European politicians and media groups voiced outrage Monday over reports that an Israeli firm supplied phone malware used by governments to spy on activists, journalists, lawyers and politicians in several countries.
The NSO Group and its Pegasus malware — capable of switching on a phone’s camera or microphone and harvesting its data — have been in the headlines since 2016, when researchers accused it of helping spy on a dissident in the United Arab Emirates.
A collaborative investigation by The Washington Post, The Guardian, Le Monde and other media outlets, based on a leaked list of 50,000 phone numbers, revealed the spying may have been far more extensive.
The leaked numbers are believed to be connected to people identified by NSO clients as potential surveillance targets.
They include one linked to a murdered Mexican journalist and family members of murdered Saudi journalist Jamal Khashoggi.
Speaking in Prague, European Commission chief Ursula von der Leyen said the spying, if confirmed, was “completely unacceptable” — sentiments echoed by France.
“These are extremely shocking acts and, if proven, are extremely serious,” government spokesman Gabriel Attal said.
– Authoritarian regimes –
It is unclear how many devices were actually targeted or surveilled and NSO has denied any wrongdoing.
But the claims that countries such as Azerbaijan, Hungary, India and Morocco, where authorities have cracked down on independent media, spied on dissident journalists at home and abroad sparked widespread indignation.
The other countries that accounted for most of the numbers on the list were Azerbaijan, Bahrain, Kazakhstan, Mexico, Rwanda, Saudi Arabia and the United Arab Emirates.
French investigative news site Mediapart claimed that the phones of its founder Edwy Plenel and one of its journalists were among those targeted by Moroccan intelligence services and said it had filed a criminal complaint.
Morocco denied the claims, saying it “never acquired computer software to infiltrate communication devices”.
– ‘Rogue’ operators –
Pegasus is a highly invasive tool that can switch on a target’s phone camera and microphone, as well as access data on the device, effectively turning a phone into a pocket spy.
In some cases, it can be installed without the need to trick a user into initiating a download.
NSO insists it is only intended for use in fighting terrorism and other crimes, and that any other use is the work of “rogue” operators — claims rubbished by Amnesty International.
“The Pegasus Project lays bare how NSO’s spyware is a weapon of choice for repressive governments seeking to silence journalists, attack activists and crush dissent, placing countless lives in peril,” Amnesty International chief Agnes Callamard said in a statement.
“While the company claims its spyware is only used for legitimate criminal and terror investigations, it’s clear its technology facilitates systemic abuse.”
The Post said the numbers on the list were unattributed, but other media outlets participating in the project were able to identify more than 1,000 people in more than 50 countries.
They included several members of Arab royal families, at least 65 business executives, 85 human rights activists, 189 journalists and more than 600 politicians and government officials — including heads of state, prime ministers and cabinet ministers.
– Khashoggi links –
The investigation identified at least 180 journalists in 20 countries who were selected for potential targeting with Pegasus between 2016 to June 2021.
On the list were 15,000 numbers in Mexico — among them reportedly a number linked to Mexican journalist Cecilio Pineda, who was killed in 2017 — and 300 in India, including politicians and prominent journalists.
Leading Indian opposition figure Rahul Gandhi was twice selected as a potential surveillance target, The Guardian reported.
Among the numbers on the list are those of journalists for Agence France-Presse, The Wall Street Journal, CNN, The New York Times, Al Jazeera, El Pais, the Associated Press, Le Monde, Bloomberg, The Economist, and Reuters, The Guardian said.
NSO Group, which is based in the Israeli hi-tech hub of Herzliya, near Tel Aviv, denied any wrongdoing.
It issued a denial on Sunday, calling the investigation “full of wrong assumptions and uncorroborated theories”, and threatening a defamation lawsuit.
“We firmly deny the false allegations made in their report,” NSO said.
It said it was “not associated in any way” with the Khashoggi murder, adding that it sells “solely to law enforcement and intelligence agencies of vetted governments”.
The Washington Post said a forensic analysis of 37 of the smartphones on the list showed there had been “attempted and successful” hacks of the devices, including those of two women close to Khashoggi, who was murdered in 2018 by a Saudi hit squad.
