The Factory: Unit 8200 and the Production Line

There is a building in Herzliya, Israel. From this building and its predecessors, the following companies emerged:

This is not a revolving door. A revolving door implies two separate buildings. This is a production line. The Israeli military trains offensive cyber operators. Those operators graduate into private companies. Those companies sell the military's capabilities — under export license from the same military. The government controls who buys. The government uses the sales as foreign policy leverage.

Israel used Pegasus sales to negotiate the Abraham Accords with UAE, Morocco, and Bahrain. The surveillance tool was the diplomatic gift. The buyers got spyware. Israel got normalization agreements. The targeted journalists and opposition figures got Pegasus on their phones.

The Product: What ISP-Level Surveillance Actually Looks Like

Read that list again. This is a product. It has a brochure. It was marketed at ISS World (the "Wiretapper's Ball") in Dubai. It has "strategic" and "tactical" deployment options like it's a field artillery system. And it handles SSH — the exact protocol our honeypot monitors.

FinFly ISP sits between your SSH client and the server. It doesn't need to break encryption — it intercepts before encryption or injects into the session. When our honeypot captures an SSH probe, that probe traversed the same ISP infrastructure that FinFly ISP targets. We measure the attacks. FinFly measures the defenders. Same pipe. Different invoices.

Eleven products. A complete surveillance ecosystem from physical proximity to ISP-level nationwide deployment. All from a single vendor. All marketed at trade shows. All sold to governments. All — every single one — now in the criminal ecosystem.

Because in 2014, someone leaked the source code.

The Leak: When Government Tools Become Everyone's Tools

The pattern is identical each time:

1. Government builds or purchases tool for offensive operations
2. Tool is used against targets (burning zero-days, exposing techniques)
3. Tool is leaked (employee, hack, WikiLeaks) or burns (vulnerability patched, technique documented)
4. Criminal ecosystem adopts the techniques within weeks to months
5. Techniques become permanent criminal capability — they cannot be recalled

The pipeline is a one-way valve. Export controls cannot recall source code that's on GitHub. Entity Lists cannot un-burn a zero-day. Sanctions cannot remove a technique from a criminal's toolkit once they've learned it. The surveillance vendor market is a capability diffusion engine — and diffusion, by definition, cannot be reversed.

The Personnel Pipeline: When Intelligence Officers Become Contractors

This is not theory. The DOJ prosecuted it. Three former US intelligence operatives — named, charged, convicted — transferred NSA offensive cyber capability to the United Arab Emirates. They built DarkMatter. DarkMatter became the UAE's domestic surveillance apparatus. Then the UAE also bought Pegasus from NSO, layering Israeli capability on top of the American foundation.

The DOJ prosecution proves the pipeline exists. But consider what it doesn't prove: that the pipeline has stopped. Three individuals were charged. The capability they transferred — the knowledge in their heads, the procedures they wrote, the systems they built — remains operational in Abu Dhabi. You cannot prosecute knowledge back into classified status.

The Domestication Pattern: How Israeli Weapons Become American Products

Read the timeline again. In five years, Paragon went from Israeli military product to American domestic law enforcement tool. The path:

1. Build in Israel — under military export license, with Unit 8200 talent
2. Incorporate in Delaware — now it's a US company on paper
3. Sell to US PE firm — now it's American-owned, American-controlled
4. Deploy domestically — ICE uses it against targets on US soil

At no point in this chain does an export control apply. Israeli export controls cover Israeli companies selling abroad. US companies using domestically acquired tools are not exporting. The surveillance capability has been laundered through corporate transactions — exactly like the IP address laundering documented in TI-2026-026 (Seychelles shells), except the asset being laundered is not an IP block but a weapons-grade surveillance tool.

The Market That Cannot Die

Five enforcement actions. Five vendors. Zero capabilities removed from the market.

FinFisher shut down — the source code is on the internet forever. NSO was Entity Listed — still selling to customers the US hasn't sanctioned. Intellexa restructured — same people, new name, different jurisdiction. Blue Coat was acquired for $4.65 billion by Symantec — the enforcement action was a liquidity event for shareholders. Hacking Team was renamed Memento Labs and kept operating.

The market is not just resilient. It is anti-fragile. Each enforcement action eliminates one name but not the capability, the personnel, or the demand. The demand is 180+ nation-states wanting to surveil their populations. That demand does not decrease because one vendor is sanctioned. It finds another vendor. Or creates one.

Where The Honeypot Meets The Brochure

Here is what connects a WikiLeaks PDF from 2011 to an SSH probe in 2026:

The $12 Billion Question

The global surveillance market is estimated at $12 billion and growing. Forty-plus vendors tracked by Google TAG alone. Products sold to 45+ countries. Deployed against journalists in 35+ documented cases. Used to negotiate diplomatic agreements (Abraham Accords). Acquired by private equity (Novalpina, AE Industrial Partners). Listed on stock exchanges (Kape/LSE).

This is not a shadow industry. It has annual reports.

And every year, its products leak, burn, or proliferate into the criminal ecosystem. The SSH probes our honeypot captures — millions per month — include techniques that were, five years ago, classified government capability. Five years from now, whatever NSO is selling today will be in criminal hands.

The surveillance vendor market is a negative externality engine running at $12 billion per year. The externality is the cybercrime wave. The victims pay the cost. The vendors collect the revenue. The cycle has been documented for a decade. Nobody with the power to stop it benefits from stopping it.

Cross-Investigation Map

Methodology

This investigation uses four evidence tiers:

• [OSINT-LIB] — Primary source: WikiLeaks Spy Files (1,063 chunks), Vault 7 (105 chunks), Google TAG Buying Spying 2024, EU Parliament Pegasus Investigation 2022, Apple vs NSO Complaint 2021
• [HONEYPOT] — SSH probe correlation: attack techniques matching documented surveillance vendor capabilities
• [LEGAL] — DOJ prosecutions (Project Raven), Apple vs NSO, Paris Court (Nexa/torture)
• [XREF] — Cross-reference to 13 related investigations in the corpus