The Maricopa County Attorney's Office was considering buying a sophisticated spyware that could eavesdrop on anyone through their computers or cell phones, according to recently hacked emails.
An Italian company called Hacking Team developed a spyware system called Galileo, which it marketed to various governments and law enforcement agencies around the world. Hacking Team was, itself, hacked weeks ago, and an estimated 100 million emails were posted online, along with detailed information about Galileo and other products.
Those emails show a Maricopa County Attorney's procurement specialist emailed Hacking Team over the course of a year about possibly buying the Galileo system.
According to experts, and the company's own literature revealed in the hack, Galileo could be installed on computers and smartphones, sometimes without any direct action by the user. The company's proposal said the spyware could be installed by sending an infected link to a smartphone. When the phone's user opened the link, the software would install itself.
The company also boasted it could install the spyware on laptops and desktops without the user clicking on links. Experts say it infected computers at the most basic level of the system, meaning it could not be removed without physically replacing the chips inside.
Once installed, Galileo apparently gave the client access to webcams, mobile phone cameras, logs of all keystrokes, even the microphones of computers and smartphones so investigators could listen to what was happening.
In an email from July 2013 the County Attorney's procurement specialist said she and a detective were interested in meeting with Hacking Team to set up a presentation about the system.
Hacking Team's proposal listed the cost of setup, training and equipment at $444,000, with an additional $60,000 for maintenance.
The County Attorney's Office initially told 12 News that Hacking Team approached them and the agency decided not to buy.
A spokesman for the agency said the proposal referred to the County Attorney's Office by the wrong name, the "Mariposa County Sheriff's Office." He said an employee instructed Hacking Team to change the name.
But the leaked emails show there was a lot more communication.
Travel records show Hacking Team employees coming to Phoenix on at least one occasion to meet with representatives from the County Attorney's Office.
When asked about that email, a spokesman for the County Attorney's Office emailed a statement, saying, "All of MCAO's investigatory activities are conducted in full compliance with applicable laws and constitutional guarantees and in accordance with court orders."
In one internal email, a Hacking Team salesman wrote a detective from the office was "very impressed" with Hacking Team's demonstration and asked his boss to come in. Later in the email, the salesman writes, "the (sic) same issues continue as far as how to use the system legally. They seem to know how to get around some of the laws."
In a phone interview, MCAO spokesman Jerry Cobb downplayed the emails between the agency and Hacking Team, saying the exchange was due to a zealous investigator.
"This is one detective who was impressed with the description of the product they were offering and wanted to learn more," Cobb said. "As it went up the chain it was decided that this wasn't something that we wanted to do."
Cobb said he did not know why the decision was made not to complete the sale with Hacking Team, only saying MCA is approached by vendors all the time and some proposals are rejected.
Cobb would not comment on why the County Attorney's Office might need a program like Galileo, saying the agency does not comment on the activities of its investigators.