A is for Amesys — The Vendor That Named Its Own Line

The Alphabet of Actors — Letter A. A companion series to The Alphabet of Harm. Where the first alphabet named modalities, this one names actors and vendors: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED.

The first alphabet ended on zero-accountability: attribution grown world-class, consequence chronically absent, the named party who is identified perfectly and touched not at all. It is the right note to have ended on, because it is true of almost the entire field. So it matters how the second alphabet opens — and it opens, deliberately, on the exception. Not because the exception undoes the rule, but because the one case where naming reached a courtroom is worth studying precisely for how rare, how partial, and how slow it was.

The exception is a French company called Amesys, and its opening act was to do the prosecution's work for it. Most of this field hides behind the language of legitimacy — 'lawful interception,' 'targeted collection,' 'solutions for public safety.' Amesys, in a presentation dated October 2008, chose a different title for its own capability: From Lawful to Massive Interception: Aggregation of Sources. The line that every other vendor euphemises — the crossing from targeted, warrant-scoped interception of a suspect to population-scale surveillance of everyone — Amesys named, in its own slide deck, and offered as a feature to buyers. When a company writes the indictment into its marketing, the question of intent is settled before any court convenes.

This dossier takes the leaked Amesys record, carries it to what the LSN wire and entity graph see of that modality today, and closes with a verdict that is, for once in this series, not entirely bleak.

1. The Actor: a vendor, a product, and a named line

Amesys was a French technology firm — later part of the Bull group, its surveillance business eventually sold and continued under the name Nexa Technologies. Its flagship was EAGLE, and EAGLE's nationwide configuration was called GLINT. The Spy Files leaked its brochures and, more damningly, its operator manuals, and together they describe not a targeted tap but a system for turning a country's communications into intelligence reports.

Read the marketing and the line Amesys named in 2008 is everywhere in the product. The GLINT brochure is titled, without embarrassment, Strategic Nationwide Interception Based on Eagle Core Technology. The index tag Amesys assigned this class of product in its own catalogue reads, in the leaked files, STRATEGIC MASSIVE. Nationwide is not an exaggeration a critic applied; it is the design target the vendor advertised. The unit of surveillance is not the suspect. It is the nation.

And the Critical System Architect brochure describes the human workflow with a candour that is, in retrospect, extraordinary. EAGLE is 'a unified system' fed by probes that 'remain passive, invisible and unreachable for any intruders.' The operator, it says, 'listens to the voice calls, reads the interception intercepts, makes the transcription and writes the intelligence note to the authority' — and does all this from 'a very simple screen' for which 'the necessary know-how is very limited.' Sit with that last clause. The selling point is that turning a nation's private communications into intelligence dossiers for a state authority requires almost no skill. Mass surveillance, democratised into a point-and-click console. That is not a capability a vendor stumbles into. It is one it engineers, brochures, and names.

2. The Instrument: what EAGLE actually did, in its own manual

Brochures flatter. Operator manuals do not — they are written for the person who has to run the machine, and they describe exactly what the machine does. The leaked EAGLE GLINT Operator Manual, reference EAGLE/MAN-EAGLE-OPERATOR, version 1.0, dated 19/03/2009, is the document that turns the marketing into fact.

Its section on the CATEGORIES OF INTERCEPTION lists what an operator can select between: Mail, Chat, HTTP, VoIP, Search-Engine, and Transfer. This is the whole texture of a person's online life — their email, their instant messages, the pages they read, their voice calls, the terms they searched, the files they moved — reconstructed per target and laid out in tabs on a screen. It is not sampling. It is not metadata alone. It is content, across every common protocol of the era, presented for reading and transcription.

The companion extras manual shows the granularity beneath each intercept. Every one carries a unique hexadecimal identifier, a precise timestamp in UTC, and full TCP information — source and destination IP address and port. And, the manual notes, 'by moving the mouse over every IP address, a Geolocalization popup window appears with the accurate coordinates.' Point at an address, see a place on a map. This is the layer that matters most for what comes later in this dossier, because it is the layer that does not depend on reading content at all: the who, the whom, the when, the where. In 2009, Amesys shipped it as a mouse-over.

Set the manual beside the first alphabet and the lineage is exact. EAGLE's operator — select a category, read the reconstructed communications of a target — is the commercial ancestor of the query layer that Letter X (XKeyscore) named at nation-state scale. The intelligence agency's needle-finder and the commercial vendor's console are the same instrument. Amesys simply sold it to whoever could pay.

The 2008 title's second half deserves its own attention, because it names the mechanism that makes a nationwide console possible: Aggregation of Sources. A single probe on a single link sees only that link. What turns scattered taps into a picture of a nation is fusion \u2014 pulling the fixed-line intercept, the mobile (GSM) intercept, the internet DPI feed, the call-data records and the geolocation into one correlated view of one person, and then repeating that for everyone. The Spy Files show Amesys did not do this alone; EAGLE sat in an ecosystem of suppliers \u2014 DPI engines like QOSMOS, proxy appliances, GSM interceptors \u2014 whose outputs it aggregated. That is the same architectural move the LSN entity graph makes when it fuses a source IP, an SSH client fingerprint and a reused key into a single operator identity. Aggregation is the primitive; the only variables are the corpus it is pointed at and whether anyone consented. EAGLE pointed it at a population. The distance between EAGLE and a legitimate fusion system was never the fusion. It was the target and the warrant, and in Libya there was neither.

3. The Deployment: the euphemism becomes a room in Tripoli

'Nationwide interception' is an abstraction until you can point to the nation. For Amesys, you can. EAGLE was sold to Muammar Gaddafi's Libya, and when the regime fell in 2011, the abstraction resolved into a specific place: journalists documented Amesys equipment and manuals inside a Tripoli internet-monitoring centre that had been used against opponents of the regime. WikiLeaks published the EAGLE GLINT manuals in the Spy Files on 1 December 2011. The room was real. The manuals in it were real. The people surveilled from it were real, and they were not terrorists or criminals in any sense a court would recognise; they were dissidents, opponents, journalists — the standard target set of an authoritarian state handed a nationwide interception console.

This is the factual foundation, and it must be kept separate from everything that came after it, because the facts are settled and the law is not. What is documented: the equipment existed, it was Amesys's, it was in Libya, it was found. That much is not in dispute. It is the bedrock beneath the legal process, and it is why the legal process was possible at all — you cannot take a vendor to court over a capability, only over a deployment, and the deployment here was concrete enough to find in a building.

The Libya case is the clearest single instance of the gap that runs through the whole commercial-surveillance trade: the distance between the brochure word 'lawful' and the actual use. 'Lawful interception' is lawful only relative to the law of the buyer, and the buyer was a dictatorship. The word did no work except to launder the sale.

4. The Accountability: stated as exactly what it is

Here the dossier must be scrupulous, because this is the part that makes Amesys worth opening a series with, and it is also the part most easily overstated. The standard of this work is a bright line between adjudicated fact and pending allegation, and it will be held.

The facts. French human-rights organisations — FIDH and LDH — filed a complaint over the Libya deployment. A French judicial investigation was opened. Amesys's surveillance business was sold and continued as Nexa Technologies, which in later years supplied a comparable system to Egypt. These are matters of public record.

The allegations, which are not facts and must not be written as if they were. In 2021, French investigating judges placed several executives under formal investigation — a mise en examen — for complicity in acts of torture, connected to the Libya deployment and, separately, to the Egypt sale by the successor company. A mise en examen is a formal charge within an ongoing investigation. It is not a conviction. It is not a finding of guilt. The individuals named are entitled to the presumption of innocence, the proceedings are unresolved, and as of this writing no verdict has been entered against them. Anyone reading this should hold those two facts together: charges exist, and guilt has not been established.

What is remarkable, then, is deliberately not a punishment, because there has been none. It is that the naming did not stop at the naming. In almost every other entry this field could write — the indicted APT operators beyond extradition, the spyware vendors who rebrand, the honeypot's operator who returns the next day — the sequence ends at attribution. Here, uniquely, it reached a judge. Not a sentence. A judge. That the bar for 'remarkable' is set that low is itself the finding of the first alphabet, restated: consequence is so rare that its mere procedural beginning is the exception worth studying.

5. The Bridge: what the LSN systems see of EAGLE's kind today

The Alphabet of Actors is still a bridge series. Each named actor is carried to what the LSN sensors and the entity graph catch of its modality now — and for Amesys the bridge is a double ending, because the vendor met two fates at once and neither is total.

The first ending is technological, and it is the one the LSN wire measures directly. EAGLE's content categories — Mail, Chat, HTTP, VoIP — all assume plaintext crossing the network, readable by a passive probe. On the LSN observation point, about 98.5% of traffic is now TLS-encrypted. That single fact obsoletes the entire content-interception layer EAGLE was built around: you cannot read a TLS-wrapped email or chat off the wire in 2026, however passive and invisible your probe. The frightening half of EAGLE — the reading of what people wrote — was killed not by a court but by the encryption wave the first alphabet documented in Letters N and X. The technology aged into uselessness on its own terms.

But the second half did not die, and this is where the geolocation mouse-over of the 2009 manual returns. The metadata EAGLE captured — source and destination IP, port, timing, location — is not content, and TLS does not hide it, because routing requires it in the clear. That surviving layer is precisely what the LSN entity graph is built from: roughly 943,811 entities correlated by exactly the addresses and fingerprints EAGLE's operators once read off a popup. The metadata half of Amesys's system is not obsolete. It is the state of the art, and this platform runs a version of it.

And the content half migrated rather than vanished. When encryption closed the wire, content surveillance moved to the endpoint — to spyware like Pegasus and FinSpy that reads the message on the device, before it is encrypted or after it is decrypted, where EAGLE's passive probe can no longer reach. The EU Parliament's own Pegasus inquiry describes the shift plainly: as communications encrypt, agencies 'tend to rely on equipment interference' — hacking the endpoint — instead of the wire. Amesys's function did not end. It changed address, from the network to the phone.

The reflexive point is unavoidable and this series does not dodge it: the surviving, state-of-the-art half of Amesys's system \u2014 metadata aggregation into a per-actor picture \u2014 is a thing this platform also does. The LSN entity graph correlates the same addresses, ports and fingerprints EAGLE's operators once read off a geolocation popup, and fuses them into named operator identities exactly as GLINT fused sources into named targets. The machinery is kin. What separates the honeypot's graph from EAGLE is the whole content of the first alphabet's closing argument: the corpus is adversary infrastructure that attacked first, not a civilian population; the purpose is disclosed and the output is published TLP:WHITE, not tasked in secret for a state; and there is no authority receiving an 'intelligence note' about a dissident. The instrument is genuinely similar; the governance is the entire difference. Naming Amesys honestly requires naming that likeness, because a register of actors written by an actor that pretended it held no comparable tool would be worth nothing.

6. The counter-narrative, steelmanned

The case for Amesys — and for the trade it belonged to — deserves its strongest form.

Lawful interception is a genuine and legitimate function. Every democratic state intercepts communications under warrant, and the vendors who build the equipment to do it lawfully are not, in the general case, criminals; they are contractors serving a legal need. Amesys, on this account, built a tool with legitimate uses, sold it under the export-control regime that existed at the time — which did not clearly prohibit the Libya sale when it was made — and cannot fairly be held to a standard invented afterward. The operator who misused it was the Libyan state, not the French engineer; blaming the toolmaker for the tyrant's use is like charging a locksmith for a burglary. And the executives now charged are entitled, really and not just formally, to the presumption of innocence; a mise en examen in the French system is an early procedural step that frequently ends without trial, and treating it as a verdict would be exactly the kind of unearned certainty this series refuses.

Much of that holds, and the dossier has tried to honour the parts that do — especially the presumption of innocence, which is not a technicality but the whole point of the bright line drawn above. Where the steelman weakens is at its own foundation, and Amesys weakened it in 2008. The locksmith analogy assumes a neutral tool put to an unforeseen use. But a company that titles its product presentation From Lawful to Massive Interception has told you it foresaw the use; it did not build a lock and discover a burglar, it advertised the burglary as a feature and marketed 'nationwide' capability to states whose only use for nationwide interception is the surveillance of their own populations. The export regime did not clearly forbid the sale — true, and that is an indictment of the regime, not an exoneration of the seller, and it is precisely why the naming-to-courtroom sequence in this case matters: it is the system, slowly, trying to build the accountability the export controls lacked. The strong version of the defence protects the individuals, rightly, and leaves the conduct of the firm exactly where its own slide deck put it.

7. Verdict — REBRANDED, and CHARGED

Amesys named the line the whole field pretends not to see, built the console that crossed it, sold it to a dictatorship, and was found out when the dictatorship fell. That much is the record, and the record is not in serious dispute.

What became of it is the double ending. The company, as Amesys, is gone — the surveillance business rebranded to Nexa Technologies and carried the same idea to new buyers, which is the field's usual answer to exposure: not cessation, but a change of name. So the first half of the verdict is the ordinary one, the one almost every letter of the first alphabet would have written: REBRANDED. The tool outlived the name.

But the second half is the rare one, and it is why Amesys opens this series rather than sitting anonymously inside it. Alone among the actors this register could have started with, Amesys carries a second word, and it has to be written with all the care its subjects are owed: CHARGED — not convicted, not sentenced, the individuals presumed innocent and the case unresolved, but charged, in a real court, by real investigating judges, over a real deployment found in a real room in Tripoli. In a field whose defining condition is that consequence never arrives, the mere arrival of the question of consequence — before a judge, with the vendor's own marketing entered into the record — is the exception worth opening on.

The first alphabet asked who watches the wielder, and answered: almost no one. The second alphabet begins by naming the almost. That is not much. In this field, it is nearly everything.

The Alphabet of Actors begins. Verdict: REBRANDED, and CHARGED (charges unresolved; presumption of innocence intact). Confidence: HIGH on the product, the deployment and the technological bridge — drawn from Amesys's own leaked manuals and brochures in the WikiLeaks Spy Files and measured against the LSN wire (~98.5% TLS) and entity graph. MEDIUM, and explicitly flagged, on the legal thread, which is stated as pending allegation and not adjudicated fact. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges, and here, for once, so may a court.