Exposed: How Israeli Spies Control Your VPN

A new report uncovers the troubling ties between top VPN services like ExpressVPN and the Israeli security state, raising alarms about how much control Israel’s Unit 8200 has over your online privacy.

An estimated 1.6 billion people rely on VPNs to carry out the most sensitive tasks online, from watching illegal videos to engaging in sexual or political activities. But few people know that a considerable chunk of that market—including three of the six most popular VPNs—is quietly operated by an Israeli-owned company with close connections to that country’s national security state, including the elite Unit 8200 and Duvdevan Units of the Israeli Defense Forces (IDF).

Previous MintPress News investigations into Israel’s growing control over the tech industry have outlined how those units have been involved in many of Israel’s most outrageous hacking, surveillance and assassination programs, acting as spies and death squads. Unit 8200, for example, has been the source of much of the world’s most infamous spying software, includingCellebrite and Pegasus, the program used to snoop on tens of thousands of the world’s top politicians and journalists, including by Saudi Arabia, who used it to help track down and kill Washington Post columnist Jamal Khashoggi.

Given this context, justifiable fears arise that control over a vast VPN empire could add to Israel’s influence over the online information and security world, creating backdoors for Israeli intelligence to carry out a vast kompromat operation on users around the globe.

This investigation is part of a series highlighting and detailing the power of Israel’s growing tech industry to access and control people’s data.

A Company Like No Other

Kape Technologies is a major player in the online privacy world, one of the three giants that collectively control the market. It owns many of the world’s top VPNs, including ExpressVPN, CyberGhost, Private Internet Access, ZenMate, Intego Antivirus, and a host of tech websites that promote its products. Kape brands can be seen sponsoring a wide array of public figures, such as Tucker Carlson, Angry Video Game Nerd, Drew Gooden, Lex Fridman, Cody Ko, Uncle Roger, and Ben Shapiro.

“We are living in an era of tyranny,” Shapiro says in one video endorsing the company, adding:

The Internet is at the frontier of a battle for control. When powerful interests want to push their agenda, they get big government and big tech to silence any voice that doesn’t fit the narrative. Americans are being forced to give up the very thing that makes Americans great: our freedom of speech. Well, I don’t like my voice being censored, I also don’t like being monitored by big Tech and big government, that’s why I use ExpressVPN [and] you should do the same.”

VPN stands for virtual private network and is a service that claims to protect your anonymity online. Instead of giving your information to an internet service provider, you provide it to the VPN company, who will scramble it, allowing users to get around government censorship and carry out activities online that they do not wish to be connected to themselves, such as purchasing banned products, partaking in certain activities, and communicating with others. Therefore, individuals trust VPNs to conceal their most sensitive activities.

Although it is headquartered in London and employs more than 1,000 people worldwide, Kape Technologies maintains a distinctly Israeli flavor. This begins with its owner, Teddy Sagi. Born in Tel Aviv, the tycoon, who previously spent time in prison for financial crimes, is estimated to be worth $6.4 billion, making him among the top ten richest Israelis.

Sagi has a long history of working closely with the IDF and is rumored to be extremely close to Israeli intelligence. In 2019, he donated $3 million to fund hundreds of academic scholarships for discharged Israeli soldiers. “It is a debt of honor for us and for me personally to express gratitude and appreciation that all of Israel’s citizens owe to you,” Sagi said at the Friends of the IDF Gala. He also made a point of finding jobs for former IDF soldiers in his businesses.

Furthermore, at the height of its campaign against Gaza, the billionaire very publicly gave more than a quarter-million dollars to an IDF charity helping transport soldiers to and from the front.

While in Cyprus in 2021, he was the subject of an assassination attempt that Israel accused Iran of masterminding, only fueling further speculation about his proximity to the national security state. (Iran, for its part, has denied the charges.)

Kape Technology’s connections to the Israeli security services do not end there. Indeed, the company is teeming with Israeli intelligence officials.Company co-founder and longtime CEO Koby Menachemi began his tech career as a developer for Unit 8200, while Liron Peer, the company’s current head of accounting, also served three years in the controversial military unit. Meanwhile, Menachemi’s successor as Kape CEO, Ido Erlichman, is a veteran of Unit 217, the Duvdevan Unit, an elite commando group that carries out intelligence operations and assassinations against the local Arab population.

Poacher Turned Online Gamekeepers?

Before 2018, Kape Technologies was known as Crossrider and was often considered a malware company. Crossrider was a platform that allowed its clients to monetize their software by forcing ads in front of users’ eyes. Users’ computers, both PC and Mac, had their browsers hijacked, changing their homepages to a search engine not of their choosing to generate advertising revenue for the company. Although Crossrider did not produce malware or viruses, its platform was notorious for allowing third parties to distribute such malware worldwide.

Thus, few people in the tech community were impressed when it changed its name to Kape Technologies and pivoted towards online privacy and protecting the public from unscrupulous actors. Erlichman told a local Israeli outlet that the name change and rebranding were necessary due to the “strong association to the past activities of the company.” In other words, the group had built up such a bad reputation that a complete facelift was necessary.

In 2017, Crossrider/Kape purchased its first VPN—CyberGhost—for $10 million. It then went on a shopping spree, acquiring several well-known companies, including ZenMate in 2018 for $5.5 million, Private Internet Access in 2019 for $126 million, and ExpressVPN in 2021 for a reported $936 million—by far the world’s most costly VPN acquisition to date.

It also bought a host of VPN review sites, such as vpnMentor and Wizcase – platforms that purport to supply readers with expert information about which VPN would be best for them. vpnMentor insists that this considerable conflict of interest does not affect their ratings. “Everything we do at vpnMentor is centered around providing value through honesty, transparency, and dedication,” they write.

It is a remarkable coincidence that their award for the best three VPNs overall went to ExpressVPN, CyberGhost and Private Internet Access – all Kape Technologies products. In fact, ExpressVPN, CyberGhost and Private Internet swept the medal positions in every category: best VPN for torrents, for Windows, for Android, for Mac, for iOS, and for American users. Wizcase’s 2024 top 3 VPN recommendations also went to ExpressVPN, CyberGhost and Private Internet Access.

Indeed, when visiting the website ranking page, users are met with a gigantic popup ad for a special deal on an ExpressVPN subscription.

Express VPN Executive, a Former Spy

When using a VPN service, users place a large amount of trust in the VPN company itself. They must trust that it is effectively encrypting users’ traffic, securing their data and the server network infrastructure, and not doing anything else with the vast amount of sensitive information they are given. As noted previously, individuals and organizations use VPNs to carry out all manner of highly compromising activities online.

Unfortunately, Daniel Gericke, ExpressVPN’s chief technology officer (CTO) from 2019-2023, was deeply involved in such questionable practices. A Reuters investigation series revealed that Gericke was a key member of a team of spies that hacked the devices of human rights activists, journalists and government officials, stealing their data and passing it on to the government of the United Arab Emirates. The UAE used this data to track down dissidents and torture them, according to the investigation.

ExpressVPN hired Gericke (a former manager for weapons firm Lockheed Martin) after the Reuters exposé and continued to back him, even after the U.S. Department of Justice fined him $335,000 for his role in the clandestine operation. “Our trust in Daniel remains strong,” the company said in a statement. Gericke left ExpressVPN last summer after nearly four years with the company.

Both the Gericke hire and its sale to an Anglo-Israeli corporation with a more than questionable past led to an exodus of staff at ExpressVPN and raises many questions about what exactly this cyber-mercenary, who was under investigation by the U.S. government for stealing sensitive data from tens of millions of people and passing it on to a foreign government, was doing as an executive at ExpressVPN for all that time, especially with the company’s user data. “If you’re an ExpressVPN customer, you shouldn’t be,” concluded whistleblower Edward Snowden.

A Unit Like No Other

With his background as a former spy, Gericke likely fits well with many of the other top Kape Technologies leaders. Ido Erlichman, Kape CEO between 2016 and 2023, is a veteran of the Duvdevan, an elite Israeli commando unit. Described by Middle East news outlet Electronic Intifada as Israel’s “death squad,” members are given special training to disguise themselves as Palestinians in order to infiltrate enemy groups and carry out extrajudicial killings. Both the selection process and the training are exceptionally rigorous, and Duvdevan commandos often spend months or even years undercover before being assigned a mission.

The life and work of Duvdevan agents were explored and promoted in the Netflix series Fauda.

Unit 8200, meanwhile, is no less prestigious. Described as Israel’s Harvard, parents spend fortunes on extra classes for their children, who know that selection into the unit will unlock a wealth of doors in Israel’s burgeoning hi-tech industry.

But Unit 8200 is also the centerpiece of the country’s repressive state apparatus. It has created a gigantic digital dragnet that is used to constantly monitor, surveil and harass the Palestinian population, whose calls, emails and every move are clocked by the group.

Unit 8200 uses this data to compile gigantic dossiers of information on Palestinians under their control, including their medical history, sex lives, and search histories, so that it could be used later for extortion. If a particular individual needs to travel across checkpoints for crucial medical treatment, permission can be suspended until they comply with Israeli requests for dirt on their peers. Information, such as if a person was cheating on their spouse or was homosexual, is also used as bait for blackmail. One former Unit 8200 soldier said that as part of his training, he was assigned to memorize different Arabic words for “gay” so that he could listen out for them in conversations.

In 2014, 43 Unit 8200 reservists went public, revealing that the unit makes no distinction between ordinary Palestinians and those engaged in violence and that Palestinians as a whole are considered enemies of the state. They also claimed that their intelligence was passed on to powerful local politicians, who used it as they saw fit.

More recently, Unit 8200’s new project, Lavender, uses artificial intelligence to select targets for the Israeli military’s bombing campaign in Gaza. A “conservative estimate” published by the medical journal The Lancet suggested that 186,000 people have died since October 7 due to Israeli bombing. Some two million more people have been displaced.

Unit 8200 agents have gone on to produce many of the world’s most downloaded apps, including the maps service Waze and the communications platform Viber. Perhaps the most consequential, however, is the spying software Pegasus.

Pegasus was used to spy on more than 50,000 prominent individuals around the world, including politicians such as President Emmanuel Macron of France, Prime Minister Imran Khan of Pakistan, and President Barham Salih of Iraq. Journalists, human rights defenders and members of royal families were also targeted for surveillance. The Unit 8200 veterans sold Pegasus to some of the world’s most authoritarian governments. Indian prime minister Narendra Modi, for example, used the software to dig up dirt on his political opponents, while other members of his government hacked the phone of a woman who accused the Chief Justice of India of raping her.

Known purchasers of the software include the U.S. Central Intelligence Agency, as well as the governments of the UAE, Panama, and Saudi Arabia, who used the software to surveil Washington Post journalist Jamal Khashoggi before he was assassinated by Saudi agents in Türkiye. All sales of Pegasus had to be approved by the Israeli government, who ostensibly had access to the data Pegasus’ foreign customers were accruing.

Unit 8200 veterans have even created spyware VPNs before. In 2013, Facebook purchased Onavo Protect and later heavily promoted its product to its billions of users. However, Those who downloaded it were unaware that, far from being a privacy app, Onavo was being used to surveil them to help Facebook understand the market and crush its competitors. After the scandal was made public, Facebook removed Onavo from the app store, and, as of 2019, the product is defunct.

The Spies Controlling Your Social Media

Facebook’s collaboration with Unit 8200 goes far deeper, however. This author’s 2022 MintPress News investigation found that a vast number of Unit 8200 veterans had gone on to work in senior positions at Meta, Facebook’s parent company.

Chief among these is Emi Palmor, a longtime IDF veteran and former Director General of the Israeli Ministry of Justice. Palmor is one of 21 individuals sitting on Meta’s Oversight Board, the panel that ultimately controls the political direction of Facebook, Instagram and Threads, deciding what content is appropriate and what is unacceptable and should be suppressed. As such, a Unit 8200 veteran is influencing what content billions of users see – and don’t see – online, including, presumably, on Israel’s assault on Gaza, an issue on which Facebook has consistently favored Israel and silenced Palestinian voices.

The same investigation found at least 99 former Unit 8200 agents working at Google. These included Google’s head of strategy and operations, Gavriel Goidel; its head of insights, data and management, Jonathan Cohen; and Google Waze’s head of global self-service, Ori Daniel.

Microsoft, meanwhile, hired at least 166 Unit 8200 veterans to fill its ranks, including many that went straight from the military into the company, suggesting that it is actively recruiting from the regiment.

These numbers are certainly a serious underestimate, as, under Israeli law, revealing one’s current or previous affiliation to Unit 8200 is an offense. Therefore, those found were the ones brazen enough to defy Israeli law.

Is Your Identity Safe?

Internet secrecy is a serious business. Over a billion individuals trust VPNs to hide their identities online. However, the background of Kape Technologies, from its beginnings as an adware company spamming users with advertisements to its key figures’ close connections to Israeli intelligence, raises serious concerns about its clients’ privacy.

At best, a worrying set of conflicts of interest arises when giving your data to a company with such an ethical background. But given that many of the key figures highlighted here have close connections to groups such as the Duvdevan and Unit 8200, both of which carry out wide-scale spying operations, and ExpressVPN’s former CTO reportedly working to spy on users and pass that information on to foreign governments, one cannot rule out the possibility that this is a gigantic sting operation to gather data on vast amounts of individuals, akin to what Unit 8200 is already known to do.

While ExpressVPN, CyberGhost, Private Internet Access, ZenMate and other Kape Technologies products may well be safe to use, activists and revolutionaries—particularly those who work on issues such as Palestine—should at least know the company’s history before reflexively trusting it.

Feature photo | Illustration by MintPress News

Alan MacLeod is Senior Staff Writer for MintPress News. After completing his PhD in 2017 he published two books:Bad News From Venezuela: Twenty Years of Fake News and Misreporting and Propaganda in the Information Age: Still Manufacturing Consent, as well as a number of academic articles. He has also contributed to FAIR.org, The Guardian, Salon, The Grayzone, Jacobin Magazine, and Common Dreams.