https://www.theregister.com/2025/11/08/mozilla_fellow_al_shafei/ # # Sign in / up The Register # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Supercomputing Month Cloud Infrastructure Month Datacenter Networking Nexus The State of Storage European Supercomputing AI Infrastructure Month Spotlight on RSAC AI Software Development Week Disaster Recovery Week Nvidia GTC Ransomware in Focus The Future of the Datacenter Cybersecurity Month VMware Explore Vendor Voice Vendor Voice Vendor Voice All Vendor Voice Nutanix: Scale Kubernetes. Not Chaos. Money Movement Hub The BigQuery Difference AWS Global Partner Security Initiative Amazon Web Services (AWS) New Horizon in Cloud Computing (X) Resources Resources Whitepapers Webinars & Events Newsletters [front] Security 6 comment bubble on white Who's watching the watchers? This Mozilla fellow, and her Surveillance Watch map 6 comment bubble on white Esra'a Al Shafei spoke with The Reg about the spy tech 'global trade' icon Jessica Lyons Sat 8 Nov 2025 // 11:08 UTC # interview Digital rights activist Esra'a Al Shafei found FinFisher spyware on her device more than a decade ago. Now she's made it her mission to surveil the companies providing surveillanceware, their customers, and their funders. "You cannot resist what you do not know, and the more you know, the better you can protect yourself and resist against the normalization of mass surveillance today," she told The Register. To this end, the Mozilla fellow founded Surveillance Watch last year. It's an interactive map that documents the growing number of surveillance software providers, which regions use the various products, and the investors funding them. Since its launch, the project has grown from mapping connections between 220 spyware and surveillance entities to 695 today. [front] These include the very well known spy tech like NSO Group's Pegasus and Cytrox's Predator, both famously used to monitor politicians, journalists and activists in the US, UK, and around the world. [front] [front] They also include companies with US and UK government contracts, like Palantir, which recently inked a $10 billion deal with the US Army and pledged a PS1.5 billion ($2 billion) investment in the UK after winning a new Ministry of Defense contract. Then there's Paragon, an Israeli company with a $2 million Immigration and Customs Enforcement (ICE) contract for its Graphite spyware, which lets law enforcement hack smartphones to access content from encrypted messaging apps once the device is compromised. Even LexisNexis made the list. "People think of LexisNexis and academia," Al Shafei said. "They don't immediately draw the connection to their product called Accurint, which collects data from both public and non-public sources and offers them for sale, primarily to government agencies and law enforcement." Surveillance is a global trade. It's not just being used in Iran, China, North Korea Accurint compiles information from government databases, utility bills, phone records, license plate tracking, and other sources, and it also integrates analytics tools to create detailed location mapping and pattern recognition. "And they're also an ICE contractor, so that's another company that you wouldn't typically associate with surveillance, but they are one of the biggest surveillance agencies out there," Al Shafei said. [front] It also tracks funders. Paragon's spyware is boosted by AE Industrial Partners, a Florida-based investment group specializing in "national security" portfolios. Other major backers of surveillance technologies include CIA-affiliated VC firm In-Q-Tel, Andreessen Horowitz (also known as a16z), and mega investment firm BlackRock. This illustrates another trend: It's not just authoritarian countries using and investing in these snooping tools. In fact, America now leads the world in surveillance investment, with the Atlantic Council think tank identifying 20 new US investors in the past year. "Surveillance is a global trade," Al Shafei said. "It's not just being used in Iran, China, North Korea. And a lot of the time you don't even have to be doing or saying anything: a hotel lobby uses smart cameras that detect unusual behavior, and if you pause too long in a hallway, your movements are flagged and logged, and sometimes automatically sent to police." [front] "This could be happening in New York. You don't have to be in Beijing for something like this to happen," she added. "You exit the building, cameras with facial recognition and gait analysis identify you automatically. Sensors track your phone's location. If a crime happened nearby, they say, 'Well, maybe [you] did it.'" 'It completely changes how you interact online' Twelve years ago, Al Shafei received what looked like a Firefox browser update notification. In reality, it was a ploy to trick her into downloading FinFisher (aka FinSpy) on her computer - part of a larger campaign targeting her and her team of social justice advocates across Asia and North Africa. In addition to Surveillance Watch, she is also co-founder of feminist-tech-focused Numun Fund, is a founding director of social justice not-for-profit org Majal, and serves on the boards of the Wikimedia Foundation, the Tor Project, and Mastodon. Developed by Gamma Group, FinFisher has been used by governments and law enforcement agencies around the world to monitor and intercept communications, gather intelligence, and track individuals' activities. It provides a whole range of snooping capabilities, giving users remote access to victims' machines, keylogging to capture passwords and account info, audio and video recording, and real-time monitoring of targets' communications and online activities. In 2013, Mozilla accused Gamma of violating its Firefox trademark in a cease-and-desist demand. That experience fundamentally changed Al Shafei's views on data privacy - and her digital activity, which can be tricky for someone very much in the public eye. It creates a troubling pattern of isolation, feelings of guilt, feelings of not being able to express myself, feelings of being targeted and controlled "My first feeling was guilt," she said, adding that she wasn't just worried about her own safety. "I worried about the fact that, by monitoring me, surveilling me, I had exposed everybody now in my network to this, so that guilt carries a lot of weight." It also required her to alert everybody in her orbit that she had been surveilled, and that meant that the snoops may have collected personal details about her family, friends, coworkers - everyone in her network, too. "The second thing is: it completely changes how you interact online. Period. I don't have social media profiles anymore," Al Shafei said, with one exception: she has a Mastodon profile because she's a board member. "But I don't share anything very sensitive or controversial." While Al Shafei knows her biometric data is easily accessible because she travels frequently, she doesn't post any photos or videos of herself online, and doesn't use any applications that require biometric identification. * Mozilla accuses Gamma of dressing up dictators' spyware as Firefox * We're number 1! America now leads the world in surveillanceware investment * Amazon's Ring can now use AI to 'learn the routines of your residence' * Super spyware maker NSO must pay Meta $168M in WhatsApp court battle "It changed how I use the web," Al Shafei continued. "It changed who I interact with on the web. It changed how much I'm willing to do on the web while protecting myself, because I don't want to put myself at any further risk. It changed how I express my views, how I access information, whether or not I would be comfortable accessing specific types of information if I felt like I could not do so safely." And all of this "creates a troubling pattern of isolation, feelings of guilt, feelings of not being able to express myself, feelings of being targeted and controlled." 'They know who you are' The Surveillance Watch homepage announces: "They know who you are. It's time to uncover who they are." It's creepy and accurate, and portrays all of the feelings that Al Shafei has around her spyware encounters. Her Majal team has "faced persistent targeting by sophisticated spyware technologies, firsthand, for a very long time, and this direct exposure to surveillance threats really led us to launch Surveillance Watch," she said. "We think it's very important for people to understand exactly how they're being surveilled, regardless of the why." The reality is, everybody - not just activists and politicians - is subject to surveillance, whether it's from smart-city technologies, Ring doorbell cameras, or connected cars. Users will always choose simplicity over security, and the same can be said for data privacy. "We want to show that when surveillance goes not just unnoticed, but when we start normalizing it in our everyday habits, we look at a new, shiny AI tool, and we say, 'Yes, of course, take access to all my data,'" Al Shafei said. "There's a convenience that comes with using all of these apps, tracking all these transactions, and people don't realize that this data can and does get weaponized against you, and not just against you, but also your loved ones." (r) Get our Tech Resources # Share More about * Mozilla Foundation * Privacy * Security More like these x More about * Mozilla Foundation * Privacy * Security * Surveillance Narrower topics * 2FA * Advanced persistent threat * Application Delivery Controller * Authentication * BEC * Black Hat * BSides * Bug Bounty * Center for Internet Security * CHERI * CISO * Common Vulnerability Scoring System * cookies * Cybercrime * Cybersecurity * Cybersecurity and Infrastructure Security Agency * Cybersecurity Information Sharing Act * Data Breach * Data Protection * Data Theft * DDoS * DEF CON * Digital certificate * Encryption * End Point Protection * Exploit * Firefox * Firewall * Google Project Zero * Hacker * Hacking * Hacktivism * Identity Theft * Incident response * Infosec * Infrastructure Security * Kenna Security * NCSAM * NCSC * NSO Group * Palo Alto Networks * Password * Personally Identifiable Information * Phishing * Privacy Sandbox * Quantum key distribution * Ransomware * Remote Access Trojan * REvil * RSA Conference * Spamming * Spyware * TLS * Trojan * Trusted Platform Module * Vulnerability * Wannacry * Zero trust More about # Share 6 comment bubble on white COMMENTS More about * Mozilla Foundation * Privacy * Security More like these x More about * Mozilla Foundation * Privacy * Security * Surveillance Narrower topics * 2FA * Advanced persistent threat * Application Delivery Controller * Authentication * BEC * Black Hat * BSides * Bug Bounty * Center for Internet Security * CHERI * CISO * Common Vulnerability Scoring System * cookies * Cybercrime * Cybersecurity * Cybersecurity and Infrastructure Security Agency * Cybersecurity Information Sharing Act * Data Breach * Data Protection * Data Theft * DDoS * DEF CON * Digital certificate * Encryption * End Point Protection * Exploit * Firefox * Firewall * Google Project Zero * Hacker * Hacking * Hacktivism * Identity Theft * Incident response * Infosec * Infrastructure Security * Kenna Security * NCSAM * NCSC * NSO Group * Palo Alto Networks * Password * Personally Identifiable Information * Phishing * Privacy Sandbox * Quantum key distribution * Ransomware * Remote Access Trojan * REvil * RSA Conference * Spamming * Spyware * TLS * Trojan * Trusted Platform Module * Vulnerability * Wannacry * Zero trust TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like Microsoft's lack of quality control is out of control OPINION At one point, Microsoft's QC was legendary. Now, it's the wrong kind of legend Software8 Nov 2025 | 78 Meta can't afford its $600B love letter to Trump The Zuck better hope his finance bros have deep pockets and a whole lotta patience to pull this off Off-Prem8 Nov 2025 | 29 ChatGPT, Claude, and Grok make very squishy jury members All three acquitted a teen in a mock trial based on a case where a judge ruled guilty AI + ML8 Nov 2025 | 8 Huawei's ACT pathway powers scalable AI adoption across industries Company unveils pathway for intelligent transformation Sponsored Feature [front] Previously unknown Landfall spyware used in 0-day attacks on Samsung phones 'Precision espionage campaign' began months before the flaw was fixed Research7 Nov 2025 | 3 AI benchmarks are a bad joke - and LLM makers are the ones laughing Study finds many tests don't measure the right things AI + ML7 Nov 2025 | 13 Blackwell a no-sell in China as trade deal fails to materialize Xi and Trump haven't gotten to discuss the chips, though they were supposed to AI + ML7 Nov 2025 | 2 Bell bottom-era tape unearthed, could contain lost piece of Unix history It might have the first-ever version of UNIX written in C OSes7 Nov 2025 | 29 China warns Dutch away from Nexperia as it lets chip exports resume Netherlands court still overseeing governance at the chipmaker Systems7 Nov 2025 | 10 Google's Gemini Deep Research can now read your Gmail and rummage through Google Drive Even with more info, web giant says agent can't be trusted to keep you healthy, wealthy, and wise AI + ML7 Nov 2025 | 9 Cybercrims plant destructive time bomb malware in industrial .NET extensions Multi-year wait for destruction comes to an end for mystery attackers Cyber-crime7 Nov 2025 | 18 Researchers want to kill the vibe, propose better model for AI coding MIT researchers offer cure for illegible software Software7 Nov 2025 | 17 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * Ts & Cs * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2025 no-js