On September 13,  numerous files of documentary materials were leaked and sent to the media outlets, allegedly created by the State Security Service, including the processed information obtained through covert surveillance.

IDFI examined the systemic characteristics of the disclosed materials, in particular, volume, period, categorization of target subjects, and diversity of information. Some data were randomly compared to open-source information. The results of our observations indicate that:

- A particularly large volume of data leaked, probably created in 2014-2021, contains intensely sensitive information;

- The materials are highly unlikely to be counterfeit;

- The materials are highly likely to be produced by the State Security Service;

- A significant portion of the data is likely obtained illegally;

- The materials are likely to indicate the systematic nature of illegal surveillance.

On September 14, the Georgian Prosecutor's Office announced the launch of an investigation. The State Security Service expressed its full readiness to cooperate with the investigation. The leaked documents are still posted on the website. If these documents are authentic, an immediate restriction on public access to these materials is necessary to protect data subjects’ privacy and safety.

The Prosecutor's Office of Georgia should immediately inform the public whether the leaked data is authentic. Investigating this issue is not of any extreme hardship, especially in the light of the State Security Service’s willingness to cooperate. Delaying in the investigation will substantially harm basic human rights and public interests. Besides, the Prosecutor's Office should apprehend that the involvement of independent actors in the process of investigation is of utmost importance for ensuring the legitimacy of the investigation.

At the same time, the Parliament of Georgia must recognize the severity of the situation. Efforts of the Prosecutor's Office alone will not build public trust. Parliament should use its Constitutional powers and intervene in the investigation, especially considering the apparent signs of the systemic nature of illegal surveillance.

We call on:

The Prosecutor's Office of Georgia to:

- Urgently investigate the authenticity of the disseminated materials and keep the public constantly informed;

- In case of data being authentic, use international cooperation mechanisms and ensure the erasure/restriction of disseminated materials;

- Ensure the involvement of the Public Defender of Georgia and the State Inspector in the investigation process.

The Parliament of Georgia to:

- Immediately set up a commission of inquiry. The commission should investigate the legitimacy of the alleged systematic nature of the surveillance by the State Security Service and the issue of involvement of high-ranking officials.

The Media Outlets and Journalist to:

- Cover the leaked data in full compliance with the principles of journalistic ethics. Materials should be distributed only to the extent that a valuable public interest strictly requires. Coverage should protect the right to privacy.

IDFI’s Observations:

Observation N1: The materials mainly reflect highly sensitive information

The leaked documents reflect particularly sensitive and compromising types of data related to people’s private lives.  Besides, the materials contain information that is allegedly supposed to be a state secret. If the facts presented in the leaked data are true, the facts of different types of serious crimes are exposed.

The materials have been generated in recent years. It focuses mainly on activities related to religious issues, although the materials feature various individuals who are neither clergymen nor have any connection to the public arena. Data also reflects persons employed in international organizations and embassies.

Publicly and freely available access to these types of materials will have serious consequences for the community, for the personal life and safety of the people referred, as well as for public order in general.

Observation N2: The materials are highly unlikely to be counterfeit

The information presented in the leaked materials is extremely detailed. It is inconceivable to falsify information this volume and details to this degree. The possibility of some specific piece of information being altered, or otherwise modified, cannot be ruled out, although, in general, there is no actual evidence against the authenticity of the materials. It is noteworthy that several objects of covert electronic surveillance have already confirmed the authenticity of the leaked information.

The authenticity of the information, in this context, implies that these materials are created based on relevant information. There can be found not only covert electronic surveillance in the leaked materials, but also information obtained from open sources.

If we compare the current events in the state in the relevant time, the content structure of the documents, in some cases the formal attributes, the degree of detail, as well as the confirmation of some objects of surveillance, we conclude with high probability that the disseminated materials are not falsified.

Observation N3:  The materials are highly likely to be produced by the State Security Service

In the digital world, covert electronic surveillance does not pose a particular technical difficulty. Publicly available digital devices give a person with proper knowledge the ability to control other digital devices. However, in this case, we are not dealing with an individual or a group of individuals, but with large-scale sectoral (religious-oriented) surveillance, which, most likely, has been going on for years.

Conducting covert electronic surveillance on such a scale and with such a degree of simplicity as described in the documents is difficult to imagine without the use of the state infrastructure and its special technical and legal capabilities.

Namely, the central body conducting covert electronic surveillance in Georgia is the LEPL operative-technical Agency (hereinafter referred to as the "Agency"). The Agency is a legal entity under public law governed by the State Security Service. [1]

Paragraph A of Article 7 of the “Law of Georgia on Legal Entity of Public Law - Operative-Technical Agency of Georgia” states that the Agency is authorized to carry out related activities to perform its tasks:

A.a) wiretapping and recording of telephone communications;

A.b) obtaining information from the communication channel;

A.c) obtaining information from a computer system;

A.d) real-time geolocation;

A.f) with covert video recording and/or audio recording, photo shooting.

The Agency has the following technical capabilities to implement the listed activities:

1. Real-time control of communication, stationary semi-stationary and non-stationary capabilities; [2]

2. Creates a central data bank where the identifying data of all electronic communications implemented throughout Georgia are stored;[3]

3. Carries out real-time geolocation determination using stationary or non-stationary technical capabilities.

for the implementation of the measures specified, the Agency has direct (both physical and remote) access to the infrastructure of mobile communications and Internet provider companies. Otherwise, the Agency is authorized to place its software and technical facilities in the companies, the company is obliged to cooperate and assist the Agency in the implementation of these measures. Additionally, the agency is authorized to use special software called "Computer viruses" - (non-traditional means).[4]

It should be emphasized that Article 12 of law proclaims the measures carried out by covert electronic surveillance to be the exclusive competence of the Agency and declares other state bodies inadmissible to establish another body with similar powers. [5]

The total size of distributed materials is about 14 GB. The documents relate to a circle of numerous individuals, probably hundreds of people.[6]  All the normative or factual data that have been disclosed so far indicate that the capabilities of covert electronic surveillance, which are needed to generate the disclosed volume of information, are available only to the State Security Service – Operative-Technical Agency. We can therefore conclude that, with high probability, the leaked data was generated by the State Security Service, which, among other things, relies on data obtained as a result of covert electronic surveillance.

Observation N4. The data obtained by covert electronic surveillance are allegedly obtained illegally

First of all, it should be noted that the leaked materials are not based solely on data obtained through covert electronic surveillance. In some cases, publicly available information is used.

As mentioned above, the Agency has exclusive access to almost all covert electronic surveillance activities. This ‘privilege’ does not place the Agency beyond the law and it is not free to target anyone it wishes under the surveillance. Georgian legislature requires an appropriate legal basis and prior or subsequent consent of the judge.Besides, according to the law, the information on the activation of thelawful interception management systemshould be automatically provided to the State Inspector's Office or the Supreme Court of Georgia to check the legality of the action.

It is implausible that the court permitted to obtain material that covers personal data of the disclosed volume and content. It is not clear how the information was obtained, however, in some cases, circumstances indicate that the State Security Service is easily able to circumvent procedural and technical guarantees of human rights protection.

Also,  beyond covert electronic surveillance, as noted, materials reflect data and information that can be obtained from open sources. Although there are no questions about the legality of obtaining such information, purposes of the processing such info are uncertain (for example, information on the party affiliation and preferences of Georgian citizens is processed).

Observation N5: The information leaked is likely to indicate a systematic nature of illegal surveillance

If the data leaked is deemed authentic, would be naïve to conclude that only a specific person or group of State Security Service employees are responsible for alleged illegal surveillance. It is clear that surveillance on such a scale is sanctioned by high-ranking officials, and that the processing of relevant information by allegedly illegal methods is a systemic practice of the State Security Service.

_____

[1] Paragraph 1 of Article 3 of the Law of Georgia on Legal Entity of Public Law - Operative-Technical Agency of Georgia.

[2] Paragraph 1 of Article 9 of the Law of Georgia on Legal Entity of Public Law - Operative-Technical Agency of Georgia.

[3] Article 11 of the Law of Georgia on Legal Entity of Public Law - Operative-Technical Agency of Georgia.

[4]Paragraphs “e”, “f” and “g”, “l”, “m” “n” of Article 2 of the Law of Georgia on Legal Entity of Public Law - Operative-Technical Agency of Georgia.

[5]According to theArticle 12 of the Law of Georgia on Legal Entity of Public Law - Operative-Technical Agency of Georgia, "Performing the tasks provided for in sub-paragraphs" A.a "-" A.e "of Article 7 of this Law, as well as" A.a "," A.c "," B "and" C "of the first paragraph of Article 8 of this Law, the exercise of the powers provided for in subparagraphs and subparagraphs "a" - "c" of paragraph 2 and Articles 9-11, shall fall within the exclusive competence of the Agency. It is inadmissible to create and function another state body with similar tasks and authorities on the territory of Georgia.

[6] We did not perform a detailed quantitative analysis of the unique objects of the surveillance, as we did not fully study the published materials.