German intelligence agency not required to disclose use of Pegasus
Germany’s foreign intelligence agency, the Bundesnachrichtendienst (BND), is not required to disclose information to the press related to its acquisition and use of Pegasus spyware. The Federal Administrative Court in Leipzig issued a ruling on the matter last week.
Arne Semsrott, editor-in-chief of the online research platform FragDenStaat (“Ask the State”), filed a lawsuit against the BND in August 2023 seeking information about whether the intelligence agency had purchased Pegasus spyware. In the event the BND had acquired the tool, Semsrott also wanted to know how frequently it had been used in previous years – and if it was still in use.
Semsrott filed suit after the BND declined his request for information. The agency justified its decision on the grounds that as a matter of policy it refrained from commenting on all matters that touched on intelligence gathering or other intelligence-related activities.
No disclosures required
The Federal Administrative Court (Bundesverwaltungsgericht) has now sided with the BND. While acknowledging that Semsrott had standing to invoke the constitutional right to freedom of the press – ruling that it was immaterial whether he pursued his work as a journalist in the context of print media or the digital realm – the court decided that a substantial public interest outweighed Semsrott’s journalistic interest in the release of the requested information.
In the court’s view, the BND argued convincingly that the disclosures the plaintiff was seeking could limit its functional capabilities. The aim of Semsrott’s questions was to reveal the agency’s current intelligence work and methods. Disclosing the information requested could do indirect damage to ongoing operations – and the information could also be of significant interest to foreign intelligence agencies.
Pegasus is developed by NSO Group, an Israeli company that claims to sell the tool only to government clients. It can be used to gain complete control of a targeted individual’s smartphone; once the phone has been infiltrated, attackers can for instance read the owner’s chats and listen in on their conversations. The device’s location can also be tracked, and its microphone and camera activated without the device owner’s awareness. According to cybersecurity experts, Pegasus can also be placed on devices as part of so-called zero-click attacks – meaning that the targeted individual has no awareness that their phone is infected, and does not have to trigger the infection by, for example, clicking on a link.
Pegasus used by German agencies
Investigations by Norddeutscher Rundfunk, Westdeutscher Rundfunk, the Süddeutsche Zeitung and Die Zeit revealed in 2021 that the BND had deployed Pegasus abroad. According to the outlets’ reporting, the chancellor’s office under then-Chancellor Angela Merkel had received advance notice and had approved the use of the tool – while the committee in the Bundestag responsible for exercising oversight of the BND was initially kept in the dark.
More precise details about the BND’s use of Pegasus were not made public at the time – neither the BND nor the chancellor’s office disclosed information on the matter.
Prior to these revelations it had come to light that in fall 2020, Germany’s federal police agency, the Bundeskriminalamt (BKA), had acquired Pegasus. BKA Vice President Martina Link confirmed the purchase to the Bundestag’s Committee on Internal Affairs. The BKA reportedly has at its disposal a modified version of Pegasus that was adapted to be in line with German law – the modification was necessary because the standard version of the spyware has capabilities that exceed what is legal in Germany.
Years-long criticism of Pegasus
The revelations of the BKA and BND’s acquisition of Pegasus drew widespread criticism. Among the critics was Bundestag member Konstantin von Notz of the Green Party. Von Notz characterized Pegasus as a “dream for dictators” and a “nightmare for the rule of law” and said it was “highly problematic for a German agency to acquire such an instrument of total surveillance.”
The heightened controversy surrounding Pegasus stems from the fact that the surveillance tool has repeatedly been tied to human rights violations. An investigation led by Amnesty International and an international group of media organizations revealed in summer 2021 how Pegasus had been used to spy on journalists, activists, and opposition figures around the world.
Even before these revelations, however, NSO Group and Pegasus had already come in for criticism for failing to adhere to human rights standards. Human rights experts have long called for a moratorium on Pegasus and related products.
The United States imposed sanctions on NSO Group in November 2021. The US has also placed limits on the use of commercial spyware by government agencies.
In response to the Federal Administrative Court’s ruling, plaintiff Arne Semsrott said that the “antiquated understanding of the press held by many agencies and courts” was now a thing of the past – the acknowledgement that online and print media have the same rights was long overdue, he said. But: “That the BND can still worm its way out of the affair and continue to keep silent on whether it uses the controversial Pegasus software is disappointing.” (js)