The U.K. government must urgently investigate the sale of hacking...

rules and policies, extensive information showing that Gamma International’s FinSpy hacking software was being exported without a license to administrations with “dismal human rights records,” PI said. The Department for Business, Innovation and Skills (BIS) confirmed that such products fall within the scope of the U.K. export control regime, and notified the company, PI said. But despite that fact that FinSpy has been on the market for six years, and that businesses are legally obligated to seek export license classifications, Gamma has only submitted a control list classification inquiry asking whether it needs an export license for the software, PI said. Under the law, Gamma must apply for country-specific licenses in order to sell to customers outside the EU, but BIS confirmed it hasn’t received any applications for such licenses, PI said. Gamma is known to have sold the product to Bahrain and Turkmenistan, where it was used to target dissidents for harassment, arrest and even torture, it said. BIS’s acknowledgement that FinSpy exports should be controlled is welcome, but it’s now up to HMRC to show it can “quickly and effectively lay down the law,” PI Head of Research Eric King said. Although PI asked HMRC for a response within 14 days of its letter indicating whether it had launched or was about to launch an investigation of Gamma, there’s been nothing yet, the organization said. HMRC said it can’t comment on individual cases. Gamma didn’t respond to a request for comment.