F is for FinFisher — The Infection Answer to Encryption, and the Vendor That Actually Died

The Alphabet of Actors — Letter F. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED.

Three vendors now sit in this register, and together they form something neater than any of them intended: a complete set of answers to a single problem. The problem is encryption. Amesys (Letter A) sold a passive tap that copied traffic off the wire, and encryption killed it — you cannot read what you cannot decrypt. Blue Coat (Letter B) sold the second answer, an inline proxy that terminates the encryption and reads the plaintext as it passes. FinFisher sold the third, and it is the one that won: do not fight the encryption at all. Go around it. Get onto the device where the message is typed and read, where the plaintext lives before it is ever sealed for transit, and the strongest cryptography in the world becomes irrelevant, because you are reading over the target's own shoulder.

That answer has a name — the endpoint implant, or in plainer words, spyware — and FinFisher, the intrusion brand of the Anglo-German Gamma Group, was one of the companies that turned it into a catalogue product for governments. What makes FinFisher worth a letter is not only that it built this; it is that it built it early, said out loud exactly what it was for, sold it to the usual buyers with the usual results, and then did something no other vendor in this register did. It died.

This is the letter about infection rather than interception, about the fake software update as a weapon, and about the one surveillance company in this series that actually ceased to exist.

1. The Actor: a governmental hacking shop, by catalogue

FinFisher was not coy about what it sold. Its Spy Files portfolio is headed 'Governmental IT Intrusion and Remote Monitoring Solutions,' and it reads like a product line because it was one. There was the FinIntrusion Kit, the FinUSB Suite and FinFireWire for gaining access. There were the implants themselves — FinSpy for computers, FinSpy Mobile for phones. There was a whole delivery family, FinFly, in USB, LAN, Web and ISP variants, for getting the implant onto the target. And there was FinTraining, a hacking course to teach a government's operators how to use the rest. A one-stop offensive shop.

The Gamma Group behind it was Anglo-German — the brochures carry a United Kingdom telephone number and the company's later corporate centre of gravity was in Germany, a detail that matters for how the story ends. But the important thing about the actor is not its nationality; it is its customer. FinFisher did not sell to criminals or to the open market. It sold to governments, as a legitimate defence contractor sells to governments, with the framing of lawful assistance to law enforcement and intelligence. That framing is the whole moral pivot of the commercial-spyware industry, and FinFisher is one of the cleanest early specimens of it: a firm that took the most intrusive capability imaginable — total control of a target's personal device — and packaged it as an ordinary government procurement, with a training course and a support line.

The productization is the point. Nation-states have always been able to break into devices. What FinFisher and its peers did was make that capability buyable off a catalogue by any government that could pay, including governments with no functioning check on how they would use it. The capability did not change. The customer list did.

2. The Instrument: infection, because interception failed

The FinSpy brochure states the thesis of the entire endpoint-spyware industry in three bullet points, and it is worth quoting because a vendor describing its own reason to exist is the most honest evidence there is. Traditional lawful-interception solutions, it says, 'face new challenges that can only be solved using active systems like FinSpy': Data not transmitted over any network; Encrypted Communications; Targets in foreign countries. Read those as the confession they are. Interception off the wire fails when the data never crosses a wire you can tap, when the data is encrypted, and when the target is somewhere you cannot reach a cable. FinSpy's answer to all three is the same: stop trying to catch the data in motion, and instead live on the machine where the data sits still and unencrypted.

Once installed, the brochure says, FinSpy 'can be remotely controlled and accessed' — the operator reads the files, the messages, the keystrokes, directly from the device. And the mobile version makes the encryption point explicit in a way that reads, in retrospect, like a prophecy of the decade that followed. FinSpy Mobile solves what off-air interception cannot: Data not transmitted over any network and kept on the device, Encrypted Communications in the Air-Interface, and — the decisive phrase — End-to-end encryption from the device such as Messengers, Emails or PIN messages. In 2011, before the encryption wave the first alphabet measured had even fully arrived, FinFisher had already named the escape hatch. When everyone encrypts their messages end to end, you do not break the encryption. You put your implant inside the messenger app, and read the message on the screen the user is reading it on.

This is why the endpoint implant is the answer that won, and it is why FinFisher belongs in the register even though its specific products are now crude and dead. It identified, and sold, the exact modality that near-universal encryption would make dominant: not the tap, not the decrypting proxy, but the spy that lives on your phone.

3. The Delivery: the fake update as a national capability

An implant is only as good as your ability to get it onto the target, and here FinFisher's FinFly family is the register's trust-exploitation motif turned into a countrywide product. The most revealing of them is FinFly ISP, and its feature list is a short course in infection by borrowed legitimacy.

FinFly ISP, the brochure says, 'Can be installed inside the Internet Service Provider Network.' From that position — inside the pipe every customer's traffic flows through — it 'Hides Remote Monitoring Solution in Downloads by Targets,' 'Injects Remote Monitoring Solution as Software Updates,' and 'Remotely installs Remote Monitoring Solution through Websites visited by the Target.' Sit with the middle one. The target's computer asks for a routine software update — the kind every device fetches constantly, the kind security advice tells you to always install — and FinFly ISP, sitting in the ISP, answers that request with the spyware instead. The victim installs the implant themselves, believing they are patching their system, and they are more likely to do it precisely because they have been trained to trust updates.

This is the exact same principle the register has now seen three times. Blue Coat's proxy read encrypted traffic by holding a certificate the client had been made to trust. APT41 signed its malware with code-signing certificates stolen from real companies. FinFly ISP delivers its implant as a software update the user trusts. None of them breaks the security mechanism; all of them abuse the trust the mechanism exists to establish. The fake update is the borrowed-legitimacy attack aimed at the one thing every user has been told is safe, and FinFisher sold it as a strategic, nationwide capability to be bolted into a country's internet backbone.

4. The Deployment: lawful by whose law

FinFisher's marketing speaks, like every vendor in this register, of organized crime and lawful interception. The documented use tells the story the marketing is built to obscure, and it is the vendor thread's constant refrain.

Research by Citizen Lab — the University of Toronto group that has done more than anyone to expose the commercial-spyware trade — established FinSpy being used against pro-democracy activists and dissidents in Bahrain, including individuals living in exile in the United Kingdom. Read that last detail carefully, because it is the whole argument. A person flees an authoritarian state, reaches the safety of a democracy, and is followed there by an implant on their own phone, sold to their persecutor by a company operating out of Europe. 'Lawful interception' was lawful by the law of Bahrain, aimed at people whose only offence was opposition, reaching them in a country whose law would never have authorized it. The word 'lawful' did exactly the work it always does in this trade: it laundered the sale.

This is the same finding as Amesys in Libya and Blue Coat in Syria, and its repetition is not redundancy — it is the pattern. The commercial-spyware and interception industry sells a capability as narrow, lawful and aimed at criminals, and the capability arrives, again and again, aimed at a population's dissidents, journalists and exiles. FinFisher is one more confirmation, with one more set of named human targets, that the euphemism and the use are not the same thing and were never meant to be.

5. The Accountability: the one vendor that actually died

Here the register reaches a first, and it must be stated with the same bright line as every legal thread in this series. FinFisher is the only vendor so far whose story ends not in a rebrand or an acquisition but in death — and the death came under legal pressure, though the legal case was never resolved to a conviction.

The facts. German civil-society organisations — Reporters Without Borders, the European Center for Constitutional and Human Rights, the Gesellschaft fuer Freiheitsrechte, and the outlet Netzpolitik — filed a criminal complaint alleging that FinFisher had exported FinSpy to Turkey without the export licence German law required, where it was linked to spyware used against the country's opposition. Munich prosecutors opened an investigation and searched the company's premises. And in 2022, the FinFisher group of companies filed for insolvency and ceased to operate.

The allegation, held as an allegation. The export-control violation was charged in the complaint and investigated; it was not adjudicated to a conviction, the company contested wrongdoing, and the FinFisher entities dissolved before any court resolved the criminal question. So the honest statement is not 'FinFisher was convicted' — it was not — but something more precise and, in this register, more remarkable: a surveillance vendor came under a serious criminal investigation for how its product was exported and used, and did not survive it. Whether the insolvency was caused by the legal pressure, the reputational damage, the loss of business that followed exposure, or some combination, the outcome is singular here. Amesys rebranded to Nexa and its people went to court but the capability lived on. Blue Coat was bought by Symantec at a premium. FinFisher simply ended.

That is the fullest vendor accountability the register has recorded — and, as the next section shows, it still was not enough, because you cannot bankrupt a modality.

6. The Bridge: the company is gone, the idea is the state of the art

Every letter carries the actor to what the LSN systems and the wider record show today, and for FinFisher the bridge is the endpoint-migration thesis the first alphabet measured, now confirmed by FinFisher's own foresight and its market's afterlife.

The first alphabet established that near-universal TLS — about 98.5% of traffic on the LSN wire — hollowed content interception and pushed content surveillance to the endpoint, where the plaintext still lives. FinFisher is the commercial embodiment of that migration, and the uncanny thing is that it saw the migration coming and sold the product for it in 2011, years before the wire had fully closed. 'Infection where interception fails' was not a retrospective description of FinFisher; it was FinFisher's opening pitch. The endpoint implant is the future the encryption transition was always going to produce, and FinFisher was one of the firms that pre-built it.

Which is exactly why the company's death changed so little. FinFisher was the crude first generation — brochures at trade shows, FinFly ISP injecting fake updates. By the time it dissolved in 2022, the modality it pioneered had been refined past recognition by successors, above all NSO Group's Pegasus, the zero-click, zero-day endpoint implant that Google's own Buying Spying report and Citizen Lab have documented targeting journalists and dissidents worldwide, Bahrain among them. Same idea — get onto the device, defeat encryption by owning the endpoint — executed at a level FinSpy Mobile could only gesture at. The bankruptcy of FinFisher removed one early, clumsy vendor from a market it had helped create and that had long since outgrown it. The idea did not go insolvent. It got better funded.

7. The counter-narrative, steelmanned

The defence of FinFisher, and of the endpoint-implant industry, is the same one made for every vendor in this register, and it has real force where encryption is concerned.

Encryption is the point. End-to-end encryption is a genuine and enormous good — it protects dissidents, journalists, businesses and ordinary people from exactly the mass interception this series has spent letters condemning. But the same encryption that protects the innocent also protects the guilty, and a law-enforcement or intelligence service facing a serious criminal or a genuine terrorist who uses an encrypted messenger has, lawfully, almost no option left except the endpoint. 'Going dark' is a real operational problem, not merely a talking point; a targeted, warranted implant on a specific suspect's device is, on this account, the modern equivalent of a wiretap warrant — the narrow, court-authorized intrusion that democratic societies have always permitted against specific, suspected individuals. FinFisher, its defenders would say, sold a lawful capability for that lawful purpose, and its misuse by some buyers no more condemns the tool than a misused wiretap condemns the concept of lawful interception.

This dossier grants the premise and rejects the conclusion, and the distinction is where the whole ethics of the industry lives. A warranted implant on a specific suspect, authorized by a court that has weighed the evidence, is indeed a legitimate instrument, and nothing in this letter argues that endpoint access is never justified. But that is not what FinFisher sold. It sold a turnkey national capability to governments including ones with no independent court to grant the warrant, no oversight to weigh the evidence, and a documented habit of aiming the capability at opponents rather than criminals — and it sold it with a delivery system, FinFly ISP, designed for mass, deniable infection through an entire country's ISP, which is not the shape of a targeted wiretap but of a dragnet with individual triggers. The 'going dark' argument justifies a narrow, governed, court-authorized endpoint intrusion. FinFisher's business was selling the ungoverned version of that capability to the ungoverned buyer, and the Bahraini exile with an implant on the phone is what the difference looks like. The defence describes a legitimate tool. FinFisher sold the tool with the governance deliberately removed.

8. Verdict — DISSOLVED, and INHERITED

FinFisher saw the encryption future before it arrived and sold the answer to it: not the tap that would die and not the proxy that would fight, but the implant that would win — an offensive presence on the target's own device, reading the plaintext before the cryptography could seal it, delivered through the one thing every user has been taught to trust, the software update. It sold that capability to governments as lawful assistance, and it arrived, as such capabilities do, on the phones of dissidents and exiles.

The verdict's first word is the register's rarest: DISSOLVED. FinFisher did not rebrand to escape a lawsuit or get absorbed at a premium into a security giant. Under the shadow of a criminal export investigation and the exposure of how its product had been used, the FinFisher companies filed for insolvency and ceased to exist. It is the only actor in this series so far — vendor, state or criminal — that actually ended. If the register were a story about whether the surveillance industry can be held accountable, this would be its hopeful chapter: a company that crossed the line and did not survive the crossing.

But the second word is why the hope is thin, and it is the same lesson DarkSide taught among the criminals: INHERITED. Killing the company did nothing to the modality, because the modality was a market and the market had already surpassed it. FinFisher's clumsy first-generation implant was, by the time it died, an antique beside NSO's Pegasus and the zero-click spyware industry that had inherited its entire premise — infect the endpoint, defeat encryption by owning the device — and executed it at a scale and stealth FinFisher never reached. The company that pioneered the idea went bankrupt; the idea is now the most consequential surveillance modality on earth, aimed at the same kinds of people, from better-funded firms, more effectively than ever.

Three vendors in, the register's pattern is clear and it is not comforting. Amesys was charged and rebranded; Blue Coat was fined at the reseller and absorbed; FinFisher was investigated and died. Three different fates, three different degrees of consequence — and in every case the capability outlived the company, because the buyers, the demand and the modality were never on trial. The vectors do not lie: the tool that infects the endpoint is the answer to encryption, and it does not care which vendor sells it or whether that vendor lives. FinFisher died. Judge, then, not the one dead company, but the living market that buried it and kept selling.

The Alphabet of Actors continues. Verdict: DISSOLVED, and INHERITED. Confidence: HIGH on the product, the infection-answer thesis and the market lineage — drawn from FinFisher's own Spy Files brochures (FinSpy, FinSpy Mobile, FinFly ISP) and Google's Buying Spying. MEDIUM, and explicitly bounded, on the dissident-targeting (attributed to Citizen Lab research) and the accountability thread (criminal complaint, Munich investigation and 2022 insolvency stated as fact; the export violation stated as alleged, contested, and unresolved by conviction). Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the market, not just the one company that died.