British spy gear sold to Gulf state amid crackdown

The UK government has approved over £11m worth of surveillance exports to a repressive Gulf state in the past five years, Declassified has found.

British companies have been issued 11 licences for exporting “telecommunications interception equipment” to Oman since 2021, with three earmarked for law enforcement users.

The Royal Oman Police, their main law enforcement agency, works closely with the Internal Security Service (ISS), the equivalent of MI5, to crack-down on protest, dissent, and activism.

Gatherings of more than 10 people are banned, with participants and organisers facing years in prison.

Some of the technology, exported under control entry “5A001f2”, is “designed for the extraction of client device or subscriber identifiers (e.g. IMSI, TIMSI, or IMEI), signalling, or other metadata” transmitted wirelessly.

This is consistent with an IMSI-catcher, notorious tracking devices commonly deployed at protests. Many are capable of intercepting calls, texts, and geolocating devices with alarming accuracy.

The volume of sales indicates that Oman accounts for just under a third of all of Britain’s IMSI-catcher exports since 2021.

Declassified can also reveal two of the exporting companies whose 5A001f2 licences were approved in 2024 for law enforcement users.

Freedom of Information disclosures show that a temporary licence worth £50,000 was approved for Surrey-based Cellxion to export to law enforcement for the purposes of “communication and network surveillance”.

UK police forces previously refused to confirm the alleged use of IMSI-catchers from Cellxion. The secret is so closely guarded that police began defying their legal requirements to disclose spending data to prevent further information from being identified.

Another licence was given to Smith Myers Communications to deliver equipment worth £5m to Omani law enforcement. This company also provided interception equipment to a commercial user in Singapore for a “communication and network surveillance, interception purpose” in 2024.

A third licence was approved by Britain’s trade department for similar technology in 2021, again to be used for Omani law enforcement, in a package worth £5m.

Other licences were issued in 2023 worth at least £1.4m for exporting “interception equipment designed for the extraction of voice or data” to commercial users in Oman. The exporters are unknown for these.

Secret state

Oman’s Musandam peninsula was forcibly annexed during a British military operation in 1970, against the wishes of its Shihuh community, who have lived under heavy surveillance ever since.

Sources in the area, who could face arrest if identified, claimed Omani security forces oversaw the installation of phone masts in a range of areas on the east coast of the peninsula in 2023, including Zighy Bay.

This is home to a luxury five-star hotel part-owned by an Emirati Sheik, Sultan bin Muhammad al-Qasimi. The resort has reportedly been visited by Tony Blair and several Saudi princes.

It is possible that interception equipment was installed alongside the phone masts in Musandam, however this cannot be confirmed.

The total lack of public transparency in Oman means it is impossible to identify how these technologies could be being used by law enforcement and commercial users.

A UK government spokesperson said: “All export licensing decisions are made in line with our Strategic Export Licensing Criteria, and we will not grant a licence where there is a clear risk that the items might be used to commit or facilitate internal repression or human rights violations.”

Cellxion and Smith Myers Communications did not respond to requests for comment.

Activists hacked in Oman

The UK’s exports of invasive surveillance technology risk deepening Oman’s lack of freedom of expression; which should make them unlawful under British export criteria.

Hani Al-Sarhani, an exiled activist now based in London, was involved in organising protests in Oman on April 12th last year. This movement was mostly in response to Oman’s crippling economy, a crisis spanning years.

He told Declassified that his phone number, managed by Omantel, was hacked on the day of the protests, giving malicious actors unauthorised access to his account.

Documents seen by Declassified show that a new SIM-card had been requested which Omantel granted without Al-Sarhani’s signature.

The activist said that several people were sent messages from his X (formerly Twitter) account, which used his phone number for two-factor authentication, and other organisers who had recent contact with him were swiftly arrested in Oman.

Al-Sarhani believes that Oman’s security forces accessed his account with the telco’s assistance, telling Declassified that “[Oman’s authorities] don’t care about laws. They just want to control the situation.”

Omantel, which is state-owned and has links to GCHQ, did not take action on Al-Sarhani’s incident report, nor did it respond to Declassified’s request for comment.

Last month, Talib Al-Saedi, was forcibly disappeared and later sentenced to three months in prison under cybercrime laws for criticising Oman’s regime online, according to the Gulf Centre for Human Rights. He is only one of many to have been arrested for online activity.

Mohammed Al-Fazari, an exiled journalist and author of a new book about Oman, told Declassified: “There are no human rights activists anymore. They’ll arrest maybe one-in-ten, and then the other nine fall into place after.”

Oman’s cyber capabilities, built by Britain

Oman’s chilling effect grew after the Cyber Defence Centre was established in 2020. It is governed by the ISS, which was previously run by MI6 spies after a British-backed coup helped install Sultan Qaboos, who ruled Oman for half a century.

The CDC gave Oman’s security services the authority to import technology to “monitor any electronic network in the country,” which lets them track activists, according to rights groups.

As with the creation of Oman’s security apparatus, the UK showed its interest in the CDC’s establishment.

A secret Privy Council advising Sultan Qaboos – including the heads of MI6 and British military at the time – “managed to land some important messages on … cyber-protection” in 2017, according to the diaries of former foreign minister, Alan Duncan.

MI5 and MI6 later trained Omani intelligence directors in 2019, despite concerns about how they uphold the Sultanate’s authoritarian regime.

The Foreign Office’s desire to promote cyber-development in Oman became much clearer after the establishment of the cyber-security agency.

It spent £1.8m on technology programmes in Oman, including hiring CyLon to build a cyber-security accelerator under the context of “enhancing national security capabilities.”

CyLon has deep links to national security and intelligence infrastructure, while also enjoying very close proximity to the government.

One of its founders, Grace Cassy, was a former Foreign Office diplomat and later worked as a foreign policy aide to Tony Blair.

The company has also been advised by former directors of GCHQ, the National Cyber Security Centre, and Israel’s Shin Bet.

The Foreign Office did not respond to queries on its interests in Oman’s cyber-security. CyLon was also approached for comment.