Spyware Sanctions Unravel: U.S. Treasury Quietly Drops Intellexa Consortium Figures

In a move as mysterious as the spyware at the heart of the controversy, the U.S. Treasury has quietly lifted sanctions on three key players tied to the notorious Predator surveillance tool. The decision, made without public explanation, comes even as global outrage mounts over the misuse of commercial spyware against journalists, activists, and politicians. Is the U.S. backing away from its stance on cyber mercenaries, or is there more beneath the surface?

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) stunned observers this week by removing Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou from its sanctions list. These figures have been central to the Intellexa Consortium, the shadowy holding company behind Predator - a commercial spyware platform infamous for its use in covert surveillance campaigns.

Harpaz, a manager at Intellexa S.A., and Gambazzi, owner of both Thalestris Limited and Intellexa Limited, were sanctioned as recently as September 2024. Hamou, described as a key enabler and offshoring specialist, faced sanctions in March. Thalestris reportedly managed Predator’s distribution rights, handling transactions and acting as the parent to Intellexa S.A., while Hamou orchestrated corporate logistics from Greece. Their sudden removal from the list, with no explanation from OFAC, has left experts and human rights advocates demanding answers.

Predator, active since at least 2019, is designed to operate in the shadows. Like its infamous cousin Pegasus, it’s marketed for law enforcement and counterterrorism but has repeatedly been deployed against journalists, lawyers, and political activists. Investigations from groups like Amnesty International and Recorded Future have documented Predator’s continued use, including a recent attempt to hack a Pakistani human rights lawyer via WhatsApp. Despite mounting evidence of abuse, the spyware ecosystem remains highly profitable, secretive, and competitive, with companies shifting strategies to evade oversight and sanctions.

The Treasury’s earlier rationale for the sanctions was clear: unchecked commercial spyware poses a “growing security risk” to the U.S. and its allies. Critics now fear that delisting these individuals without transparency may embolden actors in the global spyware market. “Any hasty decisions to remove sanctions from individuals involved in attacking U.S. persons and interests risk signaling to bad actors that this behavior may come with little consequence,” warned Natalia Krapiva, senior tech legal counsel at Access Now.

As spyware vendors adapt to regulatory crackdowns, the line between legitimate surveillance and cyber mercenary activity keeps blurring. The delisting of Intellexa’s affiliates raises unsettling questions: Are sanctions effective in a world where digital espionage knows no borders, and will accountability ever catch up with those profiting from surveillance in the shadows?

WIKICROOK

• Sanctions List: A sanctions list is an official record of individuals or entities prohibited from specific activities, often for security or regulatory compliance.
• Spyware: Spyware is software that secretly monitors or steals information from your device without your consent, putting your privacy and data at risk.
• Zero: A zero-day vulnerability is a hidden security flaw unknown to the software maker, with no fix available, making it highly valuable and dangerous to attackers.
• Commercial Surveillance: Commercial surveillance involves private firms selling monitoring tools to governments or agencies, often raising privacy, ethical, and human rights concerns.
• Offshoring: Offshoring relocates business operations abroad, often to cut costs. In cybersecurity, it can create new risks and compliance challenges.