A Bulgaria-based surveillance technology firm sold its controversial wares to countries known for repressing their citizens, allowing those governments to snoop on conversations and monitor phones’ locations and web browsing, according to a new report.

The nonprofit Human Rights Watch obtained export licensing records covering 2018 through 2023, which show the Bulgarian government allowed the surveillance firm Circles to peddle the tech to law enforcement and intelligence agencies in El Salvador, the United Arab Emirates, Serbia, Azerbaijan, Guatemala, Bahrain, Jordan, Malaysia, Morocco and Panama.

Many of those countries have long records for crushing dissent and some have used spyware to snoop on dissidents and journalists in the past.

The documents put the European Union’s export control regime — meant to stop the sale of sophisticated surveillance technology — in a harsh light. The EU has struggled to control the flow of spyware and other surveillance technology from being sold beyond its borders despite loud calls for it to do more to confront the problem.

“All EU governments should be clamping down on exports of tools that can be used for repression, not rubber-stamping them,” Zach Campbell, senior surveillance researcher at Human Rights Watch, said in a statement. 

“The European Commission has evidence that EU governments have been issuing licenses seemingly without conducting serious human rights due diligence, and yet appears to have taken no action despite having the legal framework to control this.”

The Bulgarian government and the European Commission did not immediately respond to requests for comment.

The Bulgarian government told Human Rights Watch that “[e]xports that contradict the country’s national, European and international commitments, including with regard to the protection of human rights, are not allowed” and that “[t]he Ministry maintains a consistent policy of zero tolerance for abuses and strictly monitors compliance with the established rules,” according to a Human Rights Watch press release.

The European Commission told the nonprofit that member states are “solely responsible for licensing decisions on dual-use exports.”

Human Rights Watch said it contacted Circles for comment four times and never received a response.

Powerful surveillance tools

The export licensing records Human Rights Watch obtained originated with the Bulgarian Ministry of Economy and Industry’s department charged with supporting or blocking export license applications for Bulgarian companies, according to the press release.

Human Rights Watch could not get any records for 2025 or 2026 so it is unclear if the sales are still happening.

Like many firms selling powerful surveillance tech, Circles bills itself as offering a tool that is meant to be exclusively used to combat terrorism and crime. But human rights and digital freedoms advocates have long complained that the company’s technology has been abused, a fact which has been documented in the past.

Circles sold several different tools to the repressive governments, including a technology called Pixcell, which is capable of capturing internet data, phone calls and messages, the press release said. It also sold a second system, known as Landmark, which geolocates mobile phones in real time.

A third system, known as “Voice Over Location Enabler” software, uses SS7 protocol to “remotely intercept targets’ incoming and outgoing voice calls” as well as data including both parties’ locations, according to the press release, quoting from Circles’ documents.

Circles was co-founded by Tal Dilian, the executive behind the blacklisted spyware firm Intellexa. In February, a Greek court found Dilian guilty on charges relating to how Intellexa was used to spy on a range of civil society members, including journalists and politicians.

In May, Human Rights Watch published a report saying that European surveillance technology companies have peddled spywares to repressive governments. Those companies include Finland, Poland, Denmark, the Czech Republic, Estonia and Bulgaria.

France, Greece, Spain, Germany and Italy — all known exporters of the surveillance tech — would not give Human Rights Watch trade records, according to that report.