A Bulgaria-based surveillance technology company sold phone-monitoring and internet-interception tools to law enforcement and intelligence agencies in ten countries with documented records of repressing dissidents, according to a report published by Human Rights Watch.
The nonprofit obtained export licensing records from Bulgaria's Ministry of Economy and Industry covering 2018 through 2023, which show the Bulgarian government approved licenses allowing the firm Circles to sell surveillance products to El Salvador, the United Arab Emirates, Serbia, Azerbaijan, Guatemala, Bahrain, Jordan, Malaysia, Morocco, and Panama.
Human Rights Watch said it was unable to obtain records for 2025 or 2026, leaving open the question of whether the sales are ongoing.
The three tools described in the report are capable of capturing internet data, phone calls, and messages; geolocating mobile phones in real time; and using SS7 protocol to remotely intercept voice calls along with the locations of both parties involved.
Circles sells several distinct surveillance products. One, called Pixcell, captures internet data, calls, and messages. A second, called Landmark, geolocates mobile phones in real time. A third, described internally as "Voice Over Location Enabler" software, uses SS7 protocol to "remotely intercept targets' incoming and outgoing voice calls" as well as both parties' location data, according to the press release, quoting Circles' own documents.
Like other firms in the commercial surveillance market, Circles has described its products as tools intended solely for combating terrorism and crime. Human Rights Watch said it contacted the company for comment four times and received no response.
The report casts a critical light on the European Union's export control framework, which is designed to prevent the sale of sophisticated surveillance technology to governments that might abuse it. Critics have long argued that enforcement of that framework has been inconsistent.
"All EU governments should be clamping down on exports of tools that can be used for repression, not rubber-stamping them," Zach Campbell, senior surveillance researcher at Human Rights Watch, said in a statement. "The European Commission has evidence that EU governments have been issuing licenses seemingly without conducting serious human rights due diligence, and yet appears to have taken no action despite having the legal framework to control this."
The European Commission, responding to Human Rights Watch, said member states are "solely responsible for licensing decisions on dual-use exports." The Bulgarian government told the nonprofit that exports contradicting the country's "national, European and international commitments, including with regard to the protection of human rights, are not allowed" and that it "maintains a consistent policy of zero tolerance for abuses." Neither the Bulgarian government nor the European Commission responded to requests for comment from The Record.
Circles was co-founded by Tal Dilian, the same executive behind the blacklisted spyware firm Intellexa. In February, a Greek court found Dilian guilty on charges related to Intellexa's use to surveil civil society members, including journalists and politicians.
The Bulgaria findings come roughly a month after Human Rights Watch published a separate report identifying surveillance technology exports from Finland, Poland, Denmark, the Czech Republic, Estonia, and Bulgaria to repressive governments. France, Greece, Spain, Germany, and Italy — all known exporters of surveillance technology — declined to provide Human Rights Watch with trade records, according to that earlier report.
The cumulative picture reinforces longstanding concerns from digital rights advocates that the EU's dual-use export regime, despite existing legal authority, has not translated into consistent oversight. Whether the European Commission moves to exercise that authority against member states will likely define how meaningful the framework proves to be in practice.