A Spy in the Machine

Moosa Abd-Ali Ali has spent most of his life campaigning for democracy and equal rights in Bahrain, a Middle East island nation of 1.3 million that has been ruled by the Khalifa family dynasty for more than 200 years. He’s been jailed seven times -- "Not a small number," he says -- and has endured brutal torture and assault at the hand of Bahraini officials.

One day in 2011, Moosa opened the Facebook Messenger app on his iPhone. What he saw was chilling: someone else typing under his name to an activist friend of his in Bahrain. Unbeknownst to him, Moosa’s phone and computer had been infected with a highly sophisticated piece of spyware, built and sold in secret. The implant effectively commandeered his digital existence, collecting everything he did or said online. An investigation would later reveal that Moosa’s online life was hijacked for eight months. All signs pointed to Bahrain as the culprit, and FinFisher, a mysterious spyware for-hire tool, as the weapon of choice. Bill Marczak, a research fellow at CitizenLab and the co-founder of Bahrain Watch, calls FinFisher just the latest step in "productized surveillance," an approach pioneered by companies like Gamma and Milan-based Hacking Team that aims to make digital intrusion as easy and full-service as any other government technology package.