Hacking Team’s New Owner: ‘We’re Starting From Scratch’
On July 5, 2015, a vigilante hacker known as Phineas Fisher posted online more than 400 gigabytes of internal data stolen from the servers of the infamous European spyware vendor Hacking Team. That embarrassing breach sparked a slow decline for the company, with key employees leaving, and other companies taking over the market.
Four years later, despite the influx of cash from a mysterious Saudi Arabian investor, and what appeared to be a slow but steady recovery, Hacking Team is no more. At the beginning of April, Swiss-Italian company InTheCyber announced that it had acquired a majority stake into Hacking Team, and that it was merging the two companies into a new one called Memento Labs.
The goal, according to the new owner of the company, Paolo Lezzi, is to rebuild. That's why, when we asked if he was worried Phineas Fisher could come back, he laughed.
"Right now there's not much damage to make," Lezzi said in a phone call. "The company was compromised, and it's in a tough situation."
Got a tip? You can contact this reporter securely on Signal at +1 917 257 1382, OTR chat at lorenzofb@jabber.ccc.de, or email lorenzofb@motherboard.tv
Lezzi, who's worked in the cybersecurity industry for years, was adamant that Memento Labs needs to "get the company back on its feet." That means revamping the product and rewriting the code almost from the ground up.
"We want to change absolutely everything," Lezzi said. "We're starting from scratch."
David Vincenzetti, one of the founders of Hacking Team, is out, according to Lezzi. Vincenzetti's role, as of now, is of informal advisor to Lezzi, who was quick to point out that Vincenzetti has no formal role in the new company.
Lezzi admitted that they're starting from a tough situation, and that the recovery will take time. He pointed to the ISS World conference in Prague next year as the date when he hopes Memento Labs will be all up and running. ISS World, also known informally as "the wiretapper's ball," is a conference held in various cities every year, where government employees and companies that sell surveillance gears to governments meet to talk shop and learn about new products.
When asked about the Saudi investors, who own 20 percent of the company, Lezzi was less forthcoming, saying he's never met them.
Lezzi said that, for now, the new company will keep Hacking Team's customers. In the future, it will ask the Italian government for an export license for each sale. That is how it worked for Hacking Team until now, after the Italian government revoked the company's global export license in 2016. If one customer is caught violating human rights, Lezzi said, the company will revoke their license "immediately."
The idea, at least for now, is not to compete with NSO Group, an israeli company that's been valued at around $1 billion.
"NSO is certainly a great leader [in the market]," Lezzi told me. "We believe there's space and that the italian creativity and expertise could have its say in this niche."
This story has been updated to clarify that Hacking Team already needed to get individual export licenses for each customer.
Listen to CYBER, Motherboard's new weekly podcast about hacking and cybersecurity.