U.S. stonewalls probe into security firm that allegedly spied on Assange for CIA, says Spanish judge
MADRID — The Justice Department has failed to respond to multiple requests from Spanish authorities for help in an investigation into a local security firm suspected of being used by the CIA to conduct aggressive — and potentially illegal — surveillance of WikiLeaks founder Julian Assange.
“I am not so pleased about it,” said Santiago Pedraz, the investigating judge in charge of the case, in an exclusive interview with Yahoo News, when asked about the failure of officials in Washington so far to cooperate with his probe. “They have absolutely not answered anything.”
Since June of last year, Spanish judges have sent three requests for information to the Justice Department primarily seeking information about the ownership of IP addresses believed to be in the United States that had access to files documenting Assange’s activities while he was holed up in the Ecuadorian Embassy in London, according to copies of the requests reviewed by Yahoo News.
Despite a mutual legal assistance treaty (MLAT) between the U.S. and Spain pledging to assist each other in criminal investigations, none of the Spanish requests have yet elicited any substantive responses from the United States, the judge said. Instead, Justice Department lawyers have asked Spanish authorities for more information about the basis for the inquiry before taking any action.
Chief among those puzzle pieces is whether U.S. intelligence officials — as Assange’s lawyers have alleged — arranged for the Spanish security firm UC Global to violate Spanish privacy and bribery laws by installing cameras and hidden microphones inside the Ecuadorian Embassy, including in a women’s bathroom where Assange would sometimes take meetings. This in turn allowed the company to secretly record or otherwise eavesdrop on conversations that Assange had with his lawyers, doctors, advisers, journalists and others, including in one case a U.S. congressman, according to internal documents from the Spanish case.
“We want to find out what was done with this material,” Pedraz said. He pointed to the CIA’s potential role as a principal “theory” that “we are trying to investigate.” He did not rule out, however, that there could be other explanations for the alleged data transfer.
A DOJ spokeswoman wrote in an email that “as a matter of policy,” the department doesn’t comment on its correspondence with foreign governments over MLAT requests. Legal experts say that the MLAT process can often be frustratingly slow — especially when it requires, as in this case, federal prosecutors to seek court orders for the information the foreign government is seeking. Still, T. Markus Funk, a former federal prosecutor who wrote a guidebook about the MLAT process for the U.S. court system, said the fact that the Justice Department hasn’t responded to the Spanish requests over a 17-month period seems “unusually slow.” He added: “This seems to be outside of what would be normal.”
The investigation by Spanish police, which has been extensively reported in the Spanish press, has taken on new significance in recent weeks in the aftermath of a Yahoo News report documenting how the CIA, under its then-director Mike Pompeo, launched in 2017 a covert operation to cripple WikiLeaks that included ultimately aborted plans to abduct Assange in a so-called “snatch operation.” CIA officials, incensed by WikiLeaks’ publication of sensitive agency hacking documents, even discussed — but never implemented — a plot to assassinate Assange, according to former U.S. intelligence officials knowledgeable about the CIA’s operation.
While White House lawyers put the brakes on the most extreme measures Pompeo had pushed, the CIA did undertake other aggressive actions, including arranging to obtain audio and visual recordings of Assange inside the embassy as well as spying on some of his associates, according to the Yahoo News report. Pompeo, in his only public comments on the article, acknowledged that “pieces of it are true,” and called on the Justice Department to criminally prosecute the sources who spoke to Yahoo News for disclosing classified information. (The CIA has consistently declined to comment on any aspect of its targeting of Assange and WikiLeaks and did so again in response to an inquiry for this article.)
The CIA’s targeting of the WikiLeaks founder — and allegedly arranging to eavesdrop on his meetings and conversations inside the Ecuadorian Embassy — may not be surprising, given that Pompeo in his first speech as CIA director had publicly declared WikiLeaks to be a “non-state hostile intelligence service.”
But the agency’s actions have emerged as a potential roadblock to the Justice Department’s efforts to extradite Assange to the United States to face criminal charges that he published classified documents — including the identities of sensitive sources for the U.S. government overseas — in violation of the World War I-era Espionage Act.
Assange’s lawyers have seized on the Yahoo News report, raising it repeatedly before a British appeals court in October as fresh grounds to deny the Justice Department’s request. “This is a case of credible evidence of U.S. government plans developed at some length to do serious harm to Mr. Assange,” Mark Summers, one of Assange’s lawyers, said during a hearing on the extradition case.
Although much about events at the Ecuadorian Embassy remains murky, the key to unraveling that evidence may now rest with the outcome of the Spanish investigation. The probe began in April 2019 when Assange, after having taken refuge in the Ecuadorian Embassy for seven years, was evicted by that country’s new leadership. He was immediately arrested by the British and then charged by federal prosecutors in Alexandria, Va., in an 18-count indictment for what Justice Department officials described as “one of the largest compromises of classified information in the history of the United States.”
At that point, three employees of UC Global came forward to Spanish police to tell a strange but intriguing story: They had been directed by the company’s owner, David Morales, a former Spanish special forces officer, to secretly record Assange’s conversations by installing hidden microphones concealed in fire extinguishers in the embassy. They also asserted they had covertly downloaded data from the cellphones of his visitors, and swiped copies of Assange’s written notes. At one point, they claimed, they were instructed to steal the diaper of a baby believed to be Assange’s son in order to perform a DNA test on the baby’s feces to establish his paternity. (Informed that such a test was not practicable, the plan was dropped.)
One of the witnesses asserted in a written statement to police that Morales also discussed with employees a plan to unlock the embassy doors to facilitate a “kidnapping” of Assange or “even the possibility of poisoning Mr. Assange,” according to a copy of the statement reviewed by Yahoo News. All of these proposals “Morales claimed to be evaluating with his contacts in the United States,” the statement said.
After interviewing the witnesses and reviewing computer data they provided, Spanish police in September 2019 arrested Morales and searched his home and offices, seizing computers, servers, mobile phones and other material. He was later released on bail and is awaiting the completion of the criminal investigation to learn whether he will be formally charged.
One of the former employees said in an interview with Yahoo News here that the purpose of the surveillance was made clear when Morales gathered his small workforce together after a trip to the United States, where he attended a Las Vegas gun show. UC Global had been contracted to provide security at the embassy by SENAIN, the Ecuadorian intelligence service. But, Morales told the group, “all the information was not for the Ecuadorian Embassy, it was for the United States,” said the former employee, who spoke on the condition that he not be publicly identified. (The three employees have been given status as “protected witnesses” in the case, shielding their identities from public view.)
Morales, according to the employee, also told the group that “we have moved to the dark side,” and “he mentioned the CIA.” (In a declaration filed with the court, the witness said Morales had told the employees that in exchange for their surveillance of Assange, “U.S. intelligence” would arrange for the company to get lucrative “contracts all over the world.”) The disclosure troubled the employee and his colleagues. “I realized this was like a bomb that was about to explode,” he said.
Among the meetings the UC Global employees were directed to eavesdrop on was a visit Assange had in August 2017 with Dana Rohrabacher, then a Republican congressman from southern California, according to the employee. Rohrabacher, an avid Trump supporter who repeatedly expressed sympathy for Russian President Vladimir Putin, suggested to Assange that he might be able to get him a presidential pardon if he publicly identified an internal Democratic Party insider as his source for party emails WikiLeaks published during the 2016 election — rather than Russian operatives as the U.S. intelligence community had concluded.
UC Global employees secretly copied WhatsApp messages from Rohrabacher’s cellphone, which he was required to leave at the door, listened in on the meeting through a crack in the door (the microphones were not yet functional) and wrote up a detailed report that they understood was to be shared with the CIA, the former employee said. Rohrabacher did not respond to requests for comment.
In an email exchange with Yahoo News, Morales adamantly denied the allegations by the whistleblowers, saying the claims that he discussed the kidnapping or poisoning of Assange were “lies” and that he never told his employees the surveillance of the WikiLeaks founder was on behalf of U.S. intelligence. “I never said that,” he said, adding that the allegations by three of his employees were “sensationalist” conspiracy theories “like a spy film script.”
The surveillance that UC Global conducted at the Ecuadorian Embassy was done under the firm’s contract with the Ecuadorian intelligence service and was done because the Ecuadorians had become concerned about some of Assange’s activities, Morales insisted. “The Ecuadorian government has the complete right to take the actions that [it] considers [it needs] to prevent the protection of their interests, especially with a person that was interfering continuously against their foreign affairs issues,” he wrote. He later added: “What the SENAIN or the Ecuadorian government did with the information ... if they share or not with other entities ... that is not my responsibility.”
But Fidel Narváez, who served as first secretary of the Ecuadorian Embassy in London in 2017 and 2018, disputed portions of that account, saying he and his Ecuadorian colleagues were completely unaware that conversations within the embassy were being secretly recorded. “It was obvious they were trying to collect information” on Assange and his visitors, he said. Morales was pointing the finger at Ecuador because “it’s the only way out” for the company — “to say it was Ecuador instructing them to do the spying,” he added.
The former employees had no communication with anybody at the CIA and have no direct evidence to back up the statements they attributed to Morales. Instead, they added yet another layer of intrigue: Another of Morales’s clients at the time was one of the world’s biggest casino companies, Las Vegas Sands, then owned by Sheldon Adelson, the late billionaire who had been for years one of the Republican Party’s largest donors.
As the employees told it, Morales took direction from one of the Las Vegas Sands’ senior security officials, Zohar Lahav, an Israeli American who previously worked as a security officer at the Israeli Consulate in Miami. And the purpose, they allege, was to funnel surveillance videos — and other information that UC Global had scooped up about Assange — to the CIA through Las Vegas Sands. (Among the requests the Spanish authorities have made to the Justice Department is an opportunity to question the security official.)
A Sands spokesman declined comment. But a source familiar with the company’s dealings with UC Global confirmed that Las Vegas Sands had a contract with the Spanish firm to provide personal security for Adelson when he was traveling on his yacht in the Mediterranean. (Such security was covered as part of Adelson’s compensation package, the source said.) But the source dismissed the idea that the company’s dealings with UC Global had anything to do with the CIA, saying that such connections — which have been alleged before — were “out of a James Bond film.”
The source also declined to comment on whether Lahav is still working for Las Vegas Sands. Messages sent to Lahav’s cellphone by Yahoo News were unanswered.
On June 19, 2020, José de la Mata Amaya, the original judge in charge of the case, sent the first Spanish request for assistance to the Justice Department’s Office of International Affairs, asserting that investigations by Spanish police showed “there is a serious probability of the existence of offenses that could constitute an offence against privacy and against client/attorney confidentiality,” he wrote, citing provisions of the Spanish criminal code, according to a copy of the request reviewed by Yahoo News.
In particular, the judge asked for Justice Department prosecutors to provide information about the ownership and geolocation data on five IP addresses that, he wrote, accessed the server of UC Global for three days in January 2018. He asked the DOJ to respond “as soon as possible.”
“We had a chance to review and understand the seriousness of the allegations in this very interesting espionage and bribery investigation,” a Justice Department lawyer, Sandra Barbulescu, wrote back on July 16, 2020. She then pointed out that in order to provide the information the Spanish requested, the Justice Department would need to file applications with the U.S. courts that would require Spanish authorities to answer a series of questions, including: the basis for the Spanish contention that the IP addresses were granted access to the UC Global recordings; the grounds for their suspicions about Morales, to whom it is believed he was transferring data; whether he was an agent of a foreign power; and perhaps most importantly, “What was the purpose of the spying?”
Over the course of the next year and a half, Spanish authorities provided two responses to the Justice Department’s questions, laying out some of the evidence obtained from the whistleblowers as well as sending another request for a videoconference interrogation of the Las Vegas Sands security official. When those went unanswered, the Spanish sent a “reminder” on July 6, stating that the earlier queries hadn’t produced any substantive replies.
The Spanish authorities still haven’t heard back, said Pedraz, the judge overseeing the case, in the recent interview. (The Spanish have also sent requests to the British government — which has jailed Assange while he awaits a ruling on the U.S. extradition request — seeking a video statement from the WikiLeaks founder. The statement was taken by the Spanish police, but British officials have so far blocked requests to take statements from Assange’s lawyers, whose meetings with their client were allegedly recorded.)
But cyber experts say that even if the Justice Department finally does respond, it’s not clear how much Spanish authorities will learn that could solve the underlying mystery at the heart of the case. It is not uncommon for cyber actors — whether they be intelligence services or hackers — to mask their IP addresses, and “false positives” could often result.
And at least one of the IP addresses requested by the Spanish belongs to the Shadowserver Foundation, a nonprofit that uses former intelligence and law enforcement personnel to identify bots, malware and the vulnerabilities of computer networks. “We’re an organization that scans the entire internet every day,” said one of the foundation’s law enforcement liaisons, who asked not to be identified by name. “I wouldn’t be surprised if we would show up on the logs of every computer in the planet.”
Yahoo News correspondent Zachary Dorfman contributed reporting to this story.
Cover thumbnail photo illustration: Yahoo News; photos: Kirsty Wigglesworth/AP, via El País
