The Pegasus spyware scandal in Europe: a threat to free speech across the continent?

November 24, 2021
4:58 pm

Elia Duran-Smith
European Human Rights Researcher

Keywords: human rights, Pegasus Spyware, NSO Group, freedom of speech, media freedom, intelligence

Introduction

After winning the European Parliament’s inaugural Daphne Caruana Galizia prize for journalism, a renewed spotlight has been thrown on the findings of the consortium that revealed the alleged Pegasus spyware scandal.^[1] This article provides an overview of the Pegasus spyware, the findings of the award-winning consortium in Europe and the subsequent actions being taken by European Union (EU) institutions and member states.

About Pegasus

The Pegasus software was created by the Israeli NSO Group. The consortium of 17 media outlets who covered this story claims that they received a leak suggesting the Pegasus software infected over 50,000 phones in 50 countries and has been used to target members of royal families, politicians, public officials, dissenting journalists, and human rights activists.

Reportedly, some of the highest-profile targets have been members of the Emirati royal family, French President Emmanuel Macron, European Council President Charles Michel, and Jamal Khashoggi, the Washington Post journalist who was murdered in the Saudi consulate in Istanbul in 2018.^[2] Nevertheless, the source of the leak is unknown. Moreover, many phones reportedly infected with the Pegasus spyware have had traces of the software but have not been confirmed as infected.^[3]

NSO has denied any wrongdoing and said the list of phone numbers found by the consortium was “not a list of Pegasus targets or potential targets. The numbers in the list are not related to NSO Group in any way.”^[4] The firm maintains that the software is “not a mass surveillance technology”, and the intended purpose of the technology is to target “specific individuals” suspected of committing serious crimes such as terrorism and human trafficking.^[5] However, who is deemed a ‘serious criminal’ and ‘terrorist’ is, of course, subjective; in some authoritarian states, dissent and free government scrutiny is seen as a danger to national security.^[6] Therefore, in those states, journalists and human rights activists may be regarded as perfectly legitimate surveillance targets. Furthermore, those states have little, if any, judicial accountability for the actions of their intelligence agencies.^[7]

NSO claims it is sold only to law enforcement, military and intelligence agencies whose human rights records have been vetted.^[8] Additionally, the NSO Group asserted they only export their software with the consent of the Israeli government and abide by all the country’s procedures, but this has not been independently verified.^[9] NSO also stated that it does not operate the systems and “does not have access to the data of its customers’ targets”.^[10] They also affirmed that they would “continue to investigate all credible claims of misuse and take appropriate action.”^[11] NSO has, in the past, terminated contracts of and revoked access to the Pegasus spyware to five clients since 2016 following investigations into its misuse.^[12]

The software can infect iPhone and Android devices via texts, Whatsapp, iMessage and other unknown vulnerabilities. Information may be harvested by accessing emails, texts, photos and videos, contacts, Whatsapp chats, calendars and GPS data. The software can also reportedly record calls and activate phone cameras and microphones. In 2019, NSO was sued by Whatsapp, which claimed the Group was to blame for Pegasus infections on 1400 phones. Despite NSO denying these claims, NSO has been banned from the messaging app.^[13]

Azerbaijan

Reportedly, more than 40 Azerbaijani journalists have been identified as targets of Pegasus surveillance, including those from the two of the few remaining independent media organisations in the country.^[14] Azerbaijan’s independent news outlets have been targeted for decades, with the majority of independent news outlets now disbanded and families of journalists often facing harassment by national authorities. Human Rights Watch has stated that the right to criticise the government in Azerbaijan has been “virtually extinguished.”^[15]

Hungary

The phone numbers of at least five Hungarian journalists and opposition politician György Gémesi appeared on the leaked list.^[16] The phones of investigative journalists Andras Szabo and Szabolcs Panyi were reportedly found to have been successfully infected with the spyware.^[17] Panyi said this was “devastating” for the future of critical journalism in Hungary. He explained that “it’s every journalist who has been targeted’s concern that once it’s revealed you were surveilled and even our confidential messages could have been compromised, who the hell is going to talk to us in the future? Everyone will think that we’re toxic, that we’re a liability”.^[18]

Hungarian law allows for the intelligence services to carry out surveillance in some cases with only the minister of justice’s signature and no judicial oversight for the purposes of protecting national security. Judit Varga, Hungarian justice minister, declined to comment on this story but did say “every country needs such tools.”^[19] In August 2021, the Hungarian data protection authority announced it had commenced an official investigation into the allegations regarding the Hungarian government’s employment of the Pegasus spyware. Meanwhile, the Hungarian government stated it was “not aware of any alleged data collection.”^[20]

France

Traces of Pegasus spyware were reportedly found in French President Emmanuel Macron’s phone, that of one of his diplomatic advisors, as well as those of at least five cabinet members. The alleged infections mainly occured in 2019 and, to a lesser extent, in 2020. French investigative media outlet Mediapart revealed this information came from anonymous leaks of forensic analyses conducted by France’s intelligence services and the Parisian public prosecutor. Neither the French government nor the public prosecutor’s office issued official statements or confirmed the spyware attacks. NSO has strongly denied that Macron was the target of a Pegasus infection and said French ministers “are not and have never been Pegasus targets.”^[21]

Spain

In 2020, an investigation conducted by El País and the Guardian allegedly found that at least five members of the Catalan independence movement, including the speaker of the Catalan parliament, had been targeted using the Pegasus spyware.^[22] Additionally, this year numerous Catalan MEPS and current and former leaders of the pro-independence Catalan government have requested an inquiry be set up to investigate what may be a “case of domestic political espionage” by the Spanish government.^[23]

The EU’s response

The European parliament has made a statement acknowledging the findings of the journalistic consortium, saying the leak “shows how this technology has been systematically abused for years.”^[24] Additionally, the EU’s justice commissioner, Didier Reynders, told the European Parliament that the EU must promptly protect the rights of activists, journalists and politicians through legislative measures. He said the European Commission “totally condemned” reported attempts of illegal acquisitions of information on opposition figures by national intelligence agencies. He called for thorough investigations on invasions of privacy and for the prosecution of those found to be involved. Additionally, he stated the EU’s executive branch is closely following the Hungarian data protection authority’s investigation into the targeting of journalists and politicians with Pegasus spyware.^[25]

Sophie In ‘t Veld, a leading member of the European Parliament’s Civil Liberties, Justice and Home Affairs Committee, said she found the European Commission’s statement that it had never had any contact with the firm “hard to believe”. She announced an investigation into the use of Pegasus spyware within the EU had been established.^[26]

Conclusion

The revelations of the reports on the alleged use of Pegasus spyware in Europe has demonstrated the international and complex nature of the contemporary cybersecurity landscape. The findings reveal that the vulnerabilities of digital security at the national and international levels are faced by those within the highest echelons of power in Europe. However, the implications for the security of journalists and human rights defenders may also present a dire challenge to hold those with the most power to account. It appears that the EU has acknowledged this. Still, it is unclear whether the EU will be able to tackle this issue both within and without its borders, especially if its own institutions are implicated in the employment of this surveillance software.

Bibliography

BBC News (2021, July 19). Pegasus: Spyware sold to governments targets activists. https://www.bbc.co.uk/news/technology-57881364

Boffey, D. (2021a, September 15) EU commissioner calls for urgent action against Pegasus spyware. The Guardian. https://www.theguardian.com/news/2021/sep/15/eu-poised-to-tighten-privacy-laws-after-pegasus-spyware-scandal

Boffey, D. (2021b, October 14). Pegasus project consortium awarded EU prize for spyware revelations. The Guardian. https://www.theguardian.com/media/2021/oct/14/guardian-jointly-awarded-eu-prize-pegasus-project-spyware-revelations

Corera, G. (2021, July 21). Pegasus scandal: Are we all becoming unknown spies? BBC News. https://www.bbc.co.uk/news/technology-57910355

Hansen, Y. (2021, October 19). Government cannot verify Pegasus export claims. Luxembourg Times. https://www.luxtimes.lu/en/luxembourg/government-cannot-verify-pegasus-export-claims-616eead9de135b9236b1efcc

Henley, J. and Kirchgaessner, S. (2021, September 23). Spyware ‘found on phones of five french cabinet members’. The Guardian.

https://www.theguardian.com/news/2021/sep/23/spyware-found-on-phones-of-five-french-cabinet-members

Jones, S. and Kirchgaessner, S. (2020, July 13). Phone of top Catalan politician ‘targeted by government-grade spyware’. The Guardian.

https://www.theguardian.com/world/2020/jul/13/phone-of-top-catalan-politician-targeted-by-government-grade-spyware

Rueckert, P. (2021, July 18). Pegasus: The new global weapon for silencing journalists. Forbidden Stories. https://forbiddenstories.org/pegasus-the-new-global-weapon-for-silencing-journalists/

^[1] Boffey, 2021b