Bulgaria approved the export of surveillance equipment to authoritarian governments.

      **TL;DR** Leaked export licenses reveal that Bulgaria authorized Circles BG, an affiliate of NSO Group, to sell phone-tracking and interception technology to intelligence agencies in Azerbaijan, Serbia, the UAE, and over a dozen other countries from 2018 to 2023. The findings, released by Human Rights Watch, raise concerns about the effectiveness of EU dual-use export controls.

      Bulgaria’s export control authority granted a Sofia-based surveillance company permission to sell phone-tracking tools, interception systems, and monitoring infrastructure to intelligence agencies in countries known for suppressing dissent. The licenses, published by Human Rights Watch on Wednesday, detail exports from Circles BG to government entities in Azerbaijan, Serbia, Malaysia, Mexico, the UAE, and at least ten other nations between 2018 and 2023.

      Circles is affiliated with NSO Group, the Israeli firm responsible for the Pegasus spyware that has been employed against journalists, politicians, and human rights defenders globally. The leaked licenses provide a clearer view of how the company leveraged its Bulgarian operations to export surveillance technology to governments accused by international watchdogs of using such tools against their own citizens.

      ### The Circles-NSO Connection

      Circles was acquired in 2014 by a company that also owns NSO Group, consolidating both under the Q Cyber Technologies umbrella. In 2020, the University of Toronto’s Citizen Lab identified Circles as operating surveillance systems that exploited vulnerabilities in global telecommunications networks across at least 25 countries.

      Tal Dilian, one of Circles’ co-founders and a former Israeli military intelligence commander, was sanctioned by the United States in March 2024 due to his involvement with Intellexa, a surveillance consortium he established. Intellexa developed the Predator spyware, which led to Greece’s 2022 "Predatorgate" scandal, resulting in a conviction for Dilian and three others in February 2026, each receiving an eight-year prison sentence.

      The licenses also highlight direct commercial connections between Circles and NSO Group. In October 2021, NSO purchased equipment valued at $119,941 from Circles, which was later transferred to the Israeli Ministry of Defence’s Home Front Command.

      Shortly after, NSO Group was added to the US Commerce Department’s Entity List due to allegations of its spyware being used to target civil society. Despite its corporate ties to NSO, Circles BG is not included on any US sanctions or export-control blacklists.

      ### Who Bought What

      The export documents specify certain government agencies and the equipment they acquired. Azerbaijan’s Foreign Intelligence Service obtained Dell server and storage infrastructure worth over $42,000 with a license issued in June 2022, along with a mobile phone tracking system to determine device locations.

      This tracking license was valid until December 2023, during which Azerbaijan launched its military campaign to reclaim Nagorno-Karabakh. A joint investigation by Amnesty International and Citizen Lab found in May 2023 that Pegasus spyware was targeting Armenian public figures amid the conflict.

      In Serbia, the interior ministry purchased a portable mobile phone surveillance and location-tracking device for $18,254 shortly before the country's December 2023 elections. Amnesty International reported in December 2024 that Serbian authorities used spyware and forensic extraction tools against journalists and civil society activists, a claim disputed by the Serbian government.

      The UAE’s Signals Intelligence Agency acquired a voice interception system known as VOLE for $10,000 through a local intermediary in 2018. Malaysia’s military intelligence used Telekom Malaysia Berhad to obtain the same system in a package worth over $52,000 that included installation and training.

      The documents also name government agencies in Bahrain, Brazil, the Dominican Republic, Ghana, Guatemala, El Salvador, Jordan, Morocco, and Panama as end users. One export to Mexico involved a tactical signals intelligence system designed for locating and monitoring mobile devices, with the end user identified as the government of Michoacán, a state long affected by cartel violence.

      ### The EU’s Export Control Gap

      As Brussels prepares for a comprehensive review of the EU’s dual-use export control framework, the European Commission is expected to propose changes by early 2027. Current regulations require national authorities to evaluate whether cyber-surveillance tools might be utilized for internal repression or significant human rights violations before approving exports.

      “These licenses clearly show that Bulgaria is approving the exports of surveillance technology globally to police, military, and intelligence agencies in countries with a long history of employing such technology to suppress rights,” stated Zach Campbell, a senior surveillance researcher at Human Rights Watch. Campbell also noted that the European Commission has failed to halt the exports despite being aware of them, a claim this article could not independently verify.

      Bulgaria’s Ministry of Foreign Affairs informed Politico that Circles' documentation indicated the technologies were meant for crime prevention, counter-terrorism, and humanitarian rescue operations. The ministry noted that it considers “all relevant circumstances” when reviewing applications.

      The underlying issue is structural;