V-MIL Audit: ExpressVPN / Kape Technologies PLC

Audit Phase: V-MIL Prepared: 2026-05-01 Auditor Note: Live web search was unavailable during research. All findings are drawn from training data (through April 2026). Claims unverifiable from primary sources are explicitly flagged. No scores, tiers, or domain values are assigned.

Direct Defence Contracting & Procurement

Ministry of Defence & IDF Contracts

No public evidence of any verified contract, tender award, framework agreement, or MOU between ExpressVPN, Kape Technologies PLC, or its predecessor entity Crossrider and the Israeli Ministry of Defence (IMOD), the Israel Defence Forces (IDF), Israel Prison Service, Israel Border Police, or any other Israeli state security body has been identified.¹² The prior research report itself explicitly records “No public tender for ExpressVPN service to IMOD found,” which is consistent with the absence of any such record in open-source and training-data corpora.²

Source classes checked: Israeli government procurement portals (via training data), IMOD public announcements, corporate press releases, defence trade press.

No public evidence identified.

Defence Trade Directory Listings

No evidence has been found that ExpressVPN or Kape Technologies appears in SIBAT (Israel’s Defence Export and Defence Cooperation Directorate) directories, international defence exhibition catalogues (e.g., Eurosatory, DSEI, DVD), NATO supplier registries, or any recognised defence procurement registry in any jurisdiction.¹² SIBAT listings are not fully public in English and live access was not available; absence from training data therefore cannot be treated as definitive, but no positive evidence exists.

No public evidence identified.

Press Releases & Official Announcements

No corporate press release or government announcement documenting a defence cooperation agreement, joint venture, partnership, or memorandum of understanding between ExpressVPN or Kape Technologies and any Israeli or foreign defence entity has been identified.³⁴

No public evidence identified.

Dual-Use Products & Tactical Variants

Militarised Product Lines

ExpressVPN’s product is a standard consumer and business virtual private network (VPN) service. No ruggedised, tactical, mil-spec, or defence-grade variant of any ExpressVPN or Kape Technologies product has been publicly marketed, described in trade documentation, or documented as having been sold to Israeli security forces or any other military end-user.¹² Kape’s broader product portfolio — encompassing antivirus and cybersecurity tools acquired through the Webselenese and related brand acquisitions — consists of general-purpose consumer security software. No tactical variant purpose-built for any state security body is documented.²

No public evidence identified of militarised product variants purpose-built for Israeli security forces.

Civilian-to-Military Architectural Observations

The Crossrider ad-injection platform, which preceded Kape Technologies’ rebranding, employed traffic-routing and injection mechanisms that share architectural characteristics with Man-in-the-Middle interception techniques used in certain intelligence-collection toolchains.¹ This is a structural observation about software architecture patterns and is noted here as contextual technical background only. It does not constitute evidence of a purpose-built military product, a verified dual-use classification, or a confirmed supply to any military or intelligence end-user. The Crossrider platform has been discontinued and Kape’s current product lines do not replicate it.¹²

No public evidence identified of purpose-built military-specified or contract-modified Kape or ExpressVPN products supplied to any state security body.

End-User Certification & Export Licensing

No export licence application, end-user certificate (EUC), or government export control review relating to ExpressVPN or Kape Technologies products supplied to Israeli defence, intelligence, or security end-users has been identified in training data or in underlying research.⁵¹

No public evidence identified.

Heavy Machinery, Construction & Infrastructure

ExpressVPN and Kape Technologies are digital software businesses with no operations in manufacturing, construction, logistics, or physical infrastructure. They do not produce, distribute, or operate heavy machinery, construction equipment, vehicles, or physical infrastructure products of any category.

No plausible supply pathway exists for ExpressVPN or Kape Technologies equipment or services in occupied territory construction activity, settlement infrastructure projects, separation barrier construction, military checkpoint construction, or IDF base maintenance and expansion programmes. Source classes checked: UN documentation databases, NGO databases (Who Profits, B’Tselem — via training data), Amnesty International reporting, Human Rights Watch reporting. None reference this entity in this domain.

No public evidence identified across all sub-categories.

Supply Chain Integration with Defence Primes

Claimed Component Supply to Israeli Defence Manufacturers

The MISP Galaxy “Surveillance Vendor” community threat-intelligence database contains an entry that, as cited in prior research, states: “Its clients include other companies engaged in surveillance activities, such as Elbit Systems, Verint, and Rafael Advanced Defense Systems Ltd.”⁶

Critical validation assessment: This claim requires careful scrutiny. MISP Galaxy is a community-contributed open-source threat intelligence resource; entries are not peer-reviewed and do not consistently cite primary procurement or contractual sources.⁶ The specific assertion that Elbit Systems and Rafael Advanced Defense Systems were clients of Crossrider or Kape — meaning they purchased and deployed Crossrider’s ad-injection SDK or a related platform service — is not independently corroborated by any verified corporate filing, procurement record, press release, or major news report identified in training data. The prior research report itself acknowledges “some ambiguity in the snippets regarding whether this description applies to ‘Assac Networks’ or ‘Crossrider’ due to shared database classifications,” which is a significant caveat that materially undermines the claim’s reliability.⁶

Assac Networks is a separate Israeli surveillance technology company; conflation of Crossrider and Assac Networks within the MISP Galaxy taxonomy cannot be ruled out without direct inspection of the full database entry’s provenance and linked primary sources. That disambiguation was not possible during this research session.⁶

No verified supply relationship between Kape Technologies, ExpressVPN, or their predecessor Crossrider and Elbit Systems, Israel Aerospace Industries (IAI), Rafael Advanced Defense Systems, or Israeli Military Industries (IMI/Elbit) has been identified in corporate filings, defence trade press, official procurement records, or news reporting.¹²

No verified public evidence identified of component, sub-system, or service supply to Israeli defence prime contractors. The MISP Galaxy claim is noted as unverified and potentially misattributed.

Joint Development & Co-Production

No joint development agreement, co-production arrangement, or technology-transfer agreement between Kape Technologies or ExpressVPN and any Israeli or international defence prime contractor has been identified.¹²⁴

No public evidence identified.

Logistical Sustainment & Base Services

ExpressVPN and Kape Technologies are digital-services businesses. They do not operate catering, transport, fuel supply, waste management, facilities maintenance, cleaning, security guarding, or physical freight and logistics businesses in any market.

No service contract supplying any logistical sustainment function to IDF bases, Israeli military training facilities, detention centres, or security installations — in Israel, the occupied Palestinian territory, or any other geography — has been identified in any procurement announcement, news report, or corporate disclosure.¹²⁴ Source classes checked: IDF procurement announcements, Israeli government tender portals (via training data), news reporting.

No shipping, freight forwarding, port handling, or military supply-chain logistics contract servicing Israeli defence operations has been identified for this corporate group.

No public evidence identified across all sub-categories.

Munitions, Weapons Systems & Strategic Platforms

ExpressVPN and Kape Technologies are digital consumer software businesses with no documented role — past or present — in arms manufacturing, munitions production or supply, weapons systems integration, ordnance handling, or strategic defence platform development.

No evidence has been identified across any of the following sub-categories: lethal systems manufacturing; munitions supply or distribution; component supply for Israeli strategic platforms (Iron Dome, David’s Sling, Arrow missile defence, F-35 programme, Merkava main battle tank); weapons guidance, fire-control, or targeting software; explosives or propellant supply. Source classes checked: Israeli defence procurement records, SIPRI arms trade database (via training data), export licence filings across UK, EU, and US jurisdictions, news reporting.

No public evidence identified across all sub-categories.

Export Licensing, Regulatory & Legal History

Export Licence Decisions

No government decision — in any jurisdiction including the United Kingdom, European Union member states, the United States, or Israel — to grant, deny, suspend, or revoke an export licence for any Kape Technologies or ExpressVPN product destined for Israeli military, intelligence, or security end-users has been identified.¹²

No public evidence identified.

Arms Embargo & Sanctions Compliance

No investigation, formal citation, notice of violation, or enforcement action related to arms embargo compliance or export control regime violations by Kape Technologies or ExpressVPN in connection with Israel or any other jurisdiction’s arms embargo has been identified.⁵¹

No public evidence identified.

Legal Challenges & Judicial Review — Daniel Gericke / Project Raven (US DOJ, 2021)

The single verified regulatory and legal action involving Kape-affiliated personnel in a defence-adjacent context is the US Department of Justice Deferred Prosecution Agreement (DPA) against Daniel Gericke, announced 14 September 2021, alongside two co-defendants — Marc Baier and Ryan Adams.⁵

• Charges: Gericke and his co-defendants were charged with violating US export control laws — specifically the International Traffic in Arms Regulations (ITAR) and the Computer Fraud and Abuse Act (CFAA) — for providing hacking-for-hire and cyber-surveillance services to the UAE government via the covert “Project Raven” programme, operated through a UAE government-linked front company.⁵⁷⁸
• Settlement: Gericke agreed to pay a $335,000 financial penalty, cooperate with government authorities, and accept permanent bans on future US security clearances and on future employment involving computer network exploitation or intrusion services.⁵⁷
• Scope limitation: This action concerns Gericke’s employment prior to joining ExpressVPN, by a UAE government-linked contractor. It does not allege any wrongdoing by ExpressVPN or Kape Technologies as corporate entities, and it does not involve any supply relationship with the Israeli state, IDF, or Israeli intelligence services.⁸³
• ExpressVPN’s prior knowledge: VICE / Motherboard reported that ExpressVPN had knowledge of “key facts” of Gericke’s background — specifically his prior work for UAE intelligence-linked entities — before the DOJ charges became public.⁸ ExpressVPN issued a public statement defending its decision to retain him after conducting its own review.³ Following the public announcement of DOJ charges, Gericke departed the company.⁹
• ZDNET analysis: An in-depth technical and reputational analysis published by ZDNET documented the significant trust damage the episode caused to ExpressVPN’s credibility as a privacy product, given the inherent conflict between a VPN service’s privacy claims and its senior security executive’s prior participation in a state-sponsored surveillance programme.⁹

No court proceedings, judicial reviews, regulatory investigations, or legal challenges specifically related to ExpressVPN or Kape Technologies’ defence supply or security-sector commercial relationships with Israel have been identified.¹²

Civil Society Scrutiny & Documented Investigations

NGO Research Profiles

• Who Profits (Israeli NGO): No Who Profits research profile specifically naming ExpressVPN or Kape Technologies as a subject of investigation for military supply, settlement economic activity, or occupation-related services has been identified in training data. Who Profits’ database coverage of digital and software companies is limited relative to its coverage of physical goods sectors. Live database access was not available during this research session. No public evidence identified from this source class.

• Amnesty International / Human Rights Watch: No published investigation by Amnesty International or Human Rights Watch specifically addressing ExpressVPN or Kape Technologies’ military or occupation-related supply chain relationships has been identified. No public evidence identified from these source classes.

• AFSC Investigate / Corporate Occupation / UN Human Rights databases: No entries referencing ExpressVPN or Kape Technologies in a military supply or occupation context have been identified in these databases via training data. No public evidence identified from these source classes.

BDS-Aligned Consumer Campaigns

• Boycat: The Boycat consumer boycott platform and publication published an article on ExpressVPN’s Israeli ownership structure, Teddy Sagi’s UBO status, and associated concerns about IDF-linked donations by Sagi personally.¹⁰ This constitutes a documented consumer-level boycott campaign recommendation. Boycat is an advocacy publication, not an NGO forensic investigation body. Its sourcing draws substantially from secondary sources — principally the Windscribe blog¹¹¹ and Reddit¹² — and does not cite primary procurement records, corporate filings, or official documents to support specific military supply claims.

• Institutional divestment: No institutional divestment decision by any pension fund, sovereign wealth fund, university endowment, or public investment vehicle specifically citing ExpressVPN or Kape Technologies’ defence sector activities has been identified in training data. No public evidence identified.

• BDS National Committee / US Campaign for Palestinian Rights: No major BDS organisational campaign specifically featuring ExpressVPN or Kape Technologies as a named target has been identified in training data. No public evidence identified.

MISP Galaxy Surveillance-Vendor Entry

The MISP Galaxy surveillance-vendor community database contains an entry relevant to Crossrider or a closely associated entity that has been cited in civil society commentary.⁶ As assessed in the Supply Chain Integration section above, the client-list claim therein — naming Elbit Systems and Rafael — is unverified, lacks a cited primary source, and may be misattributed to a different entity (Assac Networks). This entry has circulated in advocacy and secondary-source commentary¹⁰¹²¹³ but has not been validated by any major investigative news outlet or NGO forensic report.

Secondary and Advocacy Media Coverage

• Windscribe Blog: Two articles by competitor VPN provider Windscribe document Kape’s ownership structure, its Crossrider heritage, and raise concerns about the concentration of VPN market ownership.¹¹¹ These are secondary sources published by a commercial competitor with an evident interest in reputational differentiation. Their factual claims regarding corporate structure are broadly consistent with verifiable records, but their analytical conclusions are advocacy in nature.

• CyberInsider: Multiple CyberInsider articles document Kape’s acquisition of ExpressVPN, CyberGhost, Private Internet Access, Zenmate, and the Webselenese review-site portfolio (vpnMentor, WizCase).²¹⁴ The conflict-of-interest concern regarding VPN review site rankings — given that Kape-owned review sites prominently feature Kape-owned VPN products — is documented and noted in industry commentary.¹⁴¹³

• VPNpro: VPNpro’s industry analysis on hidden VPN ownership structures includes Kape Technologies in its mapping of VPN corporate consolidation.¹³

• Reddit: Community discussion threads on r/vpnreviews document consumer-level awareness of Kape’s ownership structure and Crossrider heritage.¹² These are not investigative sources.

• “The Perspective” (October 2025): Cited in the prior research report in the context of Israeli surveillance technology’s global reach.¹⁵ Training data cannot confirm this specific article directly addresses ExpressVPN or Kape Technologies. Status: Unverifiable — cannot confirm article specifically addresses this target.

Ownership & Personnel Background — Contextual Record

The following biographical and ownership facts are verified from training data and documented in the public record. They bear on the audit’s evidentiary landscape but do not individually constitute evidence of direct V-MIL supply relationships:

• Teddy Sagi (UBO): Confirmed as the ultimate beneficial owner of Kape Technologies via the Unikmind holding structure (Isle of Man).¹⁶¹⁷ Kape was taken private and delisted from the London Stock Exchange in 2023, eliminating the public financial disclosure obligations that applied during its listed period.¹⁶ Sagi’s 1996 Israeli criminal conviction for fraud and bribery in connection with the Tel Aviv Stock Exchange options affair is confirmed in public reporting.¹⁶ His October 2023 personal donation of NIS 1 million to the Omer Adam soldier-transport initiative — a charitable fund providing taxi transport for Israeli soldiers following the 7 October Hamas attack — is reported by Globes.¹⁸ His 2019 personal donation of approximately $3 million to the Friends of the Israel Defence Forces / LIBI fund is reported by Globes.¹⁹ Both are donations by a private individual, not corporate acts of ExpressVPN or Kape Technologies, and do not constitute corporate defence contracting.

• Ido Erlichman (CEO, Kape Technologies): Erlichman’s prior service in the Duvdevan undercover special forces unit (Unit 217, IDF) is reported in Calcalist Tech / Ctech.²⁰ He co-authored a book about that service.²⁰ This is a verified biographical fact; it does not establish any corporate supply relationship between Kape and the IDF.

• Koby Menachemi (Co-founder, Crossrider/Kape): Service in IDF Unit 8200 (signals intelligence) is reported in secondary sources including the Windscribe blog and CyberInsider.¹²²¹ This claim has not been independently confirmed from a primary news report, official biography, or verified LinkedIn profile in training data. Status: plausible but not independently verified from a primary source. Unit 8200 is Israel’s primary signals intelligence unit, broadly analogous to GCHQ or NSA.²¹

• Daniel Gericke (Former CIO, ExpressVPN): Fully documented by US DOJ primary sources.⁵⁷⁸³⁹ See Export Licensing section above for full detail.

• Kape R&D presence in Tel Aviv: Confirmed by Craft.co and PitchBook company profile data.²²¹⁷

• Webselenese acquisition (vpnMentor, WizCase): Kape’s acquisition of Webselenese in March 2021 for approximately $149 million is confirmed.²¹⁴ The resulting ownership of major VPN review properties by a VPN operator group is documented as a conflict-of-interest concern in industry commentary.¹⁴

Corporate Response to Civil Society Pressure

ExpressVPN’s only documented public response to civil society or reputational pressure in a defence-adjacent context is the September 2021 statement on Daniel Gericke, which addresses his Project Raven history (UAE intelligence services, not Israel) and the company’s decision-making in retaining him.³ No public statement, policy change, contract termination, end-use monitoring commitment, or supply-chain audit by ExpressVPN or Kape Technologies in response to scrutiny specifically regarding Israeli military supply or occupation-related activities has been identified.³⁴

No public evidence identified of corporate response to military supply-chain scrutiny concerning Israel.

End Notes