Black Cube CEO Suspected of Running Crime Organization. Revealed: The Romania Interrogation

Source

At the beginning of April 2016, two employees of Israeli private intelligence firm Black Cube were arrested in a raid on the Bucharest Marriot by members of Romania’s Directorate for Investigating Organized Crime and Terrorism.

The two – David Geclowicz and Ron Weiner – were caught with computers used hours prior to hack into the computers of family members and other confidants of Romania’s Laura Codruta Kovesi, then a state prosecutor heading the National Anti-corruption Directorate (DNA), charged with leading the country’s anti-corruption efforts.

Kovesi was leading a number of high profile investigations into senior Romainain officials, including people close to the president. Black Cube was hired to find damaging evidence against her. The hack took place weeks before a decision was to be made on whether to appoint Kovesi for another term and it was quickly revealed that she was also investigating a former senior official from Romania’s intelligence service. His name is Daniel Dragomir and he was supposedly the man who commissioned the job from Black Cube, whose CEO, Dan Zorella, a dual Romainian-Israeli citizen, was also a suspect.

Two months later, on June 27, Zorella found himself in an Israeli police interrogation room. He provided his version of events to the Israeli police’s anti-fraud unit and a Romanian investigator who was also present after Bucharest had requested assistance with the case. Transcript of his interrogations reveals how the private intel organization works, finds clients and conducts its operations abroad. It offers a rare window into a shadowy world of former spies, digital intelligence operations and political espionage.

An apple and a newspaper

Zorella’s investigation begins with a simple assertion by the police: “We informed [Zorella] that we are questioning him on suspicions that he has set up a criminal organization and is a member of it.” The investigators also said the firm was suspected of “harassment, cyber offenses, including breaking into computers illegally with criminal intent, aimed at harming a public official in Romania,” asking him: “How do you respond?”

Zorella tells the officer he wants to cooperate, and then is asked: “Do you know David Geclowicz and Ron Weiner?”

• Why Israeli Firm Black Cube Went After Obama’s Team
• Israeli Company Negotiated to Sell Advanced Cybertech to the Saudis
• Israeli Tycoon Hired Spy Firm to Get Dirt on Finance Minister, Report Says

Zorella answers in the affirmative: “Yes, they work for [Back Cube]. Ron works in the Israeli company, and he’s a former member of Israeli intelligence and a programmer. David is employed by [Black Cube’s] British firm. He’s a smart guy who works out of our London branch… and was supposed to be our representative in Paris.”

The investigators then ask him about how he and his firm got involved in Romania.

Zorella tells them that, “At the end of January 2016, a person called Daniel Dragomir reached out to me about an important and sensitive project in Romania. A person called Gidi Zalibenski was the mediator [Zalblinski was sentenced to six years in prison in Romania for tax fraud, Israel’s prosecution is moving to have the sentence moved to an Israeli prison]. Daniel said that there is an important issue he needs looked into regarding Romania’s DNA [anti-corruption taskforce headed by Kovesi]. I was told Daniel was from Romania’ secret services, so I decided to take Udi Levy with me to the meeting. Levy is a former official in Israeli intelligence and worked closely with [former Mossad chief] Meir Dagan.”

Zorella recalls for the officers his first meeting with the Romanians. “We flew to Bucharest on February 1st 2016, and arrived at the Sheraton. Daniel was very careful with how he communicated with us, as is common in the world of intelligence. For example, he used an app called Silent Phone and a message service called Wickr. He used the username JohnDoe500 and wrote to me, ‘meet me at the Hilton, at the English Bar.’ He said: ‘You’ll recognize me. I’ll have an apple and a newspaper on my table.’ And that’s indeed how we identified him when we arrived.”

According to the testminoy, after the two sides introduced themselves, Dragomir told them though he used to work for Romanian intelligence in an official capacity, but that he was moved because of the anti-corruption investigations. He said the investigation was “bullshit”, but that it gave him the opportunity to act as a front for the Romanian intelligence – to which Levy allegedly responded: “It’s the same with us” in a reference to Israel.

Regarding the fact that Dragomir did not work in an official capacity, Zorella told investors: “In our field, no one ever leaves the service of the government.”

According to the transcript of Zorella’s interrogation, he said he believed he had been hired by the Romanian Intelligence Service, the SRI, with the consent of its leader, Eduard Hellvig, and Romanian President Iohannis Klaus.

According to Zorella, “Daniel [Dragomir] then suggested we leave the English Bar and we headed a few blocks away to a restaurant called Nada Mas. Being an intelligence man, Daniel sat down at the corner table, facing the door. We ordered food and it was noisy and Daniel finally started telling us about the project.

“He said he needed to confirm or deny a few suspicions around a number of corruption incidents, corruption and misconduct in the DNA [the anti-corruption task force that was investigating Dragomir and others]. Specifically, against Laura [Codruta] Kovesi [who headed the task force]. He said since she was appointed she had taken over the country. He said that [Kovesi] was working with the deputy chief of the SRI, Florian Coldea and that together they had turned the country into one of fear and terror.”

According to Zorella, Dragomir never mentioned his own case or asked them to intervene on his behalf, but rather cast it as a “national issue.”

“We started to understand this was a sensitive case and Udi [Levy] decided to start recording the meeting. He has a pen that is a recording device. I don’t record clients but Udi has such a pen and he signaled to me he was about to start recording and I nodded to give him my consent.”

Zorella handed this and other recordings to the police, and asked to stress that they document Dragomir implying to the Israelis that he was in touch with the Romanian president regarding the anti-corruption investigations.

The company’s CEO testified that he consulted former Mossad chief Dagan in a private meeting in the latter’s home. Dagan vouched for the SRI, according to Zorella. He claims Dagan said that the operation was under the sponsorship of the SRI, and that it was “an important mission.” It is important to note the timeline in this context as this was only a week prior to Dagan passing away. As Dagan died three months before Zorella’s interrogation, police were unable to confirm the account.

According to Zorella, Dragomir said he “had received the SRI’s permission to act as an arm of the organization, so we could carry out operations and penetrate emails.” When asked for proof that he was operating as a group within the SRI, Zorella did not present a document. When asked what form of approval his company had, he said: “I recalled how Meir Dagan, Black Cube’s honorary president, had good ties with the Romanian Intelligence Service.

“I thought he could do some more in-depth checking for us regarding the substance of the project …. I went to Meir Dagan’s home a few days after the talk with Daniel [Dragomir]. I explained the project’s sensitivity and asked if he could check with his contacts in Romania on whether it was a government project.”

“Dagan didn’t know Dragomir. He said he’d check and get back to us…. Dagan got back to me a day or two later by phone. He said he had checked in Romania and that indeed this was a very important and sensitive project for the country of Romania. We should carry out the operations, as Daniel had said, only inside Romania, and this way we’ll be protected by the organization [the SRI] and be considered an arm of the SRI – it’s an important mission, good luck.”

As Zorella said in the transcript, “Dragomir said he was interested in launching the project …. He said there were only three weeks left to carry out the mission,” referring to the deadline for extending Kovesi’s term.

On March 16, Zorella said he arrived in Bucharest again for another meeting with Dragomir at the English Bar. This time, Dragomir took him to a “safe house” in a residential part of the Romanian capital – “this is very common among intel organizations”. There, Dragomir paid Zorella 149,000 euros. “He asked me to count the money but I didn’t want to. I saw there were a number of bundles of ten thousands euros in 100 euro bills and a number of bundles of 500 euro bills. It looked more or less like the sum so I put the money back in the envelope and that was that.”

The team

Zorella then testified that he returned to Israel and began to set up a team for the Romanian project. “I appointed Gal Farchi to lead the project, I told him we need a team to work only from inside Romania. I also said we need to hold meetings with those close to Kovesi. Gal’s team in Israel included two analysts – Yossi Berkstien and Nathan, that were in charge of research and open intel – social media etc – and they were charged with producing profiles of all the people we think we can get information from: Laura (Kovesi), her father, her ex-husband as well as others.

“The rest of the team were supposed to find phone numbers and emails that were not provided by our client. At the same time, David Geclowicz and Ron Weiner were sent to Bucharest to try to break into an email account. Ron is the technical guy who knows how to do the actual breaking in. David was supposed to call the people and try to convince them to open the email we sent them.”

The police investigator then asks him about the rest of the team. Zorella responds that there was also “a couple of agents called Stella Penn and Yossi Segal.” The two were part of the team that dealt with the actual operations and operated under false aliases. Penn’s name was already revealed and she was publicly identified as a Black Cube agent after it was revealed the firm was involved with Harvey Wienstien.

“They were supposed to meet someone in London who worked closely with Laura (Kovesi) who was supposed to supply information about misconduct on her part… the meeting [did eventually] take place in London, [but] after Geclowicz and Weiner were arrested.” In the end, the source, Liana Sabo, never supplied any information and refused to talk about Kovesi.

Soft offensive

Geclowicz and Weiner flew to Bucharest and set up shop in the Marriot. “At first,” Zorella said, “they tried an approach that intel people call a ‘soft offensive.’ This means sending out emails to the relevant people but not calling them.” The emails include files that comprise a target’s computer.

“If I remember correctly, it was on Tuesday, before their arrest, and the operation worked on Sabo. After this type of offensive was exhausted, we shifted to more advanced techniques: We sent a positive news story about Kovesi written by a fake journalist to a number of her family members and people who worked with her, to get them to respond. The [fake] reporter even called them to get their response to the report. Through this system we succeeded in getting the email of a former DNA official who worked with Kovesi and even her ex-husband’s email. Both these emails were attained on Friday, ahead of the arrest.”

Rosie, a Black Cube analyst who was not involved in the project, was asked to call Kovesi’s father in German, “as she speaks German, with the goal of bringing him in for a meeting. She didn’t know about our cyber activities. [One of the project’s analysts] Yossi Berkstien, who probably used the name Adam Adler, spoke to the father in Romaian and tried to bring the dad in for a meeting through a different cover story. Both of these attempts failed. He did not agree to meet anyone,” Zorella recalled.

On Friday, March 31 2016, just before the arrest, Zorella says, Gal Farchi, the project’s chief, “reported that he got the passwords [to the targets’ email accounts] and I understood we needed to act fast to analyze the materials. I ordered him to go and take the materials from David [Geclowicz] and Ron [Weiner], cause he speaks Romanian and can prepare the report we can give to the clients and finish the project. He reported this to Avi Yanus who reported it to me.”