Elaman claims to have first developed the FinFisher suite, a spyware package that allows its user to take complete control of a mobile device or computer, allowing them access to all the data and even to take control of the microphone and camera. By 2008, Elaman was marketing FinFisher commercially before Gamma took over the promotion and leadership behind the product in the late 2000s.

In Indonesia, Gamma TSE controversially supplied the Ministry of Defense with unspecified equipment – 'wiretapping' gear, according to the House Intelligence Commission – last September. The Indonesian government has not answered requests for further information about the nature of the equipment. Furthermore command servers for FinSpy, a Finfisher product, have been located in Indonesia. While we do not know when or from where these were exported by Elaman or by Gamma, the companies reportedly sell Finfisher exclusively to governments.

A new cadre of spies

Seven years before Gamma's most recent Indonesian sale, Elaman proposed setting up a Technical Surveillance Unit (TSU) for an unspecified Indonesian client. The March 2005 white paper is a blueprint for a unit that would “provide technical support to The Special Operations Groups and all the Intelligence and Security Services”.

More than an elite rapid reaction force, the proposed TSU was a counterterrorism unit with the capacity to be kitted out to collect physical surveillance and audio surveillance on targets by way of covert recording devices, worn on the body, hidden in vans and installed as bugs. Under the program, each TSU officer would receive equipment adapted to his/her skills. Students specially selected for courses including 'mail opening' and 'covert methods of entry' would be taught by former police and military specialists on Elaman staff, who are willing to carry out the trainings at a UK training ground or to fly out to Indonesia (with business class tickets, laundry and other expenses paid by the client government, or rather, its taxpayers). 

Beyond merely providing or proposing equipment, Elaman counsels governments on their counter-terrorism policies. Tucked away in the shopping list Elaman pitched is a “Terrorist Database” software program, with a one-year maintenance package. That Indonesia has a terrorist database is often rumoured but rarely openly discussed. In 2005, Elaman counselled the Indonesian government to create a complete intelligence database at the TSU command centre with “the ability to link with the other databases within the country”, kept in its own secure environment. Elaman was offering “English to Arabic translation software for voice, email and fax monitoring” with voice identification capacities – presumably to Arabic-speaking, observant Muslims as part of a broader counterterrorism strategy.

Tracking surveillance sales

Much of the kit Elaman proposed in 2005 has become standard tools in many police forces. But Elaman and Gamma produce much more invasive spy products. And as Indonesia's military spending is shrouded in secrecy, it is unclear what the Indonesian government has purchased from partners Elaman and Gamma: whether it went through with the TSU proposal or the true nature of Gamma's reported “wiretapping” equipment.

One of the reasons we know so little about these transactions is that any impact assessment of the exports often only kick in if the purchase is a very costly one. Last October, Privacy International wrote to the UK Export Credits Guarantee Department about the Gamma TSE Indonesia sale as the UK government underwrote its cost. They responded that as the transaction's overall value was below the approximately £ 9.25 million mark (specifically 10 million SDR), the sale did not have to be reviewed for its human rights impacts under the OECD Common Approaches framework. They also declined to state the type of equipment sold while the Export Control Organisation of the UK government did not hold information as to whether any export credit licenses were sought or whether FinFisher was part of the sale. This information can be found in the response to Privacy International's Freedom of Information request attached to this post.

To put it in perspective, a single FinSpy software license set for the targeting of up to 500 targets cost just US$ 250,000 in 2009. Since surveillance equipment is generally cheaper than conventional arms, for which the export controls regime was designed, purchases from surveillance companies like Elaman and Gamma do not get assessed appropriately such that the truly invasive technologies are adequately controlled. If it were known what the export contained, it would be easier to establish if a licence were needed.

Unlawful surveillance is particularly damaging in countries with a history of military repression and the House Commission on Defense and Information's assurance that the mysterious equipment would not be used for “purposes outside the TNI’s duties and functions” is hardly reassuring. A 2011 leak of 500 pages from the intelligence files on Indonesia's Special Forces unit, Kopassus contain extensive reports on Papuan activists garnered through unlawful covert spying. Even Detachment 88, the antiterrorism front line unit for who the TSU's equipment seems best suited reported is regularly accused of torture. 

The first step to understanding how surveillance played a vital role in these abuses is understanding what technical capacities the government has. An export regime that better assesses the content and not just the quantity of surveillance equipment sales is urgently needed. This will allow for greater oversight and transparency of the decisions taken by exporting governments, allowing them to be held to account on how serious they take their human rights obligations.