From a list of more than 50,000 cellphone numbers obtained
by the Paris-based journalism nonprofit Forbidden Stories and the human rights
group Amnesty International and shared with 16 news organizations, journalists
were able to identify more than 1,000 individuals in 50 countries who were
allegedly selected by NSO clients for potential surveillance.
They include 189 journalists, more than 600 politicians and
government officials, at least 65 business executives, 85 human rights
activists and several heads of state, according to The Washington Post, a
consortium member. The journalists work for organizations including The
Associated Press, Reuters, CNN, The Wall Street Journal, Le Monde and The
Financial Times.
Amnesty also reported that its forensic researchers had
determined that NSO Group's flagship Pegasus spyware was successfully installed
on the phone of Post journalist Jamal Khashoggi's fiancee, Hatice Cengiz, just
four days after he was killed in the Saudi Consulate in Istanbul in 2018. The
company had previously been implicated in other spying on Khashoggi.
NSO Group denied in an emailed response to AP questions that
it has ever maintained “a list of potential, past or existing targets.” In a
separate statement, it called the Forbidden Stories report “full of wrong
assumptions and uncorroborated theories.”
The company reiterated its claims that it only sells to
“vetted government agencies” for use against terrorists and major criminals and
that it has no visibility into its customers’ data. Critics call those claims
dishonest — and have provided evidence that NSO directly manages the high-tech
spying. They say the repeated abuse of Pegasus spyware highlights the nearly
complete lack of regulation of the private global surveillance industry.
The source of the leak — and how it was authenticated -- was
not disclosed. While a phone number's presence in the data does not mean an
attempt was made to hack a device, the consortium said it believed the data
indicated potential targets of NSO's government clients. The Post said it
identified 37 hacked smartphones on the list. The Guardian, another consortium
member, reported that Amnesty had found traces of Pegasus infections on the
cellphones of 15 journalists who let their phones be examined after discovering
their number was in the leaked data.
The most numbers on the list, 15,000, were for Mexican
phones, with a large share in the Middle East. NSO Group's spyware has been
implicated in targeted surveillance chiefly in the Middle East and Mexico.
Saudi Arabia is reported to be among NSO clients. Also on the lists were phones
in countries including France, Hungary, India, Azerbaijan, Kazakhstan and
Pakistan.
“The number of journalists identified as targets vividly
illustrates how Pegasus is used as a tool to intimidate critical media. It is
about controlling public narrative, resisting scrutiny, and suppressing any
dissenting voice,” Amnesty quoted its secretary-general, Agnes Callamard, as
saying.
In one case highlighted by the Guardian, Mexican reporter Cecilio
Pineda Birto was assassinated in 2017 a few weeks after his cell phone number
appeared on the leaked list.
AP's director of media relations, Lauren Easton, said the
company is “deeply troubled to learn that two AP journalists, along with
journalists from many news organizations” are on the list of the 1,000
potential targets for Pegasus infection. She said the AP was investigating to
try to determine if its two staffers' devices were compromised by the spyware.
The consortium's findings build on extensive work by
cybersecurity researchers, primarily from the University of Toronto-based
watchdog Citizen Lab. NSO targets identified by researchers beginning in 2016
include dozens of Al-Jazeera journalists and executives, New York Times Beirut
bureau chief Ben Hubbard, Moroccan journalist and activist Omar Radi and
prominent Mexican anti-corruption reporter Carmen Aristegui. Her phone number
was on the list, the Post reported. The Times said Hubbard and its former
Mexico City bureau chief, Azam Ahmed, were on the list.
Two Hungarian investigative journalists, Andras Szabo and
Szabolcs Panyi, were among journalists on the list whose phones were
successfully infected with Pegasus, the Guardian reported.
Among more than two dozen previously documented Mexican
targets are proponents of a soda tax, opposition politicians, human rights
activists investigating a mass disappearance and the widow of a slain
journalist. In the Middle East, the victims have mostly been journalists and
dissidents, allegedly targeted by the Saudi and United Arab Emirates
governments.
The consortium's “Pegasus Project” reporting bolsters
accusations that not just autocratic regimes but democratic governments,
including India and Mexico, have used NSO Group's Pegasus spyware for political
ends. Its members, who include Le Monde and Sueddeutsche Zeitung of Germany,
are promising a series of stories based on the leak.
Pegasus infiltrates phones to vacuum up personal and
location data and surreptitiously control the smartphone’s microphones and
cameras. In the case of journalists, that lets hackers spy on reporters’
communications with sources.
The program is designed to bypass detection and mask its
activity. NSO Group’s methods to infect its victims have grown so sophisticated
that researchers say it can now do so without any user interaction, the
so-called “zero-click” option.
In 2019, WhatsApp and its parent company Facebook sued NSO
Group in U.S. federal court in San Francisco, accusing it of exploiting a flaw
in the popular encrypted messaging service to target — with missed calls alone
— some 1,400 users. NSO Group denies the accusations.
The Israeli company was sued the previous year in Israel and
Cyprus, both countries from which it exports products. The plaintiffs include
Al-Jazeera journalists, as well as other Qatari, Mexican and Saudi journalists
and activists who say the company’s spyware was used to hack them.
Several of the suits draw heavily on leaked material
provided to Abdullah Al-Athbah, editor of the Qatari newspaper Al-Arab and one
of the alleged victims. The material appears to show officials in the United
Arab Emirates discussing whether to hack into the phones of senior figures in
Saudi Arabia and Qatar, including members of the Qatari royal family.
NSO Group does not disclose its clients and says it sells
its technology to Israeli-approved governments to help them target terrorists
and break up pedophile rings and sex- and drug-trafficking rings. It claims its
software has helped save thousands of lives and denies its technology was in
any way associated with Khashoggi's murder.
NSO Group also denies involvement in elaborate undercover
operations uncovered by The AP in 2019 in which shadowy operatives targeted NSO
critics including a Citizen Lab researcher to try to discredit them.
Last year, an Israeli court dismissed an Amnesty
International lawsuit seeking to strip NSO of its export license, citing
insufficient evidence.
NSO Group is far from the only merchant of commercial
spyware. But its behavior has drawn the most attention, and critics say that is
with good reason.
Last month, it published its first transparency report, in
which it says it has rejected “more than $300 million in sales opportunities as
a result of its human rights review processes.” Eva Galperin, director of
cybersecurity at the Electronic Frontier Foundation and a strident critic,
tweeted: “If this report was printed, it would not be worth the paper it was
printed on.”
A new, interactive online data platform created by the group
Forensic Architecture with support from Citizen Lab and Amnesty International
catalogs NSO Group’s activities by country and target. The group partnered with
filmmaker Laura Poitras, best known for her 2014 documentary “Citzenfour” about
NSA whistleblower Edward Snowden, who offers video narrations.
“Stop what you're doing and read this,” Snowden tweeted
Sunday, referencing the consortium's findings. “This leak is going to be the
story of the year.”
Since 2019, the U.K. private equity firm Novalpina Capital
has controlled a majority stake in NSO Group. Earlier this year, Israeli media
reported the company was considering an initial public offering, most likely on
the Tel Aviv Stock Exchange.