TL;DRLeaked export licences show Bulgaria approved Circles BG, an NSO Group affiliate, to sell phone-tracking tools and interception systems to intelligence agencies in Azerbaijan, Serbia, the UAE, and at least a dozen other countries between 2018 and 2023. The findings, published by Human Rights Watch, raise questions about the effectiveness of EU dual-use export controls.

Bulgaria’s export control authority licensed a Sofia-based surveillance firm to sell phone-tracking tools, interception systems, and monitoring infrastructure to intelligence agencies in countries with documented records of suppressing dissent. The licences, published by Human Rights Watch on Wednesday, cover exports by Circles BG to government buyers in Azerbaijan, Serbia, Malaysia, Mexico, the UAE, and at least ten other countries between 2018 and 2023.

Circles is an affiliate of NSO Group, the Israeli company behind the Pegasus spyware that has been used to target journalists, politicians, and human rights defenders worldwide. The leaked licences offer the clearest picture yet of how the company used its Bulgarian base as a gateway for exporting surveillance technology to governments that international watchdogs have accused of deploying such tools against their own citizens.