TI-2026-039B — The Surveillance Market: From Palestine to Your Pocket

Series: TI-2026-039 "The Ghost Network" · Letter B · Published June 23, 2026
Classification: PUBLIC · Sources: EU Parliament PEGA Committee, Apple v. NSO Group (2021), Google TAG "Buying Spying" (2024), "The Palestine Laboratory" (Loewenstein), "The Walls Have Eyes" (Molnar), "The Weapon Wizards" (Katz & Bohbot), LSN honeypot, LSN OSINT library (136K documents)

I. The Pipeline: Military → Private → Criminal

Every major commercial surveillance vendor follows the same lifecycle:

II. "The Harvard of Counterterrorism" — Testing on Palestinians

Elbit Systems won a contract for the US-Mexico border wall surveillance system. The technology deployed there was the same technology tested on Palestinians at West Bank checkpoints. This is not coincidence — it is the business model. Palestinians are the testing ground; the world is the market.

III. The Scale: What Google TAG Documented

In February 2024, Google's Threat Analysis Group published "Buying Spying" — the most comprehensive public accounting of the commercial surveillance vendor industry. Key findings:

Google found that CSV vendors are now responsible for 50% of known zero-day exploits used against Google products. Not nation-states directly — their private-sector cutouts.

IV. The European Parliament's Verdict

The PEGA Committee's findings are damning: EU member states purchased Israeli surveillance technology and used it against their own citizens. This is not a foreign threat — it is domestic deployment of foreign-developed weapons, tested on an occupied population, sold to democratic governments that then turned them on their own democracy.

V. Apple v. NSO Group: The Court Record

VI. The Honeypot Connection: Same Infrastructure, Different Payloads

Our honeypot observes attacks from the same ASN infrastructure that hosts commercial surveillance operations:

The "7-to-51" anomaly persists: IPs directly registered in Israel (7 IPs, 0 hits) never attack. IPs operated by Israeli nationals through European shells (36 IPs, 951 hits) attack constantly. The separation is absolute and intentional.

Note: The Israeli ISPs (Partner, Cellcom, Pelephone) — all three major Israeli mobile carriers — appear in our threat intelligence database with elevated threat scores but zero honeypot hits. They are indexed because they appear in third-party threat feeds. They do not directly attack SSH infrastructure. The attacks come exclusively through the European shell companies (Pfcloud, registered in Bavaria by an Israeli national).

VII. The Commercial Surveillance Vendor Ecosystem Map

All Israeli. All Unit 8200-linked (directly or one degree removed). All serving the same function: converting military intelligence capability into commercial product. The only difference between NSO and Pfcloud is the tier of customer. NSO sells to governments. Pfcloud hosts criminals. The network infrastructure is interchangeable.

VIII. The Economic Model: How Palestine Subsidizes Global Surveillance

Israel's defense exports totaled $12.5 billion in 2022 — the highest ever recorded. Of this, cyber and intelligence products represent an estimated $3-5 billion annually. The development costs for these products are subsidized by:

1. Compulsory military service — 3 years of unpaid R&D by every Israeli citizen
2. Captive test population — 5 million Palestinians under varying degrees of surveillance, used as a live testing environment
3. US military aid — $3.8 billion annually (2019-2028 MoU), freeing domestic budget for offensive R&D
4. Export revenues recycled into R&D — creating a self-sustaining loop where surveillance income funds more surveillance development

This is not metaphor. It is the documented business model described by Loewenstein, confirmed by the EU Parliament, and litigated in US courts. Palestinians pay with their freedom. The world pays with its privacy. Israeli companies profit from both.

IX. Where the Lines Converge: Surveillance Infrastructure = Criminal Infrastructure

X. The Doppelgänger Problem: Same Pipes, All Sides

The Russian "Doppelgänger" disinformation campaign (2022-present) used the same upstream providers (aurologic GmbH) that serve Pfcloud/OMEGATECH. This means:

• Russian state disinformation operations → route through German ASNs → same upstream as Israeli bulletproof hosting
• Israeli commercial surveillance → route through European shells → same jurisdictional arbitrage as Russian ops
• Criminal infrastructure (ransomware, C2, SSH scanning) → same networks as both of the above

This is not a conspiracy — it is network economics. There are a finite number of "abuse-tolerant" upstream providers. aurologic GmbH (AS30823) is one. They serve all comers because, as their CEO stated: "I can kick everyone out but then I won't make any sales."

The implication: when you let one category of malicious activity use your infrastructure, you let all categories use it. There is no "good" bulletproof hosting. There is no "ethical" upstream for surveillance operations. The pipes don't discriminate.

XI. The Manufacturing of Consent for Surveillance

XII. The Science of Coercion: From Radio to Rootkits

The trajectory from 1950s psychological warfare research to 2026 commercial surveillance is direct:

The scale grows. The accountability shrinks. The 1950s required a Congressional committee to expose. The 2020s require a honeypot running on a refurbished Dell workstation.

XIII. RAND's Framework: Hostile Social Manipulation

The RAND report documents "psychological operations social media" forces — military units specifically tasked with social media manipulation. These operations use the same bulletproof hosting infrastructure we observe attacking our honeypot. The same Pfcloud ASN that hosts Mishayev's criminal operations could host a psyop campaign server. We would see the same SSH probes. The payload behind them might be ransomware or it might be democracy erosion.

XIV. What Edward Snowden's Archives Predicted

XV. The Conspiracy That Isn't: Logical Consequences of Documented Facts

XVI. What We Can Prove vs. What We Cannot Ignore

What we can prove (HIGH confidence — direct evidence):

• Daniel Mishayev is Israeli (ORG-DM262-RIPE, country=IL)
• Pfcloud UG is registered in Bavaria (HRB 12249, District Court Passau)
• AS51396 provides transit for AS202412 (OMEGATECH) and AS205759 (GHOSTYNETWORKS)
• OMEGATECH hosts 67 C2 servers for 16 malware families (Recorded Future)
• Our honeypot records 951 attacks from this ecosystem
• NSO Group sold Pegasus to 22+ EU end-users in 14+ member states (EU Parliament)
• Unit 8200 alumni founded NSO, Cellebrite, Candiru, Intellexa (founders' bios)
• Kape Technologies owns ExpressVPN, PIA, CyberGhost AND vpnMentor review site
• Bright Data operates 150M+ proxy nodes via SDK in consumer devices

What we cannot prove but cannot ignore (MEDIUM confidence — pattern evidence):

• Whether Mishayev has active connections to Israeli intelligence (pattern matches but no direct evidence)
• Whether the "7-to-51 anomaly" reflects deliberate operational security or coincidental geographic distribution
• Whether specific GHOSTYNETWORKS operations serve intelligence collection vs. purely criminal objectives
• The full extent of overlap between commercial surveillance infrastructure and criminal infrastructure
• Whether regulatory gaps are maintained deliberately or through lobbying-induced paralysis

XVII. The Defense Paradox

We publish this article on a server. That server connects to the internet. That internet routes through infrastructure controlled by the entities we are exposing. The submarine cables carry our forensic analysis alongside Pegasus payloads. The DNS system that resolves our domain is the same system that resolves C2 servers.

We are inside the system we are documenting. Every reader of this article has their connection logged somewhere. Every researcher who follows these links leaves a trail. The surveillance infrastructure does not pause for journalism.

And yet — we publish. Because the alternative is silence. And silence is the operating condition the surveillance market requires to function. Every Pegasus infection depends on the target not knowing. Every proxy SDK depends on the user not reading the EULA. Every bulletproof hosting operation depends on the investigator not following the money.

So we follow the money. We trace the ASNs. We run the honeypot. We index the documents. We name the names.

The surveillance market exists because information asymmetry is its product. The antidote to information asymmetry is publication. We are the antidote. This is what freedom looks like in 2026: a refurbished workstation, a Cowrie honeypot, 136,617 indexed documents, and the willingness to name what the evidence shows.

XVIII. Indicators of Compromise

TI-2026-039B · The Surveillance Market · Letter B
Published by LSN Threat Intelligence · June 23, 2026
Sources: EU Parliament PEGA Committee (2022), Apple v. NSO Group (N.D. Cal. 2021), Google TAG "Buying Spying" (2024), "The Palestine Laboratory" (Loewenstein 2023), "The Walls Have Eyes" (Molnar 2024), "The Weapon Wizards" (Katz & Bohbot 2017), "Manufacturing Consent" (Chomsky 1988), "Science of Coercion" (Simpson 1994), RAND "Hostile Social Manipulation" (2019), NSA/FRA Intel Paper (2013, Snowden archive), "The Secret History of the Five Eyes", LSN threat_intel PostgreSQL, LSN Cowrie honeypot
Cross-referenced: TI-2026-039A, TI-2026-034B, TI-2026-038D-F