A look at the Latin American countries that bought Hacking Team exploit packages and then used them to spy on political opposition
Lorenzo Franceschi-Bicchierai / Motherboard : Tweets: @lorenzofb , @decespedes and @rondeibert Tweets: Lorenzo Franceschi-B / @lorenzofb : Here's how the vigilante hacker only known as Phineas Fisher hacked Hacking Team. http://motherboard.vice.com/ ... http://twitter.com/... Diani Barreto / @decespedes : “And that's all it takes to take down a company & stop its abuses against human rights.” On #EthicalHacking: http://motherboard.vice.com/ ... Profdeibert / @rondeibert : Hacking Team had 11 different customers in Mexico alone, including several local police, and the State Attorney http://motherboard.vice.com/ ...
Context & Ripple Effects
Phineas Fisher's breach of Hacking Team turned the company's own sales ledger into evidence: the leaked client list put Mexico and Italy at the top, with a product demo pitched to a Bangladeshi death squad and an attempted push into the UK market. This piece narrows that ledger to Latin America, where governments bought exploit packages and pointed them at political opposition rather than criminals.
The scale behind it is larger than one region — founder David Vincenzetti's spyware reached over 40 governments worldwide, and Mexico alone counted 11 Hacking Team customers including local police forces and the State Attorney. The reporting matters because it documents the end use of commercial exploits, not just their sale.
First-order effects
- Political opposition figures and activists in the named Latin American countries were the direct surveillance targets — the buyers used government-grade exploits on domestic dissent, not foreign adversaries.
- Hacking Team's customer relationships are exposed as complicity: every documented abuse now attaches to the vendor's brand and sales pipeline, on top of the damage from Fisher's earlier breach.
Second-order effects
- Rival surveillance vendors like FinFisher — which Fisher also breached — face the same exposure dynamic, forcing the industry to weigh export revenue against the reputational risk of being tied to repression of opposition groups.
- Civil society researchers and journalists gain a template for tracing abuses back through procurement records, raising the due-diligence cost for any government buying off-the-shelf spyware.
Third-order effects
- Leak-driven accountability becomes the de facto oversight mechanism for a trade that formal export controls barely touch — Fisher himself remained uncaught, with Italian authorities eventually giving up the pursuit, while the market he exposed persisted into the hacker-for-hire era seen later with RocketHack's infiltration of thousands of politicians' and journalists' accounts.
- If the pattern holds, commercial spyware consolidates around vendors willing to serve repressive buyers, pushing the question of regulation from national export rules toward whether such tools should be sold across borders at all.
The trend: Commercial state spyware keeps finding authoritarian and semi-authoritarian buyers regardless of breaches or exposés, making leaked documentation the main check on an industry that formal regulation has not restrained.