Governments Used Spyware to Surveil Journalists and Activists. Here’s Why Revelations About Pegasus Are Shaking Up the World

Activist groups are calling on governments to step in to regulate the sale of spyware after data was leaked to major news outlets showing hundreds of journalists, activists, dissidents and lawyers around the world likely had their phones targeted by invasive surveillance software was leaked to major news outlets.

“The industry has shown that it is incapable of policing itself, while governments—including democratic states—are hiding behind national security to whitewash these surveillance abuses,” said the digital rights group Access Now in a statement. “We need regulation, transparency, and accountability now.”

The dataset, obtained by the non-profit Forbidden Stories and shared with Amnesty International and several publications, contains a list of phone numbers believed to have been selected for surveillance by clients of NSO Group, an Israel-based company that developed a piece of spyware called Pegasus that can harvest information from a target’s smartphone.

Among the 37 confirmed victims are well-known public figures such as Hatice Cengiz, the fiancee​ of murdered Saudi journalist Jamal Khashoggi, and Roula Khalaf, the editor of the Financial Times newspaper. They submitted their phones for forensic analysis to confirm infection.

But the number of potential victims is far higher: more than 50,000 phone numbers were included on the leaked list. They include Indian opposition leader Rahul Gandhi and Fatima Movlamli, an Azerbaijani activist who had intimate photos of herself leaked online in 2019.

According to NSO, Pegasus infects a target’s phone and can access all data, as well as remotely activate the cameras and microphone. The company says it only sells its software to “vetted” governments and intelligence agencies, but the targets identified in the leaked dataset suggest that its services are being used by authoritarian states with extensive records of human rights abuses.

At least 180 journalists around the world were among those selected for targeting, according to the Guardian newspaper.

One of them was Swati Chaturvedi, an Indian investigative journalist who in 2016 published an expose of the inner workings of the ruling party’s online disinformation operation. “For me, the most worrying thing was my sources and my family,” she said in an interview with TIME. “For three days, I was literally getting chills. Having a thick skin and doing investigative reporting is one thing. But this is worse than Big Brother. It sends a message of total intimidation: Don’t report. Don’t tell the truth. Because we are watching you, and we can be very aggressive and very nasty to you.”

“I was not in the least surprised that I was targeted,” said Paranjoy Guha Thakurta, a journalist whose iPhone was confirmed by Forbidden Stories to have been infected by Pegasus, at a time when he was working on a story about connections between Facebook and the Indian government. “We need an inquiry.”

“India describes itself as the world’s largest democracy,” Chaturvedi says. “In a democracy, you’re not supposed to attack your own citizens. This kind of unauthorized surveillance is the fiercest attack that anyone can do in a democracy.”

The potential scale of the software’s reach reveals for the first time the extent to which governments around the world are making use of a new private market for spyware. “A couple of decades ago, if you wanted to do this kind of hacking in your government, you basically needed to have a massive STEM sector,” said John Scott-Railton, a researcher at Citizen Lab, in a public talk in March. “But today, all you need is a checkbook.” (Citizen Lab is a digital surveillance research group based at the University of Toronto, which analyzed several of the phones identified in the Forbidden Stories leak.)

Several journalists told TIME they were waiting for analyses of their devices to come back, suggesting that the number of confirmed victims could still rise higher.
 

Is your country on this Pegasus Spyware list?#PegasusProject pic.twitter.com/jWuSXLhKtR

— Amnesty International (@amnesty) July 19, 2021

“It’s a profound shift in the balance of power between a state and a population, when the state with almost no friction can slide its way into all of your lives,” Scott-Railton said in March. “If you really want to understand me, get on my phone. That means that it is a profound change in the relationship of power, and it should be the subject of a large public conversation. Unfortunately, many of the people who are pushing for the acquisition and use of these technologies would prefer the use continue to be secret.”

“While these revelations are vital in shedding light on the murky industry, there are likely countless others that have been targeted and that are unaware their digital activity is secretly being monitored,” says Samuel Woodhams, a researcher at Privacy.co.

The spyware industry continues to be largely unregulated, in part because states themselves are often the customers for these services, but the latest revelations could spur the international community to act.

“Until meaningful restrictions are imposed on the creation and distribution of spyware, it will continue to be used to undermine human rights and democracy,” says Woodhams.

In a statement to media organizations that broke the story, the NSO group said it “denies false claims made in your report, many of which are uncorroborated theories that raise serious doubts about the reliability of your sources.”

The group specifically denied that its technology was “in any way” associated with the murder of dissident Saudi journalist Khashoggi, who was killed by Saudi agents inside the kingdom’s embassy in Turkey allegedly on the orders of Crown Prince Mohamed Bin Salman.

But NSO also added that it does not have insight into what its clients do with its software. The company said in the statement that it “does not have access to the data of its customers’ targets,” and NSO does not “collect, nor possess, nor has any access to any kind of data of its customers.”