https://www.ftm.eu/articles/europe-health-data-us-firm-israel-spies Hold power to account Hold power to account 50,000 Help Follow the Money reach 50,000 members Become a member Skip to content Back Hide menu [ ] About us Articles Newsletters Podcast Topics Log in Become a member Our newsletters Write for us Become a source Authors Donate FAQ Bookmarked articles About us Articles Newsletters Podcast Topics Get full access You're only seeing part of our work. Create an account to explore all our investigations. Try it for free for 30 days, no strings attached. Start trial membership Log in here The EU Files Europeans' health data sold to U.S. firm run by ex-Israeli spies 9 October 2025 * 8 min. reading time Gift article Download the app Give free access to this article. E-mail Facebook LinkedIn WhatsApp Bluesky Mastodon Reddit Link E-mail Facebook LinkedIn WhatsApp Bluesky Mastodon Reddit Link [Spy_Header] The European messaging service Zivver - which is used for confidential communication by governments and hospitals in the EU and the U.K. - has been sold to Kiteworks, an American company with strong links to Israeli intelligence. Experts have expressed deep concerns over the deal. Collection: The EU Files Authors: Sebastiaan Brommersma, Siem Eikelenboom Image: (c) Tim Schaap Bookmark Add contribution This story in 1 minute What's the news? * With the sale of Amsterdam-based data security company Zivver, sensitive information about European citizens is now in the hands of Kiteworks. * The CEO of the American tech company is a former cyber specialist from an elite unit of the Israeli army, as are several other members of its top management. * Various institutions in Europe and the U.K. - from hospitals to courts and immigration services - use Zivver to send confidential documents. While Zivver says these documents are encrypted, an investigation by Follow the Money shows that the company is able to read their contents. Why does this matter? * Cybersecurity and intelligence experts told Follow the Money that the takeover should either have been prevented or properly assessed in advance. * Zivver processes information that could be extremely valuable to third parties, such as criminals or foreign intelligence services. * That information is now subject to invasive U.S. law, and overseen by a company with well-documented links to Israeli intelligence. How was this investigated? * Follow the Money investigated the acquisition of Zivver and the management of Kiteworks, and spoke to experts in intelligence services and cyber security. This article is part of an ongoing series. The EU Files Read more Fold in When the American data security company Kiteworks bought out its Dutch industry peer Zivver in June, CEO Jonathan Yaron described it as "a proud moment for all of us". The purchase was "a significant milestone in Kiteworks' continued mission to safeguard sensitive data across all communication channels", he added in a LinkedIn post. But what Yaron did not mention was that this acquisition - coming at a politically charged moment between the U.S. and the EU - put highly sensitive, personal data belonging to European and British citizens directly into American hands. Zivver is used by institutions including hospitals, health insurers, government services and immigration authorities in countries including the Netherlands, Germany, Belgium and the U.K. Neither did Yaron mention that much of Kiteworks' top management - himself included - are former members of an elite Israeli Defence Force unit that specialised in eavesdropping and breaking encrypted communications. Our journalism is only possible thanks to the trust of our paying members. Not a member yet? Sign up now In addition to this, an investigation by Follow the Money shows that data processed by Zivver is less secure than the service leads its customers to believe. Research found that emails and documents sent by Zivver can be read by the company itself. This was later confirmed by Zivver to Follow the Money. "All of the red flags should have been raised during this acquisition" Zivver maintained, however, that it does not have access to the encryption keys used by customers, and therefore cannot hand over data to U.S. authorities. This is despite independent researchers confirming that the data was - for a brief period - accessible to the company. If U.S. officials wanted access to such communication, Zivver would be legally obligated to provide it. Cybersecurity experts now point to serious security concerns, and ask why this sale seems to have gone through without scrutiny from European authorities. "All of the red flags should have been raised during this acquisition," said intelligence expert Hugo Vijver, a former long-term officer in AIVD, the Dutch security service. Classified documents Amsterdam-based Zivver - which was founded in 2015 by Wouter Klinkhamer and Rick Goud - provides systems for the encrypted exchange of information via email, chat and video, among other means. Dutch courts, for example, work with Zivver to send classified documents, and solicitors use the service to send confidential information to the courts. Other government agencies in the Netherlands - including the immigration service - also use Zivver. So do vital infrastructure operators such as the Port of Rotterdam and The Hague Airport. In the U.K., a number of NHS hospitals and local councils use the company. In Belgium and Germany it is used in major hospitals. The information that Zivver secures for its customers is therefore confidential and sensitive by nature. When approached by Follow the Money, a number of governmental agencies said the company's Dutch origins were a big factor in their decision to use Zivver. Additionally, the fact that the data transferred via Zivver was stored on servers in Europe also played a role in their decisions. Now that Zivver has been acquired by a company in the United States, that data is subject to far-reaching American laws. This means that the U.S. government can request access to this information if it wishes, regardless of where the data is stored. The Trump effect These laws are not new, but they have become even more draconian since U.S. President Donald Trump's return to office, according to experts. Bert Hubert, a former regulator of the Dutch intelligence services, warned: "America is deteriorating so rapidly, both legally and democratically, that it would be very naive to hand over your courts and hospitals to their services." "Trump recently called on Big Tech to ignore European legislation. And that is what they are going to do. We have no control over it," he added. [Red_Flag_S] In Europe, Hubert said: "We communicate almost exclusively via American platforms. And that means that the U.S. can read our communications and disrupt our entire society if they decide that they no longer like us." Zivver had offered an alternative - a European platform governed by EU law. "We are now throwing that away. If you want to share something confidential with a court or government, consider using a typewriter. That's about all we have left," Hubert said. Israeli ties Beyond American jurisdiction, Kiteworks' management raises another layer of concern: its links to Israeli intelligence. Several of the company's top executives, including CEO Yaron, are veterans of Unit 8200, the elite cyber unit of the Israel Defence Force (IDF). The unit is renowned for its code-breaking abilities and feared for its surveillance operations. `In Israel, there is a revolving door between the army, lobby, business and politics' Unit 8200 has been linked to major cyber operations, including the Stuxnet attack on Iranian nuclear facilities in 2007. More recently, it was accused of orchestrating the detonation of thousands of pagers in Lebanon, an incident the United Nations said violated international law and killed at least two children. The unit employs thousands of young recruits identified for their digital skills. It is able to intercept global telephone and internet traffic. International media have reported that Unit 8200 intercepts and stores an average of one million Palestinian phone calls every hour, data that ends up on Microsoft servers in Europe. Some veterans themselves have also objected to the work of the unit. In 2014, dozens of reservists signed a letter to Israeli leaders saying they no longer wanted to participate in surveillance of the occupied territories. "The lines of communication between the Israeli defence apparatus and the business community have traditionally been very short," said Dutch intelligence expert Vijver. "In Israel, there is a revolving door between the army, lobby, business and politics." Veterans at the helm That revolving door is clearly visible in big U.S. tech companies - and Kiteworks is no exception. Aside from Yaron, both Chief Business Officer Yaron Galant and Chief Product Officer Amit Toren served in Unit 8200, according to publicly available information. They played a direct role in negotiating the acquisition of Zivver. Their background was known to Zivver's directors Goud and Klinkhamer at the time. The EU Files What is transpiring within the European Union? What are the goals and aspirations of the EU, and how is the budget allocated? Follow these files Unfollow these files [EU_vlaggen] Other senior figures also have military intelligence backgrounds. Product director Ron Margalit worked in Unit 8200 before serving in the office of Israeli Prime Minister Benjamin Netanyahu. Mergers and acquisitions director Uri Kedem is a former Israeli naval captain. Kiteworks is not unique in this respect. Increasing numbers of U.S. cybersecurity firms now employ former Israeli intelligence officers. This trend, experts say, creates vulnerabilities that are rarely discussed. An independent researcher quoted by U.S. Drop Site News said: "Not all of these veterans will send classified data to Tel Aviv. But the fact that so many former spies work for these companies does create a serious vulnerability: no other country has such access to the American tech sector." Or, as the ex-intelligence regulator Hubert put it: "Gaining access to communication flows is part of Israel's long-term strategy. A company like Zivver fits perfectly into that strategy." The information handled by Zivver - confidential communications between governments, hospitals and citizens - is a potential goldmine for intelligence services. According to intelligence expert Vijver, access to this kind of material makes it easier to pressure individuals into cooperating with intelligence agencies. Once an intelligence service has access to medical, financial and personal data, it can more easily pressure people into spying for it, he said. But the gain for intelligence services lies not just in sensitive information, said Hubert: "Any data that allows an agency to tie telephone numbers, addresses or payment data to an individual is of great interest to them." He added: "It is exactly this type of data that is abundantly present in communications between civilians, governments and care institutions. In other words, the information that flows through a company like Zivver is extremely valuable for intelligence services." A flawed security model? These geopolitical concerns become more pronounced when combined with technical worries about Zivver's encryption. For years, Zivver presented itself as a European alternative that guaranteed privacy. Its marketing materials claimed that messages were encrypted on the sender's device and that the company had "zero access" to content. But an investigation by two cybersecurity experts at a Dutch government agency, at the request of Follow the Money, undermines this claim. [Spy_Spot] The experts, who participated in the investigation on condition of anonymity, explored what happened when that government agency logged into Zivver's web application to send information. Tests showed that when government users sent messages through Zivver's web application, the content - including attachments - was uploaded to Zivver's servers as readable text before being encrypted. The same process applied to email addresses of senders and recipients. "In these specific cases, Zivver processed the messages in readable form," said independent cybersecurity researcher Matthijs Koot, who verified the findings. "Even if only briefly, technically speaking it is possible that Zivver was able to view these messages," he said. He added: "Whether a message is encrypted at a later stage makes little difference. It may help against hackers, but it no longer matters in terms of protection against Zivver." Despite these findings, Zivver continues to insist on its website and in promotional material elsewhere - including on the U.K. government's Digital Marketplace - that "contents of secure messages are inaccessible to Zivver and third parties". So far, no evidence has surfaced that Zivver misused its technical access. But now that the company is owned by Kiteworks, experts see a heightened risk. Former intelligence officer Vijver puts it bluntly: "Given the links between Zivver, Kiteworks and Unit 8200, I believe there is zero chance that no data is going to Israel. To think otherwise is completely naive." A missed safeguard The sale of Zivver could technically have been blocked or investigated under Dutch law. According to the Security Assessment of Investments, Mergers and Acquisitions Act, such sensitive takeovers are supposed to be reviewed by a specialised agency. But the Dutch interior ministry declared that Zivver was not part of the country's "critical infrastructure," meaning that no review was carried out. That, in Hubert's view, was "a huge blunder". "It's bad enough that a company that plays such an important role in government communications is falling into American hands, but the fact that there are all kinds of Israeli spies there is very serious," he said. "The takeover is taking place in an unsafe world full of geopolitical tensions" Experts say the Zivver case highlights Europe's lack of strategic control over its digital infrastructure. Mariette van Huijstee of the Netherlands-based Rathenau Institute said: "I doubt whether the security of sensitive emails and files ... should be left to the private sector. And if you think that is acceptable, should we leave it to non-European parties over whom we have no control?" "We need to think much more strategically about our digital infrastructure and regulate these kinds of issues much better, for example by designating encryption services as vital infrastructure," she added. Zivver, for its part, claimed that security will improve under Kiteworks. Zivver's full responses to Follow the Money's questions can be read here and here. But Van Huijstee was not convinced. "Kiteworks employs people who come from a service that specialises in decrypting files," she said. "The takeover is taking place in an unsafe world full of geopolitical tensions, and we are dealing with data that is very valuable. In such a case, trust is not enough and more control is needed." Read 0 contributions Get full access You're only seeing part of our work. Create an account to explore all our investigations. Try it for free for 30 days, no strings attached. Start trial membership Log in here Related articles [allianz_ga] Account required The EU Files This is how Western banks and insurers finance Israel's war in Gaza An Israeli bulldozer tears up a street during an Israeli raid in the occupied West Bank city of Jenin on September 1, 2024. Account required Your 'ethical' pension plan could be funding Israeli human rights abuses The skyscrapers surrounding Hashalom Station in Tel Aviv, also known as 'Silicon Wadi'. Account required The EU Files The apps you use might send your data to Israel - raising concerns about surveillance and human rights abuses Collection The EU Files What is transpiring within the European Union? What are the goals and aspirations of the EU, and how is the budget allocated? Follow these files Unfollow these files [EU_vlaggen] Authors Follow Sebastiaan Brommersma Former IP lawyer. Currently writing about digital technology, from big tech and big data to AI and cybercrime. Follow Siem Eikelenboom Experienced investigative journalist. Was part of the international team that investigated the Panama Papers. Send a news tip Connections Locations Israel Share this quote Share Font size 0 Contributions [1 ] Eye Follow the Money Become a source Articles Topics Donate Help Follow us on: Home Podcasts Profile More 0:00 Close [] Read article 0:00 0:00 1X Playback rate 1X 1.25X 1.5X 1.75X 2X 2.5X Sleep timer 5M 10M 15M 20M 30M 45M 60M FTM uses functional and anlytics cookies. We use this information to improve our website. Want to know more? Read our cookie policy and our terms & conditions. Accept Decline