The Amesys affair: French surveillance in the service of Gaddafi
The Amesys affair: the 2007 contract with Libya, the Eagle system and Deep Packet Inspection, Nexa Technologies, Egypt and the complicity in torture case.
The Amesys affair: how the French Eagle surveillance system served repression in Libya
The Amesys affair is one of the most emblematic scandals of the export of cyber-surveillance technologies to authoritarian regimes. In 2007, this subsidiary of the French group Bull sold Muammar Gaddafi’s regime the Eagle system, a mass communications interception platform based on Deep Packet Inspection. For four years, it was used to identify, hunt down and arrest Libyan opponents, some of whom were tortured.
It all begins in the summer of 2011. Libya collapses after months of bloody clashes triggered by the civil war. In the middle of the chaos, journalists enter the abandoned offices of the Tripoli secret services. Expecting an arsenal, they find dozens of servers in computer racks, on which familiar words appear: “Eagle System”, “Amesys”, “Packet interceptor”. All written in French.
This article retraces the complete timeline of the Amesys affair, explains how the Eagle system works technically, follows the company’s transformation into Nexa Technologies and its repeat offences in Egypt and Madagascar, and analyses a French judicial procedure that, fifteen years after the facts, has still not reached a verdict.
- 2007: Amesys, a subsidiary of Bull, sells the Eagle system to Libya in the context of Gaddafi’s controversial visit to Paris.
- Eagle: interception “at the scale of a nation” based on Deep Packet Inspection, able to target individuals by keywords.
- August 2011: the Wall Street Journal publishes the evidence found in the Libyan intelligence offices in Tripoli.
- 19 October 2011: complaint by FIDH and LDH. The Paris prosecutor first tries not to investigate.
- 2012 to 2020: the software is resold as Cerebro, Nexa Technologies sells to Egypt for 10 million euros, then demonstrates the Predator spyware.
- June 2021: Amesys and its executives indicted for complicity in acts of torture. Investigation still ongoing.
The context: Gaddafi’s Libya and the Arab Spring
In January 2011, Muammar Gaddafi’s authoritarian regime has ruled Libya for almost 42 years. Daily life for Libyans is marked by difficulties to eat, travel and study, and by the constant threat of arbitrary arrest and imprisonment. The State systematically resorts to torture to crush any voice opposing the regime.
In this context, regional uprisings emerge to protest against the dictatorship: this is the beginning of the Libyan Arab Spring. Gaddafi answers with a violent, accelerated crackdown. The head of internal security, Abdullah Senussi, personally leads the bloody repression of the Benghazi uprising in February 2011. To maintain “optimal” order, the Libyan State uses every means, including large-scale surveillance systems.
The revelation: the Tripoli servers
In June 2011, several news sites, including Reflets.info and Owni.fr, expose the involvement of the company Amesys in an espionage affair linked to the Libyan regime. Intrigued, the Wall Street Journal sends a specialised team on site.
A few weeks later, amid the chaos of Tripoli, the team reaches the offices of the intelligence services. They discover a hall full of computers, servers, files and technical instruction posters in English. Folders stamped CONFIDENTIAL lie on the desks: “Help us keep our classified activities secret. Do not discuss classified information outside headquarters.” Another folder bears a familiar logo: Amesys, a flagship of French IT engineering services.
Searching the computers, the journalists find a Yahoo Chat exchange dated 26 February: a romantic conversation between two people expressing their fear of being watched. The quality of the capture is striking. On the racks, other terms appear: “Deep Packet Inspection”, “Eagle System”, already present in the documents leaked in June. One captured email shows a Libyan activist asking an activist exiled in Cairo for help with his trial of 12 August 2010. The journalist can easily imagine that person’s fate.
At the end of August 2011, the investigation is published. These discoveries hit France like a bomb: they are the first concrete proof that a cutting-edge Western technology served as a cyber tool for a repressive State apparatus.
Amesys, Bull and the 2007 contract
We have to go back to 2007. Amesys, a subsidiary of the French group Bull, signs a lucrative contract with the Libyan government to supply surveillance equipment. The transaction takes place in a context of “diplomatic rapprochement”, marked by the controversial reception of Colonel Gaddafi in Paris in December 2007, clearly motivated by the signing of commercial contracts.
This rapprochement triggers open protests within the government itself. Rama Yade, then Secretary of State for Human Rights, publicly warns that France must not “merely sign commercial contracts without demanding guarantees on human rights”. These statements, relayed by FIDH and LDH, establish that as early as 2007, the repressive nature of the Libyan regime was known at the highest levels of the French State. The economic and political stakes are nevertheless judged too high: Amesys sells its technology to Libya, very discreetly.
The Eagle system and Deep Packet Inspection
To meet Libya’s mass surveillance needs, Amesys develops a technology ahead of its time: the Eagle system, a set of tools for interception and mass data analysis, whose capabilities intrinsically destined it to the hunt for opponents.
What is Deep Packet Inspection?
The core of Eagle is Deep Packet Inspection (DPI). Unlike shallow packet inspection, which only checks addresses, DPI examines in detail the very content of the data flowing through a network.
DPI has legitimate uses: malicious code detection, quality of service management. But it is also the tool of choice for eavesdropping, Internet censorship and mass behavioural analysis. Deployed nationwide, it turns a country’s communication infrastructure into an instrument of total surveillance. In 2011, a very large share of online communications were neither secured nor encrypted, HTTPS still being the exception: a simple interception was enough to read everything.
From technique to manhunt
The repressive potential of DPI was fully exploited by the Gaddafi regime. Eagle made it possible to intercept “all online and offline communications at the scale of a nation”. A former Libyan external security official explained to Le Figaro that the system could find “targets in the country’s massive flow” and identify “suspicious individuals based on keywords”. The ability to refine these keywords with the Libyan command allowed opponents to be targeted with unprecedented precision.
The descent into hell: complaint, destruction of evidence and repeat offences
The FIDH and LDH complaint
On 19 October 2011, the International Federation for Human Rights and the Human Rights League file a complaint with the Paris court. Amesys defends itself by claiming its equipment could not monitor phone lines and was intended to fight terrorism. Insufficient arguments: the customer of the contract was Abdullah Senussi, head of Libyan intelligence, notoriously convicted of terrorism and subject to an international arrest warrant for crimes against humanity. The company could not ignore that its technology would have a “potentially devastating impact on civilian populations”.
Destroy everything to rebuild everything
In early 2012, damning evidence rains down. Still at the helm, Philippe Vannier, the CEO, makes a radical decision: he orders his sales director and their teams to destroy any evidence linked to the Libyan surveillance accusations. Through shell companies, the Eagle software is resold under the name Cerebro to Advanced Middle East Systems (AMESys, the irony of the name is notable) in the United Arab Emirates. A new company is born: Nexa Technologies. Rebranding, reorganisation and judicial slowness allow the affair to be smothered and the machine to be restarted.
Repeat offences: Egypt, Saudi Arabia, Madagascar
| Year | Event |
|---|---|
| 2014 | Nexa Technologies sells Cerebro, very close to Eagle, to the Egyptian regime of Abdel Fattah al-Sisi for 10 million euros, “without the French State finding anything to object to”. |
| After 2014 | Investigations extend to the sale of technology to Saudi Arabia. |
| November 2020 | Nexa demonstrates the Predator spyware, close to Pegasus, in Madagascar and acts as an intermediary for its resale, according to a Le Monde investigation published in 2023. |
Impunity remains, at this stage, total.
The historic trial: complicity in acts of torture
After a long investigation, in June 2021, Amesys and some of its executives, including Philippe Vannier (president until 2010) and Olivier Bohbot (president of Nexa since 2014), are indicted for complicity in acts of torture on the Libyan side. Almost ten years after the facts.
The link established by the victims
Before the judges, Libyan activists, one of whom had been arrested, detained and tortured following the surveillance of his electronic communications, testified. The archives of the Libyan security services, added to the case file, confirmed that the surveillance of identifiers and email addresses was used to identify opponents.
The prosecutor’s obstruction
The investigation was marked by institutional resistance. In March 2012, the Paris prosecutor’s office issues a request not to investigate, arguing that “selling equipment to a State cannot in itself constitute an element of the offence”. After a specialised judge opens the investigation, the prosecutor’s office appeals, tries to block it and persists in requesting a dismissal. It takes a decision of the Paris Court of Appeal in January 2023 to give the investigation the final green light. To this day, no decision has been handed down.
Amesys’ defence: the State’s approval
The company argues that in 2007 the legal framework was insufficient to regulate cyber-surveillance technologies, and above all that Eagle was designed under the control and with the approval of the DGSE and the State. A line of defence suggesting active complicity of the intelligence services in the export.
Frequently asked questions about the Amesys affair
What is the Eagle system?
Eagle is the mass communications interception and analysis system developed by Amesys and delivered to Libya from 2007. Based on Deep Packet Inspection, it made it possible to monitor a country’s entire Internet traffic and to identify individuals from keywords.
Has Amesys been convicted?
No. Amesys and several of its executives were indicted in June 2021 for complicity in acts of torture, and the Paris Court of Appeal confirmed these indictments in January 2023. The investigation is still ongoing and no judgment has been handed down.
What became of Amesys and Nexa Technologies?
The Eagle software was resold under the name Cerebro to a company in the United Arab Emirates, and the business was continued by Nexa Technologies, itself indicted for the sale of cyber-surveillance equipment to Egypt.
Are exports of surveillance technologies regulated?
Yes, partially. Dual-use goods are subject to export authorisation in France (dual-use goods service) and to a European regulation revised in 2021, which Amnesty International calls a “missed opportunity” to stop exports to repressive regimes.
Key takeaways
The Amesys affair is an emblematic case study of how a State’s commercial interests can lead to passive or active complicity in international crimes.
Thierry Breton, former president of Atos, allegedly also protected Philippe Vannier by appointing him head of the cybersecurity business and bringing him onto the board of directors, and some Eagle engineers obtained key positions at ANSSI. Amesys is not merely a company behind a clumsy surveillance programme. It is, above all, a State problem, in which we are the main victims.
Sources
- Wall Street Journal, Firms Aided Libyan Spies (2011)
- Owni, La Libye sur écoute française (2011)
- FIDH, The Amesys case
- FIDH, L’affaire Amesys
- FIDH, Chronology: the Amesys affair explained in 11 dates
- LDH, Surveillance and torture in Libya: the Paris Court of Appeal confirms the indictment of Amesys and its executives
- LDH, Surveillance and torture in Egypt and Libya: Amesys and Nexa Technologies executives indicted
- Business & Human Rights Resource Centre, Amesys lawsuit (Libya)
- Business & Human Rights Resource Centre, Contrat avec la Libye : Amesys se défend
- Business & Human Rights Resource Centre, Nexa Technologies indicted for complicity in torture (Egypt)
- FrenchWeb, Amesys, decision on the challenges to the indictments in the Libya cyber-surveillance case
- VOA Afrique, Proceedings against a French company for complicity in torture in Libya at a standstill
- Le Monde, Predator: French company Nexa Technologies accused of acting as an intermediary in the sale of the spyware (2023)
- Wikipedia, Deep packet inspection
- Fortinet, What Is Deep Packet Inspection (DPI)?
- French Ministry for Europe and Foreign Affairs, Control of sensitive dual-use goods and technologies
- Direction générale des Entreprises, Dual-use goods service (SBDU)
- Amnesty International, New EU dual-use regulation agreement a “missed opportunity”
- SGDSN, Controlling exports of war materials