C is for Covert Collection — The Wiretap Became a Product

TI-2026-071C · Series: 🕰️ The Alphabet of Harm · Letter C · TLP:WHITE · 2026-07-09

The alphabet continues. A diffused downward into everyone; B refused to change at all. C does a third thing — it commercializes and spreads. Covert collection was an industry with a price list before it was a scandal, and being exposed, repeatedly and thoroughly, only made it grow. This is the letter about the harm that answers a leak by opening a new market.

📋 The Short Version

Covert collection is the interception of communications and data without the subject knowing. For most of its history it lived in the dark — a state capability, unspoken. Then, between 2011 and 2014, it did something almost no other harm in this alphabet did: it leaked its own sales brochures. The WikiLeaks Spy Files opened the filing cabinet of the lawful-interception (LI) industry, and inside was not a conspiracy but a catalog — a mature commercial sector with vendors, product lines, and price sheets for intercepting an entire nation's traffic.

One vendor, VasTech, advertised the service in four words: "Capture and Recording of All Traffic." Another, Septier, titled a sales deck, without irony, the "Dual Usage Strategy of Lawful Interception Systems." A third, VUPEN, listed "Exploits" as a product line, like a caterer listing canapés.

That was the wiretap in 2013: a box at the telephone exchange, sold to governments. In 2026 it is a remote, zero-click implant on the target's own phone — Pegasus, Predator, Candiru — sold not to a handful of intelligence agencies but to what the European Parliament called "a much wider global cyber mercenary industry." And at the very bottom of that same market, our own systems catch its cheapest possible descendant, running for free, every day.

Verdict: MUTATED. Covert collection was exposed as thoroughly as any harm in the archive — WikiLeaks, Citizen Lab, Amnesty, the EU Parliament, a US sanctions listing — and it did not shrink. It changed form (appliance to implant), changed market (a few states to a mercenary industry), and changed reach (down to the commodity floor). Same ethic, more forms, more buyers, more targets. Confidence: HIGH on the archived industry record and the present commodity collection we measure directly. MEDIUM on framing the criminal secret-harvest as a causal descendant of the LI industry rather than a parallel expression of the same collect-everything logic (§9). Scope note: lawful interception is genuinely lawful in many uses; the harm documented here is the dual-use design and the abuse it enabled, not interception as such.

1. The Word

Every other letter so far has had to be reconstructed — the archive gives a photograph and our systems supply the motion. Covert collection is different, and it is the reason C is one of the richest letters in the alphabet: the industry documented itself, and then someone published the documentation.

Understand what makes that extraordinary. Bulletproof hosts (B) advertise on criminal forums but keep no public ledger. APT actors (A) are reconstructed by their victims. The surveillance-interception industry, by contrast, is legitimate on paper — it incorporates in Israel, France, Germany, South Africa, the UK; it exhibits at trade shows (ISS World, the "Wiretapper's Ball"); it prints glossy brochures. It has to, because its customers are governments who want a warranty. And so, when the Spy Files leaked, they did not reveal a secret capability. They revealed a sector — with logos, datasheets, and the banal vocabulary of B2B sales applied to the most intimate possible product: the contents of a stranger's phone calls.

The word "covert" describes the target's experience, not the industry's. The collection is covert to the person collected. To the buyer, it is a purchase order.

2. The Catalog

Here is the industry as its own materials describe it — a product menu, drawn from the Spy Files vendors (Utimaco Safeware AG, VUPEN Security, VasTech, telesoft, Speech Technology Center, Septier, and dozens more):

Read that last row against the rest. In the same catalog that sells "Data Retention" and "Speech Recognition" — the sober language of telecoms compliance — a vendor lists Exploits as a service product, in the same font. That is the tell of the whole letter: the industry that presented itself as lawful interception was, from the beginning, in the business of breaking in. The compliance vocabulary and the offensive capability were always the same catalog.

And the word that recurs is "All." Capture and recording of all traffic. Not a warranted tap on a named suspect — the whole pipe. The collect-everything ethic was not a later abuse of these systems. It was the marketed feature.

3. The Dual-Usage Tell

If one document distills this letter, it is Septier Communication's brochure, whose title the vendor chose itself: "Dual Usage Strategy of Lawful Interception Systems."

The document diagrams passive interception probes sitting on 2G and 3G networks, feeding an "SLR Interception Server," with LI mediation, gray-VoIP detection, and data retention — architected, in its own words, to scale to "tens of thousands of insertions." Tens of thousands. Not the dozen active warrants a democracy's courts might issue in a year; a capacity built for population-scale monitoring.

"Dual usage" is the industry saying the quiet part in a sales deck. A lawful-interception system, sold to satisfy a country's legal-intercept obligations, is also — by design, as a marketed strategy — a mass-surveillance system. The "lawful" label was the packaging that made the export licensable and the purchase respectable. The architecture underneath did not care whether the insertion was warranted. It scaled to tens of thousands because the buyer wanted it to.

This is why exposure alone could never end the modality. You cannot shame an industry for a capability it advertised as a feature. The Spy Files did not catch the LI sector doing something it hid. They caught it doing exactly what its brochures promised — and the brochures were already public to anyone at the trade show.

4. The Exposure That Did Not Stop It

The alphabet promised a "caught" column, and covert collection has, in fact, the most crowded one in the entire series. This is a harm that has been exposed again and again:

• The Spy Files (2011-2014) — WikiLeaks published the industry's catalog.
• Vault 7 (2017) — WikiLeaks published a state's own implant toolkit (the CIA's), showing the same capabilities in government hands.
• Citizen Lab and Amnesty International — documented Pegasus and Predator infections on the phones of journalists, dissidents, and lawyers, technically, forensically, repeatedly.
• The EU Parliament (2022) — after a sitting MEP was targeted, opened a formal investigation naming "a much wider global cyber mercenary industry."
• US sanctions (2021) — NSO Group was added to the US Commerce Department's Entity List, a direct commercial penalty.

Set against A (indictments without arrests) and B (takedowns absorbed within weeks), this is a genuinely thick record of consequence. Real forensics, real parliamentary process, real sanctions.

And the industry grew anyway. Because its customers are states, and a state that considers a capability essential to its security does not stop buying it because a newspaper or a parliament disapproves. Exposure raised the reputational cost, sanctioned a leading vendor, drove some brands to rebrand — and the market expanded, because the demand behind it is the same permanent demand that keeps B alive: a buyer who will pay almost anything, and a supplier who will incorporate somewhere that lets them sell. Transparency is necessary. Against a state-funded market, it is not sufficient. The leak becomes, at most, a barrier the next entrant routes around.

5. The Mutation: From the Appliance to the Implant

Between the Spy Files and the present, the form of covert collection changed completely, and the change is the core of the MUTATED verdict.

The 2013 product was a box at the carrier. VasTech's "capture and recording of all traffic" meant physical appliances installed at a telecom's core, tapping the pipe. It required the cooperation (or compulsion) of the carrier, a monitoring center, racks of hardware. It collected everyone's traffic to find someone's.

The 2026 product is an implant on the target's own device. NSO Group's own 2021 report describes Pegasus as "a technology used by states and state agencies around the world to collect data from the mobile devices of specific suspected major criminals... We license it only to the law enforcement and intelligence agencies of sovereign states." Read the shift: the collection point moved from the network to the endpoint, from the carrier's rack to the victim's pocket. A zero-click Pegasus or Predator infection needs no carrier cooperation, no monitoring center — just a phone number and an unpatched flaw. The wiretap became a piece of software delivered over the air.

That is a profound miniaturization of power. The Spy Files appliance was heavy, visible, and required a state's telecom infrastructure. The implant is invisible, remote, and requires only money and a target. The capability did not merely survive exposure; it became lighter, more precise, and vastly more deniable — which is exactly what let it spread.

6. The Market: From a Few States to a Mercenary Industry

The second half of the mutation is the buyer. The Spy Files vendors sold to a relatively small set of national governments — the classic customer for a monitoring center is a state's signals-intelligence or interior ministry.

The implant changed the economics, and the economics changed the market. Google TAG's 2024 "Buying Spying" documents the present tier — Candiru, Cytrox (Predator), and peers — selling zero-day exploit chains and phone spyware, with operations observed from Italy and Kazakhstan to Egypt. The EU Parliament's phrase is the precise one: no longer a handful of vendors serving a handful of agencies, but "a much wider global cyber mercenary industry."

This is the exact arc letter A traced for offensive capability — the "Buying Spying" crack in the wall — running in parallel for surveillance. Nation-grade covert collection became a commercial product, and once something is a product, its buyer base is defined by budget, not by sovereignty. The result was documented over and over: spyware bought by governments and turned not on "suspected major criminals" but on journalists, opposition politicians, lawyers, and — the moment that forced the EU's hand — the Parliament's own members. The commercialization did not just widen the market; it widened the target set, from the state's declared enemies to the state's inconvenient critics.

6b. Who It Was Actually Pointed At

The industry\u2019s own language names its target as \u201csuspected major criminals.\u201d The forensic record names someone else. What the caught column of \u00a74 documents \u2014 Citizen Lab, Amnesty International\u2019s Security Lab, the EU Parliament\u2019s inquiry \u2014 is a consistent pattern of the collection being turned not on terrorists but on journalists, human-rights lawyers, opposition politicians, and the family members of dissidents. The forensic reports are specific and technical: infected iPhones recovered and analysed, the same implant found on the phones of people whose only common trait was that a government found them inconvenient.

This is the part of the letter that requires no interpretation, only the record. We do not judge the buyer here; we state what the vectors and the forensics show, and we leave the judgment to the reader \u2014 which is the whole posture of this alphabet. But it is the fact that turns covert collection from a technical modality into a harm with victims. The Spy Files vendor sold \u201clawful interception.\u201d The documented use, again and again, was the surveillance of the people a rule-of-law state is supposed to protect: those who report on power, litigate against it, or run against it. The gap between the \u201clawful\u201d label and that documented use is not a footnote. It is the entire moral content of the letter, and it is why \u201cexposure without consequence\u201d (\u00a74) is not an abstraction but a running cost paid by specific, named people.

7. The Floor — What We Actually Catch

Our own systems do not intercept Pegasus, and this letter does not pretend they do. But the market covert collection became does not stop at the mercenary tier. It runs all the way down to a floor our sensors sit directly on — and there, the same ethic is running for free.

The secret harvest (dossier 059A) is what covert mass collection looks like at the bottom of the price curve: 1,025 IPs sweeping 2,117 distinct secret-file paths — every variant of /.env, /.git/config, /.aws/credentials, cloud service accounts, AI keys — across the entire internet, indiscriminately, at machine speed, from disposable hyperscaler compute. No warrant, no vendor, no monitoring center. Just a script that collects every exposed secret it can reach, from everyone, quietly.

Hold the two ends of the market together:

• The ceiling: a sovereign state pays millions for a Pegasus license to collect one dissident's phone, quietly.
• The floor: a commodity crew pays nothing to run a harvester that collects everyone's leaked credentials, quietly.

VasTech's "Capture and Recording of All Traffic" and the commodity harvester's capture-and-recording of all secrets are the same sentence at opposite ends of the budget. The tool is unrecognizably different — a nation-state appliance versus a Python loop. The ethic is identical: take everything, without the subject's knowledge, because collection is cheap and someone will find a use for the haul. Covert collection did not just mutate upward into the implant. It sank downward into the ambient scan, and our wire is where we watch it land.

8. The Verdict

Set the archive beside the wire and the shape is neither A's diffusion nor B's stasis. It is metastasis.

• Did it end? No — despite the most thorough exposure record in the alphabet (Spy Files, Vault 7, Citizen Lab, EU Parliament, sanctions), the industry grew.
• Was anyone caught? More than anywhere else in this series — real forensics, a parliamentary inquiry, a US Entity List designation. And it was absorbed, because the customer is a state.
• What did it become? Everything, at every price. The appliance became the implant; the few state buyers became a mercenary market; the collect-everything ethic sank to the commodity floor our systems catch.

Verdict: MUTATED (and metastasized). C gives the alphabet its third pattern. A showed a harm diffusing downward until it was ambient. B showed a harm holding its form for two decades. C shows a harm commercializing outward — answering every exposure not by contracting but by finding a new form, a new buyer, a new floor. The three patterns are the alphabet's grammar: read which one a modality follows, and you know where to look for its present-day self. For covert collection, you look everywhere at once — in a sovereign's implant, in a mercenary's product line, and in the dumbest scan hitting your /.env right now.

There is a hard truth underneath the verdict, and it is worth stating plainly because the rest of the alphabet will keep returning to it. Collection is cheap, and getting cheaper, at every tier. A state that once needed a monitoring center now needs a phone number; a criminal who once needed a botnet now needs a wordlist of secret-file paths. When the cost of taking everything falls toward zero, the only remaining brake on covert collection is not technical difficulty — that brake is gone — but rules about what may be done with the haul. And rules, as A and B both showed, are exactly the thing this whole archive records being written and then not enforced.

9. Method Note — The Honest Limits

Three limits, stated directly.

First, lawful interception is genuinely lawful in many uses. A warranted tap on a named suspect, overseen by a court, is a legitimate and necessary function of a rule-of-law state. Nothing in this letter argues that interception is inherently a harm. The harm documented here is specific: the dual-use design that scales a warranted capability to "tens of thousands of insertions," and the documented abuse of that capability against journalists, dissidents and legislators. The modality's harm is the gap between "lawful" as a label and "lawful" as a constraint.

Second, the floor is an analogy, held honestly. The commodity secret-harvest shares covert collection's ethic — indiscriminate, unconsented, mass collection — but it is not proven to descend from the LI industry. It is far more likely a parallel expression of the same logic (collection is cheap, so collect) than a causal heir of VasTech. The strong claim is that the ethic generalized to every budget; the genealogy is held at MEDIUM.

Third, we hold the archive and catch the floor; we do not catch the ceiling. This corpus can quote the Spy Files and measure the secret-harvest. It cannot, from a honeypot, observe a Pegasus infection. The mercenary tier of this letter rests entirely on the external record — NSO's own report, the EU Parliament, Google TAG, Citizen Lab — cited as such. As always: the vectors tell the truth about what strikes our wire. For what strikes a dissident's phone, we defer to those who forensically caught it, and name them.

Investigation Metadata

Cross-references: TI-2026-071A (A is for APT — the parallel "Buying Spying" democratization) · TI-2026-071B (B is for Bulletproof — the companion CONTINUES verdict) · TI-2026-059A (The Secret Harvest — the commodity floor of covert collection) · TI-2026-035C (The Surveillance Vendors — prior LSN Spy Files coverage) · TI-2026-027E (Surveillance for Sale).