Journalism investigatigation
The Pegasus Project is an international investigative journalism initiative that revealed governments' espionage on journalists, opposition politicians, activists, business people and others using the private Pegasus spyware developed by the Israeli technology and cyber-arms company NSO Group. Pegasus is ostensibly marketed for surveillance of "serious crimes and terrorism". In 2020, a target list of 50,000 phone numbers leaked to Forbidden Stories, and an analysis revealed the list contained the numbers of leading opposition politicians, human rights activists, journalists, lawyers and other political dissidents.
A small number of phones that were inspected by Amnesty International's cybersecurity team revealed forensic evidence of the Pegasus spyware, a zero-click Trojan virus developed by NSO Group. This malware provides the attacker full access to the targeted smartphone, its data, images, photographs and conversations as well as camera, microphone and geolocation. This information was passed along to 17 media organisations under "The Pegasus Project" umbrella name. Reports started to be published by member organisations on 18 July 2021, revealing notable non-criminal targets and analysing the practice as a threat to freedom of the press, freedom of speech, dissidents and democratic opposition. On 20 July, 14 heads of state were revealed as former targets of Pegasus malware. Various parties called for further investigation of the abuses and a limitation on trading such repressive malware, among them the newsrooms involved, the Committee to Protect Journalists, the International Press Institute, and Edward Snowden.
Software.
The Pegasus spyware was developed by the Israeli cyberarms company NSO Group. It can be covertly installed on mobile phones (and other devices) running most versions of iOS and Android. The spyware is named after the mythical winged horse Pegasus—it is a Trojan horse that can be sent "flying through the air" to infect phones. Usages of the Pegasus spyware have been monitored for years. Amnesty has argued that the digital invasion is correlated with real-life consequences for spied targets, via psychological or physical damages.
The NSO Group exports are overseen by the Israeli Ministry of Defense's Defense Exports Control Agency (DECA).
Investigation.
Origins and members.
In 2020, a list of over 50,000 phone numbers believed to belong to individuals identified as "people of interest" by clients of the Israeli cyberarms firm NSO Group was leaked to Amnesty International and Forbidden Stories, a media nonprofit organisation based in Paris, France.
This information was passed along to 17 media organisations under the umbrella name "The Pegasus Project". Over several months, over 80 journalists from "The Guardian" (United Kingdom), "Le Monde" and Radio France (France), "Die Zeit", "Süddeutsche Zeitung", WDR and NDR (Germany), "The Washington Post" and "Frontline" (United States), "Haaretz" (Israel), "Aristegui Noticias" and "Proceso" (Mexico), "Knack" and "Le Soir" (Belgium), "The Wire" (India), "Daraj" (Syria), Direkt36 (Hungary), and OCCRP investigated the spying abuses.
Investigative methodology.
The leaked list of targeted phone numbers provides an indication of being a "person of interest" and a first indication of possible hacking, to be confirmed via direct forensic examination of the phone. According to Amnesty, "The Citizen Lab at the University of Toronto independently peer-reviewed a draft of their forensic methodology outlined in "Forensic Methodology Report: How to catch NSO Group's Pegasus". ;ref name="citizenlab.ca/2021/07/amnesty-peer-review" ; ;/ref ; Amnesty also published various tools or data from this investigation, including a Mobile Verification Toolkit (MVT) and a GitHub repository listing indicators of NSO/Pegasus compromised devices. Some emerging unverified online services claim to be able to assess an infection by Pegasus, but their usage is discouraged as possible scams themselves. Amnesty and Forbidden Stories received numerous queries for checking devices but were not able to satisfy the demand for assistance.
Findings.
The investigation suggested that Pegasus continued to be widely used by authoritarian governments to spy on human rights activists, journalists and lawyers worldwide, although NSO claims that it is only intended for use against criminals and terrorists.
A French journalist noted that "in a matter of cyber-surveillance, we observe that abuse is "de facto" the rule". Forbidden Stories argues the Pegasus software and its usages "de facto" constitute a global weapon to silence journalists.
Forensic Architecture and the Pegasus Project lead a data analysis and built a data visualisation plotting attempt hacking of dissidents together with real-life intimidations, threats or violence. They have argued that Pegasus has become a key tool for states to repress their own people.
Regions and targets.
Targets include known criminals as well as human rights defenders, political opponents, lawyers, diplomats, heads of state and nearly 200 journalists from 24 countries. "The Guardian" mentioned 38 journalists in Morocco, 48 journalists in Azerbaijan, 12 journalists in the United Arab Emirates and 38 journalists in India as having been targeted. Some of the targets whose names have been revealed are listed below; the list is non-exhaustive.
Heads of state and government.
According to an analysis by the German newspaper "Die Zeit" and others, the following incumbent and former heads of state and government have been targeted, implying possible full access to their mobile phones' data:
Hungary.
Used against opposition journalists, opposition leaders and critics.
India.
Used against opposition leaders, union ministers, journalists, administrators such as Election Commissioner and heads of the Central Bureau of Investigation (CBI) and minority leaders.
Mexico.
Used against anti-corruption journalists, opposition leaders and a judge.
Morocco.
Used against opposition, Western Sahara–friendly journalists in Morocco and France, and more than 6,000 Algerian politicians, high-ranking military officials, heads of intelligence, civil servants, diplomats and activists.
Poland.
In July 2017, Prime Minister Beata Szydło agreed with Benjamin Netanyahu to buy Pegasus licenses. Michał Woś, deputy minister of justice, requested a parliamentary committee to divert funds from a ministry-run fund to "combat crime." Once approved, the Central Anticorruption Bureau (CBA) purchased the licenses for PLN 33.4 million. The transaction with NSO Group was camouflaged with unrelated invoices. The contract for 40 licenses to be used over three years was mediated by Matic, a company established by former Militia and Security Service associates. The spyware was first deployed in November 2017.
In 2018, Citizen Lab suspected that an operator codenamed "ORZELBIALY" (Polish for "white eagle," a reference for the coat of arms of Poland) was spreading Pegasus through mobile network operators. In 2020, "Rzeczpospolita" reported that the bulk of evidence in a corruption case against former Civic Platform politician Sławomir Nowak was obtained using Pegasus. The CBA denied ever buying the license, still the government assured it had court permission.
In December 2021, Citizen Lab announced to have found multiple hacks into phones of prominent opposition figures during the 2019 parliamentary elections that the right-wing populist party Law and Justice (PiS) of Jarosław Kaczyński won by a slim margin, which lead to a further erosion of judicial independence and press freedom. As of January 25, 2022, the reported victims include:
On February 7, 2022, the Supreme Audit Office (NIK) revealed that between 2020 and 2021, 544 of its employees' devices were under surveillance in over 7,300 attacks. According to NIK experts, three of the phones could be infected with Pegasus.
On January 17, 2024, the Polish Parliament established a commission of inquiry into operational and exploratory activities involving Pegasus. The scope of the commission's work will cover the period from November 16, 2015 to November 20, 2023.
Saudi Arabia.
Used against an opposition journalist and a women's rights activist since 2018.
United Arab Emirates.
Used against human rights activists, local leaders and local nobility and Sheikh Maktoum family members. With more than 10,000 people of interest linked to Dubai, it was one of the most extensive uses of Pegasus. The targets were mainly from the UAE and Qatar, but also included people from Egypt, Lebanon, Iraq, Yemen, and Saudi Arabia. In 2020, the NSO Pegasus license was stripped from Dubai due to human rights concerns and spying on Sheikh Maktoum family members.
Reactions.
NSO Group's response.
Vetting and licence contract.
NSO Group did not deny the presence of its spyware, responding to the report by stating they rigorously vetted its customers' human rights records before allowing them to use its spy tools. It says military-grade Pegasus is only supposed to be used to prevent serious crime and terrorism. NSO stated its purchasing client governments are bidden by a signed contract and licence, agreeing to terms of uses, and contractually limited to legitimate criminal or terrorist targets. Once sold, NSO Group says it does not know nor can see how its client governments use its spyware.
Involvement denial and deresponsibilisation.
NSO Group stated: "NSO does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers' targets. NSO does not operate its technology, does not collect, nor possesses, nor has any access to any kind of data of its customers. Due to contractual and national security considerations, NSO cannot confirm or deny the identity of our government customers, as well as the identity of customers of which we have shut down systems."
The CEO of NSO Group categorically claimed that the list in question is unrelated to them, the source of the allegations can not be verified as a reliable one. "This is an attempt to build something based on a crazy lack of information... There is something fundamentally wrong with this investigation." The owner of the company that developed the Pegasus spyware categorically refutes all allegations, stating that the list of the phone numbers in question has nothing to do with the Pegasus spyware. NSO denied "false claims" about its clients' activities, but said it would "continue to investigate all credible claims of misuse and take appropriate action".
Journalists/NGOs.
Journalists around the world have expressed outrage at the use of anti-criminality tools against non-criminals, journalists, opposition representatives, and other civilians. Edward Snowden has called for governments to impose a global moratorium on the international spyware trade in order to avoid ubiquitous violation of privacy and associated abuses.
"Haaretz" argued such invasive monitoring technology is the weapon of choice for autocratic governments, allowing continuous monitoring of opponents, preventing protests from the beginning before they are organised, and discouraging sources to share information with journalists. This technology should, therefore, be shared only with countries with independent and solid rule of law.
The Committee to Protect Journalists called for a critical reform of the surveillance software industry and market.
The International Press Institute, an international press freedom network, denounced the abuse of spying on journalists, calling formal investigations and accountability.
Tamer Almisshal, an investigative journalist for Al Jazeera Arabic, said, "[The hacking of the Al Jazeera staffers' and journalists' phones is] a crime against journalism. Based on this spyware, journalists have been arrested, disappeared, or even killed. Khashoggi is just one example".
In a statement, the National Association of Hungarian Journalists said they were "shocked" by the revelations and also stated: "If this is the case, it is unacceptable, outrageous and illegal, full information must be disclosed to the public immediately".
In a tweet, the Press Club of India (PCI) issued a statement: This is the first time in the history of this country that all pillars of our democracy — judiciary, Parliamentarians, media, executives &amp; ministers — have been spied upon. This is unprecedented and the PCI condemns unequivocally. The snooping has been done for ulterior motives. What is disturbing is that a foreign agency, which has nothing to do with the national interest of the country, was engaged to spy on its citizens. This breeds distrust and will invite anarchy. The Govt should come out clean on this front and clarify. Similarly, the Editor's Guild of India also released a statement directed against the alleged spying made by the Indian government, saying:
This act of snooping essentially conveys that journalism and political dissent are now equated with 'terror'. How can a constitutional democracy survive if governments do not make an effort to protect freedom of speech and allows surveillance with such impunity?It asked for a Supreme Court monitored enquiry into the matter, and further demanded that the inquiry committee should include people of impeccable credibility from different walks of life—including journalists and civil society—so that it can independently investigate the facts around the extent and intent of snooping using the services of Pegasus.
Companies.
Amazon's cloud computing subsidiary AWS stated they had terminated "relevant infrastructure and accounts" linked to NSO Group, following an investigation by Amnesty International that discovered Amazon CloudFront was being used to infect targets with the Pegasus malware.
The CEO of WhatsApp, Will Cathcart, called for a global moratorium on the use of unaccountable surveillance technology and defended the use of end-to-end encryption following the reports.
National governments.
Algeria.
In a statement released, Algeria's public prosecutor has ordered an investigation into the