Black Cube CEO suspected of running crime organization

At the request of the Romanian government, the head of Israeli private intelligence firm Black Cube was questioned in 2016 over an operation in Bucharest. Leaked transcripts of his interrogation offer a rare window into the shadowy world of political espionage.

At the beginning of April 2016, two employees of Israeli private intelligence firm Black Cube were arrested in a raid on the Bucharest Marriot by members of Romania’s Directorate for Investigating Organized Crime and Terrorism.

The two David Geclowicz and Ron Weiner - were caught with computers used hours prior to hack into the computers of family members and other confidants of Romania’s Laura Codruta Kovesi, then a state prosecutor heading the National Anti-corruption Directorate (DNA), charged with leading the country’s anti-corruption efforts.

Kovesi was leading a number of high profile investigations into senior Romainain officials, including people close to the president. Black Cube was hired to find damaging evidence against her. The hack took place weeks before a decision was to be made on whether to appoint Kovesi for another term and it was quickly revealed that she was also investigating a former senior official from Romania’s intelligence service. His name is Daniel Dragomir and he was supposedly the man who commissioned the job from Black Cube, whose CEO, Dan Zorella, a dual Romainian-Israeli citizen, was also a suspect.

Two months later, on June 27, Zorella found himself in an Israeli police interrogation room. He provided his version of events to the Israeli police’s anti-fraud unit and a Romanian investigator who was also present after Bucharest had requested assistance with the case. Transcript of his interrogations reveals how the private intel organization works, finds clients and conducts its operations abroad. It offers a rare window into a shadowy world of former spies, digital intelligence operations and political espionage.

Zorella’s investigation begins with a simple assertion by the police: “We informed [Zorella] that we are questioning him on suspicions that he has set up a criminal organization and is a member of it.” The investigators also said the firm was suspected of “harassment, cyber offenses, including breaking into computers illegally with criminal intent, aimed at harming a public official in Romania,” asking him: “How do you respond?”

Zorella tells the officer he wants to cooperate, and then is asked: “Do you know David Geclowicz and Ron Weiner?”

Zorella answers in the affirmative: “Yes, they work for [Back Cube]. Ron works in the Israeli company, and he’s a former member of Israeli intelligence and a programmer. David is employed by [Black Cube’s] British firm. He’s a smart guy who works out of our London branch… and was supposed to be our representative in Paris.”

The investigators then ask him about how he and his firm got involved in Romania.

Zorella tells them that, “At the end of January 2016, a person called Daniel Dragomir reached out to me about an important and sensitive project in Romania. A person called Gidi Zalibenski was the mediator [Zalblinski was sentenced to six years in prison in Romania for tax fraud, Israel’s prosecution is moving to have the sentence moved to an Israeli prison]. Daniel said that there is an important issue he needs looked into regarding Romania’s DNA [anti-corruption taskforce headed by Kovesi]. I was told Daniel was from Romania’ secret services, so I decided to take Udi Levy with me to the meeting. Levy is a former official in Israeli intelligence and worked closely with [former Mossad chief] Meir Dagan.”

Zorella recalls for the officers his first meeting with the Romanians. “We flew to Bucharest on February 1st 2016, and arrived at the Sheraton. Daniel was very careful with how he communicated with us, as is common in the world of intelligence. For example, he used an app called Silent Phone and a message service called Wickr. He used the username JohnDoe500 and wrote to me, ‘meet me at the Hilton, at the English Bar.’ He said: ‘You’ll recognize me. I’ll have an apple and a newspaper on my table.’ And that’s indeed how we identified him when we arrived.”

According to the testminoy, after the two sides introduced themselves, Dragomir told them though he used to work for Romanian intelligence in an official capacity, but that he was moved because of the anti-corruption investigations. He said the investigation was “bullshit”, but that it gave him the opportunity to act as a front for the Romanian intelligence - to which Levy allegedly responded: “It’s the same with us” in a reference to Israel.

Regarding the fact that Dragomir did not work in an official capacity, Zorella told investors: “In our field, no one ever leaves the service of the government.”

According to the transcript of Zorella’s interrogation, he said he believed he had been hired by the Romanian Intelligence Service, the SRI, with the consent of its leader, Eduard Hellvig, and Romanian President Iohannis Klaus.

According to Zorella, “Daniel [Dragomir] then suggested we leave the English Bar and we headed a few blocks away to a restaurant called Nada Mas. Being an intelligence man, Daniel sat down at the corner table, facing the door. We ordered food and it was noisy and Daniel finally started telling us about the project.

“He said he needed to confirm or deny a few suspicions around a number of corruption incidents, corruption and misconduct in the DNA [the anti-corruption task force that was investigating Dragomir and others]. Specifically, against Laura [Codruta] Kovesi [who headed the task force]. He said since she was appointed she had taken over the country. He said that [Kovesi] was working with the deputy chief of the SRI, Florian Coldea and that together they had turned the country into one of fear and terror.”

According to Zorella, Dragomir never mentioned his own case or asked them to intervene on his behalf, but rather cast it as a “national issue.”

“We started to understand this was a sensitive case and Udi [Levy] decided to start recording the meeting. He has a pen that is a recording device. I don’t record clients but Udi has such a pen and he signaled to me he was about to start recording and I nodded to give him my consent.”

Zorella handed this and other recordings to the police, and asked to stress that they document Dragomir implying to the Israelis that he was in touch with the Romanian president regarding the anti-corruption investigations.

The company’s CEO testified that he consulted former Mossad chief Dagan in a private meeting in the latter’s home. Dagan vouched for the SRI, according to Zorella. He claims Dagan said that the operation was under the sponsorship of the SRI, and that it was “an important mission.” It is important to note the timeline in this context as this was only a week prior to Dagan passing away.

As Dagan died three months before Zorella’s interrogation, police were unable to confirm the account.

According to Zorella, Dragomir said he “had received the SRI’s permission to act as an arm of the organization, so we could carry out operations and penetrate emails.” When asked for proof that he was operating as a group within the SRI, Zorella did not present a document. When asked what form of approval his company had, he said: “I recalled how Meir Dagan, Black Cube’s honorary president, had good ties with the Romanian Intelligence Service.

“I thought he could do some more in-depth checking for us regarding the substance of the project …. I went to Meir Dagan’s home a few days after the talk with Daniel [Dragomir]. I explained the project’s sensitivity and asked if he could check with his contacts in Romania on whether it was a government project.”

“Dagan didn’t know Dragomir. He said he’d check and get back to us…. Dagan got back to me a day or two later by phone. He said he had checked in Romania and that indeed this was a very important and sensitive project for the country of Romania. We should carry out the operations, as Daniel had said, only inside Romania, and this way we’ll be protected by the organization [the SRI] and be considered an arm of the SRI – it’s an important mission, good luck.”

As Zorella said in the transcript, “Dragomir said he was interested in launching the project …. He said there were only three weeks left to carry out the mission,” referring to the deadline for extending Kovesi’s term.

On March 16, Zorella said he arrived in Bucharest again for another meeting with Dragomir at the English Bar. This time, Dragomir took him to a “safe house” in a residential part of the Romanian capital - “this is very common among intel organizations”. There, Dragomir paid Zorella 149,000 euros. “He asked me to count the money but I didn’t want to. I saw there were a number of bundles of ten thousands euros in 100 euro bills and a number of bundles of 500 euro bills. It looked more or less like the sum so I put the money back in the envelope and that was that.”

The team

Zorella then testified that he returned to Israel and began to set up a team for the Romanian project. “I appointed Gal Farchi to lead the project, I told him we need a team to work only from inside Romania. I also said we need to hold meetings with those close to Kovesi. Gal’s team in Israel included two analysts - Yossi Berkstien and Nathan, that were in charge of research and open intel - social media etc - and they were charged with producing profiles of all the people we think we can get information from: Laura (Kovesi), her father, her ex-husband as well as others.

“The rest of the team were supposed to find phone numbers and emails that were not provided by our client. At the same time, David Geclowicz and Ron Weiner were sent to Bucharest to try to break into an email account. Ron is the technical guy who knows how to do the actual breaking in. David was supposed to call the people and try to convince them to open the email we sent them.”

The police investigator then asks him about the rest of the team. Zorella responds that there was also “a couple of agents called Stella Penn and Yossi Segal.” The two were part of the team that dealt with the actual operations and operated under false aliases. Penn’s name was already revealed and she was publicly identified as a Black Cube agent after it was revealed the firm was involved with Harvey Wienstien.

“They were supposed to meet someone in London who worked closely with Laura (Kovesi) who was supposed to supply information about misconduct on her part… the meeting [did eventually] take place in London, [but] after Geclowicz and Weiner were arrested.” In the end, the source, Liana Sabo, never supplied any information and refused to talk about Kovesi.

Geclowicz and Weiner flew to Bucharest and set up shop in the Marriot. “At first,” Zorella said, “they tried an approach that intel people call a ‘soft offensive.’ This means sending out emails to the relevant people but not calling them.” The emails include files that comprise a target's computer.

“If I remember correctly, it was on Tuesday, before their arrest, and the operation worked on Sabo. After this type of offensive was exhausted, we shifted to more advanced techniques: We sent a positive news story about Kovesi written by a fake journalist to a number of her family members and people who worked with her, to get them to respond. The [fake] reporter even called them to get their response to the report. Through this system we succeeded in getting the email of a former DNA official who worked with Kovesi and even her ex-husband’s email. Both these emails were attained on Friday, ahead of the arrest.”

Rosie, a Black Cube analyst who was not involved in the project, was asked to call Kovesi’s father in German, “as she speaks German, with the goal of bringing him in for a meeting. She didn’t know about our cyber activities. [One of the project’s analysts] Yossi Berkstien, who probably used the name Adam Adler, spoke to the father in Romaian and tried to bring the dad in for a meeting through a different cover story. Both of these attempts failed. He did not agree to meet anyone,” Zorella recalled.

On Friday, March 31 2016, just before the arrest, Zorella says, Gal Farchi, the project’s chief, “reported that he got the passwords [to the targets’ email accounts] and I understood we needed to act fast to analyze the materials. I ordered him to go and take the materials from David [Geclowicz] and Ron [Weiner], cause he speaks Romanian and can prepare the report we can give to the clients and finish the project. He reported this to Avi Yanus who reported it to me.”

Yanus is Zorella’s partner and Black Cube’s co-founder. He is in charge of the financial and business side of the company.

“At first we thought that maybe they got drunk or were kidnapped. Maybe terror even because they are Israelis, but we never imagined that something like this [the arrest] could happen. We were so panicked we asked Yossi [Berkstien] to quickly travel to Sofia, Bulgaria in a cab and fly back as soon as possible. He did take off and landed in London. From the moment we got the passwords on Friday, we should have downloaded the information overnight. However, the materials were only actually downloaded on Saturday morning and then the two were arrested with them, so we never actually saw the materials.”

After the arrest, Zorella says he reached out to Dragomir via the Wickr app: “He promised he would take care of things at the highest level possible and that it will be resolved soon. After a few days I started to understand that he cannot solve the problem. I started to document our communications.”

He says he and Yanus then came up with a new cover story claiming they had found great materials on the DNA, the goal being “to make sure they were still interested in communicating with us and wouldn't throw us to the dogs. [Dragomir] said he had received information from another intel service that the FBI tipped them off to [Black Cube’s] activities in Bucharest.”

Kovesi was ousted from her position in 2018 and last year a EU court ruled her firing was unlawful. Today she serves as a prosecutor for the EU, focusing on financial crimes.

Eduard Hellvig continues to serve as the head of the SRI and Iohannis Klaus is still the president of Romania.

Geclowicz and Weiner were convicted and sentenced to community service. Since the affair, Black Cube has said it has learned a lesson, and the company has stopped providing services to governments, or getting involved in politics in any way.

Still, in The New Yorker in 2018, Ronan Farrow reported that the company had gathered material on Ben Rhodes and Colin Kahl, two former aides to former U.S. President Barack Obama.

This was only one example of reports that the company had served governments even before the complications in Romania. In Israel, TheMarker reported that Black Cube had provided services to the Defense Ministry from 2012 to 2014.

Black Cube said in response to this report: “This is a regrettable affair from five years ago being recycled many times by the media in Israel and abroad. Black Cube was hired by a senior figure in Romania and cooperated fully with the authorities in Romania, trying to resolve the complicated affair it became embroiled in as a victim and to release two of its people from custody.

“The company and its people have never been questioned in Israel except to take part in international assistance to the authorities in Romania. After the affair, the company established a committee that reviews and confirms the acceptance of new clients. The company, whose services have been hired by leading law firms around the world for a decade, continues to operate in accordance with the law in every country.”