Amesys / Eagle

Technical capabilities

Amesys developed the “Eagle” interception system, a national-scale Deep Packet Inspection and content-monitoring platform. Eagle ingests internet-backbone traffic, performs payload reconstruction for unencrypted protocols (HTTP, SMTP, POP3, FTP, instant-messaging clients of the late 2000s era), maintains target lists and provides analyst-facing search and replay across captured sessions.

The platform was designed for “lawful interception” at scale and was sold as a turnkey monitoring center to authoritarian governments. The technology stack predates pervasive HTTPS deployment and assumes a network environment with substantial cleartext traffic. Nexa Technologies and AMES have continued development of comparable systems since the 2014 corporate restructuring.

Documented use

Eagle is one of the most thoroughly documented commercial mass-surveillance systems sold to an authoritarian regime:

• Libya (2007 to 2011): Eagle was sold to the Gaddafi regime for an estimated 28 million euros. Wall Street Journal reporters discovered the installation manuals and target lists in the abandoned Tripoli monitoring center after the fall of Tripoli in August 2011. Targets included Libyan opposition figures, journalists, and exiles in the United Kingdom and the United States.
• Egypt (2014 onwards): Nexa Technologies and AMES sold the “Cerebro” interception system to the al-Sisi government for an estimated 10 million euros. Mediapart and Telerama published the contract documents in 2017.
• Reported Saudi Arabia, Qatar, Morocco and Kazakhstan deployments in subsequent journalism, with less court-document corroboration.

The French International Federation for Human Rights (FIDH) and the Ligue des droits de l’Homme (LDH) filed legal complaints in 2011 (Libya) and 2017 (Egypt) under French extraterritorial jurisdiction for crimes against humanity and complicity in torture.

Legal proceedings

French criminal prosecutions arising from the Eagle and Cerebro deployments are among the most advanced legal accountability proceedings against any commercial surveillance vendor:

• 2017: French prosecutors open formal investigation into Nexa Technologies for the Egypt deal.
• June 2021: Four Nexa Technologies and AMES executives indicted (mis en examen) by Paris prosecutors for complicity in acts of torture and enforced disappearance (Egypt). One additional executive indicted for complicity in acts of torture (Libya).
• 2023: French court rulings advance the Libya proceedings against Amesys / Bull SA legacy entities.
• 2024: Trial preparation continues. The case is the first in which executives of a Western surveillance vendor face criminal charges for complicity in human-rights violations.

Customer states and sanctions

Documented customers include Libya (until 2011 NATO intervention), Egypt (from 2014), with reported but less corroborated deployments in Saudi Arabia, Qatar, Morocco and Kazakhstan. Despite the indictments, neither Amesys, Nexa Technologies, nor AMES is on the US Entity List or designated by US OFAC. The European Union does not maintain an equivalent designation list for commercial surveillance vendors.

Technical countermeasures

• HTTPS Everywhere by default: Eagle and Cerebro depend heavily on cleartext payload reconstruction. Modern HTTPS deployment substantially reduces effectiveness.
• Tor Browser: defeats both classification and content reconstruction by Eagle-class systems.
• Signal end-to-end encryption: content cannot be reconstructed even if metadata is captured.
• WireGuard or commercial VPN to trusted endpoint: tunnels traffic out of the surveilled national backbone.
• Encrypted DNS: removes the DNS-query signal Eagle uses for target discovery.
• Compartmented communications identity: separate phone, email, and social identity from primary identity, particularly for activists and journalists.

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.