On 9 December last year, Egypt’s National Telecommunications Regulatory Authority, represented by the Egyptian Computer Emergency Readiness Team (EG-CERT), issued an urgent warning to citizens about advanced hacking attempts targeting smartphone users in more than 150 countries around the world, including Egypt. It noted that these attempts rely on exploiting previously unknown vulnerabilities (zero-day vulnerabilities), in addition to sending malicious links and messages that appear to come from trusted parties.
The warning coincided with reports by Google and Apple about sophisticated commercial spyware such as “Predator”, belonging to the Israeli company “Intellexa”, which has been subjected to American sanctions because of the threat it poses to global cybersecurity.
Intellexa is one of the best-known “mercenary” spyware companies, a term used by civil society and industry researchers to describe private entities that develop spyware and sell it to governments.
The irony is that the Egyptian authorities had previously cooperated with the same company, during the period (2019–2021), to use specific software such as (Predator) to monitor a group of activists, politicians and human rights defenders, according to a set of technical investigations conducted by Amnesty International in cooperation with other international organisations.
A subsequent investigation conducted by Amnesty International in cooperation with (nside Story Haaretz and WAV Research Collective ) revealed evidence indicating that Intellexa had the ability to remotely access the systems of Predator’s clients, even those physically located at the premises of its government clients. Consequently, Intellexa was able to access the data of people subjected to targeted surveillance attacks by governments.
The most serious dimension that the investigations revealed, in addition to documents leaked from inside the company, is that “Intellexa” has the ability to remotely access the systems of Predator’s clients, even those physically located at the premises of its government clients. Consequently, Intellexa was able to access the data of people subjected to targeted surveillance attacks by governments.
The leaked files, which cover a large part of the company’s recent history, contain additional technical evidence confirming, through digital forensic evidence, that the Predator spyware, Intellexa’s main programme, was used in specific cases of surveillance abuses previously documented in Greece and Egypt.
In this context, Mahmoud Shalaby, Amnesty International’s researcher on Egypt and Libya, affirms that in recent years the organisation has documented the use of commercial spyware and digital attacks in Egypt against human rights defenders, journalists and political activists.
Shalaby cites, for example, the use of the Predator spyware belonging to the “Intellexa” alliance in campaigns linked to Egypt, in addition to the organisation obtaining digital forensic evidence dating back to 2020 and 2021, which included the targeting of opposition figures and journalists.
In addition, the investigations of the “Pegasus” Project in 2021 showed that phone numbers belonging to Egyptian activists and journalists were on potential lists for targeting with the Pegasus programme. Shalaby explains that the organisation discovered that in 2019 hundreds of people, among them human rights defenders at Egyptian civil society organisations, were subjected to a cyberattack in which they received emails that were attempts to gain access to the targeted persons’ email accounts, through a form of phishing known as OAuth (OAuth Phishing).
All of these illegal practices constitute a broad violation of people’s right to privacy, according to Shalaby, and the Egyptian government has used them to stifle the public sphere in the country and to create a state of self-censorship by tracking and intimidating human rights defenders, journalists and anyone who might be engaged in the public sphere.
Who Is Watching Egyptians?
In recent years, Egypt has faced growing human rights criticism over the expansion of digital and legal surveillance tools that infringe on citizens’ privacy and freedom of expression, particularly via phones, the internet and social media networks, in addition to the blocking of news websites.
Despite this, last year the House of Representatives approved new amendments to the Criminal Procedure Law that allow the Public Prosecution, after a reasoned authorisation from a summary judge, to monitor wired and wireless communications, social media accounts, email, and text, voice or video messages on phones and technical devices, to seize the media containing them, or to record private conversations, on condition that the felony or misdemeanour is punishable by imprisonment of more than 3 months, with a maximum duration of 30 days, renewable.
A review and tracking of the surveillance systems acquired by the Egyptian authorities since 2013 shows a clear pattern of systematic expansion in the purchase of technologies for the interception of communications and for digital espionage from American, French, Italian and Israeli companies.
These systems, which included (ProxySG, Vortex, Cortex, Remote Control System, Pegasus and Cerebro), were not limited to monitoring public content, but enabled the hacking of personal devices, the activation of cameras and microphones, the interception of encrypted communications, and the analysis of user behaviour on a wide scale.
“Digital surveillance” refers to the monitoring and tracking of citizens’ digital activities, whether through phone calls, email, instant messages or internet browsing, with the aim of collecting and analysing information in order to understand user behaviour. Digital censorship, meanwhile, is a set of technical and legal processes that control content, monitor data traffic and analyse digital patterns, including tools for network management, the interception of communications, or the analysis of databases.
On the other hand, tracking citizens means collecting precise information about individual behaviours, such as the websites they visit, the people they communicate with and the search terms they use, according to an information technology expert who spoke to us and preferred not to be named.
According to the expert, the potential legal violation lies in the absence of clear legislation regulating the relationship between the state and private companies in the operation of these systems, which places the collection of personal data or the monitoring of individuals’ behaviour in a legal grey area. Potential violations include breaches of privacy or exceeding the scope of the Telecommunications Law, especially when the systems are used without a clear legislative basis, or in the absence of independent oversight mechanisms that guarantee citizens’ rights.
He explains that the operation of these systems rests on equipment, software and personnel: the equipment handles the storage and transmission of data, while the software analyses and classifies it, and it is run by specialised personnel who oversee the operation of networks and the management of databases, whether this software is local or imported, and in some cases from companies with indirect ties to foreign states that may have potential political or security influence, without this necessarily meaning that there is a direct threat to national security.
The data collected includes identifying data (metadata), such as phone numbers, IP addresses and call times, the content of communications when there is a legal basis, and browsing behaviour and app usage. The investigation highlights that these systems, despite being part of infrastructure or digital transformation projects, make it possible to compile and analyse wide-ranging information about citizens.
This system operates as a chain of technical processes that include data collection, analysis and the ability to track an individual’s digital behaviour, and it encompasses the equipment, software and personnel responsible for operating these systems. While the equipment handles the transmission and storage of data, the software analyses and classifies it, and specialists operate it. In the absence of a clear legislative framework, these tools are misused, or their use remains in a grey area that may affect citizens’ rights to privacy.
How Do the Companies Operate Inside Egypt?
The data of official and published contracts shows that private companies such as “Raya Information Technology” and “GTS” have worked as technical partners for official bodies such as Misr for Central Clearing, Depository and Registry and Telecom Egypt in projects to modernise networks and build data centres, projects that represent the backbone of Egypt’s digital infrastructure, in cooperation with foreign companies.
It should be noted here that the companies are not accused of carrying out surveillance directly; however, the announced contracts, the type of technologies they provide and their position within the state’s digital infrastructure point to a pivotal role in enabling surveillance systems that are not subject to independent legislative oversight.
The Canadian company Sandvine is at the forefront of the foreign companies that supplied deep packet inspection (DPI) devices and technologies to internet service providers in Egypt, which enabled the authorities to monitor user behaviour and block websites.
According to reports by (Qurium) and (Citizen Lab), and a report by the Egyptian Association for Freedom of Thought and Expression, the company was used to train Egyptian employees in monitoring communications and directing internet traffic, as well as allowing access to sensitive data about citizens’ digital activity.
Software used to block independent media websites has also been detected within networks in Egypt, including internet traffic analysis and deep packet inspection. Meanwhile, reliable reports indicate that the Egyptian authorities blocked at least around 424 websites in 2017, and the number rose to more than 500 websites by 2019.
The blocking continued in the following years to include dozens of additional websites up to 2025, bringing the total number of blocked websites to 600 websites. This list includes 126 news websites and television channels, in addition to proxy (Proxy) websites and virtual private networks (VPN), as well as human rights and political websites.
For its part, Amnesty International revealed, in a report issued by its Digital Security Lab on 25 September 2020, the use of the German software (FinSpy) to monitor activists and human rights defenders through a fake update of (Adobe Flash), in what became known as the “NilePhish” group, which targeted various operating systems including Windows, Mac, Linux and Android.
On 29 February 2024, the US Department of Commerce imposed restrictions on the Canadian company (placing it on the list of prohibited entities), accusing it of selling internet surveillance and website-blocking tools to the Egyptian government.”
Although human rights groups welcomed this step, the decision raised wide questions about why a Canadian company in particular was targeted, at a time when other European and American companies continue to supply similar technologies.
Months after the American decision, specifically in September 2024, (Sandvine) announced that it would withdraw from 56 countries it described as “non-democratic”, singling out Egypt by name and pledging to stop dealing with it by March 2025. The company presented this step as part of a “comprehensive reform” to prevent the misuse of its technology, backed by announcements that its chief executive was stepping down, the appointment of a director responsible for “human rights”, and the donation of a share of its future profits to organisations working on internet freedom.
However, according to observers, these measures appeared closer to a response to an economic crisis and mounting political pressure than to a genuine ethical shift, especially since the withdrawal does not mean dismantling the existing system, but rather leaves a vacuum that other companies quickly fill.
Documents and reports indicate that (Sandvine) made sales in Egypt exceeding $30 million since 2019, including to government bodies such as the National Telecommunications Regulatory Authority and the Ministry of Defence, alongside major telecommunications companies, most notably Vodafone Egypt and Telecom Egypt.
One of its largest deals was a contract worth more than $10 million concluded in 2020 with Telecom Egypt, according to what was published by the Bloomberg website. This relationship was not limited to the sale of equipment, but extended to operation, support and training services, including qualifying local employees to use surveillance technologies within networks.
Although the company does not publish the details of its contracts or the names of the governments it deals with, its official website reveals that its business model is not limited to supplying technical equipment, but includes what it describes as “professional services”, which include the installation, configuration and operation of systems and the training of end users, in addition to providing resident support engineers at the premises of its clients among telecommunications operators and government bodies.
The support and services terms published on the company’s website show that training in the operation of surveillance products and network management is an integral part of the commercial contract.
This contractual model matches what independent technical reports have documented, among them reports by the (Qurium Media Foundation), which detected the use of (Sandvine) equipment within the networks of internet service providers in Egypt to carry out the systematic blocking of media and human rights websites through (DPI) technologies. According to “Qurium”, the blocking patterns that were detected indicate an advanced configuration of the systems within the networks, which presupposes the existence of direct training and technical support, and not merely the random use of the tools.
Likewise, analyses issued by (Citizen Lab) at the University of Toronto concluded that the technical infrastructure for surveillance and internet blocking in Egypt relied on centralised systems configured at network level, which suggests direct technical cooperation between the technology suppliers and the operating bodies.
In the same context, technical data from reports by “Masaar” and “OONI” showed the use of (Packet Logic) devices, produced by “Sandvine”, to monitor internet traffic within Egyptian networks, including data analysis, the diversion of communication paths, redirection and the blocking of websites.
The name of the Canadian company is linked to attempts to target the phones of political opponents, among them the politician and former MP Ahmed Tantawi, during the presidential election at the end of 2023.
A technical investigation revealed that Tantawi’s phone was targeted with a series of attacks that used the Predator spyware, which is capable of recording calls, activating the camera and microphone and monitoring encrypted messages.
The picture is not limited to a single company; the Egyptian authorities imported software such as the system (ProxySG) from the American company (Blue Coat Systems) through a local agent, namely (Systems Engineering of Egypt), also known as (See Egypt), in a deal that included offers from both (Gamma Group and Narus System), according to a technical report; it is one of the largest systems integration companies in Egypt, and has longstanding contracts with sovereign ministries.
This is in addition to the French software (Vortex and Cortex) for intercepting communications, and the (Remote Control System) programme from the Italian company “Hacking Team” for hacking and remote surveillance, as well as the Israeli Pegasus programme for spying on smartphones.
There was also use of (Cerebro) software from the companies “Amesys/ Nexa” Technologies to monitor communications through deep packet inspection (DPI) technology, as well as of projects such as the public opinion measurement system for monitoring digital activity on social networks.
According to observers, these tools gave the authorities wide capabilities to spy on calls, messages and correspondence, to record what happens in the vicinity of devices, and to monitor files and applications, up to switching on the microphone and camera remotely.
(ProxySG) gives the operating bodies a comprehensive capability to monitor internet traffic en masse, track users and determine their approximate locations, filter content and block websites and applications, and intercept messaging applications such as (WhatsApp, Viber, Skype), as well as analyse user behaviour and link digital activity to users’ identities.
The use of this system in Egypt was uncovered through technical investigations and human rights reports, following the detection of fake SSL certificates and wide-scale connection interception operations, especially after 2013, which confirms that the matter does not concern individual measures or judicial orders, but rather a comprehensive surveillance tool for the internet infrastructure.
However, this level of interception was not the upper limit of surveillance capabilities, as the authorities turned to more intrusive tools based on hacking the devices themselves. In this context comes the (Remote Control System (RCS)) programme, produced by the Italian company Hacking Team.
In 2015, leaks of the company’s internal documents revealed its contract with the Egyptian authorities, which allowed them to use a comprehensive spyware programme capable of hacking computers and phones and spying on calls, messages, email and chat applications, in addition to activating the camera and microphone, logging keystrokes, copying files and determining geographic location.
The leaks revealed a deal between the Egyptian Ministry of Defence and (Hacking Team) whose cost reached 598,000 euros, in addition to another deal worth 58,000 euros with an Egyptian company named (GNSE Group), while Saudi General Intelligence contracted with the company in a deal estimated at 600,000 euros, in addition to a deal with the UAE Ministry of Interior that cost 634,000 euros.
RCS targets multiple operating systems, including, for example: (Windows – Linux – macOS – Android – iOS – BlackBerry), in a clear shift from network surveillance to direct control over personal devices.
As this trend escalated, reliance on “Pegasus”, one of the most dangerous spyware programmes in the world, which is produced by the Israeli company “NSO Group”, increased as well. Since 2018, technical reports have revealed its use by the Egyptian government, relying on advanced mechanisms that include sending malicious links or carrying out zero-click attacks by exploiting unknown vulnerabilities (Zero-Day), which allows the phone to be hacked without the user’s knowledge.
The “NSO” Group is an Israeli company founded in 2010; the group is also known as “Q Cyber Technologies”, and it develops and sells spyware and surveillance software to the governments of states and their intelligence agencies. According to the transparency and responsibility report issued by the company in June 2021, NSO has 60 clients in 40 countries, of whom intelligence agencies make up 51%, law enforcement bodies 38% and military bodies 11%.
The name of NSO, and especially of the Pegasus software, has been linked to widespread use by Arab governments in targeting journalists, activists, human rights defenders and politicians, inside and outside the borders of their states. The company’s name came to international prominence from 2016, after the revelation by (Citizen Lab) of the targeting of the Emirati rights defender Ahmed Mansoor.
After that, reports by human rights groups followed one after another, documenting the use of “Pegasus” against activists and journalists in Palestine, Egypt, Jordan and other Arab countries. In parallel, NSO faces a series of lawsuits in several countries, including cases filed by WhatsApp and Meta in the United States, judicial investigations in France, and lawsuits by Apple and human rights organisations, over the hacking of devices, journalists and human rights defenders.
This system does not stop at imported tools, but extends to declared government projects, among them the “Public Opinion Measurement System” of the Egyptian Ministry of Interior, which was announced in 2013 under the name “Project for Monitoring the Security Risks of Social Networks”. It is capable of monitoring platforms such as Facebook, Twitter, YouTube and Instagram, analysing textual content, tracking keywords and measuring public opinion trends, with the possibility of adding new platforms in the future.
The company Systems Engineering of Egypt won the contract to implement the project, beating the British “Gamma Group” and the Israeli “Narus”.
The Hidden Cost: Millions of Dollars in the Shadows
Although the details of digital surveillance contracts are not published, the state’s general budgets show a notable rise in allocations for ‘information systems development’ and ‘cybersecurity’ in recent years, without disclosing the beneficiary bodies or the nature of the technology used. In their annual reports to investors, surveillance technology companies list revenues from government clients in the Middle East and North Africa region without naming the countries, which intersects with independent technical reports that have documented the operation of these systems within Egyptian networks.
Surveillance-related contracts are not usually listed under their real names, but pass through loosely worded items in the general budget such as “developing the telecommunications infrastructure”, “securing national networks” or “supporting digital transformation”, items that are not broken down and for which neither the contracting companies nor the nature of the services provided are disclosed. But the absence of a final figure does not prevent an estimate of the scale of the cost.
According to global market prices, deep packet inspection (DPI) systems and network surveillance platforms used at the level of a country with tens of millions of internet users require investments estimated at millions, and sometimes tens of millions, of dollars.
Internal documents reviewed by Bloomberg news agency show that “Sandvine” sold advanced surveillance technology in Egypt with a total value exceeding $30 million since 2019, including a single deal exceeding $10 million with Telecom Egypt. In 2015, leaks from the company “Hacking Team” revealed that, in figures, about 137,500 euros had been spent on its spyware programme in Egypt.
In the same context, the state’s general budget for the 2025/2026 fiscal year indicates the allocation of about EGP 13 billion, notably for public investments in the communications and information technology sector, of which about EGP 9 billion is financed directly from the budget and allocated to supporting the telecommunications infrastructure, strengthening cybersecurity, and localising information technology and artificial intelligence.
How Does Surveillance Software Turn into a Vulnerability?
The danger of advanced surveillance and spyware software is not limited to violating individuals’ privacy or pursuing activists, but extends to constituting a direct threat to Egypt’s national security itself. These tools rely on exploiting unknown “zero-day” vulnerabilities in smartphone operating systems, which allows full access to devices without the user’s knowledge or consent, according to a researcher in security affairs who spoke to us and preferred not to be named.
According to the security researcher, once hacked, phones become capable of transmitting highly sensitive data, including calls, messages, geographic locations, photos and files, and even of switching on the microphone and camera at any time. This level of intrusion does not threaten individuals alone, but opens the door to leaking the data of officials, military personnel, diplomats, journalists or employees in vital institutions, which places the state’s entire information security system at risk of invisible penetration.
The danger of this software doubles when it is linked to foreign companies, particularly Israeli ones, such as NSO Group and Intellexa, which operate in a political and security environment that is complex for Egypt.
For his part, Mostafa Fouad, executive director of the HuMENA organisation, tells Zawia3 that there are two tracks in the type of software that the Egyptian authorities have used to monitor citizens and block websites in recent years.
The first track consists of tools used at network level by internet service providers, tools that make it possible to carry out blocking, to disable or restrict tools for circumventing blocking, and sometimes to interfere directly in browsing traffic itself. The second track is targeted spyware on the devices themselves, whether mobile phones or computers, and it is the most dangerous track for individuals, because it targets the device directly.
“Fouad” adds: among the documented examples is what (Citizen Lab) announced regarding the targeting of Ahmed Tantawi with the Predator software in 2023, where the targeting began through malicious links, then developed into what is known as “network injection” on non-(HTTPS ) connections on the (Vodafone Egypt) network.
Regarding what HuMENA has monitored over the past years, Fouad explains that the organisation is not a digital forensics laboratory, and that it has a referral programme with specialised partners but does not have a “digital clinic”. Nevertheless, its continuous work on civic space makes it possible to follow public evidence and the reports of specialised partners and to link them to the impact on the ground.
According to this monitoring, blocking has become widespread and extended since 2017, and blocking methods have also evolved to become more complex: they are no longer limited to blocking a specific link, but have come to include disabling alternative domains and carrying out blocking at multiple levels with different providers.
Fouad also points to a clear shift from mass blocking to individual targeting, considering that the case of Ahmed Tantawi represents an explicit example of the use of commercial spyware against a political figure, a model that raises concern because of the possibility that it will expand to include journalists, human rights defenders and opponents.
Regarding the most prominent companies the Egyptian government has cooperated with, the executive director of “HuMENA” explains that not all the details are available in the form of published contracts, but specific names have appeared in technical and human rights documentation, as well as in official decisions issued outside Egypt.
Among these examples is the company (Sandvine), while the examples also include the company Cytrox, the developer of the Predator software, which is linked to the Intellexa group.
As for the Italian companies, Fouad points out that “their story is well known”. After the 2015 leaks, press and human rights reports spoke of a contract or contracting arrangement linking the Egyptian Ministry of Defence with the Italian company “Hacking Team “, and of the existence of a local intermediary called “GNSE Group”, with reference to an invoice dating back to 2012 linked to this context.
Likewise, European human rights reports and statements issued by Italian organisations during the period 2016–2017 addressed the Italian company Area SpA obtaining a licence to export a communications and network surveillance system to an Egyptian body known as the Technical Research Department (TRD), through a local intermediary, before the licence was suspended and the Italian authorities then moved to cancel or withdraw it under pressure from human rights groups.
According to Fouad, these programmes represent a grave violation of citizens’ rights and of international human rights charters; he explains that the matter does not concern a single isolated measure, but an integrated system based on two parallel levels: the systematic and widespread blocking of information, and direct technical intervention that reaches the point of breaching individual privacy.
The widespread blocking of websites, especially when it extends to hundreds of websites and affects independent media platforms, human rights websites and tools for circumventing blocking such as VPN networks, in practice leads to the undermining of the digital public sphere, and imposes fundamental restrictions on citizens’ right to access information and on freedom of expression and the exchange of opinions, beyond any narrow or exceptional legal justifications, according to “Fouad”.
The matter does not stop at banning or blocking, since the manipulation of network traffic, or what is known as the hijacking of unencrypted ( HTTP) connections, cannot be considered an administrative or regulatory measure, but is rather a direct technical intervention in the user’s own connection, with all that this entails in terms of a fundamental infringement of the security and integrity of communications.
In the case of targeted spyware, such as Predator or FinSpy, the violation reaches its peak, as it extends to hacking the device of a specific person, with all that this carries in terms of a direct violation of privacy, the confidentiality of correspondence and personal life, in addition to the clear intimidating effect that this pattern of surveillance creates on journalists, human rights defenders and political opponents.
Fouad affirms that these practices directly contradict Egypt’s international obligations in the field of protecting privacy and freedom of expression, and also contradict the Egyptian constitutional guarantees relating to the confidentiality of communications, especially in light of the absence of transparency, the lack of independent oversight, and the lack of effective and testable avenues of appeal for those affected.
As for the possibility that this software may itself turn into a vulnerability affecting Egypt’s national security, which the authorities declare they seek to protect, Fouad believes that digital control tools carry at their core a dangerous paradox, since they themselves create structural weak points within the communications infrastructure.
He says that the presence of equipment capable of manipulating traffic or redirecting users necessarily means the existence of a “control point” that can be exploited, hacked or misused.
In the case of the Predator software, Fouad notes that Citizen Lab’s documentation of what is known as “network injection” on a local network reveals that the technical capability is not limited to targeting a specific individual, but could, theoretically, turn into a tool with a wide collective impact in the event of mismanagement, exposure to counter-hacking, or a leak of the tools themselves. He adds that reliance on foreign suppliers and highly sensitive technical supply chains in turn carries additional risks, including the possibility of leaks, the existence of backdoors, or the use of these tools by multiple parties outside any real framework of accountability or oversight.
Fouad concludes by stressing that this picture reflects a structural contradiction, since these policies are presented as tools of “protection”, while in practice they lead to weakening the security of communications, deepening the fragility of the digital infrastructure, and undermining trust in the digital public sphere as a whole.
And finally..
The warning by the National Telecommunications Regulatory Authority, issued in December 2025, officially confirms the scale of the threat, but this time from a defensive angle. The statement warned citizens of advanced hacking attempts targeting smartphone users in Egypt, and explicitly referred to the use of sophisticated spyware relying on unknown vulnerabilities, the same description used in the reports of Google and Apple when they discuss the tools of the Israeli company Intellexa and the Predator programme.
The paradox here is that the state, which warned its citizens of the danger of this software, itself operates in a communications environment and digital infrastructure in which, according to documented reports, surveillance tools from similar foreign companies have been used. This contradiction highlights the real danger: that technologies that are supposed to be “security” tools turn into a strategic weakness that allows external powers to infiltrate the Egyptian digital space, instead of protecting it.
Although contracting for these tools has been justified on “security” grounds, the reality of technical dependence raises fundamental questions about the independence of sovereign digital decision-making: can a state protect its national security through tools whose technical structure it does not fully control? And is surveillance turning from a tool of internal control into a channel for potential external penetration?
