Cyber companies accompanied Netanyahu on his visit to Budapest, one of them later trained foreign intelligence officers in Hungary

Benjamin Netanyahu’s visit to Hungary in the summer of 2017 was of major diplomatic significance: he was the first Israeli prime minister to visit the country in 30 years. In a press conference at the end of 2022 the prime minister of Hungary, Viktor Orbán said that “Israeli-Hungarian relations reached outstanding heights” during the meeting.

Earlier, the visit came under the spotlight because, as Direkt36 revealed, shortly afterwards, the Hungarian government purchased the Israeli-developed Pegasus spy software, which was later used to target journalists and businessmen with critical views on the government.

Now new details have emerged about the visit of the recently re-elected Netanyahu, and its significance for cybersecurity. The visit also included a Hungarian-Israeli business forum, but so far it was not known which companies participated. However, tech news portal Tech12’s Amitai Ziv, with the help of the social justice promoting NGO Hatzlaha, obtained a list of those who came to Budapest with Benjamin Netanyahu’s delegation, and shared it with Direkt36.

The list reveals that while representatives of NSO Group, the developer of Pegasus, were not present at the business forum, other Israeli companies also involved in cybersecurity and specifically in surveillance technologies were there.

One such company was Picsix, which, according to its website, just like NSO, sells surveillance technology to government agencies to monitor criminals and terrorists. Among the devices they are developing are for example ones that can locate phones connected to networks almost anywhere in the world, able to intercept calls, and with Picsix products secret services can even access text messages on phones.

This was not the only appearance of Picsix in Hungary: months after Netanyahu’s visit, its trainers met with Bangladeshi agents here in Budapest to train them to use their phone-tapping device. This was previously reported by Al Jazeera news channel, but Direkt36 has now discovered further details of the training. For example, we have details of the conditions under which the Israelis and Bangladeshis tried out the device together: they intercepted mobile phone calls from the kitchen of a fifth district apartment, listening in on calls from randomly selected people.

We have contacted the Hungarian government and the Israeli Embassy in Budapest with our questions. The Israelis declined to comment. “The Israeli Ministry of Defense does not comment on its defense export policy to certain countries for security, political and strategic reasons,” they wrote, with no reaction from the Hungarian government.

The Bangladeshi thread

In 2021, Al Jazeera broadcast a documentary on the foreign dealings of influential Bangladeshi figures, and as part of it reported that Bangladesh had acquired Israeli-developed wiretapping technology, which the Israelis had trained Bangladeshi intelligence officers in Hungary to use. The documentary also revealed that the device was tested during the training and – by all accounts illegally – intercepted Hungarian calls.

Al Jazeera based these allegations on the accounts of a Bangladeshi man living in Hungary at the time who witnessed the events. In the film, the news channel referred to the man as Sami, but it has since emerged that his real name is Zulkarnain Saer Khan. Khan no longer lives in Hungary and, for his safety, he has asked us not to write about his current whereabouts. He became an investigative journalist, and has just shared with Direkt36 new details about the surveillance training in Budapest.

Khan said he lived in Hungary for seven years and ran an Indian restaurant in Horánszky Street, Budapest. He added that his father was a former high-ranking soldier in Bangladesh, so he has contacts in the Bangladeshi elite. He also said that, since his country has no embassy or consulate in Hungary, he had been informally asked by the Bangladeshi leadership to help his compatriots on occasions when they had business in Hungary.

In 2019, Khan was asked for a favor again. He was told by a Bangladeshi intelligence officer that Bangladeshi officers would be arriving in Budapest and would need accommodation and transport to the venue of their training.

Training in a hangar in Budapest

Al Jazeera’s research two years ago revealed that the training course taught Bangladeshis how to use the P6 Intercept surveillance device, manufactured by Picsix. The Israelis sold the P6 Intercept to the Southeast Asians through a Singapore-based brokerage company. The contract for the sale of the device, obtained by Al Jazeera, states that the P6 Intercept was transferred from Hungary to the Bangladeshis, but other sources familiar with the transaction told the news channel that this was only on paper. It was allegedly necessary to include a third country so that Bangladesh would not know that their government was doing business with Israel. The Muslim-majority country does not officially recognise the state of Israel.

Khan said a total of seven Bangladeshis arrived in Hungary in 2019. He found them a flat in Molnár Street in the V district of Budapest, where they stayed, and their training took place in a hangar-like building of One Telecom Ltd, a company registered in Budapest and owned by a Hungarian and an Israeli citizen.

The company moved out of the building years ago, and it now houses the offices of a Hungarian company. One of its employees told Direkt36 during a visit to the site that they had been renting the premises for a year and a half, and that when they moved in, the only evidence of the Israeli-Hungarian company’s previous presence was a sticker on a door with the company’s logo. The staff member said that all they knew about the company was that it was involved in telecommunications.

The staff member also said that they had done a lot of remodeling to the office, covering the plain linoleum floor with carpet and bringing in furniture so that it no longer resembled the one used by the previous tenant. However, the building and the layout of the rooms are consistent with what Khan saw and the building can be identified from photographs he took at the time.

We also reached the former landlord, who said he rented the space to the Israeli-Hungarian company between 2013 and 2020. The landlord said it was a telecoms company, which among other things supplied and installed telephones and TVs, and was a subcontractor to several major companies.

“It was a perfectly normal company, with fitters coming to work there,”

he said, adding that “they rented property from us, we had no other connection”. He said he had signed the lease with a Hungarian citizen. We did not receive a reply to our further questions by email about whether he was aware of the company’s Israeli connections or why the company moved from the site in 2020. One Telecom didn’t reply to our questions.

Khan was taken to the training site by Bangladeshi secret service agents. “The Israelis were not happy that I was being taken in, I had to go through two or three checkpoints,” Khan recalled, adding that he saw 25-30 people moving around inside and he was seated in a separate room. There, a table was covered with papers. Some of them described the training schedule, but there was also a detailed description of the P6 Intercept interface and how it works. He also took photos of the documents.

According to the tutorial, the tool makes it easy to connect to and monitor phones with just a few clicks. In the booklet, which Khan saw and photographed, the P6 Intercept’s operation is described in detail, step by step, from locating nearby phones to connecting to them. The use of the various functions is explained over several pages, illustrated with screenshots.

Interception from Molnár Street

According to Khan, on the last day of the training, the Bangladeshis persuaded their trainers to try out the device purchased by their secret service. The Israelis were initially reluctant to do so and, according to Khan, they specifically stated that they did not want diplomatic complications because the Hungarian intelligence services were not aware that they had brought an interception device into the country. The Bangladeshis’ request was rebuffed by saying that they had received their training, they had been given a separate CD with the most important information, and that there was no need for a demonstration.

In the end, Khan said, the Israelis did agree to hold the demonstration at the urging of the Bangladeshis, but they suggested a different place for doing that. This ended up being the Bangladeshis’ apartment in Molnár Street, District V.

The device, as described by Khan on the basis of what he saw and heard in the apartment, resembles a laptop and essentially functions as a telephone tower. It can intercept phone calls within a radius of between half and one kilometer. Its operators can even turn on the phones’ speakers, but they can’t connect to the screen with it. It also has a voice recognition system, so it can identify the caller based on previous calls, even if they change phone numbers.

In addition to himself, Khan said, there were three Bangladeshi secret service officers in the apartment, as well as two Israeli nationals who presented the device and an Irish businessman involved in the transaction. All of them, including Khan, were gathered around the interception device on the table in the dining room of the Molnár Street apartment.

“The Israelis switched it on and started explaining that they were already connected to the nearest telephone tower and had already intercepted about two hundred calls in the area”

Khan recalls.

“They showed me that with a few clicks you can connect to calls. They were connected to four or five calls, chosen at random. Each call was listened to for one or two minutes, while I was asked if I understood anything of the conversations,”

recalled Khan, noting that he does not speak Hungarian well and that most of the people intercepted on the phone spoke too fast to understand anything.

“I can recall one woman talking to her daughter as if she was in a bank doing some business, and she also mentioned a flower shop,” said Khan, who said that during the interceptions the Israelis explained how to record the calls and how to save them.

According to Khan, they also explained a feature that would allow the device to find a speaker in the intercepted calls based on pre-recorded audio, even if the speaker was using a phone number that had not been previously known.

“It took about 8-10 minutes altogether. The Israelis finally concluded by saying that the Hungarian authorities may have a device that could detect that they were listening in on calls, so it would be better to stop. They joked that it would be bad to get into diplomatic trouble”

Khan said.

The device is capable of intercepting up to 200-300 phones at a time and is most often used by the services at demonstrations and other mass events, Eliott Bendinelli, an expert from the UK-based anti-technology abuse group Privacy International, told Al Jazeera about the P6 Intercept. The calls intercepted in Budapest were randomly selected, according to Khan. He did not know exactly who the Israelis meant by “the Hungarians”, with whom there was no agreement, or whether the domestic authorities were even aware of the training.

According to Khan, the Bangladeshi officers wanted to invite the Israeli trainers to a dinner at his restaurant in Nyáry Pál Street, but only the Irish businessman joined them. The Israelis stayed away for security reasons and because, they told Khan, they usually do not leave the training site.

Legal concerns

Al Jazeera reported on the training and alleged interception in Hungary two years ago, but there is no information about the Hungarian authorities having investigated the case. In addition to the Budapest Police Headquarters and the National Police Headquarters, we also sent our questions to the Hungarian National Cyber Security Center. None of the authorities responded to our inquiry.

But what happened raises the possibility of a breach of law. Tivadar Hüttl, a lawyer working for the rights protection organization TASZ, told Direkt36 that the report indicates that the intercepted persons suffered a data breach, as their data was handled without their consent or legal authorization.

"In the data protection breach, in addition to the unlawful processing of data, the obligation to inform the data subjects whose phones were targeted – not only by the actual interception, but also by the identification of their phone number – was also breached."

In addition, he said, three offences contrary to the Criminal Code could be identified: misuse of personal data, illicit data mining and information system breaches. The latter two are punishable by up to two and three years’ imprisonment.

Why Hungary?

Khan claims to have asked Bangladeshi officers why their training was taking place in Budapest. He recalled that the Bangladeshis cited mainly practical reasons, mentioning the location of the Hungarian-Israeli joint venture company and the fact that it would have been more difficult for Bangladeshis to enter Israel than to come to Hungary.

It was not the first time that senior Bangladeshi officials had asked Khan for help. In early 2021, Direkt36, assisting Al Jazeera’s investigation, wrote about a man named Haris Ahmed, brother of the then Bangladeshi Chief of General Staff Aziz Ahmed, who fled to Hungary in 2015 with false papers and under a false name. Haris Ahmed fled his country because he had been convicted of murder there.

Our previous article revealed that the man had lived in Hungary for years without any problems and had several businesses. Among other things, he had catering and retail interests and also ran an illegal money exchange business.

Update: In a previous version of this article, we claimed that Khan was asked for a favour by a Bangladeshi intelligence officer in 2018, and that the training of officers took place in the same year. In contrast, Khan stated that the training took place in early 2019. We apologise for the mistake.

Translation by Direkt36.