One year ago this month, Turkmenistan's state news agency reported on a meeting between the country's authoritarian president and a visiting executive from a German electronics firm that supplies surveillance and encryption technology to governments and militaries.
Hartmut Jaeschke of the Munich-based Rohde & Schwarz, according to the report, told President Gurbanguly Berdymukhammedov during the talks that the company sought "to gain a stronger foothold" in Turkmenistan, whose government is consistently ranked among the world's most repressive.
Jaeschke's visit caught the eye of Human Rights Watch (HRW), which said it had been told by a knowledgeable source that Turkmen authorities were seeking "technology for monitoring and blocking mobile and satellite communications, which would also enable the government to block Internet access."
Rohde & Schwarz, a major global player in surveillance technology, has declined to disclose details about its dealings with the Turkmen government, which the Washington-based rights group Freedom House this week ranked among its "worst of the worst" for political rights and civil liberties.
But two sources familiar with the matter told RFE/RL's Turkmen Service that the company's products had been purchased by a Turkmen ministry identified by security researchers as a likely user of powerful Western spyware.
One of the sources, a Turkmen official, said security services in the Central Asian state are using Rohde & Schwarz technology to flag and block websites the government doesn't like, and to eavesdrop on Internet and mobile users.
RFE/RL was unable to independently corroborate that claim. But leaked internal documents from other firms in recent years indicate that Turkmen authorities have actively pursued Western surveillance technology.
The case highlights an ongoing debate over the ethics of supplying repressive governments with sophisticated electronic-surveillance tools. Western firms market these products as instruments that can help governments combat crime and terrorism. But rights groups and Western officials have warned that such technologies are also used by state actors to target political opponents.
Not Just For Fighting Crime
Several lawsuits have been filed over the alleged use of Western spyware against journalists, activists, and dissidents in a range of countries, including Libya, Egypt, Mexico, and Bahrain.
One of those lawsuits was filed in Israel by Canada-based Saudi dissident Omar Abdulaziz. He alleges that the Israeli firm NSO Group's spyware was used to track U.S.-based journalist Jamal Khashoggi, a critic of the Saudi government who was killed inside the Saudi consulate in Istanbul in October.
The Toronto-based research project Citizen Lab said in October that it was confident that Abdulaziz's mobile phone was "targeted and infected" with NSO spyware deployed by an operator "linked to Saudi Arabia's government and security services."
A founder of NSO last month denied that its technology was used to target Khashoggi, and the firm says its products are "licensed for the sole use of providing governments and law enforcement agencies the ability to lawfully fight terrorism and crime."
Meanwhile, a group of Bahraini dissidents filed a lawsuit in Britain last year, saying they were targeted by authorities in Bahrain with spyware known as FinFisher, which is produced by the British company Gamma Group.
Spyware Detected
Evidence indicates that the FinFisher spyware, which is capable of remotely taking control of a computer or mobile phone and logging users' activities, was likely also used by an operator linked to the Turkmen Communications Ministry, according to a 2012 Citizen Lab report.
This same ministry has obtained telecommunications technology from Rohde & Schwarz, according to two sources who spoke to RFE/RL's Turkmen Service. One of those sources -- an official in the Turkmen government -- said this technology can be used to block websites and track Internet and mobile users.
Both the Turkmen official and the other source, a Rohde & Schwarz representative directly involved with its business in the country, spoke to RFE/RL on condition of anonymity, saying they were not authorized to discuss the matter openly.
The Turkmen official said that the German firm's technology is being used by the country's security services to spy on civilians in the country, where Berdymukhammedov has steadily built a personality cult since taking power in 2006.
A month after Jaeschke's talks with Berdymukhammedov in February 2018, HRW sent a letter to Rohde & Schwarz asking if it had supplied -- or was considering supplying -- Turkmenistan with technology that could be used to violate the rights of its citizens.
The company, which has developed and sold technology enabling the surveillance of mobile phones replied that it "does not disclose information on its business and customers in security-relevant areas," HRW said.
Precisely which products Rohde & Schwarz, which has an office in Ashgabat, might be supplying to Turkmen authorities remains unclear.
Company spokeswoman Simone Kneifl echoed the earlier statement to HRW, telling RFE/RL's Turkmen Service that the firm "in principle does not disclose information on its possible business and customers in security-relevant areas."
Kneifl added that the company "strictly complies with all applicable laws and regulations regarding its export business." The Turkmen government source said the German firm might be unaware of how its technology is being used in Turkmenistan.
'Lawful Hacking Solution'
Under Berdymukhammedov, Turkmen authorities have blocked the websites of all independent media outlets, including that of RFE/RL's Turkmen Service, known locally as Azatlyk. Major social-networking and video-sharing sites are blocked as well -- including Facebook, YouTube, Twitter, and VKontakte -- as are encrypted messaging services such as WhatsApp, Telegram, Viber, and Signal.
Turkmen authorities appear to have been in earlier discussions about obtaining Western electronic-surveillance technology. In 2015, the Organized Crime and Corruption Reporting Project (OCCRP) reported on leaked e-mails from 2012 showing that an Italy-based software manufacturer gave the green light for its spyware to be "presented and promoted" to the MNB, the Turkmen secret police.
In 2013, an Israeli tech firm wrote to the Italian company, Hacking Team, saying that the Turkmen secret police had asked for a "proposal + product description for lawful hacking solution," OCCRP reported.
A trove of internal commercial documents published by Wikileaks in 2013 included a detailed proposal by Gamma Group, the British company being sued by the Bahraini activists, to equip the Turkmen government with its FinFisher spyware.
Rohde & Schwarz, which has supplied the German government and NATO with sophisticated communications technology, has been conducting business in Turkmenistan since the era of Berdymukhammedov's eccentric and dictatorial predecessor, Saparmurat Niyazov, according to Viktoria Gerasimova, the firm's representative for Central Asia.
Gerasimova denied that Rohde & Schwarz provides any equipment to Turkmenistan that could be used to eavesdrop on Internet or mobile users. She said that the firm had supplied the government with television and FM radio transmitters, as well as spectrum-monitoring technology, but that such deliveries ended "a long time ago."
"The network has been built. It's all working, television is being broadcast. Everyone is getting a signal and is happy to be watching television. What else do you want from me?" she said.
Gerasimova said she believes that suggestions that Turkmen authorities are using Rohde & Schwarz equipment to spy on civilians are part of an effort to damage the company's reputation.
As recently as November 2016, the Rohde & Schwarz website said potential clients should contact the company for information about "systems that detect and track targets" and "support authorities in the entire prosecution process." It also said the company could be contacted for more information about "gathering information out of communications and communications' behavior," adding that such information provides "valuable assets" to authorities.
"In order to gather indications or evidences for prosecuting crime, authorities can exploit the electromagnetic spectrum. Often it is possible to intercept information about the targets' intentions, their locations or other data that help conducting law enforcement," the Rohde & Schwarz website said, according to an archived version of the now-deleted page.
Asked to comment on the removal of the page and the accuracy of the Turkmen state news service's account of Berdymukhammedov's meeting in Ashgabat with Jaeschke, Rohde & Schwarz provided the same statement it gave earlier to RFE/RL: "Rohde & Schwarz in principle does not disclose information on its possible business and customers in security-relevant areas."
Outsourcing Surveillance
The Turkmen government source told RFE/RL's Turkmen Service that Berdymukhammedov's government has used two private companies to conduct electronic surveillance on citizens, and that one of these firms is led by a veteran of Turkmen security services.
Using technology and training from Rohde & Schwarz, these private companies eavesdrop on phone conversations and online communications at the behest of Turkmen security services, the source told RFE/RL.
RFE/RL is not publishing the names of these companies or the individual because it was unable to independently corroborate the source's claim, which contradicts the assertion by the company's Central Asia representative, Gerasimova, that Rohde & Schwarz is not supplying eavesdropping tools to Turkmenistan.
Both companies are active in the field of communications and information technology.
According to the Turkmen government source, the firm owned by the former security-services officer is controlled directly by the MNB. The firm conducts surveillance work using technology purchased from Rohde & Schwarz, and in turn obtains contracts from Turkmen state companies for website development, software support, and other IT services, the source alleged.
The other company, according to the source, is under the control of Berdymukhammedov's administration and also benefits from government contracts.
In addition to technology, Rohde & Schwarz supplies software support and training for specialists, the source said, adding that specialists with at least one of the private Turkmen companies underwent such training.
This technology and training helps Turkmen authorities block online platforms facilitating content and discussions they do not approve of, the Turkmen government source said. Web and mobile messaging services are also targeted by Turkmen authorities, the source added.
In order to access blocked sites and messaging services, Turkmen Internet users employ virtual private networks (VPNs) and proxy servers. Turkmen security services are capable of identifying citizens using VPNs, the government source told RFE/RL.
RFE/RL in recent years has reported about cases in which Turkmen security services allegedly called citizens in for questioning over their use of VPN services and threatened them with punishment. Turkmen authorities have also warned citizens not to visit websites critical of the government.
RFE/RL regularly receives reports that web users have had their Internet access cut after using VPN services.
Turkmen authorities appear to have stepped up efforts recently to combat the use of VPN apps in the country. Security services have blocked numerous websites and other online services, including the Google Play app store.
Recently there was a 577-percent spike in searches for VPN services by Internet users in Turkmenistan over the course of a week, according to the website Vpncompare.co.uk, which tracks Internet connections via VPN services.
The lone Internet provider in Turkmenistan is the state-owned Turkmentelecom, which is controlled by the Communications Ministry.
'Digital Arms To Dictators'
HRW has called on Rohde & Schwarz to publicly disclose "whether it's considering selling technology to Turkmenistan, with its record of repressing rights, and how it is addressing the possibility its technology will be used to further rights violations."
"Companies have a responsibility to respect human rights, which means that they should undertake credible human rights due diligence to determine whether their activities could contribute to human rights abuses," the rights watchdog said in a statement in June.
The issue of spyware deliveries to authoritarian regimes has prompted proposed legislation in the European Parliament. The legislation aims to tighten export controls to prevent "the abuse of certain cyber-surveillance technologies by regimes with a questionable human rights record."
Marietje Schaake, a Dutch member of the European Parliament and a rapporteur for the legislation, told RFE/RL that "the export of digital arms to dictators has to stop."
"This is another case that demonstrates why we urgently need these reforms. We can't waste more time: we need to act now," Schaake said in response to the investigation by RFE/RL's Turkmen Service into Rohde & Schwarz's dealings with Ashgabat.
Schaake and the lead rapporteur for the legislation in the European Parliament, Klaus Buchner of Germany, both lamented that the legislation had stalled for more than a year due to objections from countries including France, Finland, and Sweden.
Buchner told RFE/RL that "cutting-edge cyber-surveillance technology" is increasingly falling into the hands of "countries that are unfree and, in the case of Turkmenistan, resemble brutal dictatorships."
"We are exporting the active destruction of democratic values and institutions all over the world," Buchner said in e-mailed comments.
