Smartphones of journalists and opposition members spied on worldwide
According to media reports, the Pegasus surveillance software of the Israeli company NSO has been used to spy on even more opposition figures and journalists than previously known. Traces of the spyware have been found on 37 smartphones of media workers, human rights activists and their relatives as well as business people. This was reported by an international consortium of journalists in cooperation with the organisations Forbidden Stories and Amnesty International. They had analysed a data set with more than 50,000 telephone numbers, which had apparently been selected by Pegasus users as potential spying targets.
Among others, NDR, WDR, Süddeutsche Zeitung, Die Zeit, The Guardian and several international media are involved in the research, which is known as the “Pegasus Project”.
According to the report, the list of telephone numbers includes entries from 2016 to 2021 from at least ten of the company’s customers. According to its own information, NSO only sells its surveillance technology to government agencies.
The journalists were able to assign thousands of telephone numbers to specific persons, including heads of state and government. In addition, the numbers of more than 180 journalists were on the list, including the editor-in-chief of the British Financial Times, editors of the French media Le Monde, Mediapart and Le Canard Enchainé, as well as from Hungary and Azerbaijan. Government critics in India and a Mexican journalist killed in 2017 are also on the list.
IT experts from the Amnesty International Security Lab were able to forensically examine the iPhones of 44 people on the list and detect traces of Pegasus in 37 cases. The Citizen Lab of the University of Toronto has verified the method. On some smartphones, the Trojan is said to have been active until July of this year.
Journalists in Hungary, Azerbaijan and France
The victims are said to include several investigative journalists from Hungary. A former NSO employee confirmed to the media involved in the research that Hungary was or still is one of NSO’s customers. It is unclear, however, which specific agency is behind these wiretaps.
In Azerbaijan, several journalists critical of the government are also said to have been monitored. In addition, the mobile phones of two journalists from the French online newspaper Mediapart were attacked with Pegasus between 2019 and 2020. This was allegedly done by Moroccan secret services.
The fiancée of Saudi Arabian journalist Jamal Khashoggi, who was murdered in 2018, was also found to have been monitored with Pegasus: Her smartphone was infected with Pegasus four days after the murder. Khashoggi was also allegedly spied on using the software before he was murdered.
Pegasus turns smartphones into bugs
If the Pegasus Trojan is installed on a phone, attackers can, for example, switch on the microphone unnoticed in order to record conversations. In addition, phone calls can be listened to, chats can be read and pictures can be taken. The spy programme is installed remotely by attackers. This is even said to be possible without the victims having to click on a link or become active in any other way: The attackers send a prepared message that is not displayed on the device and automatically downloads and activates the spy software.
Clarification demanded
In a statement on Sunday, NSO spoke of “false accusations and misleading allegations” with regard to the research. There was “no factual basis” for the allegations. The company’s software was also “in no way connected to the heinous murder of Jamal Khashoggi”. As in the past, NSO asserted that Pegasus is “sold exclusively to law enforcement agencies and intelligence agencies of vetted governments for the sole purpose of saving lives by preventing crime and acts of terrorism”.
Agnès Callamard, Secretary General of Amnesty International, on the other hand, said: “The Pegasus project reveals that NSO’s spyware is a weapon of choice for repressive governments seeking to silence journalists, attack activists and suppress dissent, putting countless lives at risk.” While the company claims that the software is only used for legitimate criminal investigations, it is clear that the technology enables systematic abuse, he said.
France’s government spokesman Gabriel Attal reacted indignantly to the reports. “This is of course an extremely shocking state of affairs,” he told Franceinfo on Monday and announced investigations. In Hungary, opposition politicians and a journalists’ association are also pushing for immediate clarification. Meanwhile, Hungary’s Foreign Minister Peter Szijjarto has rejected accusations that his country has used Pegasus to monitor journalists and opposition members. He said the IH secret service was prepared to provide information to the Hungarian parliament’s security committee.
The German Federation of Journalists (DJV) is also demanding information from German security authorities and secret services on whether the Pegasus spying software was used against German journalists. The DJV federal chair Frank Überall spoke of (in German) an “unprecedented surveillance scandal”.
The organisation Reporters Without Borders (RSF) also expressed shock (in German) at the large number of states that are said to have monitored media workers. RSF’s German director Christian Mihr demanded: “The revelations of the Pegasus project must be a wake-up call: The international community must now put a stop to the global trade in surveillance technology. Proposals for binding export rules have been on the table for years and must finally be implemented.” Amnesty International also called for an immediate moratorium on the export, sale and use of surveillance technologies.
Repeated human rights violations
The Pegasus software has been criticised for years in connection with human rights violations: for example, as recently as December 2020, security researchers at Citizen Lab revealed that Pegasus had been used to spy on the mobile phones of 36 employees of the news channel Al Jazeera (in German). According to the investigation, the attackers had connections to the governments of Saudi Arabia and the United Arab Emirates.
RSF as well as other organisations such as Amnesty International and Human Rights Watch had last accused NSO in May (in German) of not adhering to human rights standards despite promises to do so. (dpa / js)