Predator Files: President Macron, Alexandre Benalla and a French firm's attempts to sell spyware to Saudi Arabia

TheThe international 'Predator Files' investigation has revealed a highly-sensitive affair involving Emmanuel Macron, his sacked former bodyguard Alexandre Benalla and an apparent attempt to sell spy software to Saudi Arabia. The journalistic investigation has been carried out by fifteen international media coordinated by the European investigations network EIC and based on confidential documents obtained by Mediapart and the German publication Der Spiegel.

The saga began with a judicial investigation led by judges Stéphanie Tacheau and Ariane Amson into the French company Nexa (formerly Amesys), which was suspected of being an “accomplice to torture” for having sold surveillance systems to Libya and Egypt.

At the beginning of June 2021 gendarmes at the crimes against humanity and hate crime unit the Office Central de Lutte contre les Crimes contre l’Humanité et les Crimes de Haine (OCLCH) discovered that Nexa was commercially active in Saudi Arabia. And that its boss Stéphane Salies, who had his phones tapped at the time, seemed perfectly aware of the abuses that the Saudis could commit with his products, given his view that they had “lost the plot a bit” in murdering journalist Jamal Khashoggi in October 2018. On June 15th 2021 Nexa's premises were searched and its senior executives were questioned.

On two occasions, in June and July 2021, the investigating judges asked France's anti-terrorism prosecution unit the PNAT, led by Jean-François Ricard, for the scope of the investigation to be broadened to include suspicions of “complicity in torture in Saudi Arabia”.

The PNAT twice refused, taking the view that there was not enough evidence for this. But it told the judges that they were authorised to make use of the documents they had just found in the search, and to come back to the prosecution unit if necessary. It was not an “outright refusal” the PNAT told Mediapart.

Sifting through these documents the gendarmes found other explosive facts that could tarnish the head of state Emmanuel Macron and his former bodyguard and personal security advisor Alexandre Benalla. The latter has already come under suspicion in a number of criminal proceedings and convicted in three of them, in particular for using violence against demonstrators on May 1st 2018, events which led to him being fired from the Élysée three months later.

A notebook found in the offices of a Nexa executive, someone who had incidentally taken part in Emmanuel Macron's 2017 presidential campaign, revealed the existence of meetings that had taken place in the spring of 2018 between Nexa and personnel at the Élysée. One of these meetings took place in the presence of Alexandre Benalla and Emmanuel Macron, according to this same document.

Then from 2020, Alexandre Benalla helped Nexa in its commercial campaigns, in particular in Saudi Arabia, where the French company was trying to sell the powerful spy software Predator, which is capable of capturing the contents of mobile phones. He introduced Nexa to a Saudi “prince” whom he portrayed as “very close” to the Saudi Crown Prince Mohammed bin Salman, known as 'MBS'.

But since this new information was added to the case file in March 2022, nothing has happened. Perhaps put off by the initial refusal to enlarge the scope of the investigation, the investigating judges have apparently not approached the prosecutor about this again. Nor has the head of the PNAT prosecution service taken the initiative to widen the remit of the probe himself.

The result is that this part of the probe has come to a standstill. The investigating judges do not have permission to carry out enquiries concerning Saudi Arabia, to check if Nexa did actually sell spy software to the country, or to find out more about Alexandre Benalla's role.

The French company has made Riyadh a commercial priority, despite the increasing number of human rights breaches (the stalking of human rights activists, arbitrary arrests, death sentences) and the use of hacking software to infect the phones of those close to journalist and prominent regime critic Jamal Khashoggi, who was killed on the orders of Mohammed bin Salman. Emmanuel Macron, anxious to preserve French arms sales to the Saudi dictatorship, was weak in his criticism of the murder, before helping to start MBS's rehabilitation on the international stage at the end of 2021.

Old links between MBS and Benalla

Alexandre Benalla himself has known Mohammed bin Salman for a long time. In visits to Paris between 2013 and 2015, before he became the Saudi kingdom's strongman in 2017, the Crown Prince called on the personal protection services of a young security officer called Alexandre Benalla and of one of the latter's friends and colleagues Christian Guédon, a former member of the elite gendarme tactical unit the GIGN (Groupe d’intervention de la gendarmerie nationale) and a man with a busy career.

From the summer of 2016 both men worked alongside Emmanuel Macron, looking after his personal protection until his victory in the 2017 presidential election. Once Macron was in the Élysée Benalla joined the president's office and became his go-to man on security issues, and many other matters too. Christian Guédon himself joined the presidential security corps, the Groupe de sécurité de la présidence de la République (GSPR), after an exception was made to allow him to do so. He became Emmanuel Macron's closest bodyguard during the president's first term.

Alexandre Benalla clearly stayed close to MBS. During the latter's first official visit to Paris in April 2018 Emmanuel Macron invited the Crown Prince to dine with him at the Louvre Museum. That evening Alexandre Benalla was allowed to be present during some of the confidential conversations between the two men, much to the surprise of some of the French head of state's staff, as one Élysée source later told Mediapart.

It transpires that the number three at the Nexa group, Renaud Roques, was himself also actively involved alongside Emmanuel Macron during the 2017 presidential election, according to documents found by the gendarmes in his computer.

A large-scale interception system

An initial high-level meeting apparently took place by April 24th 2018 at the latest, according to a page of a notebook seized during a search of Renaud Roques's office at Nexa. The handwritten note mentioned the presence of Alexandre Benalla, Emmanuel Macron and General Éric Bio-Farina, head of security at the Élysée, and also gave their personal mobile phone numbers, which we have been able to verify.

This initial meeting seems to have been devoted to a general presentation about the company (“around 100 people, “innovation”, “90% export”) and its “unique products”, among them powerful Israeli software to hack mobile phones.

The same notebook describes a second meeting on May 3rd 2018, without either Emmanuel Macron or Alexandre Benalla, but in the presence of General Bio-Farina and someone called “Dr Schmidt”.

This time Nexa seems to have set out a detailed proposal, involving a system of “predictive analysis” that allowed “threats to the PR” - meaning the 'president of the Republic' – to be identified through monitoring of security watchlist files known as 'fiches S'. These highly confidential files, kept by France's domestic intelligence agency the DGSI, list individuals regarded as potentially dangerous – Islamists, and extremists from the Right and Left. The notebook also mentions a system that is able to “monitor in real time”, thus enabling any potential “action by Daesh [editor's note, Islamic State]” to be “anticipated”.

What came of these proposals? The Élysée, Alexandre Benalla and Renaud Roques did not respond to our questions. The two Nexa bosses, Stéphane Salies and Olivier Bohbot, declined to respond on this issue.

In any case, Nexa and Alexandre Benalla met again two years later over the issue of Saudi Arabia, a market that Nexa had been exploring ever since 2008, just a year after its creation. The company, which at the time was called Amesys, had tried to sell Riyadh its Eagle software (since renamed Cerebro), a “large-scale interception system” able to monitor the internet at the level of an entire country.

This initial attempt failed. But Nexa tried again to sell Cerebro, this time apparently successfully.

At the end of 2014 the French government – via the arms export department ODAS – agreed an enormous three-billion euro deal with Saudi Arabia. The deal was called 'Donas' for “Saudi Arabia donation”, and it provided for the delivery of weapons to Lebanon.

According to Mediapart's information, the Donas contract included two linked surveillance equipment systems: the large-scale telephone eavesdropping system called Cortex supplied by Ercom (now a subsidiary of defence and aerospace group Thales) and Nexa's own Cerebro system, a deal for which was made for 13.5 million euros.

But a political crisis blew up between Riyadh and Beirut in 2016. The contract remained in place but it was agreed that the equipment would ultimately be sent to Saudi Arabia. Internal documents show that Nexa fulfilled the Donas contract and sent at least one invoice for 1.6 million euros. An engineer at the group also told gendarmes that the system was indeed supplied direct to Saudi Arabia. “I made two or three trips to Riyadh where there was a small system set up, in other words two or three servers … The software … was called … Cerebro,” he said.

When contacted, Thales and Nexa declined to comment on this contract.

Meanwhile another project, this one called 'West', took shape in 2014. This aimed to help secure the western border of the Saudi kingdom by intercepting “UHF radio frequencies, GSM and local data”. Nexa was one of the subcontractors for this deal, for two million euros, via its organisation based in Dubai, Advanced Middle East Systems (AMES).

Commercial activity in the kingdom

At Nexa gendarmes also found a letter on headed notepaper from the Saudi kingdom asking for the “installation of an interception system for GSM communications”. This project seems to have come to fruition, as a document in 2014 lists a “small” and “existing” contract with the Saudi Ministry of Defence concerning IMSI-catchers. These devices are able to spy on mobile phone communications within a range of several hundred metres.

Nexa was on a roll and in October 2017 it tried to sell the Saudis its new IMSI-catcher which was even more powerful. In a conversation intercepted by gendarmes the group's number three, Renaud Roques, was seeking to send an example of this new device to Saudi to provide a demonstration, even though he did not have a licence authorising him to do so. It is not known how this episode ended.

Nexa's commercial push was not held back by the murder of Saudi journalist Jamal Khashoggi, savagely killed and then dismembered in Istanbul in October 2018 by the Saudi secret services.

In 2019 Nexa bought its rival Trovicor, a company with German origins, which moved its headquarters to Dubai after coming under suspicion for having supplied surveillance equipment to dictatorships such as Syria and Iran. It turns out that Trovicor had been supplying the systems to enable Saudi Arabia's judiciary to carry out eavesdropping since at least 2014.

This was how Nexa found itself managing telephonic eavesdropping in the Saudi kingdom. In the spring of 2020 the French group won a contract for 4.9 million euros to maintain and modernise the system until 2025.

Nexa now dreamt of moving up a gear by selling new products to Riyadh. At the same time the group again became close to Alexandre Benalla. Since his enforced departure from the Élysée he had become a private security consultant via his company Comyy Group and a rather nebulous non-governmental organisation based in Geneva. In the space of one year, from June 2020 to June 2021, Alexandre Benalla and Nexa number two Olivier Bohbot exchanged no fewer than 499 messages and 89 attachments on WhatsApp.

Only two of these conversations were added to the judicial investigation file. The first is dated September 7th 2020, just a few hours after Mediapart had revealed a secret meeting between Alexandre Benalla, accompanied by an advisor to Emmanuel Macron who was still in post, and the new president of Guinea-Bissau in a Paris hotel. At 11.47pm Alexandre Benalla sent a copy of the article to Olivier Bohbot without comment. The Nexa executive replied to him the following morning in familiar terms: “They won't let go of you! Hi Alex, you okay?”

A month later the two men exchanged messages about Saudi Arabia. “The guy I'm introducing you to is the CEO of Pasco Limited. He's a prince … He's very close to MBS, He's also a very good friend of Tamin, the Emir of Qatar, who had given him Qatari nationality,” said Alexandre Benalla in a message sent at 10.02am on October 6th 2020.

The meeting was planned for the same day, evidently in an hotel. “I'm here,” wrote Olivier Bohbot at 10.59am. “I'm on my way … go into the lobby. Tell them you have a meeting with a client,” replied Alexandre Benalla. At 11.34am he alerted the Nexa number two to the fact that the Saudi prince had arrived. “He's arriving in the lobby. Arab, long grey hair,” Benalla wrote.

We have not been able to identify the company Pasco, nor the identity of the prince who runs it.

At the time he was setting up this meeting for Nexa, however, Alexandre Benalla, already under suspicion for having signed a security contract with a Russian oligarch close to the Kremlin while he was still at the Élysée, was formally banned from entering into any professional relationship with individuals that he had known in the course of his public duties or with foreign public authorities. This was according to the opinion of the committee on civil service ethics Commission de Déontologie de la Fonction Publique. This body had determined a ban of three years after his departure from the Élysée in 2018.

In the spring of 2021 Nexa took part in a tender bid in Riyadh to try to sell its new IPDR software, which analyses internet traffic metadata on a massive scale. It was a replacement for Cerebro which had become unable to work effectively because of encryption.

IPDR cannot intercept the content of messages but it is able to identify who is speaking to the 'targets' even if they use encrypted apps such as Signal or WhatsApp. The project was estimated to be worth “20 to 30 million euros” Nexa boss Stéphane Salies said on the phone.

An intercepted phonecall on May 5th 2021 suggests that Alexandre Benalla helped in this tender process. “Yesterday the guy whom Alex bloody well sent our way, he called me 19 times in the day … So, very good because you can't imagine the number of things he triggered there,” said Stéphane Salies to one of his staff. It is not known if Nexa ended up winning the contract.

“No contract was ever signed through Mr Benalla's intervention and he never received payment from us,” Stéphane Salies and Olivier Bohbot told us, while declining to make any other comment on their relationship with Emmanuel Macron's former personal security adviser.

At the time the Nexa bosses were also working to sell Predator, a powerful telephone hacking software designed by its partner Intellexa, a group based in Europe but run by former officers in Israeli military intelligence.

Stéphane Salies was perfectly aware of the dangerous nature of such a product in the hands of dictators. “It depends who uses it and how it's used. Look what's happened in Saudi Arabia, they have after all lost the plot a bit” over “[Jamal] Khashoggi”, the boss of Nexa said on the phone on June 3rd 2021.

Questioned in custody about this conversation, Stéphane Salies acknowledged that “Saudi Arabia is certainly one of the countries that could be problematic”. However, he assured gendarmes that he was only looking to sell Riyadh “judicial interception” systems and not malware systems.

Trojan horses and spyware

A document seized during a search at Nexa contradicts this version of events. It is an unsigned draft of a “brokerage contract” dated January 6th 2020 between Advanced Systems, the Nexa Group's company in Dubai, and the company Gamma International Limited, represented by Louthean Nelson and registered in Labuan Island in Malaysia, one of the least transparent tax havens in the world.

This discreet company is a subsidiary of the Anglo-German group Gamma International, of which Louthean Nelson is the boss. The company is known for having developed the suite of hacking softwares named FinFisher, that Gamma sold in 2013.

In the 2020 contract with Nexa, Gamma agreed to supply, for a price, some high level “contacts” in order to help the French group to sell its whole range of products to the “royal court of Saudi Arabia”, including “wifi intrusion”, “Trojan horse”  and software infection systems. This corresponds to the capabilities of the Predator software, which Nexa sold at the time.

Questioned by the EIC, Louthean Nelson said that Gamma has not had any stake in the FinFisher software since 2013 and that he had “never been in contact or had dealings with Intellexa/Cytrox, and never had dealings with Advanced Systems/Nexa”.

In any case, Predator does seem to have been exported to Saudi Arabia in the end. Two technical studies performed by Citizen Lab and Amnesty International have concluded that the spy software has probably been used by the Saudi authorities.

However, what is not known is whether a contract was actually signed, and if any deal was clinched by Nexa or by its partner Intellexa, Predator's creator. Questioned about this, Nexa's executives declined to comment, but said that they have always “respected all applicable regulations and obtained the authorisation of the appropriate monitoring bodies”. Intellexa and its directors did not respond to our questions.

----------------------------------------------------

• The original French version of this article can be found here.

English version by Michael Streeter